Multiple packager

[Nicolas C]

Hello everyone,

As part of a Wapt deployment for a client, I need to allow several users to create and publish packages on the server (internal development).
Unfortunately, I'm encountering an error during the upload phase (FATAL ERROR SSL writing timeout) which seems to be related to the user account (a member of the selfservice group, not the local admin of the machine).
If I rerun the command with the Wapt admin credentials, it works.
So, do I have a configuration problem, or is only the Wapt admin account authorized to perform this type of operation?

[Nicolas C]

Okay, I'm making some progress on this!

Looking at the specs for the corporate version, I see there's a feature that would fit my needs (group packager), but it's way out of my budget...

However, based on the thread "User and password as arguments to wapt-get", I've managed to get the upload working, but obviously, the credentials are in plain text in wapt-get.py; does anyone have a workaround to make this more secure?

[sfonteneau]

I'm having trouble understanding your need.

Do you want to build packages automatically?

[Nicolas C]

From what I understand, it's not possible to have accounts or groups authorized to upload, see the specs for the corporate version: "Differentiate rights between the people who build the packages and those who deploy them."

So, to put it simply, I want to allow the development team to create and upload their application packages to the server without having to give them the server's admin credentials, thus making authentication automatic during the upload process (wapt-get build-upload).
I achieve this by filling in the appropriate fields in the wapt-get.py file;

+parser.add_option("--wapt-server-user", dest="wapt_server_user", default="admin", help="User to upload packages to waptserver. (default: %default)")
+parser.add_option("--wapt-server-passwd", dest="wapt_server_passwd", default="my_password", help="Password to upload packages to waptserver. (default: %default)")

But obviously this is accessible to anyone who knows what to look for, so I'm looking for a method to make it more secure.

[sfonteneau]

You should look into multi-repository support:

https://www.wapt.fr/fr/doc/Multi-depot/index.html

Your package developers will have their own WAPT repository hosting the "Dev" packages.

This repository can be added to the WAPT agent configuration as an additional repository on all clients (using the public certificate corresponding to the private key used by the developers):

https://www.wapt.fr/fr/doc/Installation ... pt-get-ini

The most appropriate approach would be to define a test environment before pushing Dev packages to Production.

WAPT developers can then create packages in their "Dev" repository using their password (this is no longer an issue), and you can then qualify the packages before moving them to the main repository.

[Nicolas C]

Thanks for the reply, I'll look into that!

Could you clarify what you mean by "WAPT developers will therefore be able to create packages on their 'Dev' repository with their password (this is no longer a problem)"?
Does this mean their AD user account will allow authentication on the server to perform the upload, or does creating a second repository imply creating a specific "admin" account for that repository (which doesn't grant access to the administration/console)?

Thanks again!

[sfonteneau]

Does creating a second repository imply creating a specific "admin" account for that repository (and which does not give access to the administration/console)?

That's it, the secondary repository is just an (apache/nginx/iss) instance. We can configure access to this repository to upload things however we want (sftp, smb, rsync), and authenticate however we want... ad, basic auth...