This is a terrible idea.

Can you elaborate?

If proxyuser is not going to fly (because ordinary users cannot create tags, etc..) then I see no alternative to treading in Koji as an admin user for everything.

Is there a level of privilege less than admin that we could use across the board, without admin and without proxyuser?

From discussion in IRC:

• We talked about adding a new 'permission' koji which only has rights to do what we need to do.

The problem is that koji permissions are currently not granular enough for that. i.e., in order to create a tag you have to be admin, period.

We will have to resolve this in koji before we can open MBS up to the general packager group.

Through conversation, the way @puiterwijk would like this to work (and I agree... it makes sense):

• The MBS should keep (at least) two session. One for normal unprivileged, proxy-user access. Another for privileged, koji-admin-style access.
• Only when it is needed, the MBS should "sudo", and use the privileged account (for instance, to create tags).
• When the tag is created, the unprivileged user should be given access to it.
• Then, work can proceed again with the unprivileged account.

This is cool, but is non-trivial to keep those accounts separated in builder.py.

It is not a blocker for F26 - it is a blocker for opening this up to the packager group in the ~June timeframe.

A further thought:

If the proxyuser account being used corresponds with real packager user accounts, then their account will have access to submit builds to the tag. We probably do not want this, as a packager user could tinker with the tag after MBS is done with it or while MBS is working on it - we would lose desirable releng guarantees (we wouldn't be able to assure the modulemd git refs, for instance).

Likely, we will need two system accounts - MBS-privileged and MBS-unprivileged.. or something like that. (If we want to track which builds come from which users, we can optionally submit their username in the "extras" build info dict.)

@ralph I would say, that the information shall be (or even must be) in the dict so that we can reliably check component owners (also related to #337) in Koji, verifying that it's in sync with what we have in the MBS's DB. Does it make sense?

Returning to this, we probably don't want proxyuser abilities in MBS anymore given all the issues. We should remove it, instead of trying to fix it. Filed #829.

This issue has been migrated to Fedora Forge:
https://forge.fedoraproject.org/koji/mbs/issues/334

Please continue any further discussion there.