Reaffirm provenpackager policy bounds

zbyszek commented

2026-09-22 18:05:13 +00:00

Member

[draft]
To be sent to devel-announce:

FESCo reaffirms that converting packages to (or from) %autochangelog and %autorelease falls are not considered "general cleanup" and provenpackagers should acquire maintainer approval before applying such a conversion, or use a pull request instead. See https://docs.fedoraproject.org/en-US/fesco/Who_is_allowed_to_modify_which_packages/#digest for the details of what changes should be done by provenpackagers without prior discussion.

[draft] To be sent to devel-announce: FESCo reaffirms that converting packages to (or from) %autochangelog and %autorelease falls are not considered "general cleanup" and provenpackagers should acquire maintainer approval before applying such a conversion, or use a pull request instead. See https://docs.fedoraproject.org/en-US/fesco/Who_is_allowed_to_modify_which_packages/#digest for the details of what changes should be done by provenpackagers without prior discussion.

gotmax23 commented

2026-09-22 18:06:51 +00:00

Member

I don't think pushing "general cleanup" changes as a provenpackager without prior communication or a PR is appropriate either, unless the cleanup is "urgent" or security-related or similar.

zbyszek commented

2026-09-22 19:20:45 +00:00

Author

Member

The policy allows "a general cleanup to a lot of packages". I quoted the "general cleanup" phrase, but the policy is actually narrower than that. The way I understand it, it is OK to do a sweeping cleanup across a bunch of packages without asking.

gotmax23 commented

2026-09-22 19:21:44 +00:00

Member

https://docs.fedoraproject.org/en-US/fesco/Mass_package_changes/ are supposed to be announced first.

👍 1

kevin commented

2026-09-22 22:47:40 +00:00

Owner

Here's my stab at a more verbose version:

Subject: Reminder on scope of provenpackager changes

Provenpackgers are a group of package maintainers with access to all packages in fedora.
However, we would like to remind everyone that this access should be used only in narrow cases and
should not be used to make changes beyond the very small changes to fix immediate issues without
consulting with the package maintainer(s).

In particular provenpackagers should not convert packages to %autorelease/%autochangelog or do
large 'cleanup' changes without maintainer(s) permission.

See https://docs.fedoraproject.org/en-US/fesco/Who_is_allowed_to_modify_which_packages/ for the full policy.

Here's my stab at a more verbose version: Subject: Reminder on scope of provenpackager changes Provenpackgers are a group of package maintainers with access to all packages in fedora. However, we would like to remind everyone that this access should be used only in narrow cases and should not be used to make changes beyond the very small changes to fix immediate issues without consulting with the package maintainer(s). In particular provenpackagers should not convert packages to %autorelease/%autochangelog or do large 'cleanup' changes without maintainer(s) permission. See https://docs.fedoraproject.org/en-US/fesco/Who_is_allowed_to_modify_which_packages/ for the full policy.

zbyszek commented

2026-09-23 09:39:44 +00:00

Author

Member

Let's not use "(s)", it's a DOS-era antipatterna and doesn't actually work. The correct sentence would be "without maintainer's permission" or "without maintainers' permission", and "without maintainer permission(s)" doesn't match either. Just "without maintainer permission" is easier on the eyes and works quite well.

I don't like the proposed phrasing because it constrains what pps are allowed to do more than the official policy.

Maybe something like this:

Provenpackgers are a group of package maintainers with access to all packages in fedora.
However, we would like to remind everyone that this access should be used only in limited cases described by the policy [1], and should not be used to make larger cleanups in packages without consulting with the package maintainers.

In particular provenpackagers should not convert packages to %autorelease/%autochangelog without maintainer permission.

See https://docs.fedoraproject.org/en-US/fesco/Who_is_allowed_to_modify_which_packages/ for the full policy.

Let's not use "(s)", it's a DOS-era antipatterna and doesn't actually work. The correct sentence would be "without maintainer's permission" or "without maintainers' permission", and "without maintainer permission(s)" doesn't match either. Just "without maintainer permission" is easier on the eyes and works quite well. I don't like the proposed phrasing because it constrains what pps are allowed to do more than the official policy. Maybe something like this: > Provenpackgers are a group of package maintainers with access to all packages in fedora. However, we would like to remind everyone that this access should be used only in limited cases described by the policy [1], and should not be used to make larger cleanups in packages without consulting with the package maintainers. > > In particular provenpackagers should not convert packages to %autorelease/%autochangelog without maintainer permission. > > See https://docs.fedoraproject.org/en-US/fesco/Who_is_allowed_to_modify_which_packages/ for the full policy.

decathorpe commented

2026-09-23 12:31:56 +00:00

Member

I think "larger cleanups" is a bit of a red herring here. converting to rpmautospec is arguably not a "cleanup" but 1) bringing the package in line with SHOULD packaging guidelines but also 2) changes packager workflow. And if a package has not been converted by now, that should probably be considered a conscious packager choice, i.e. there is a reason why this SHOULD guideline is not followed, and it should not be overridden by a provenpackager without consulting the maintainer first.

