On Thu, Apr 27, 2023 at 08:25:48AM +1000, Ryan Lerch wrote:
This is my top pick!
The one reason why I don't like this choice is that pagure.io was
supposed to be distribution agnostic. Just an open source forge.
Thats why you see 'fedora-infrastructure' and 'fedora-kickstarts' and
such as early project names, to make sure they indicated they were for
fedora.
But that said, I am not sure that this distinction really matters too
much these days.
if there's someone that wants a new project, but isn't a contributor in
fedora they can ask us (or indeed any contributor) to add it for them.
Had a quick look at the pagure code, and this looks like we will have to
add some additional logic for this to work (not necessarily difficult, but
it’s not just a config change)
yeah. ;(
Afaict, there is no logic to restrict creating new repos (other than
turning it off completely). Additionally. The logic that restricts FPCA is
done at the login phase. So unless we want to restrict login to FPCA+1
(which I’m not suggesting) it will take a bigger (but not that bad) of a
fix to get working.
yeah, I think we do not want to require fpca to login again.
The spammers would likely just agree to it, and we don't really need to
care what open source license people want to contribute to their
projects.
Would trying to curtail bots registering on the Fedora Accounts side be an
option here too?
I don't think so, or at least it would be harder.
A lot of times I think these things are initially setup by a human or
group of humans, then they spew the spam via script... but I guess I
don't know that for sure...
kevin