New organization: packaging #456

Closed
opened 2026-03-11 02:07:45 +00:00 by gotmax23 · 10 comments

Hello Fedora Infra Team,

I would like to request the creation of a new organization and associated
teams in Fedora Forge.

  1. New Organization Details:

Desired Organization Name (Short Name): packager-tools

Full Name of Organization: Fedora Packager Tooling

Description of Organization's Purpose: This organization will host scripts, RPM macros, and other automation tooling for Fedora packaging.

Examples of projects that should live here:

  • fedrq
  • forge-srpm-macros
  • rpmautospec and rpmautospec-core (currently on Github)
  • goorphans
  • fedora-misc-package-utilities (currently on Pagure)
  • pyrpkg and fedpkg (also on Pagure)

I'm not sure how the teams structure should be set up. Each repository should have its own permissions structure. It should be possible for members of the packager FAS group to create repositories for packager tooling that are generally useful to Fedora packagers and don't fit under an established SIG in this organization. If Infra desires, a ticket-based process to create repositories can be used or maybe self-service can be offered to provenpackager members only.

Hello Fedora Infra Team, I would like to request the creation of a new organization and associated teams in Fedora Forge. 1. New Organization Details: Desired Organization Name (Short Name): packager-tools Full Name of Organization: Fedora Packager Tooling Description of Organization's Purpose: This organization will host scripts, RPM macros, and other automation tooling for Fedora packaging. Examples of projects that should live here: - fedrq - forge-srpm-macros - rpmautospec and rpmautospec-core (currently on Github) - [goorphans](https://codeberg.org/gotmax23/goorphans) - fedora-misc-package-utilities (currently on Pagure) - pyrpkg and fedpkg (also on Pagure) I'm not sure how the teams structure should be set up. Each repository should have its own permissions structure. It should be possible for members of the `packager` FAS group to create repositories for packager tooling that are _generally useful_ to Fedora packagers and don't fit under an established SIG in this organization. If Infra desires, a ticket-based process to create repositories can be used or maybe self-service can be offered to `provenpackager` members only.
ryanlerch added this to the Sprint 16 project 2026-03-18 03:32:37 +00:00
ryanlerch modified the project from Sprint 16 to (deleted) 2026-03-23 09:14:00 +00:00
ryanlerch modified the project from (deleted) to Sprint 17 2026-03-23 10:30:09 +00:00
Author

@ryanlerch, what's the status of this?

@ryanlerch, what's the status of this?
Owner

Held off on this one, since the ticket over on the packaging committee was talking about what to name their repo, and were talking about some packaging tools there:

https://pagure.io/packaging-committee/issue/1527#comment-1008924

Held off on this one, since the ticket over on the packaging committee was talking about what to name their repo, and were talking about some packaging tools there: https://pagure.io/packaging-committee/issue/1527#comment-1008924
Owner

Since this is going to get messy, i think having two seperate orgs here is the way to go (Packaging Tools and Packaging Committee)

For this ticket, @gotmax23 how about this setup:

  • Owners team (full admin access) given to members of a new group forge-packagingtools-owners whose group membership is inherited from provenpackagers

  • Members team (write access to tickets, read access to everything else, ability to create repos) is given to members of a new group forge-packagingtools-members whose group membership is inherted from packagers. If a user creates a repo, they are given admin access to that repo.

All other commit access to repos is done by manually adding users as collaborators on a per-repo basis.

Since this is going to get messy, i think having two seperate orgs here is the way to go (Packaging Tools and Packaging Committee) For this ticket, @gotmax23 how about this setup: * Owners team (full admin access) given to members of a new group `forge-packagingtools-owners` whose group membership is inherited from `provenpackagers` * Members team (write access to tickets, read access to everything else, ability to create repos) is given to members of a new group `forge-packagingtools-members` whose group membership is inherted from `packagers`. If a user creates a repo, they are given admin access to that repo. All other commit access to repos is done by manually adding users as collaborators on a per-repo basis.
Author

@ryanlerch and I discussed this on Matrix. I think the suggested setup is workable, there's just a question of whether forge-packagingtools-owners should contain all provenpackagers or just one or two people to serve as org admins.

I pointed out that it's an expansion of the role of provenpackagers that currently only applies to distgit permissions, but provenpackagers are already a trusted group, so perhaps it makes sense to give them access to packaging tools repos as well. Another option is to create a separate team in the packager-tools org that consists of provenpackagers so repo admins can choose to give all provenpackagers perms on a repo, but the team wouldn't automatically have global admins perms.

@ryanlerch and I discussed this on Matrix. I think the suggested setup is workable, there's just a question of whether forge-packagingtools-owners should contain all provenpackagers or just one or two people to serve as org admins. I pointed out that it's an expansion of the role of provenpackagers that currently only applies to distgit permissions, but provenpackagers are already a trusted group, so perhaps it makes sense to give them access to packaging tools repos as well. Another option is to create a separate team in the packager-tools org that consists of provenpackagers so repo admins can choose to give all provenpackagers perms on a repo, but the team wouldn't automatically have global admins perms.
Owner

Okay, after a real-time chat with @gotmax23 in matrix, here is an ammended proposal:

  • Owners team (full admin access) given to members of a new group forge-packagingtools-owners with sponsors and members list being: @gotmax23 + ???

  • Provenpackager forge team: given to members of a new group forge-packagingtools-provenpackager with membership inhertied from the already existing provenpackager FAS group. Members of this team have write (or whatever) access to specific repos (a list that owners of the org or repos can update).

  • Packager forge team: given to members of a new group forge-packagingtools-packager with membership inhertied from the already existing packager FAS group. Members of this team will have no specific access to repos in the org. But have the ability to create a new repo in the organization.

Extra notes:

  • If a user creates a repo, they are given owner/admin access to that repo.
  • All other commit access to repos is done by manually adding users as collaborators on a per-repo basis, by either the owner/admin of the repo, or the owners of the org as a whole.
Okay, after a real-time chat with @gotmax23 in matrix, here is an ammended proposal: * Owners team (full admin access) given to members of a new group `forge-packagingtools-owners` with sponsors and members list being: @gotmax23 + ??? * `Provenpackager` forge team: given to members of a new group `forge-packagingtools-provenpackager` with membership inhertied from the already existing `provenpackager` FAS group. Members of this team have write (or whatever) access to specific repos (a list that owners of the org or repos can update). * `Packager` forge team: given to members of a new group `forge-packagingtools-packager` with membership inhertied from the already existing `packager` FAS group. Members of this team will have no specific access to repos in the org. But have the ability to create a new repo in the organization. Extra notes: * If a user creates a repo, they are given owner/admin access to that repo. * All other commit access to repos is done by manually adding users as collaborators on a per-repo basis, by either the owner/admin of the repo, or the owners of the org as a whole.
Author

Hi @ryanlerch, I put a final proposal to handle this and #457 in https://pagure.io/packaging-committee/issue/1527. The FPC discussed this in the last meeting, and we prefer one packaging org over the two organization approach as long as we can properly handle permissions -- which I think we can. If the plan I wrote up in the Pagure issue looks good to you, can we move forward with it?

Hi @ryanlerch, I put a final proposal to handle this and #457 in <https://pagure.io/packaging-committee/issue/1527>. The FPC discussed this in the last meeting, and we prefer one `packaging` org over the two organization approach as long as we can properly handle permissions -- which I think we can. If the plan I wrote up in the Pagure issue looks good to you, can we move forward with it?
gotmax23 changed title from New organization: packager-tools to New organization: packaging 2026-04-20 03:41:19 +00:00
Owner

From @gotmax23 on https://pagure.io/packaging-committee/issue/1527#comment-1011641

Primary requirements

This setup will unblock the FPC migration and the packaging tools requests.

  • The forge-packaging-owners group should inherit from the packaging-committee FAS group and have admin permissions in the new packaging org.
  • The forge-packaging-committee group should inherit from the packaging-committee FAS group and map to a committee team in the Forge org. This team will have admin on forge.fp.o/packaging/guidelines once I migrate this repository. I figured it'd make sense to have a separate committee team in case we need to change the owners team in the future (see open question 1 below for why we might want to do this).
  • There should be a new forge-packaging-packager group that inherits from packager and maps to a packaging/packager team that has no special permissions in the org (readonly for everything) but can create repositories for packaging tooling.
  • Org description: "This organization will host the Packaging Committee and other issue trackers, RPM macros, and generally useful tooling for Fedora packaging." I tried to make this pretty explicit and well-scoped but feedback is welcome.

Open questions

  1. Will the admin team get automatically subscribed to all notifications for anything that happens in the org's repositories? I don't want to create a fire hose for all FPC members who would have admin perms in the org.
  2. Once this repo is migrated, how do we change the Antora docs pipeline to point to the new repo?

