[gfsd]Re: Directory preamble

[Mark H. Weaver]

Janet Casey <address@hidden> writes:

>    I thought that you check all changes in the directory--developers
>    can't just insert their own changes.  Isn't that right?
> 
> Yes, it is.
> 
> I was referring to a Web interface through which developers can enter
> their own packages. Someone could conceivably enter a new version that
> they consider finished (but actually is not) into the finished section
> and then delete or ignore the beta version in the unfinished
> section. I would ideally catch this, delete the unfinished version and
> dicuss things with the developer, but it would be easier if it could
> just be flagged in some way.

I'm confused.  You acknowledged above that the developers cannot insert
their own changes, and then you seem to imply that the web interface will
allow them to do just that.

The web interface will NEVER modify the directory itself.  All
additions/changes/deletions will be mailed to you in a convenient
format, and that's it.

If the developer enters a new entry, rather than changing an existing
entry, I don't know how to detect this reliably.  I could detect if they
use the exact same package name, and perhaps add some other heuristics,
but I doubt it's worth the effort.

> Also, what about deleting packages? I would prefer that I could be the
> only one to do that. Again, I may be concerned with maliciousnes that
> we will not ancounter. 

Again, everything will go through you -- not just deletions.

        Mark