Fixes https://pagure.io/pagure/issue/873

w/where is the file alembic.ini/where the file alembic.ini is/

s/information/pieces of information/

Why don't we stamp it as part of the database creation?

I think you can drop these four lines: they contain the same info as just above.

Well... This looks like an awkward diff...

Depending on which upgrade script you're at, this could be very dangerous.... I would suggest that instead you just make sure to stamp the database on creation, and in case this still happens they need special help...

Perhaps make sure that this is covered in Installing, so that people just don't install it with this?
Also, it might be best to make sure it's not the default either.

This line is awkard.

awkward

s/to the server/to the endpoint/ ?

There is also a web-hook key displayed in the settings page which ....

s/the server/pagure/

TODO: Full list of these, including the arguments that are passed to each?

So, since the headers aren't signed, I would say you need to drop X-Pagure-Topic, as it's untrusted content. People should NOT rely on it for anything, as it can be manipulated freely by an attacker.

Is there a nonce field in the payload to prevent an attacker from resubmitting a previously valid request.

You need documentation on what all can be in this payload.

Do note that this contains information on how to upgrade the database, but I'm still missing documentation on how to upgrade from one version of Pagure to another. Is this coming in a second PR?

ok

done

done

We're adding some section and moving others so that the order in the doc
is consistent with the order of the options in the settings page.

suggestions?

For the list of topics as well as example payloads, I'll point to the fedmsg doc about pagure: https://fedora-fedmsg.readthedocs.org/en/latest/topics.html#id532

There is no nonce field, maybe we should yes.

For the headers, do we want/can we sign the headers while we add something to it?
Or should I include a signature for both header fields?

cf below, I'll point to the fedmsg doc about pagure

Adjusted (a little differently)

Adjusted (a little differently)

Adjusted to 'to the server/endpoint'

I wonder if this would cause a problem when adding new tables to the DB since we then re-run the createdb script

Sorry, I wasn't speaking about the actual content change, that looks fine to me.
I was more talking about how Pagure displays this diff, which makes it kind of awkward to see what exactly changes :).

可

Many thanks for the review :)