El sáb, 03-06-2017 a las 09:32 +0200, Pierre-Yves Chibon escribió: > On Fri, Jun 02, 2017 at 08:52:22PM +0000, Zbigniew Jędrzejewski-Szmek > wrote: > > On Fri, Jun 02, 2017 at 09:42:48PM +0200, Pierre-Yves Chibon wrote: > > > With the deprecation of pkgdb2, pagure will make it even easier > > > to give someone > > > access to a package, if someone wants to help you maintain a > > > package, you can > > > just grant them access to the project on pagure. They will only > > > have access to > > > that project and not anything else. > > > > If somebody is given access to the package on pagure, does it allow > > them to > > do non-scratch koji builds and submit updates for that package? > > Koji builds yes since koji does not check for packager membership, it > is told by > a sync script who is allowed to do what. > We could make this script check the packager membership, that might > be a nice > place to enforce it. > > Bodhi I believe also check this, maybe Randy could confirm this. koji does not have any knowledge of the packager group. If the user has valid credentials they can submit a task for any package. the sync from pkgdb is the list of packages and it gets assigned to the primary contact as the package owner in koji. The access controls are entirely enforced via dist-git acls. The script that does the owner syncing does not set any controls. it is purely to add the package and maintain who is listed as the owner in koji. Bodhi checks the acls when creating updates, it ensures that the person creating the update can commit, however afaik it does not know about the alternative arch groups which can commit to any package. Dennis
Attachment:
signature.asc
Description: This is a digitally signed message part
_______________________________________________ devel mailing list -- devel@xxxxxxxxxxxxxxxxxxxxxxx To unsubscribe send an email to devel-leave@xxxxxxxxxxxxxxxxxxxxxxx
