[gentoo-dev] Re: [gentoo-project] RFC: "Trusted contributor model"

[Matt Turner <mattst88@gentoo.org>]

On Fri, Jul 22, 2022 at 7:57 AM Joonas Niilola <juippis@gentoo.org> wrote:
>
> Cross-posting to gentoo-dev and -project lists due to technical and
> non-technical nature. Reply-to is set to -project.
>
> Once again new council has been elected: congratulations to the chosen
> members! And once again many nominees expressed their wishes to see more
> non-developer contributors to become official developers. Yet, only very
> few people (if any) are interested in mentoring them. I get it, the
> relationship between a mentor and their mentee is very intimate, and
> mentoring takes a lot of time. While the Github PRs are helping us
> increase the user contributions merged, perhaps it's distancing us from
> creating stronger bonds with the contributors? But more about this topic
> later.
>
>
> 1st RFC: "Trusted contributor model"
>
> I'm proposing us to giving special commit access to our well-reputable
> contributors (mostly proxied maintainers). They'd have access _only_ to
> their maintained package in git-tree. To understand what I mean, check
>   git shortlog -s -n net-im/telegram-desktop-bin/
>   git shortlog -s -n net-im/signal-desktop-bin/
>
> There are few packages like these where I'd already trust the core
> proxied maintainer to commit at their will. It's as ajak said during the
> council election; _We_ are the bottleneck currently reviewing and
> _testing_ contributions, and with these two examples above, 99 % of time
> everything's in condition and we just need to merge. Obviously if these
> trusted contributors had to touch another package, or anything in
> profiles/ (just basically anything outside their dedicated package
> directory) they'd have to do a PR or .patch file to be merged by
> official developers. And they'd still need a proxy Gentoo
> developer/project listed in metadata, at least for now, to take
> responsibility.
>
> On the technical side I'm not sure how to achieve this, but I know it
> can be done. For example the sync-repos are compiled like this all the
> time. If this proposal gains support, I'm willing to start figuring it
> out more in-depth.
>
> AFAIK Fedora and Arch have somewhat similar systems in place already.

How would you suggest we track who has commit access, etc? The same
way we do with developers, via a developer bug?

I ask because I've noticed a lot of inactive proxied maintainers—one
of which had been listed in metadata.xml for 6 years but had never
committed to ::gentoo.