{"action":"created","comment":{"url":"https://api.github.com/repos/taskcluster/taskcluster-docs/pulls/comments/45763349","id":45763349,"diff_hunk":"@@ -0,0 +1,167 @@\n+---\n+layout:   default\n+class:    markdown\n+---\n+\n+Namespaces\n+==========\n+\n+TaskCluster has a number of namespaces defined to allow multiple users to get along without interfering with one another.\n+The platform itself is agnostic to the structure of these namespaces, but infrastructure that interacts with the platform is dependent on the namespaces for security and correctness.\n+\n+This document necessarily contains information that is specific to users of the TaskCluster platform.\n+As such, it is open to contributions from all users who wish to carve out a section of a namespace -- just [submit a pull request](https://github.com/taskcluster/taskcluster-docs).\n+\n+## Projects\n+\n+Most work at Mozilla falls into \"projects\", and these provide a nice organizational boundary for controlling access.\n+We use a consistent name for each project in the various namespaces below -- something simple and without punctuation.\n+The known projects are:\n+\n+ * `taskcluster` -- The taskcluster platform itself\n+ * `releng` -- Mozilla release engineering (build, test, and release processes)\n+ * `gaia` -- B2G/Firefox OS build system\n+ * `bmo` -- bugzilla.mozilla.org development\n+\n+Please file a pull request to add your project!\n+\n+## Scopes\n+\n+Many scopes reflect the namespaces given elsewhere in this document, as described in the API documentation for the component.\n+\n+* `<component>:<verb>:` -\n+   Scopes for most API actions have a prefix like this.\n+   For example, the `queue.createTask` call is governed by a scope beginning with `queue:create-task:`.\n+\n+* `buildbot-bridge:`\n+   The release engineering team's buildbot bridge (BBB) uses scopes with this prefix.\n+\n+* `project:<project>:`\n+   Individual projects should use scopes with this prefix.\n+\n+* `signing:`\n+   The release engineering team's signing system uses scopes with this prefix.\n+\n+## Roles\n+\n+Most roles are defined by some kind of automatic usage in a TaskCluster component.\n+However, some are defined by convention.\n+Both are listed here:\n+\n+* `client-id:<clientId>` -\n+   Roles with this prefix give the scopes for client credentials.\n+\n+* `hook-id:<hookGroupId>/<hookId>` -\n+   Roles of this form give the scopes used to create tasks on behalf of hooks.\n+\n+* `mozilla-group:<groupName>` -\n+   Roles of this form represent the scopes available to members of the given Mozilla LDAP group via the login service.\n+\n+* `mozilla-user:<userName>` -\n+   Roles of this form represent the scopes available to the given Mozilla LDAP user via the login service.\n+\n+* `repo:<host>/<path>:branch:<branch>`,\n+* `repo:<host>/<path>:pull-request` -\n+   Roles of this form represent scopes available to version-control pushes and pull requests.\n+\n+* `moz-tree:level:<level>`\n+   Roles of this form include the basic scopes available to version-control trees at each of the three Mozilla source-code managament levels.\n+   They are useful as shorthand to configure `repo:*` roles.\n+   See [Mozilla Commit Access Policy](https://www.mozilla.org/en-US/about/governance/policies/commit/access-policy/) for information on levels.\n+\n+* `scheduler-id:<schedulerId>/<taskGroupId>` -\n+   Roles of this form represent scopes available to schedulers with the given ID.\n+\n+* `worker-id:<workerGroup>/<workerId>` -\n+   Roles of this form represent scopes available to workers with the given ID.\n+\n+* `worker-type:<provisionerId>/<workerType>` -\n+   Roles of this form represent scopes available to workers of the given type.\n+\n+## Artifacts\n+\n+Artifacts are named objects attached to tasks, and available from the queue component.\n+Artifact names are, by convention, slash-separated.\n+\n+* `public/` -\n+   The queue allows access to any artifact that begins with `public/` without any kind of authentication.\n+   Such public names are not further namespaced: tasks can create any public artifacts they like.\n+\n+* `private/` -\n+   Artifact names with this prefix are considered non-public, but access to them is otherwise quite broadly allowed (e.g., to all Mozilla employees).\n+   In general, users with narrower requirements than \"not public\" should select a different prefix and add it to this document.