We currently have this in gitlab-ci:
E: librem5-ci changes: changed-by-invalid-for-derivative Librem5 CI <librem5-builds@lists.community.puri.sm> (should use @puri.sm email addresses)
This got me thinking if it makes sense at all. Shouldn't we relax that (maybe mark as info or pedantic) since community contributors would hit the same problem even when it's a sponsored upload by someone with archive access?
This is a good question. Since it affects security in the archive I'd like to have consensus and have Matthias' view.
It's not a rejection reason (afaik Laneakia doesn't reject based on linitan errors yet) so likely not security relevant or am i missing something?
Won't users have to sign the package with their email address? So won't the email address have to be in the keyring? Or is there a workaround?
The linitan check is about the fields in d/control. I doesn't care who signs/uploads the package later on.
Oh I see. This means that d/control email address can be arbitrary but the uploading key must be in the keychain. Thanks for the clarification. In such case we ought to mark it as pedantic (or just info) in Lintian.
To me, this Lintian check actually makes little sense. The one for Maintainer is important, so the maintenance status is reflected in the modified package, but Changed-by could be any address. When Zlatan and I created the project, the initial goal was explicitly to get the community involved and have people outside of Purism contribute. That didn't really work out, but by limiting change authors to people with an @puri.sm address we make this even less likely and also make the project look a lot more like a Purism inside job than is good for it ;-)
So, IMHO we should either drop this check or relax it quite a bit (to pedantic or lower...).