What's the policy on package maintainers for packages in this repository?

[Jackenmen]

Hi. I've used to be co-maintainer of mpc-hc-clsid2 Chocolatey package from its repository but I noticed today that this is no longer the case (the removal has happened some time between August 14 and August 26 based on when I stopped getting updates about it in my email).
While I don't really have a problem with this change as I understand this unnecessarily increases the potential attack vector, it makes me curious if there's any sort of policy/process on removing package maintainers from packages kept within this repository.

[pauby]

It was likely me who removed you as a maintainer of the package. I say likely as I don't remember. As a rule, if the maintainer of a package is chocolatey-community and the package is being submitted by that user, then I will remove all other maintainers of the package.

This repository submits packages under the chocolatey-community username. As the package is being actively maintained, having other maintainers with the ability to submit the same packages can be problematic.

While I don't really have a problem with this change as I understand this unnecessarily increases the potential attack vector

Having the chocolatey-community / this repository maintain a package decreases the attack vector. The packages in this repository are public, open-source, visible and changes subject to review by different people.

curious if there's any sort of policy/process on removing package maintainers from packages kept within this repository.

Any package maintainer can remove any other package maintainer from a package. So, this is nothing un usual.

There is documentation coming to this repository, and I understand from @AdmiringWorm that it will contain notes on this situation.

[Jackenmen]

As a rule, if the maintainer of a package is chocolatey-community and the package is being submitted by that user, then I will remove all other maintainers of the package.

This doesn't (yet?) seem to be universally true for all automatic packages in the chocolatey-community repository which is why I'm asking about it. I've been kept as a maintainer for 3 years which made me think this may be a recent move. Don't get me wrong, it's a good move, I am just curious about the specifics.

Having the chocolatey-co mmunity / this repository maintain a package decreases the attack vector.

I meant that having someone other than chocolatey-community in the maintainer list (such as me) increases the attack vector (since I could, in theory, push a malicious package) which is why I said that I understand why it's beneficial to not keep anyone other than chocolatey-community in the maintainer list. So we agree there :)

There is documentation coming to this repository, and I understand from @ AdmiringWorm that it will contain notes on this situation.

👍

[AdmiringWorm]

This doesn't (yet?) seem to be universally true for all automatic packages in the chocolatey-community repository which is why I'm asking about it.

You are right, as we stand just now it is not universally true. But it is the goal we are working towards.

Basically, when a PR is coming in, a user contact us through email, etc and we see there are additional maintainers other than the chocolatey-community user, the other users are subsequently removed from the package on the website.

I've been kept as a maintainer for 3 years which made me think this may be a recent move.

It is a relatively recent move, one that we should have started doing many years ago.

As Paul also mentioned, I am working on documenting the procedures we are using in this repository, and what to expect. Unfortunately, this do take time to get added, but it is in the process of being documented that we will be removing other maintainers from the package, replacing it with a recommendation of they add themself to the CODEOWNERS file if they wish to be notified of any PR's that gets opened (at least one user being listed as the code owner will eventually be required once the new documentation is in place, and that user would be responsible for doing reviews of code that changes the package).

[Jackenmen]

Thank you, that clarifies it.