\n+\n+* `index/` -\n+   Artifact names with this prefix follow the index namespace, replacing the `.` separators with `/`.\n+   For example, a task that indexes artifacts under `gaia.npm_cache.node-v4-2.linux-x64` would name its artifacts with the prefix `index/gaia/npm_cache/node-v4_2/linux-x64`.\n+   Scopes for creating and reading such artifacts should follow the ownership hierarchy of the index routes.","path":"devel/namespaces/index.md","position":103,"original_position":97,"commit_id":"bea74f58c71413385dd8a8ab909222f9615b7235","original_commit_id":"9d3e89d422192379b610c656da90ab0e6966df01","user":{"login":"petemoore","id":190790,"avatar_url":"https://avatars.githubusercontent.com/u/190790?v=3","gravatar_id":"","url":"https://api.github.com/users/petemoore","html_url":"https://github.com/petemoore","followers_url":"https://api.github.com/users/petemoore/followers","following_url":"https://api.github.com/users/petemoore/following{/other_user}","gists_url":"https://api.github.com/users/petemoore/gists{/gist_id}","starred_url":"https://api.github.com/users/petemoore/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/petemoore/subscriptions","organizations_url":"https://api.github.com/users/petemoore/orgs","repos_url":"https://api.github.com/users/petemoore/repos","events_url":"https://api.github.com/users/petemoore/events{/privacy}","received_events_url":"https://api.github.com/users/petemoore/received_events","type":"User","site_admin":false},"body":"It seems reasonable that we put access controls over namespaces in the index. Is that currently the case, or is this a new feature?","created_at":"2015-11-24T17:01:00Z","updated_at":"2015-11-24T17:01:00Z","html_url":"https://github.com/taskcluster/taskcluster-docs/pull/39#discussion_r45763349","pull_request_url":"https://api.github.com/repos/taskcluster/taskcluster-docs/pulls/39","_links":{"self":{"href":"https://api.github.com/repos/taskcluster/taskcluster-docs/pulls/comments/45763349"},"html":{"href":"https://github.com/taskcluster/taskcluster-docs/pull/39#discussion_r45763349"},"pull_request":{"href":"https://api.github.com/repos/taskcluster/taskcluster-docs/pulls/39"}}},"pull_request":{"url":"https://api.github.com/repos/taskcluster/taskcluster-docs/pulls/39","id":50992329,"html_url":"https://github.com/taskcluster/taskcluster-docs/pull/39","diff_url":"https://github.com/taskcluster/taskcluster-docs/pull/39.diff","patch_url":"https://github.com/taskcluster/taskcluster-docs/pull/39.patch","issue_url":"https://api.github.com/repos/taskcluster/taskcluster-docs/issues/39","number":39,"state":"open","locked":false,"title":"Bug 1219943: document namespaces","user":{"login":"djmitche","id":28673,"avatar_url":"https://avatars.githubusercontent.com/u/28673?v=3","gravatar_id":"","url":"https://api.github.com/users/djmitche","html_url":"https://github.com/djmitche","followers_url":"https://api.github.com/users/djmitche/followers","following_url":"https://api.github.com/users/djmitche/following{/other_user}","gists_url":"https://api.github.com/users/djmitche/gists{/gist_id}","starred_url":"https://api.github.com/users/djmitche/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/djmitche/subscriptions","organizations_url":"https://api.github.com/users/djmitche/orgs","repos_url":"https://api.github.com/users/djmitche/repos","events_url":"https://api.github.com/users/djmitche/events{/privacy}","received_events_url":"https://api.github.com/users/djmitche/received_events","type":"User","site_admin":false},"body":"Discussion is welcome here -- I'm not sure I'm right everywhere!\r\n\r\nI'm trying to document what's in place now, rather than the way I'd like it to be.  We can adjust later.","created_at":"2015-11-17T19:28:59Z","updated_at":"2015-11-24T17:01:00Z","closed_at":null,"merged_at":null,"merge_commit_sha":"b122df82d30b8feebbc9d20dc2fe4a26b6b923da","assignee":{"login":"petemoore","id":190790,"avatar_url":"https://avatars.githubusercontent.com/u/190790?v=3","gravatar_id":"","url":"https://api.github.com/users/petemoore","html_url":"https://github.com/petemoore","followers_url":"https://api.github.com/users/petemoore/followers","following_url":"https://api.github.com/users/petemoore/following{/other_user}","gists_url":"https://api.github.com/users/petemoore/gists{/gist_id}","starred_url":"https://api.github.com/users/petemoore/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/petemoore/subscriptions","organizations_url":"https://api.github