Inactive provenpackagers to be removed from group

[Ben Cotton]

In accordance with FESCo policy[1], the following provenpackagers will
be submitted for removal in two weeks based on a lack of Koji builds
submitted in the last six months. If you received this directly, you
can reply off-list to indicate you should still be in the
provenpackager group.

Note that removal from this group is not a "punishment" or a lack of
appreciation for the work you have done. The intent of the process is
to ensure contributors with distro-wide package privileges are still
active and responsive. This process is done regularly at the branch
point in each release.

[1]
https://docs.fedoraproject.org/en-US/fesco/Provenpackager_policy/#_mainta...

Checked 148 provenpackagers
The following 23 provenpackagers have not submitted a Koji build since
at least 2021-08-04 00:00:00:

akurtakov
codeblock
iarnell
ilianaw
jsmith
jwilson
kanarip
karsten
law
laxathom
lutter
mcepl
nhorman
notting
oliver
pmachata
psabata
ruben
steve
tflink
till
tmraz
wtogami

-- 
Ben Cotton
He / Him / His
Fedora Program Manager
Red Hat
TZ=America/Indiana/Indianapolis
_______________________________________________
devel-announce mailing list -- devel-announce(a)lists.fedoraproject.org
To unsubscribe send an email to devel-announce-leave(a)lists.fedoraproject.org
Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives:
https://lists.fedoraproject.org/archives/list/[e-mail]...
Do not reply to spam on the list, report it: https://pagure.io/fedora-infrastructure

[Fabio Valentini]

On Wed, Feb 9, 2022 at 7:29 PM Ben Cotton <bcotton(a)redhat.com&gt; wrote:
>  In accordance with FESCo policy[1], the following provenpackagers will
>  be submitted for removal in two weeks based on a lack of Koji builds
>  submitted in the last six months. If you received this directly, you
>  can reply off-list to indicate you should still be in the
>  provenpackager group.
>
>  Note that removal from this group is not a "punishment" or a lack of
>  appreciation for the work you have done. The intent of the process is
>  to ensure contributors with distro-wide package privileges are still
>  active and responsive. This process is done regularly at the branch
>  point in each release.
>
>  [1]
> https://docs.fedoraproject.org/en-US/fesco/Provenpackager_policy/#_mainta...
>
>  Checked 148 provenpackagers
>  The following 23 provenpackagers have not submitted a Koji build since
>  at least 2021-08-04 00:00:00:
>
>  akurtakov
>  codeblock
>  iarnell
>  ilianaw
>  jsmith
>  jwilson
>  kanarip
>  karsten
>  law
>  laxathom
>  lutter
>  mcepl
>  nhorman
>  notting
>  oliver
>  pmachata
>  psabata
>  ruben
>  steve
>  tflink
>  till
>  tmraz
>  wtogami 
So, has this actually happened? Checking a sample of these accounts
shows that all of them are still in the provenpackager group.
I doubt that *everyone* on the list sent an off-list email to indicate
that they still need those privileges?

Fabio

[Kevin Fenzi]

On Sat, Mar 19, 2022 at 01:54:08PM +0100, Fabio Valentini wrote:
>  On Wed, Feb 9, 2022 at 7:29 PM Ben Cotton <bcotton(a)redhat.com&gt;
> wrote:
>  >
>  > In accordance with FESCo policy[1], the following provenpackagers will
>  > be submitted for removal in two weeks based on a lack of Koji builds
>  > submitted in the last six months. If you received this directly, you
>  > can reply off-list to indicate you should still be in the
>  > provenpackager group.
>  >
>  > Note that removal from this group is not a "punishment" or a lack of
>  > appreciation for the work you have done. The intent of the process is
>  > to ensure contributors with distro-wide package privileges are still
>  > active and responsive. This process is done regularly at the branch
>  > point in each release.
>  >
>  > [1]
> https://docs.fedoraproject.org/en-US/fesco/Provenpackager_policy/#_mainta...
>  >
>  > Checked 148 provenpackagers
>  > The following 23 provenpackagers have not submitted a Koji build since
>  > at least 2021-08-04 00:00:00:
>  >
>  > akurtakov
>  > codeblock
>  > iarnell
>  > ilianaw
>  > jsmith
>  > jwilson
>  > kanarip
>  > karsten
>  > law
>  > laxathom
>  > lutter
>  > mcepl
>  > nhorman
>  > notting
>  > oliver
>  > pmachata
>  > psabata
>  > ruben
>  > steve
>  > tflink
>  > till
>  > tmraz
>  > wtogami
>  
>  So, has this actually happened? Checking a sample of these accounts
>  shows that all of them are still in the provenpackager group. 
yes, and I don't see the removed ones in provenpackager anymore. 
How are you checking?

