CoC: do not allow Maintainers to tag releases, unless core is not available within a reasonable time #9798
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
The intent of this rule is to set the expectation that releases are tagged by a member of the Monero Core Team unless there are extraordinary circumstances which warrant expedited tagging.
Tagging initiates the verified reproduction process, which requires multiple independent builds from contributors. A release is not finalized until hashes are signed by a member of the core team.
What constitutes 'reasonable time' should be discussed with other maintainers and developers when such circumstances arise. Misjudgment or abuse can obviously result in the removal of write privileges at the discretion of the core team.
For a release that fixes or mitigates an actively exploited Denial of Service attack against the network, a few days to a week would seem like a reasonable time (depending on severity). For a critical problem that affects the entire network (e.g. a chain halt) this might be on the order of hours.
I'm open to suggestions on how to word this rule better. If there is opposition to allowing maintainers to tag a release under any circumstances, I'm fine with changing this to "Maintainers MUST NOT tag releases unless they are also Administrators".
Drafted for now awaiting initial feedback.