by Fabio Alessandro Locati
Trying to work out a way to do the x/crypto rebuild in a way that is as little painful as possible, I've went back to some scripts I was playing with few weeks ago, and I've decided to write this email.
Counting only non-orphan packages, and package whose name start with `golang-`, we have more that 250 packages on which @go-sig have no permission whats so ever.
This means that, at the end of the day, for big rebuilds events we will still need provenpackagers, which is not optimal in my opinion.
Do we have a clear rule around the @go-sig permissions assignation? If so, where can I find it? If not, would it make sense to have such a rule?
What can we do to ensure that go-sig have appropriate permissions on all golang packages? I'm willing to write the code to create the list of packages with wrong permissions (and potentially to fix them), but I guess we will need a clear rule and and an agreed processes before we can run such script.
What's your take on this?
Thanks a lot,
Fabio Alessandro Locati