On 06/26/2014 06:42 PM, Kevin Fenzi wrote:
Another idea that leaps to mind is to add more provenpackagers...
have we set the bar too high so no one wants to apply?
Debian has packages in collab-maint, where any Debian Developer can make
changes and upload them. In Debian, this is purely a social convention
because the project doesn't have ACLs for Debian Developers, but there
is a strong notion of package ownership despite the lack of technical
enforcement.
Perhaps Fedora package maintainers could set a flag on their package
which would grant access to anyone who maintains any other package?
This way, package maintainers could gradually reduce the need for
provenpackager privileges (similar to what Debian did with the
introduction of the Debian Maintainer role, which is also governed by
package ACLs).
--
Florian Weimer / Red Hat Product Security