.com/users/petemoore/orgs","repos_url":"https://api.github.com/users/petemoore/repos","events_url":"https://api.github.com/users/petemoore/events{/privacy}","received_events_url":"https://api.github.com/users/petemoore/received_events","type":"User","site_admin":false},"milestone":null,"commits_url":"https://api.github.com/repos/taskcluster/taskcluster-docs/pulls/39/commits","review_comments_url":"https://api.github.com/repos/taskcluster/taskcluster-docs/pulls/39/comments","review_comment_url":"https://api.github.com/repos/taskcluster/taskcluster-docs/pulls/comments{/number}","comments_url":"https://api.github.com/repos/taskcluster/taskcluster-docs/issues/39/comments","statuses_url":"https://api.github.com/repos/taskcluster/taskcluster-docs/statuses/bea74f58c71413385dd8a8ab909222f9615b7235","head":{"label":"djmitche:bug1219943","ref":"bug1219943","sha":"bea74f58c71413385dd8a8ab909222f9615b7235","user":{"login":"djmitche","id":28673,"avatar_url":"https://avatars.githubusercontent.com/u/28673?v=3","gravatar_id":"","url":"https://api.github.com/users/djmitche","html_url":"https://github.com/djmitche","followers_url":"https://api.github.com/users/djmitche/followers","following_url":"https://api.github.com/users/djmitche/following{/other_user}","gists_url":"https://api.github.com/users/djmitche/gists{/gist_id}","starred_url":"https://api.github.com/users/djmitche/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/djmitche/subscriptions","organizations_url":"https://api.github.com/users/djmitche/orgs","repos_url":"https://api.github.com/users/djmitche/repos","events_url":"https://api.github.com/users/djmitche/events{/privacy}","received_events_url":"https://api.github.com/users/djmitche/received_events","type":"User","site_admin":false},"repo":{"id":28646988,"name":"taskcluster-docs","full_name":"djmitche/taskcluster-docs","owner":{"login":"djmitche","id":28673,"avatar_url":"https://avatars.githubusercontent.com/u/28673?v=3","gravatar_id":"","url":"https://api.github.com/users/djmitche","html_url":"https://github.com/djmitche","followers_url":"https://api.github.com/users/djmitche/followers","following_url":"https://api.github.com/users/djmitche/following{/other_user}","gists_url":"https://api.github.com/users/djmitche/gists{/gist_id}","starred_url":"https://api.github.com/users/djmitche/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/djmitche/subscriptions","organizations_url":"https://api.github.com/users/djmitche/orgs","repos_url":"https://api.github.com/users/djmitche/repos","events_url":"https://api.github.com/users/djmitche/events{/privacy}","received_events_url":"https://api.github.com/users/djmitche/received_events","type":"User","site_admin":false},"private":false,"html_url":"https://github.com/djmitche/taskcluster-docs","description":"Documentation for taskcluster components","fork":true,"url":"https://api.github.com/repos/djmitche/taskcluster-docs","forks_url":"https://api.github.com/repos/djmitche/taskcluster-docs/forks","keys_url":"https://api.github.com/repos/djmitche/taskcluster-docs/keys{/key_id}","collaborators_url":"https://api.github.com/repos/djmitche/taskcluster-docs/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/djmitche/taskcluster-docs/teams","hooks_url":"https://api.github.com/repos/djmitche/taskcluster-docs/hooks","issue_events_url":"https://api.github.com/repos/djmitche/taskcluster-docs/issues/events{/number}","events_url":"https://api.github.com/repos/djmitche/taskcluster-docs/events","assignees_url":"https://api.github.com/repos/djmitche/taskcluster-docs/assignees{/user}","branches_url":"https://api.github.com/repos/djmitche/taskcluster-docs/branches{/branch}","tags_url":"https://api.github.com/repos/djmitche/taskcluster-docs/tags","blobs_url":"https://api.github.com/repos/djmitche/taskcluster-docs/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/djmitche/taskcluster-docs/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/djmitche/taskcluster-docs/git/refs{/sha}","trees_url":"https://api.github.com/repos/djmitche/taskcluster-docs/git/trees{/sha}","statuses_url":"https://api.github.com/repos/djmitche/taskcluster-docs/statuses/{sha}","languages_url":"https://api.github.com/repos/djmitche/taskcluster-docs/languages","stargazers_url":"https://api.github.com/repos/djmitche/taskcluster-docs/stargazers","contributors_url":"https://api.github.com/repos/djmitche/taskcluster-docs/contributors","subscribers_url":"https