maintainer information

[hannesm]

at the moment an opam file contains both author(s) and maintainer fields, each may contain a list of names, email addresses, etc..

seeing signing on the horizon, we'll duplicate the maintainer information into the authorisations files (which contain a set of individuals and team identifiers who are authorised to modify the package).

since I'm allergic to duplication of information (it tends to be outdated pretty quickly), I'd appreciate a convenient way forward. I suspect automated tools might want (already do?) use the maintainership information to show packages (which build/don't build/don't lint) sorted by maintainers, thus they'll need a programmatic way to get the maintainer information.

getting the mail addresses of maintainers is a multi-stage process: read authorisations file for the identifiers (which are github ids), read the public keys (where the mail address is included) OR it is a team and thus we need to read the identifiers in there, and then the public keys.

this issue is primarily to find out whether tools are using maintainer information (and if so, how they locate the maintainer), and what @AltGr thinks about duplicated information. we can also keep the maintainers in the opam file and grow the authorisations disjointly, but that'll likely lead to inconsistencies. we can also not store mail addresses as part of the public keys...

[dbuenzli]

Couldn't make sense of what you say, what is the problem exactly ?

[hannesm]

at the moment we have the field maintainers in each opam file. In the future, we need to have authorised_ids in a separate file (since it is signed by janitors). This will lead to duplication of information.

[dbuenzli]

I really don't know about the context so that may end up being very stupid but can't they somehow sign a hash of the contents of the maintainers field ?

[samoht]

this issue is primarily to find out whether tools are using maintainer information (and if so, how they locate the maintainer)

a mix between opam info <pkg> + git blame + heuristic based on the github project home.