[Date Prev][Date Next] [Thread Prev][Thread Next] [Date Index] [Thread Index]

Re: Salsa as authentication provider for Debian



>>>>> "Julien" == Julien Cristau <jcristau@debian.org> writes:

    Julien> On Sat, Apr 11, 2020 at 10:04:55AM +0300, Andrei POPESCU wrote:
    >> 
    Julien> foo@salsa.debian.org and foo@debian.org both existing and
    Julien> referring to different people risks causing confusion.  I'd
    Julien> like to understand why we're going that way.

We aren't.
However, there has been an emerging project consensus that we do not
wish  for people's usernames (salsa or otherwise, but especially salsa)
to change as their role in the project changes.

I've been seening this come up again and again throughout my term as
DPL:

* Disabling people's ability to contribute to salsa when their account
  was suspended was a significant unintended consequence of DAM actions
  last year.  It created a lot of friction.

* That same friction appeared as pushback on recommending salsa in
  various ways.

* As a side thread on the Git Packaging discussion on debian-devel,
  there was a strong desire to improve this and get to a position where
  -guest accounts didn't work the way they do today.  I did not directly
  report on that in my consensus call because it was out of scope, but
  as the person facilitating that discussion, I think we had a
  presumptive consensus in favor of moving in that direction.

* The issues with -guest accounts did impact the consensus call for the
  Git Packaging discussion in that we had fewer options to recommend for
  non-DDs starting out packaging.  People felt uncomfortable
  recommending a -guest name for packaging, and the account lifecycle
  issues significantly complicated that discussion.

* It's my reading of the thread here that there was again a rough
  consensus in favor of not having usernames change as your role in the
  project changes.  Multiple arguments have been advanced and  it
  appears the rough consensus of the discussion here is in favor of the
  change.

Your concern--about  foo@salsa and foo@debian.org both existing has been
discussed.
It's clear there is a desire to minimize this.
At least for the pathways involving nm.debian.org, my understanding is
that we will avoid this.
by requiring that people register a salsa account before obtaining a DSA
guest account, DSA could choose to close off the remaining ways in which
this conflict emerges.

Obviously, the salsa maintainers and nm maintainers don't have the power
to make this happen.  They have managed the risk in the areas where they
can and have notified everyone of the issue.

My suspicion is that the project will conclude that even given a
residual risk if DSA were not to choose to act, the advantages of having
usernames not change is sufficient that the project is unwilling to try
to override the salsa maintainers.

--Sam

Attachment: signature.asc
Description: PGP signature


Reply to: