adding additional contributors to ansible PPA

Asked by Deric Crago on 2021-02-18

I'm on the ansible community team and have a couple questions that I'm hoping someone here might be able to help with.

In the (near) future we would like to start adding community contributors to our PPA (https://launchpad.net/~ansible/+archive/ubuntu/ansible). At the moment, ansible is a user on launchpad (https://launchpad.net/~ansible) which I believe means we would need to share credentials & signing keys to add community contributors and that is not what we want.

I understand launchpad has Teams & Projects (and maybe other things?) that are probably what we're looking for... Would we be able to get some help navigating our options?

Question information

Language:
English Edit question
Status:
Answered
For:
Launchpad itself Edit question
Assignee:
No assignee Edit question
Last query:
2021-02-18
Last reply:
2021-02-18
Colin Watson (cjwatson) said : #1

Projects aren't relevant to PPAs, but teams certainly are. Ideally the owner of this PPA would be a team, indeed, though getting there from here without disruption is tricky and not very precedented. I can think of a few options:

 * Launchpad has a facility to grant additional upload access to a PPA without requiring the extra uploaders to actually own the PPA. This is poorly-documented and not visible in the web UI, but it works something like this:

   bzr branch lp:ubuntu-archive-tools
   ubuntu-archive-tools/edit-acl -A ppa:ansible/ubuntu/ansible query
   ubuntu-archive-tools/edit-acl -A ppa:ansible/ubuntu/ansible -p <some username> -t upload add

 * Normally speaking PPAs can't be transferred between owners because it would disrupt publication. In this case there's no obstacle in principle, because the idea would be to create a new team, make the existing ~ansible user a member of it, transfer the PPA, then do two renames so that ~ansible becomes something like ~ansible-jenkins (or whatever) and the new team becomes ~ansible; the end result would have the PPA being published at the same URL. We would have to invent a new process for doing the PPA transfer step, since that's currently impossible; maybe that's just a matter of temporarily disabling publication and changing some owner columns manually in the database.

 * In theory it might be possible to convert the existing user into a team directly. We can currently do this for usernames that don't have a real account associated with them, but those are sort of limited placeholders and there's no supported way to get to there from here. We would need to go through all the properties that the current ~ansible user has, figure out which of them need to be deleted because they aren't suitable for teams, probably transfer its credentials somewhere else, and do various other checks by hand. I can roughly imagine how to do it, but as far as I know it's never been done in my time working on Launchpad and it would require inventing a fair bit of new process.

If the first of these is suitable for you, you could do it today with no involvement from us, except maybe a bit of support if the edit-acl tool fails or something behaves oddly. The other two are different ways of achieving the same end result, and either of them would require non-trivial work from our end; I think the PPA transfer approach is probably more viable, but I haven't dug into either of them in depth.

Deric Crago (deric.crago) said : #2

Hi @cjwatson, thank you for the thoughtful response. We've discussed these options internally and we agree that option #2 is likely the best for us long term. If the launchpad team is willing to go through that process with us (we're ok any temporary disruptions during the process), what would our next steps / timeline look like?

Can you help with this problem?

Provide an answer of your own, or ask Deric Crago for more information if necessary.

To post a message you must log in.