[Savannah-hackers] File upload

[James E. Blair]

Regarding file upload:

- Kai Sterker's report led me to a bug where project keyrings (which
  are kept in /home/gatekpr/projects/foo/pubring.gpg were being
  created improperly.  If you are examining a request from a user,
  this is a good place to start, to see if the project keyring exists,
  and if it has the key that the file was signed with.

- Failed uploads are put in /var/tmp/ftp-in/foo/ and renamed with a
  leading dot.  So if foo.tar.gz failes to pass verification,
  /var/tmp/ftp-in/foo/.foo.tar.gz will contain the archive that
  failed, and the .sig file will be there too.  This can be useful in
  support requests as well.

Kai Sterker made some suggestions:

> I would ask for two things: (1) please be more explicit about how to 
> upload the gpg key. What command should be used to retrieve the key, 
> and how would it look like when entered into the input field. (2) some 
> feedback after a file has been uploaded. If there was an error, I could 
> possibly fix things myself if only I saw an error message.

I agree with him, and think the GPG instructions should be updated.
Do savannah-hackers agree?  If so, does one of you want to do it?

Regarding (2), the script has an email facility that I will try to get
working this week.

-Jim