Secondary requirements

  • There should be a new forge-packaging-provenpackager group that inherits from provenpackager and maps to a packaging/provenpackager team in Forge. This team will have no special permissions in the org by default, but individual maintainers can choose to give this team ACLs on a per-repo basis if desired.
  • Is it possible to create a packager-sponsors Forge team that inherits its members from the sponsors list of the packager group (and not the members list like the proposed packager team would)? This will be needed for https://pagure.io/packager-sponsors/ which we'll probably migrate to forge.fp.o/packaging/sponsors.
  • Other packagers should be able to request teams by filing an Infra ticket if needed. For example, https://pagure.io/fedpkg/ and https://pagure.io/rpkg/ are maintained by the same people, so I imagine they might want their own team under the packaging org.
From @gotmax23 on https://pagure.io/packaging-committee/issue/1527#comment-1011641 > ## Primary requirements > > This setup will unblock the FPC migration and the packaging tools requests. > > - The `forge-packaging-owners` group should inherit from the `packaging-committee` FAS group and have admin permissions in the new `packaging` org. > - The `forge-packaging-committee` group should inherit from the `packaging-committee` FAS group and map to a `committee` team in the Forge org. This team will have admin on forge.fp.o/packaging/guidelines once I migrate this repository. I figured it'd make sense to have a separate committee team in case we need to change the owners team in the future (see open question 1 below for why we might want to do this). > - There should be a new `forge-packaging-packager` group that inherits from `packager` and maps to a `packaging/packager` team that has no special permissions in the org (readonly for everything) but can create repositories for packaging tooling. > - Org description: "This organization will host the Packaging Committee and other issue trackers, RPM macros, and generally useful tooling for Fedora packaging." I tried to make this pretty explicit and well-scoped but feedback is welcome. > > ## Open questions > > 1. Will the admin team get automatically subscribed to all notifications for anything that happens in the org's repositories? I don't want to create a fire hose for all FPC members who would have admin perms in the org. > 2. Once this repo is migrated, how do we change the Antora docs pipeline to point to the new repo? > > ## Secondary requirements > > - There should be a new `forge-packaging-provenpackager` group that inherits from `provenpackager` and maps to a `packaging/provenpackager` team in Forge. This team will have no special permissions in the org by default, but individual maintainers can choose to give this team ACLs on a per-repo basis if desired. > - Is it possible to create a `packager-sponsors` Forge team that inherits its members from the sponsors list of the `packager` group (and not the members list like the proposed `packager` team would)? This will be needed for https://pagure.io/packager-sponsors/ which we'll probably migrate to forge.fp.o/packaging/sponsors. > - Other packagers should be able to request teams by filing an Infra ticket if needed. For example, https://pagure.io/fedpkg/ and https://pagure.io/rpkg/ are maintained by the same people, so I imagine they might want their own team under the packaging org.
Owner

@ryanlerch wrote in #456 (comment):

From @gotmax23 on https://pagure.io/packaging-committee/issue/1527#comment-1011641

Primary requirements

This setup will unblock the FPC migration and the packaging tools requests.

  • The forge-packaging-owners group should inherit from the packaging-committee FAS group and have admin permissions in the new packaging org.

This group and team have now been created, and are linked via mapping.

  • The forge-packaging-committee group should inherit from the packaging-committee FAS group and map to a committee team in the Forge org. This team will have admin on forge.fp.o/packaging/guidelines once I migrate this repository. I figured it'd make sense to have a separate committee team in case we need to change the owners team in the future (see open question 1 below for why we might want to do this).

This group and team have now been created, and are linked via mapping.

I also set up the permissions for this one, so any repo that this team gets added to, they get Admin privs on -- org owners can change this in the team settings page.

  • There should be a new forge-packaging-packager group that inherits from packager and maps to a packaging/packager team that has no special permissions in the org (readonly for everything) but can create repositories for packaging tooling.

This group and team have now been created, and are linked via mapping.

I also set up the permissions for this one, so any repo that this team gets added to, they only get read access to, but they have the "create new repos" flag turned on.

  • Org description: "This organization will host the Packaging Committee and other issue trackers, RPM macros, and generally useful tooling for Fedora packaging." I tried to make this pretty explicit and well-scoped but feedback is welcome.

Added this to the org description. However org owners can tweak at any time.

Open questions

  1. Will the admin team get automatically subscribed to all notifications for anything that happens in the org's repositories? I don't want to create a fire hose for all FPC members who would have admin perms in the org.

Currently yes, but this default is turning out to be quite spammy for the way we have all our orgs set up in forge. So once i implement #529 later today, this should not be an issue anymore

  1. Once this repo is migrated, how do we change the Antora docs pipeline to point to the new repo?

You will need to change where the docs site build precess looks, e.g.

Secondary requirements

  • There should be a new forge-packaging-provenpackager group that inherits from provenpackager and maps to a packaging/provenpackager team in Forge. This team will have no special permissions in the org by default, but individual maintainers can choose to give this team ACLs on a per-repo basis if desired.

This group and team have now been created, and are linked via mapping.

I also set up the permissions for this one, so any repo that this team gets added to, they get write access.

  • Is it possible to create a packager-sponsors Forge team that inherits its members from the sponsors list of the packager group (and not the members list like the proposed packager team would)? This will be needed for https://pagure.io/packager-sponsors/ which we'll probably migrate to forge.fp.o/packaging/sponsors.

This is not possible on the Forge side -- the OIDC login process that we use to populate the teams does not give us sponsors. However, this is likely be possible on the IPA side with some creative group inheritance. Will have to get further information on how the sponsors list is updated -- this is worth a seperate infra ticket i think, and i can explain my solution there if needs be.

  • Other packagers should be able to request teams by filing an Infra ticket if needed. For example, https://pagure.io/fedpkg/ and https://pagure.io/rpkg/ are maintained by the same people, so I imagine they might want their own team under the packaging org.

No worries -- just file a ticket here at forge/forge and we will get it done.

@ryanlerch wrote in https://forge.fedoraproject.org/forge/forge/issues/456#issuecomment-616778: > From @gotmax23 on https://pagure.io/packaging-committee/issue/1527#comment-1011641 > > > ## [](#primary-requirements)Primary requirements > > This setup will unblock the FPC migration and the packaging tools requests. > > > > * The `forge-packaging-owners` group should inherit from the `packaging-committee` FAS group and have admin permissions in the new `packaging` org. This group and team have now been created, and are linked via mapping. * https://forge.fedoraproject.org/org/packaging/teams/owners * https://accounts.fedoraproject.org/group/forge-packaging-owners/ > > * The `forge-packaging-committee` group should inherit from the `packaging-committee` FAS group and map to a `committee` team in the Forge org. This team will have admin on forge.fp.o/packaging/guidelines once I migrate this repository. I figured it'd make sense to have a separate committee team in case we need to change the owners team in the future (see open question 1 below for why we might want to do this). This group and team have now been created, and are linked via mapping. * https://forge.fedoraproject.org/org/packaging/teams/committee * https://accounts.fedoraproject.org/group/forge-packaging-committee/ I also set up the permissions for this one, so any repo that this team gets added to, they get Admin privs on -- org owners can change this in the team settings page. > > * There should be a new `forge-packaging-packager` group that inherits from `packager` and maps to a `packaging/packager` team that has no special permissions in the org (readonly for everything) but can create repositories for packaging tooling. This group and team have now been created, and are linked via mapping. * https://forge.fedoraproject.org/org/packaging/teams/packager * https://accounts.fedoraproject.org/group/forge-packaging-packager/ I also set up the permissions for this one, so any repo that this team gets added to, they only get read access to, but they have the "create new repos" flag turned on. > > * Org description: "This organization will host the Packaging Committee and other issue trackers, RPM macros, and generally useful tooling for Fedora packaging." I tried to make this pretty explicit and well-scoped but feedback is welcome. Added this to the org description. However org owners can tweak at any time. > > > > ## [](#open-questions)Open questions > > > > 1. Will the admin team get automatically subscribed to all notifications for anything that happens in the org's repositories? I don't want to create a fire hose for all FPC members who would have admin perms in the org. Currently yes, but this default is turning out to be quite spammy for the way we have all our orgs set up in forge. So once i implement https://forge.fedoraproject.org/forge/forge/issues/529 later today, this should not be an issue anymore > > 2. Once this repo is migrated, how do we change the Antora docs pipeline to point to the new repo? You will need to change where the docs site build precess looks, e.g. * Staging -- https://gitlab.com/fedora/docs/docs-website/docs-fp-o/-/blob/stg/site.yml?ref_type=heads#L128 * Prod -- https://gitlab.com/fedora/docs/docs-website/docs-fp-o/-/blob/prod/site.yml?ref_type=heads#L128 > > > > ## [](#secondary-requirements)Secondary requirements > > > > * There should be a new `forge-packaging-provenpackager` group that inherits from `provenpackager` and maps to a `packaging/provenpackager` team in Forge. This team will have no special permissions in the org by default, but individual maintainers can choose to give this team ACLs on a per-repo basis if desired. This group and team have now been created, and are linked via mapping. * https://forge.fedoraproject.org/org/packaging/teams/provenpackager * https://accounts.fedoraproject.org/group/forge-packaging-provenpackager/ I also set up the permissions for this one, so any repo that this team gets added to, they get write access. > > * Is it possible to create a `packager-sponsors` Forge team that inherits its members from the sponsors list of the `packager` group (and not the members list like the proposed `packager` team would)? This will be needed for https://pagure.io/packager-sponsors/ which we'll probably migrate to forge.fp.o/packaging/sponsors. This is not possible on the Forge side -- the OIDC login process that we use to populate the teams does not give us sponsors. However, this is likely be possible on the IPA side with some creative group inheritance. Will have to get further information on how the sponsors list is updated -- this is worth a seperate infra ticket i think, and i can explain my solution there if needs be. > > * Other packagers should be able to request teams by filing an Infra ticket if needed. For example, https://pagure.io/fedpkg/ and https://pagure.io/rpkg/ are maintained by the same people, so I imagine they might want their own team under the packaging org. No worries -- just file a ticket here at forge/forge and we will get it done.
Author

