On 19 June 2026 2:51:13 pm IST, "Dr. Tobias Quathamer" <[email protected]> wrote:
>Am 18.06.26 um 14:31 schrieb Otto Kekäläinen:
>> Hi,
>>
>> For me personally, a major reason to trust Debian as my OS stems from
>> Debian having in general pretty good security practices, both in
>> preventing issues and in having such archives and transparency that
>> investigating security failures after they have happened is mostly easy[1].
>>
>> However, one thing that has worried me for a long time is how access
>> control is done on Salsa.
>>
>> I would like to improve the situation starting from the Go team, and
>> thus I want to propose a policy for how team memberships are granted and
>> revoked, what levels of access exist inside the team, what avenues exist
>> to contribute without formal access, and how we encourage code reviews
>> as a way to both onboard new members and keep existing members involved.
>>
>> Before I post a draft, I wanted to check if others here think alike and
>> if having a policy for team membership would be useful?
>>
>> Or do people dismiss such things as excess "bureaucracy" and think the
>> current state of things is just fine, and worrying about potential
>> misuse is unfounded?
>
>Hi Otto,
>
>I don't think that the go team needs a policy for membership. To me,
>that seems like it raises the barrier for contributions higher. I guess
>that the trust in Debian that you've mentioned is probably due to the
>fact that only selected people are allowed to upload directly (DDs and
>DMs). All other contributions need to be checked by a DD anyway.
>
>Given that only few people are currently visibly active in the go team,
>I would rather welcome new contributors by letting them join on salsa
>immediately. I don't think that new contributors could do much harm,
>because nothing from salsa gets uploaded to Debian automatically.
I had not considered it much from a security PoV, and indeed, I agree with what
is being said here.
I think it still might be nice to have some guidelines around ACLs - things
like what should be done when a one asks for owner or maintainer access
team-wide as the latter grants permissions to prune repos. However given that
only a few folks are active, this is maybe moot as well.
Best,
Nilesh
