+- 20100530: Package of changes to drop the Application Engineer and place those responsibilities back with the Sysadm team. Exception added to permit t/l to bring in a Software Assessor under controlled basis. Because this change is non-trivial, and a compromise in late voting stage, it is marked in a different blue.
- 20100525: Two detail changes from Tom Trnka.
- 20100513: With some consensus from policy group, changed the text in 2.2.1.1 to transfer the detailed handling of pre-purchase risks to SM.
- 20100512: Some clarifying tweaks to semantics supplied by Philipp G, added Arb as a role in 9.1.1. but not as critical role.
@@ -112,13 +123,14 @@ These roles are defined as:
-
- Access Engineers
+ Access Engineer
-
- Systems Administrators
+ Systems Administrator
-
- Support Engineers
+ Support Engineer
-
- Software Assessors (including Application Engineers)
+ Software Assessor
+(including Application Engineers)
1.1.2. Out of Scope
@@ -172,12 +184,12 @@ deriving from the above principles.
See §1.1.
-- Application Engineer
+- Application Engineer
-
- A Member who manages the critical application,
+ A Member who manages the critical application,
including installing them on the critical system,
final testing, emergency patching, and ad hoc scripting.
- See §7.2.
+ See §7.2.
- Software Assessor
@@ -388,7 +400,7 @@ one Systems Administrator present.
There is no inherent authorisation to access the data.
Systems Administrators
-
+
and Application Engineers
are authorised to access
@@ -544,12 +556,17 @@ independent of filed disputes.
3.3. Application
-
+
Systems administration is to provide a limited environment
to Applications Engineers in order to install and maintain
the application.
+
+Requests for ad hoc queries over the application database for business
+or similar purposes must be approved by the Arbitrator.
+
+
3.4. Access control
@@ -595,21 +612,21 @@ authorisations on the below access control lists
Systems Administration team leader Board of CAcert (or designee) |
| SSH Access List |
- Systems Administrators and Application Engineers |
+ Systems Administrators and Application Engineers |
Unix / account / shell level |
includes by default all on Physical Access List |
Systems Administration team leader |
| Repository Access List |
- Application Engineers |
- change the source code repository and install patches to application |
+ Software Assessors Application Engineers |
+ change the source code repository and install patches to application |
exclusive with Access Engineers and Systems Administrators |
software assessment team leader |
| Support Access List |
Support Engineer |
support features in the web application |
- exclusive with Access Engineers and Systems Administrators; includes by default all Application Engineers Systems Administrators |
+ exclusive with Access Engineers and Systems Administrators includes by default all Application Engineers Systems Administrators |
Systems Administration Support team leader |
@@ -659,17 +676,26 @@ must be strictly controlled.
Passphrases and SSH private keys used for entering into the systems
will be kept private
to CAcert sysadmins
-and Application Engineers
+and Application Engineers
in all cases.
4.1.1.1. Authorized users
Only System Administrators
-and Application Engineers
+and Application Engineers
designated on the Access Lists
-in §3.4.2 are authorized to access accounts,
-unless specifically directed by the Arbitrator.
+in §3.4.2 are authorized to access accounts.
+
+System Administration team leader may temporarily permit Software
+Assessors access to the application via SSH in order to do advanced
+debugging, or as
+
+Other
+specifically directed by the Arbitrator.
+
+
+
4.1.1.2. Access to Systems
@@ -951,10 +977,11 @@ Software assessment is not primarily tasked to write the code.
In principle, anyone can submit code changes for approval.
-
+
Moved to SM 3.3
+
The primary tasks for Application Engineers are:
--
+
-
Installing signed-off patches,
-
Verifying correct running,
@@ -1032,7 +1059,8 @@ any Member that requests it.
7.6. Handover Production
-
+
Blank, now refer to SM 7.6
+
The Application Engineer is a role within Software Assessment
team that is approved to install into production the
patches that are signed off.
@@ -1048,11 +1076,13 @@ which then must be back-installed into the repositories.
-
+
this below moved to §3.3
+
+
Requests to Application Engineers for ad hoc queries over the database for business or similar purposes must be approved by the Arbitrator.
-
+
See §3.3.
@@ -1145,9 +1175,9 @@ or Case Managers.
- Access Engineer: responsible for controlling access to hardware, and maintaining hardware.
- - System administrator: responsible for maintaining core services and integrity.
+ - System Administrator: responsible for maintaining core services and integrity.
- Software Assessor: maintain the code base and confirm security ("sign-off") of patches and releases.
- - Application Engineer: install application updates and confirm basic working.
+ - Application Engineer: install application updates and confirm basic working.
- Support Engineer: human interface with users.
- Team leaders: coordinate with teams, report to Board.
- All: respond to Arbitrator's rulings on changes. Respond to critical security issues. Observe.