New version:

Provenpackgers are a group of package maintainers with access to all packages in Fedora, but these powers also come with limits and should be used responsibly. In particular, we would like to remind everyone that this access should be used only in limited cases (as described in the "Who is allowed to modify which packages" policy document [1]), and should otherwise not be used without consulting affected package maintainers first. Note that "Mass package changes" [2] are covered by a different policy.

For example, provenpackagers should not convert packages to %autorelease/%autochangelog without consent of the package maintainer.

[1] https://docs.fedoraproject.org/en-US/fesco/Who_is_allowed_to_modify_which_packages/
[2] https://docs.fedoraproject.org/en-US/fesco/Mass_package_changes/

I think "larger cleanups" is a bit of a red herring here. converting to rpmautospec is arguably not a "cleanup" but 1) bringing the package in line with SHOULD packaging guidelines **but** also 2) changes packager workflow. And if a package has not been converted by now, that should probably be considered a conscious packager choice, i.e. there is a reason why this SHOULD guideline is not followed, and it should not be overridden by a provenpackager without consulting the maintainer first. New version: > Provenpackgers are a group of package maintainers with access to all packages in Fedora, but these powers also come with limits and should be used responsibly. In particular, we would like to remind everyone that this access should be used only in limited cases (as described in the "Who is allowed to modify which packages" policy document [1]), and should otherwise not be used without consulting affected package maintainers first. Note that "Mass package changes" [2] are covered by a different policy. > > For example, provenpackagers should not convert packages to %autorelease/%autochangelog without consent of the package maintainer. > > [1] https://docs.fedoraproject.org/en-US/fesco/Who_is_allowed_to_modify_which_packages/ > [2] https://docs.fedoraproject.org/en-US/fesco/Mass_package_changes/

kevin commented

2026-09-23 17:21:00 +00:00

Owner

I'm fine with that wording. +1

zbyszek commented

2026-09-23 19:50:31 +00:00

Author

Member

+1 too

supakeen commented

2026-09-24 06:35:15 +00:00

Member

+1

ngompa commented

2026-10-06 17:32:13 +00:00

Member

+1

siosm commented

2026-10-06 17:35:58 +00:00

Member

+1

gtb commented

2026-10-06 19:43:39 +00:00

I don't really have any standing here, but I would like to suggest a slightly more general wording, something of the form:

PP permissions MUST NOT be used to implement SHOULD recommendations across the entire (or a significant set) of the package ecosystem (in practice turning them into effective MUSTs) without a much wider discussion and approval by FESCo.

I don't really have any standing here, but I would like to suggest a slightly more general wording, something of the form: PP permissions MUST NOT be used to implement SHOULD recommendations across the entire (or a significant set) of the package ecosystem (in practice turning them into effective MUSTs) without a much wider discussion and approval by FESCo.

gotmax23 commented

2026-10-06 19:48:06 +00:00

Member

PP permissions MUST NOT be used to implement SHOULD recommendations across the entire (or a significant set) of the package ecosystem (in practice turning them into effective MUSTs) without a much wider discussion and approval by FESCo.

I think that should be covered by the link to the policy about Mass Package Changes, but perhaps this could use additional clarification in the announcement.

I would also like to add a general reminder to the proposed announcement along the lines of "provenpackager members are trusted packagers that are considered examples to the rest of the Fedora packaging community and should therefore take extra care always to respectfully communicate and collaborate with other developers and closely follow the Packaging Guidelines."

> PP permissions MUST NOT be used to implement SHOULD recommendations across the entire (or a significant set) of the package ecosystem (in practice turning them into effective MUSTs) without a much wider discussion and approval by FESCo. I think that should be covered by the link to the policy about Mass Package Changes, but perhaps this could use additional clarification in the announcement. I would also like to add a general reminder to the proposed announcement along the lines of "provenpackager members are trusted packagers that are considered examples to the rest of the Fedora packaging community and should therefore take extra care always to respectfully communicate and collaborate with other developers and closely follow the Packaging Guidelines."

Rows
Columns

Reaffirm provenpackager policy bounds #3687