[Date Prev][Date Next] [Thread Prev][Thread Next] [Date Index] [Thread Index]

Re: Salsa as authentication provider for Debian



On Wed, Apr 08, 2020 at 08:25:06PM +0800, Shengjing Zhu wrote:

> > I understand you want to recognize DDs from other contributors, but why?
> > Does it help you with permissions, does it help understand who someone
> > is, or is it a habit that has been there since Alioth?
> 
> For me, it's easier to trust a DD than a non-DD, so I'll grant a role
> with higher permission if they request to join a team/project.

I think this has ups and downs.

Currently, if someone doesn't have -guest on Salsa, they are either
active DDs or locked accounts. The moment a non-"-guest" person loses
their DD status, their account gets locked.

This is currently causing trouble: when one loses DD status, suddenly
they lose access to all their repositories until they get readded to
everything with a new -guest account. For repositories that only they
controlled, this requires admin intervention and headaches.

This has happened, and it's serious enough to make Salsa not suitable
for hosting long-term projects at the moment: I don't want to build my
projects' ecosystem on something which locks me out the moment I decide
to go emeritus, or the moment I get my Debian membership temporarily
suspended for whatever reason.

I would argue that it would make more sense to grant roles and
permissions to people based on their past contributions and reputation,
rather than based on current status.

I agree that with the current proposal, the use case of "grant a person
permission based on their status, which is somehow revoked or blocked if
the status goes away" becomes something we might not be able to do.

In my opinion this change, rather than opening a new problem, fixes an
old, nasty one instead.


Enrico

-- 
GPG key: 4096R/634F4BD1E7AD5568 2009-05-08 Enrico Zini <enrico@enricozini.org>

Attachment: signature.asc
Description: PGP signature


Reply to: