launchpad-dev team mailing list archive

[Robert Collins <robert.collins@xxxxxxxxxxxxx>]

On Wed, Nov 9, 2011 at 7:38 AM, curtis Hovey <curtis.hovey@xxxxxxxxxxxxx> wrote:
> Hi rocket scientists.
>
> At UDS, Laura Czajkowski ask me about how Launchpad could solve the
> problem where membership in a team is contingent on a signed code of
> conduct. This issue is not a priority for Lp stakeholders, and the
> implementation of the feature is complex. I think this feature would be
> valuable to several Lp communities and it might be developed in
> collaboration.
>
> I have a good knowledge of how teams membership works and how the Ubuntu
> Code of Conduct works (and often does not). I want help defining an
> clear implementation path that Lp contributors can confidently complete
> in few weeks.

I think this is a very interesting proposal.

It seems to me that there are a number of different business rules
around which different teams may want. E.g. are signatures transitive
through teams (the 'company signs on behalf of' case, where membership
in the team counts as being covered [and so the team admins are
responsible for enforcing signing offline]) or are signatures auto
upgraded when a new version is issued.

I think this is a classic case where we should make LP extensible
rather than figure out how to do it in LP.

We currently have a hand-shake when a person joins a moderated team.
It goes like this:
The user attempts to join. They get told 'pending approval', and the
people that can authorise get a prompt.
They signoff and the user is joined.

If we take that existing handshake and give it a web callback
(configured per team) then a very simple API will let folk drive LP to
enforce any policy they want, with any signing mechanism they desire.
I can sketch how that would work (including nice UI etc), but thinking
about this made me realise there is an even easier lower key solution:
restricted teams.

The restricted team handshake goes like this:
User visits the team, and sees some prose that says (something like)
'go talk to Fred to join this team'.
They find Fred offline and Fred adds them.

So you can do arbitrary policies *today* by:
 - having a restricted team
 - with a URL in its description that says 'To join this team click:
https://team.example.com/join'
 - That is a tiny website like summit, which uses LP login to log the
user in, applies any business rules needed, and then uses the LP API
to offer membership to the user.

Would this fail to meet Ubuntu's needs in some way? It seems to me you
could get a very satisfactory experience with little overhead - and
different teams could collaborate on that tiny external website, which
would have very limited scope and features, and thus be a lot more
agile and tweakable than LP itself.

-Rob