Petals Distribution

You are right, if an user really wants a CLI, he can install it locally from ZIP archive.

I agree to restrict readability of configuration files to the members of group petals. If the user is not a member of the group, a warning should be displayed in mode 'console' (petals-cli -C): "Your are not granted to access the default configuration file: ...".

And don't forget to update the user documentation.

No no, I don't agree with the second point: it's bad practice to restrict the execution of the CLIs. Anyway if an user really wants it, he can install it locally.

The thing of first importance is: /etc/petals-cli/petals-cli.default and /etc/petals-registry-cli/petals-registry-cli.default are readable by everybody and it is a huge security risk.

The second point, less important is: do we want that user added to the petals group can read them?

I think you are talking about the files /etc/petals-cli/petals-cli.default and /etc/petals-registry-cli/petals-registry-cli.default.

Your idea is interesting. IMO, in the same way, Petals CLI and Petals Registry CLI should be runnable only by users member of the group petals. This is more restrictive but less easily usable because a user must added to the group petals before to be able to use CLIs.

What does our product owner think about this ?