[Pkg-dns-devel] Alioth

[Daniel Kahn Gillmor]

On Wed 2018-01-03 00:22:16 +0100, Bernhard Schmidt wrote:
> On 02.01.2018 22:57, Daniel Kahn Gillmor wrote:
>> On Tue 2018-01-02 22:44:27 +0100, Bernhard Schmidt wrote:
>>> On 02.01.2018 22:42, ondrej at sury.org wrote:
>>>> Personally, I would prefer a separate group where we add whole
>>>> collab-maint group with Developer access, but we keep the Master/Owner
>>>> access level to smaller group. That would allow us to control things
>>>> like force pushes to people who regularly take care about the packages.
>>>
>>> That's actually a nice idea!
>> 
>> hm, this worries me a bit, because it means that if Alice is deciding
>> whether to add Bob else to collab-maint or not, she's now effectively
>> granting them write access to pkg-dns repositories without knowing about
>> it.  That doesn't seem like a great outcome, because it changes the
>> semantics that people are expecting.
>
> As far as I understood:
>
> The _user_ group Debian only contains DDs, and contains all DDs.
> Therefor adding this Group with the "Developer" role to the pkg-dns-team
> project group only adds DDs, nothing more.
>
> The _project_ group Debian (successor of collab-maint) allows "Master"
> access for all DDs to all projects contained within. It is not possible
> for mere mortals to add guests to that level (although I don't exactly
> know how that works, since "Master" should have the permission to add
> new members), they can only be added to specific projects within that group.

hm, ok, i think i was a bit confused about the prior arrangement, and i
understand it now.  thanks for the explanation, Berhard.

I'm OK with Ondřej's proposed arrangement now.  So while i think i'd
still prefer using the "Debian" project group itself directly, if other
members of pkg-dns prefer Ondřej's proposal, I'd go along with it.

My reason for preferring the "Debian" project group is that I generally
prefer to have fewer "special" arrangements (fewer divergences makes it
easier for newcomers, researchers, or drive-by contributors to find
their way around), and we can certainly detect and complain about
force-pushes if they happen, just because we'll presumably each have our
own local copies of the repos in question.

But i'll go with whatever the group decides.  so, how do we decide,
before the demise of alioth is upon us?

       --dkg
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 832 bytes
Desc: not available
URL: <http://lists.alioth.debian.org/pipermail/pkg-dns-devel/attachments/20180102/41ea76f2/attachment-0001.sig>