://api.github.com/repos/djmitche/taskcluster-docs/subscribers","subscription_url":"https://api.github.com/repos/djmitche/taskcluster-docs/subscription","commits_url":"https://api.github.com/repos/djmitche/taskcluster-docs/commits{/sha}","git_commits_url":"https://api.github.com/repos/djmitche/taskcluster-docs/git/commits{/sha}","comments_url":"https://api.github.com/repos/djmitche/taskcluster-docs/comments{/number}","issue_comment_url":"https://api.github.com/repos/djmitche/taskcluster-docs/issues/comments{/number}","contents_url":"https://api.github.com/repos/djmitche/taskcluster-docs/contents/{+path}","compare_url":"https://api.github.com/repos/djmitche/taskcluster-docs/compare/{base}...{head}","merges_url":"https://api.github.com/repos/djmitche/taskcluster-docs/merges","archive_url":"https://api.github.com/repos/djmitche/taskcluster-docs/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/djmitche/taskcluster-docs/downloads","issues_url":"https://api.github.com/repos/djmitche/taskcluster-docs/issues{/number}","pulls_url":"https://api.github.com/repos/djmitche/taskcluster-docs/pulls{/number}","milestones_url":"https://api.github.com/repos/djmitche/taskcluster-docs/milestones{/number}","notifications_url":"https://api.github.com/repos/djmitche/taskcluster-docs/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/djmitche/taskcluster-docs/labels{/name}","releases_url":"https://api.github.com/repos/djmitche/taskcluster-docs/releases{/id}","created_at":"2014-12-30T22:03:05Z","updated_at":"2014-12-30T22:03:07Z","pushed_at":"2015-11-18T22:50:28Z","git_url":"git://github.com/djmitche/taskcluster-docs.git","ssh_url":"git@github.com:djmitche/taskcluster-docs.git","clone_url":"https://github.com/djmitche/taskcluster-docs.git","svn_url":"https://github.com/djmitche/taskcluster-docs","homepage":"docs.taskcluster.net","size":6362,"stargazers_count":0,"watchers_count":0,"language":"JavaScript","has_issues":false,"has_downloads":true,"has_wiki":false,"has_pages":true,"forks_count":0,"mirror_url":null,"open_issues_count":0,"forks":0,"open_issues":0,"watchers":0,"default_branch":"master"}},"base":{"label":"taskcluster:master","ref":"master","sha":"7192d4529d22160162dc68d76f8a000c6b2c3fd4","user":{"login":"taskcluster","id":6257436,"avatar_url":"https://avatars.githubusercontent.com/u/6257436?v=3","gravatar_id":"","url":"https://api.github.com/users/taskcluster","html_url":"https://github.com/taskcluster","followers_url":"https://api.github.com/users/taskcluster/followers","following_url":"https://api.github.com/users/taskcluster/following{/other_user}","gists_url":"https://api.github.com/users/taskcluster/gists{/gist_id}","starred_url":"https://api.github.com/users/taskcluster/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/taskcluster/subscriptions","organizations_url":"https://api.github.com/users/taskcluster/orgs","repos_url":"https://api.github.com/users/taskcluster/repos","events_url":"https://api.github.com/users/taskcluster/events{/privacy}","received_events_url":"https://api.github.com/users/taskcluster/received_events","type":"Organization","site_admin":false},"repo":{"id":16743730,"name":"taskcluster-docs","full_name":"taskcluster/taskcluster-docs","owner":{"login":"taskcluster","id":6257436,"avatar_url":"https://avatars.githubusercontent.com/u/6257436?v=3","gravatar_id":"","url":"https://api.github.com/users/taskcluster","html_url":"https://github.com/taskcluster","followers_url":"https://api.github.com/users/taskcluster/followers","following_url":"https://api.github.com/users/taskcluster/following{/other_user}","gists_url":"https://api.github.com/users/taskcluster/gists{/gist_id}","starred_url":"https://api.github.com/users/taskcluster/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/taskcluster/subscriptions","organizations_url":"https://api.github.com/users/taskcluster/orgs","repos_url":"https://api.github.com/users/taskcluster/repos","events_url":"https://api.github.com/users/taskcluster/events{/privacy}","received_events_url":"https://api.github.com/users/taskcluster/received_events","type":"Organization","site_admin":false},"private":false,"html_url":"https://github.com/taskcluster/taskcluster-docs","description":"Documentation for taskcluster