You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.
at the moment an opam file contains both author(s) and maintainer fields, each may contain a list of names, email addresses, etc..
seeing signing on the horizon, we'll duplicate the maintainer information into the authorisations files (which contain a set of individuals and team identifiers who are authorised to modify the package).
since I'm allergic to duplication of information (it tends to be outdated pretty quickly), I'd appreciate a convenient way forward. I suspect automated tools might want (already do?) use the maintainership information to show packages (which build/don't build/don't lint) sorted by maintainers, thus they'll need a programmatic way to get the maintainer information.
getting the mail addresses of maintainers is a multi-stage process: read authorisations file for the identifiers (which are github ids), read the public keys (where the mail address is included) OR it is a team and thus we need to read the identifiers in there, and then the public keys.
this issue is primarily to find out whether tools are using maintainer information (and if so, how they locate the maintainer), and what @AltGr thinks about duplicated information. we can also keep the maintainers in the opam file and grow the authorisations disjointly, but that'll likely lead to inconsistencies. we can also not store mail addresses as part of the public keys...
The text was updated successfully, but these errors were encountered:
at the moment we have the field maintainers in each opam file. In the future, we need to have authorised_ids in a separate file (since it is signed by janitors). This will lead to duplication of information.
I really don't know about the context so that may end up being very stupid but can't they somehow sign a hash of the contents of the maintainers field ?
at the moment an opam file contains both
author(s)
andmaintainer
fields, each may contain a list of names, email addresses, etc..seeing signing on the horizon, we'll duplicate the maintainer information into the
authorisations
files (which contain a set of individuals and team identifiers who are authorised to modify the package).since I'm allergic to duplication of information (it tends to be outdated pretty quickly), I'd appreciate a convenient way forward. I suspect automated tools might want (already do?) use the maintainership information to show packages (which build/don't build/don't lint) sorted by maintainers, thus they'll need a programmatic way to get the maintainer information.
getting the mail addresses of maintainers is a multi-stage process: read authorisations file for the identifiers (which are github ids), read the public keys (where the mail address is included) OR it is a team and thus we need to read the identifiers in there, and then the public keys.
this issue is primarily to find out whether tools are using maintainer information (and if so, how they locate the maintainer), and what @AltGr thinks about duplicated information. we can also keep the maintainers in the opam file and grow the authorisations disjointly, but that'll likely lead to inconsistencies. we can also not store mail addresses as part of the public keys...
The text was updated successfully, but these errors were encountered: