Only ask for public read-only OAuth scope for signers

[jasonm]

We only need the public_repo scope for people who make agreements. People who are signing agreements really only need their identity provided by GitHub, so we should only ask for the (no scope) "Public read-only-access" GitHub OAuth scope.

Related to, but different from, #17

[maxim]

Just wanted to note that I was about to sign and contribute to some project, but couldn't go ahead due to this scope issue. First time I'm encountering clahub, and the idea seems great, but this really needs to be resolved.

[tfoote]

We're looking at deploying clahub and I believe that this is a high barrier for entry for developers active on many projects. I see the permissions here: https://github.com/clahub/clahub/blob/master/config/initializers/omniauth.rb#L9

Can anyone give a suggestion on what it would take to change this?

[spmallette]

👍

[rjbriody]

+1

[ferventcoder]

This looks sweet, but I'm hitting the same thing as everyone else. Too many permissions requested.

[ferventcoder]

Can this be closed? #101 (comment)

[genevec]

Closing! See #101