maintainer information #2693
Open
maintainer information #2693
Comments
Couldn't make sense of what you say, what is the problem exactly ? |
at the moment we have the field |
I really don't know about the context so that may end up being very stupid but can't they somehow sign a hash of the contents of the maintainers field ? |
a mix between |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
at the moment an opam file contains both
author(s)
andmaintainer
fields, each may contain a list of names, email addresses, etc..seeing signing on the horizon, we'll duplicate the maintainer information into the
authorisations
files (which contain a set of individuals and team identifiers who are authorised to modify the package).since I'm allergic to duplication of information (it tends to be outdated pretty quickly), I'd appreciate a convenient way forward. I suspect automated tools might want (already do?) use the maintainership information to show packages (which build/don't build/don't lint) sorted by maintainers, thus they'll need a programmatic way to get the maintainer information.
getting the mail addresses of maintainers is a multi-stage process: read authorisations file for the identifiers (which are github ids), read the public keys (where the mail address is included) OR it is a team and thus we need to read the identifiers in there, and then the public keys.
this issue is primarily to find out whether tools are using maintainer information (and if so, how they locate the maintainer), and what @AltGr thinks about duplicated information. we can also keep the maintainers in the opam file and grow the authorisations disjointly, but that'll likely lead to inconsistencies. we can also not store mail addresses as part of the public keys...
The text was updated successfully, but these errors were encountered: