[Catalog-sig] group maintenance of packages?

["Martin v. Löwis"]

> I'm wondering if there is an existing way to reduce that overhead
> (e.g. there is an API that would let us script a syncronisation with
> our team list from Launchpad)

There certainly is an API: the role_form URL is fairly stable, and
we are fairly committed to keep the forms "fixed". So just write
a script that posts to that URL.

That said, we may unintentionally break stuff from time to time,
if that happens, speak up (and we just introduce a new URL for
the new form, or make new fields optional).

To figure out the current roles, use the package_roles RPC.

> or whether we need to (or it would be
> better to) extend PyPI to understand the concept of 'team' or 'group'
> and let such a team or group be placed in a role.

Not sure how common that request is to justify the effort.
If done, I think I'd favor a transitive group membership,
similar to Postgres roles (users and groups live in the
same space, and logging in transitively logs you into all your
groups. A group might have a regular password, if you know
the password, you can change group membership).

Regards,
Martin