I removed the ones listed in https://pagure.io/fedora-infrastructure/issue/10576

>  I doubt that *everyone* on the list sent an off-list email to
> indicate
>  that they still need those privileges? 
Nope, a bit less than 1/2 of them it looks like.

kevin

[Fabio Valentini]

On Sat, Mar 19, 2022 at 10:54 PM Kevin Fenzi <kevin(a)scrye.com&gt; wrote:
>  On Sat, Mar 19, 2022 at 01:54:08PM +0100, Fabio Valentini wrote:
>  > On Wed, Feb 9, 2022 at 7:29 PM Ben Cotton <bcotton(a)redhat.com&gt; wrote:
>  > >
>  > > In accordance with FESCo policy[1], the following provenpackagers will
>  > > be submitted for removal in two weeks based on a lack of Koji builds
>  > > submitted in the last six months. If you received this directly, you
>  > > can reply off-list to indicate you should still be in the
>  > > provenpackager group.
>  > >
>  > > Note that removal from this group is not a "punishment" or a lack of
>  > > appreciation for the work you have done. The intent of the process is
>  > > to ensure contributors with distro-wide package privileges are still
>  > > active and responsive. This process is done regularly at the branch
>  > > point in each release.
>  > >
>  > > [1]
> https://docs.fedoraproject.org/en-US/fesco/Provenpackager_policy/#_mainta...
>  > >
>  > > Checked 148 provenpackagers
>  > > The following 23 provenpackagers have not submitted a Koji build since
>  > > at least 2021-08-04 00:00:00:
>  > >
>  > > akurtakov
>  > > codeblock
>  > > iarnell
>  > > ilianaw
>  > > jsmith
>  > > jwilson
>  > > kanarip
>  > > karsten
>  > > law
>  > > laxathom
>  > > lutter
>  > > mcepl
>  > > nhorman
>  > > notting
>  > > oliver
>  > > pmachata
>  > > psabata
>  > > ruben
>  > > steve
>  > > tflink
>  > > till
>  > > tmraz
>  > > wtogami
>  >
>  > So, has this actually happened? Checking a sample of these accounts
>  > shows that all of them are still in the provenpackager group.
>
>  yes, and I don't see the removed ones in provenpackager anymore.
>  How are you checking?
>
>  I removed the ones listed in https://pagure.io/fedora-infrastructure/issue/10576
>
>  > I doubt that *everyone* on the list sent an off-list email to indicate
>  > that they still need those privileges?
>
>  Nope, a bit less than 1/2 of them it looks like. 
Oh, I think I know what's going on. I looked at
src.fedoraproject.org/user/$user.
But those group memberships are only synced if the user logs in, AFAIK?
So ... do these packagers retain provenpackager capabilities in
dist-git so long as they never log in? :)

Fabio

[Kevin Fenzi]

On Sat, Mar 19, 2022 at 10:58:59PM +0100, Fabio Valentini wrote:
>  
>  Oh, I think I know what's going on. I looked at
>  src.fedoraproject.org/user/$user.
>  But those group memberships are only synced if the user logs in, AFAIK?
>  So ... do these packagers retain provenpackager capabilities in
>  dist-git so long as they never log in? :) 
Yeah. Group memberships are refreshed there on login. 

But no one could use that, as if they logged in, it would refresh and
not let them use provenpackager access since they are no longer in the
group. 

kevin

[Fabio Valentini]

On Sat, Mar 19, 2022 at 11:03 PM Kevin Fenzi <kevin(a)scrye.com&gt; wrote:
>  On Sat, Mar 19, 2022 at 10:58:59PM +0100, Fabio Valentini wrote:
>  >
>  > Oh, I think I know what's going on. I looked at
>  > src.fedoraproject.org/user/$user.
>  > But those group memberships are only synced if the user logs in, AFAIK?
>  > So ... do these packagers retain provenpackager capabilities in
>  > dist-git so long as they never log in? :)
>
>  Yeah. Group memberships are refreshed there on login.
>
>  But no one could use that, as if they logged in, it would refresh and
>  not let them use provenpackager access since they are no longer in the
>  group. 
Well, in the GUI, yes, but what about the access controls in git
pre-receive hooks?
You don't need to log in with the web GUI to do "fedpkg clone; do
'malicious changes'; git commit -m 'spec cleanup'; git push".

Fabio

[Kevin Fenzi]

On Sat, Mar 19, 2022 at 11:07:17PM +0100, Fabio Valentini wrote:
>  On Sat, Mar 19, 2022 at 11:03 PM Kevin Fenzi <kevin(a)scrye.com&gt;
> wrote:
>  >
>  > On Sat, Mar 19, 2022 at 10:58:59PM +0100, Fabio Valentini wrote:
>  > >
>  > > Oh, I think I know what's going on. I looked at
>  > > src.fedoraproject.org/user/$user.
>  > > But those group memberships are only synced if the user logs in, AFAIK?
>  > > So ... do these packagers retain provenpackager capabilities in
>  > > dist-git so long as they never log in? :)
>  >
>  > Yeah. Group memberships are refreshed there on login.
>  >
>  > But no one could use that, as if they logged in, it would refresh and
>  > not let them use provenpackager access since they are no longer in the
>  > group.
>  
>  Well, in the GUI, yes, but what about the access controls in git
>  pre-receive hooks?
>  You don't need to log in with the web GUI to do "fedpkg clone; do
>  'malicious changes'; git commit -m 'spec cleanup'; git push".
I think it does check... but I am not sure. 
Will check with pingou about that. 

kevin