components","fork":false,"url":"https://api.github.com/repos/taskcluster/taskcluster-docs","forks_url":"https://api.github.com/repos/taskcluster/taskcluster-docs/forks","keys_url":"https://api.github.com/repos/taskcluster/taskcluster-docs/keys{/key_id}","collaborators_url":"https://api.github.com/repos/taskcluster/taskcluster-docs/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/taskcluster/taskcluster-docs/teams","hooks_url":"https://api.github.com/repos/taskcluster/taskcluster-docs/hooks","issue_events_url":"https://api.github.com/repos/taskcluster/taskcluster-docs/issues/events{/number}","events_url":"https://api.github.com/repos/taskcluster/taskcluster-docs/events","assignees_url":"https://api.github.com/repos/taskcluster/taskcluster-docs/assignees{/user}","branches_url":"https://api.github.com/repos/taskcluster/taskcluster-docs/branches{/branch}","tags_url":"https://api.github.com/repos/taskcluster/taskcluster-docs/tags","blobs_url":"https://api.github.com/repos/taskcluster/taskcluster-docs/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/taskcluster/taskcluster-docs/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/taskcluster/taskcluster-docs/git/refs{/sha}","trees_url":"https://api.github.com/repos/taskcluster/taskcluster-docs/git/trees{/sha}","statuses_url":"https://api.github.com/repos/taskcluster/taskcluster-docs/statuses/{sha}","languages_url":"https://api.github.com/repos/taskcluster/taskcluster-docs/languages","stargazers_url":"https://api.github.com/repos/taskcluster/taskcluster-docs/stargazers","contributors_url":"https://api.github.com/repos/taskcluster/taskcluster-docs/contributors","subscribers_url":"https://api.github.com/repos/taskcluster/taskcluster-docs/subscribers","subscription_url":"https://api.github.com/repos/taskcluster/taskcluster-docs/subscription","commits_url":"https://api.github.com/repos/taskcluster/taskcluster-docs/commits{/sha}","git_commits_url":"https://api.github.com/repos/taskcluster/taskcluster-docs/git/commits{/sha}","comments_url":"https://api.github.com/repos/taskcluster/taskcluster-docs/comments{/number}","issue_comment_url":"https://api.github.com/repos/taskcluster/taskcluster-docs/issues/comments{/number}","contents_url":"https://api.github.com/repos/taskcluster/taskcluster-docs/contents/{+path}","compare_url":"https://api.github.com/repos/taskcluster/taskcluster-docs/compare/{base}...{head}","merges_url":"https://api.github.com/repos/taskcluster/taskcluster-docs/merges","archive_url":"https://api.github.com/repos/taskcluster/taskcluster-docs/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/taskcluster/taskcluster-docs/downloads","issues_url":"https://api.github.com/repos/taskcluster/taskcluster-docs/issues{/number}","pulls_url":"https://api.github.com/repos/taskcluster/taskcluster-docs/pulls{/number}","milestones_url":"https://api.github.com/repos/taskcluster/taskcluster-docs/milestones{/number}","notifications_url":"https://api.github.com/repos/taskcluster/taskcluster-docs/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/taskcluster/taskcluster-docs/labels{/name}","releases_url":"https://api.github.com/repos/taskcluster/taskcluster-docs/releases{/id}","created_at":"2014-02-11T20:08:26Z","updated_at":"2015-11-12T05:34:30Z","pushed_at":"2015-11-18T22:50:29Z","git_url":"git://github.com/taskcluster/taskcluster-docs.git","ssh_url":"git@github.com:taskcluster/taskcluster-docs.git","clone_url":"https://github.com/taskcluster/taskcluster-docs.git","svn_url":"https://github.com/taskcluster/taskcluster-docs","homepage":"docs.taskcluster.net","size":6397,"stargazers_count":6,"watchers_count":6,"language":"JavaScript","has_issues":true,"has_downloads":true,"has_wiki":false,"has_pages":true,"forks_count":8,"mirror_url":null,"open_issues_count":2,"forks":8,"open_issues":2,"watchers":6,"default_branch":"master"}},"_links":{"self":{"href":"https://api.github.com/repos/taskcluster/taskcluster-docs/pulls/39"},"html":{"href":"https://github.com/taskcluster/taskcluster-docs/pull/39"},"issue":{"href":"https://api.github.com/repos/taskcluster/taskcluster-docs/issues/39"},"comments":{"href":"https://api.github.com/repos/taskcluster/taskcluster-docs/issues/39/comments"},"review_comments":{"href":"https://api.github.com/repos/taskcluster/taskcluster-docs/pulls/39/comments"},"review_comment":{"href":"https://api.github.com/repos/taskcluster/taskcluster-docs/pulls/comments{/number}"},"commits":{"href":"https://api.github.com/repos/taskcluster/taskcluster-docs/pulls/39/commits"},"statuses":{"href":"https://api.github.com/repos/taskcluster/taskcluster-docs/statuses/bea74f58c71413385dd8a8ab909222f9615b7235"}}}}