Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

CoC: do not allow Maintainers to tag releases, unless core is not available within a reasonable time #9798

Draft
wants to merge 1 commit into
base: master
Choose a base branch
from

Conversation

tobtoht
Copy link
Collaborator

@tobtoht tobtoht commented Feb 14, 2025

The intent of this rule is to set the expectation that releases are tagged by a member of the Monero Core Team unless there are extraordinary circumstances which warrant expedited tagging.

Tagging initiates the verified reproduction process, which requires multiple independent builds from contributors. A release is not finalized until hashes are signed by a member of the core team.

What constitutes 'reasonable time' should be discussed with other maintainers and developers when such circumstances arise. Misjudgment or abuse can obviously result in the removal of write privileges at the discretion of the core team.

For a release that fixes or mitigates an actively exploited Denial of Service attack against the network, a few days to a week would seem like a reasonable time (depending on severity). For a critical problem that affects the entire network (e.g. a chain halt) this might be on the order of hours.

I'm open to suggestions on how to word this rule better. If there is opposition to allowing maintainers to tag a release under any circumstances, I'm fine with changing this to "Maintainers MUST NOT tag releases unless they are also Administrators".

Drafted for now awaiting initial feedback.

@Malinero
Copy link
Collaborator

FWIW, I'd vote for "MUST NOT", feels like there's already enough pressure on maintainers.

If no Administrator can be available for a full week, then maybe we need additional administrators.
If it's a matter of hours, a Maintainer can still create a tag in their own namespace and release their own binaries, they don't have to be "official".

Unlike merging PRs, tagging is not a frequent action. It doesn't feel unreasonable to put this expectation on the group of administrators.

@selsta
Copy link
Collaborator

selsta commented Feb 16, 2025

If no Administrator can be available for a full week, then maybe we need additional administrators.

We already have difficulties finding maintainers, finding more administrators is going to be even more difficult.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants