fesco

#3476 SIG members without packager membership
Closed: Accepted by siosm. Opened by gotmax23.

Closed: Accepted
Reopen Issue

Hi again :wave:,

(Yes, this is another ticket related to distgit permissions, but it's a separate problem from https://pagure.io/fesco/issue/3475).

Defintion

Packaging SIGs are FAS groups that are synced to distgit and co-maintain packages. These all end in -sig. They are described as pkgdb groups in https://docs.fedoraproject.org/en-US/infra/howtos/groups_in_fedora/ since they used to be used in pkgdb.

Problem

It turns out there are several members of packaging SIGs that are not members of the packager group. I don't think these users can push changes to distgit via SSH, but they might be able to push via HTTPS, merge MRs, or make other package settings changes, even though they aren't members of the packager group.

Pagure would've blocked these users from being added directly as co-maintainers due to the REQUIRED_GROUPS setting, but I don't think this has an effect on group members that already have access.

Data

See https://fedorapeople.org/~gotmax23/rogue.json which was generated with goorphans distgit rogue from https://go.gtmx.me/goorphans (the main logic is in actions/rogue.go if you're curious). The "total" key in the data is the union of all groups.

Request

If there's another layer of access control in Pagure/distgit that I'm not aware of, which is possible, this can be closed.

Otherwise, we need to do something here. I guess these users need to be removed from these groups. If possible, these groups should be configured in the accounts system to not allow adding users who aren't packagers. Also, when users are removed from the packager group, we need to consider any other memberships they may have.

Discussion

See https://lists.fedoraproject.org/archives/list/devel@lists.fedoraproject.org/thread/W3K7WSYI6M5K2WOQSN74OX5EFFHVJCKO/#W3K7WSYI6M5K2WOQSN74OX5EFFHVJCKO, although the issue mentioned in https://pagure.io/fesco/issue/3475 was also brought up here.

So, I think (but haven't confirmed) that there is a git hook preventing any non packagers pushing to real (non fork) packages.

If the group has enough rights they could I think merge pr's.

I don't think we currently have any way to prevent them being added in the account system. Perhaps something could be implemented...

CC: @abompard for comment.

The listed members of python-packagers-sig used to be members of the packager group, but they were removed (likely due to the inactive packager process). Perhaps the process should remove such users from all their sig groups?

Yeah, as I mentioned elsewhere, there is some work ongoing to do this: https://pagure.io/fedora-infra/toddlers/pull-request/366

Metadata Update from @humaton:
- Issue tagged with: meeting

Next steps — it looks like there's nothing to do here other than waiting on Infra/Releng to complete and deploy the cleaning_packager_groups toddler. I think there should be a formal announcement and testing before this is put in place to avoid surprises.

The solution was implemented and deployed in production.

Metadata Update from @humaton:
- Issue close_status updated to: Accepted
- Issue status updated to: Closed (was: Open)

This does not seem to have been fully completed, and I'm not sure it was announced publicly, either.

When I sent the orphaned packages report today, I got a Delivery Status Notification Address not found failure when sending to npocs who is a member of crypto-team in FAS which had orphan affected packages. This user is a member of a packaging SIG while not being a member of the packager group or even having a valid email.

https://fedorapeople.org/~gotmax23/rogue2.json still shows multple non-packagers who are part of FAS groups synced to distgit.

Metadata Update from @gotmax23:
- Issue status updated to: Open (was: Closed)

Possibly related, but it's only a small list: https://pagure.io/fedora-infrastructure/issue/12935 ?

Probably not. The list in the ticket is much smaller. I haven't looked at the code, but perhaps the issue is that the toddler is looking at group membership on distgit and not in FAS. It needs to figure out which groups are synced to Pagure distgit via the distgit API but FAS should be used to lookup the group members. As far as I know, group membership only get synced to distgit when the respective users log in/log out so the list of group members provided in the distgit API response is likely incomplete.
Edited by gotmax23

https://pagure.io/fedora-infra/toddlers/issue/382 tracks fixing the issue in the toddler. This still should be publicly announced so active users aren't surprised if they're "magically" removed from packaging SIGs that may also be used in other places in the project.

This was discussed in today's meeting: https://lists.fedoraproject.org/archives/list/devel@lists.fedoraproject.org/message/QLPMFUG5VSBZW6L5WORW2PVZFB57JJOS/

Set to pending announcement once things are ready.

Metadata Update from @ngompa:
- Issue untagged with: meeting
- Issue tagged with: pending announcement

Looks like the toddler fix is still pending?

What's the status here?

No update in the toddler ticket. I pinged there.

Looks like there's no news from the toddlers, marking as stalled for now.

Metadata Update from @decathorpe:
- Issue tagged with: stalled

Metadata Update from @sgallagh:
- Issue untagged with: pending announcement

Looks like this is progressing now:
https://forge.fedoraproject.org/apps/toddlers/issues/382#issuecomment-561081

Looks like this has been fixed on the infra side and deployed. So it just needs to be announced.

Metadata Update from @siosm:
- Issue untagged with: stalled
- Issue tagged with: pending announcement

Announced: https://lists.fedoraproject.org/archives/list/devel@lists.fedoraproject.org/thread/WAJXLUQZF7VLTHWGML3CCLDXMN7XZWOB/

Metadata Update from @siosm:
- Issue untagged with: pending announcement

Metadata Update from @siosm:
- Issue close_status updated to: Accepted
- Issue status updated to: Closed (was: Open)
Metadata
None
None
None
None
None
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.