Thanks for creating the org and answering all my questions. It looks like there is an issue with two of the groups/teams, though. I have been added to

which have a fedora- prefix, not a forge- prefix like is configured in https://forge.fedoraproject.org/infra/ansible/src/commit/cea0a27b737837df664b83cdcbce0b52b2293bc0/roles/openshift-apps/forgejo/templates/values.yaml.j2#L564-L565. The Packager and Committee teams are currently empty, presumably because of the mismatched group names. Can either the group names in IPA or the Forgejo configuration be fixed?

Thanks for creating the org and answering all my questions. It looks like there is an issue with two of the groups/teams, though. I have been added to - https://accounts.fedoraproject.org/group/fedora-packaging-packager/ - https://accounts.fedoraproject.org/group/fedora-packaging-committee/ which have a `fedora-` prefix, not a `forge-` prefix like is configured in <https://forge.fedoraproject.org/infra/ansible/src/commit/cea0a27b737837df664b83cdcbce0b52b2293bc0/roles/openshift-apps/forgejo/templates/values.yaml.j2#L564-L565>. The Packager and Committee teams are currently empty, presumably because of the mismatched group names. Can either the group names in IPA or the Forgejo configuration be fixed?
gotmax23 reopened this issue 2026-04-20 14:27:15 +00:00
Owner

@gotmax23 wrote in #456 (comment):

Thanks for creating the org and answering all my questions. It looks like there is an issue with two of the groups/teams, though. I have been added to

which have a fedora- prefix, not a forge- prefix like is configured in

"forge-packaging-committee":{"packaging":["Committee"]},
"forge-packaging-packager":{"packaging":["Packager"]},

. The Packager and Committee teams are currently empty, presumably because of the mismatched group names. Can either the group names in IPA or the Forgejo configuration be fixed?

Sorry about this, that was a error on my part.

I have created the proper groups now:

and have changed the ones i made in error to be empty:

We typically do not delete groups, but since these were made in error, and never actaully used, i will check with @kevin to see if they are ok to delete in this case.

@gotmax23 wrote in https://forge.fedoraproject.org/forge/forge/issues/456#issuecomment-616929: > Thanks for creating the org and answering all my questions. It looks like there is an issue with two of the groups/teams, though. I have been added to > > * https://accounts.fedoraproject.org/group/fedora-packaging-packager/ > * https://accounts.fedoraproject.org/group/fedora-packaging-committee/ > > which have a `fedora-` prefix, not a `forge-` prefix like is configured in https://forge.fedoraproject.org/infra/ansible/src/commit/cea0a27b737837df664b83cdcbce0b52b2293bc0/roles/openshift-apps/forgejo/templates/values.yaml.j2#L564-L565. The Packager and Committee teams are currently empty, presumably because of the mismatched group names. Can either the group names in IPA or the Forgejo configuration be fixed? Sorry about this, that was a error on my part. I have created the proper groups now: * https://accounts.fedoraproject.org/group/forge-packaging-packager/ * https://accounts.fedoraproject.org/group/forge-packaging-committee/ and have changed the ones i made in error to be empty: * https://accounts.fedoraproject.org/group/fedora-packaging-packager/ * https://accounts.fedoraproject.org/group/fedora-packaging-committee/ We typically do not delete groups, but since these were made in error, and never actaully used, i will check with @kevin to see if they are ok to delete in this case.
Sign in to join this conversation.
No milestone
No project
No assignees
2 participants
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference
forge/forge#456
No description provided.