New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

maintainer information #2693

Open
hannesm opened this Issue Oct 1, 2016 · 4 comments

Comments

Projects
None yet
3 participants
@hannesm
Member

hannesm commented Oct 1, 2016

at the moment an opam file contains both author(s) and maintainer fields, each may contain a list of names, email addresses, etc..

seeing signing on the horizon, we'll duplicate the maintainer information into the authorisations files (which contain a set of individuals and team identifiers who are authorised to modify the package).

since I'm allergic to duplication of information (it tends to be outdated pretty quickly), I'd appreciate a convenient way forward. I suspect automated tools might want (already do?) use the maintainership information to show packages (which build/don't build/don't lint) sorted by maintainers, thus they'll need a programmatic way to get the maintainer information.

getting the mail addresses of maintainers is a multi-stage process: read authorisations file for the identifiers (which are github ids), read the public keys (where the mail address is included) OR it is a team and thus we need to read the identifiers in there, and then the public keys.

this issue is primarily to find out whether tools are using maintainer information (and if so, how they locate the maintainer), and what @AltGr thinks about duplicated information. we can also keep the maintainers in the opam file and grow the authorisations disjointly, but that'll likely lead to inconsistencies. we can also not store mail addresses as part of the public keys...

@dbuenzli

This comment has been minimized.

Contributor

dbuenzli commented Oct 1, 2016

Couldn't make sense of what you say, what is the problem exactly ?

@hannesm

This comment has been minimized.

Member

hannesm commented Oct 1, 2016

at the moment we have the field maintainers in each opam file. In the future, we need to have authorised_ids in a separate file (since it is signed by janitors). This will lead to duplication of information.

@dbuenzli

This comment has been minimized.

Contributor

dbuenzli commented Oct 1, 2016

I really don't know about the context so that may end up being very stupid but can't they somehow sign a hash of the contents of the maintainers field ?

@samoht

This comment has been minimized.

Member

samoht commented Oct 2, 2016

this issue is primarily to find out whether tools are using maintainer information (and if so, how they locate the maintainer)

a mix between opam info <pkg> + git blame + heuristic based on the github project home.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment