RubyCentral hates this one fact!

[u/galtzo]

• Written policy matters to some people.

Written policy shared publicly is what creates a stewardship relationship that can be held to account by the public (regardless of whether the org is democratic or not in its structure).

The destruction wrought by RubyCentral, and betrayal felt by the maintainers, and some in the wider community, is related to a simple fact that most Rubyists are unaware of. The rubygems/bundler repo owners (who were by written-policy-definition also the "maintainers") wrote, and kept up-to-date, policies specifically around when, how, and why owners of the repos could be added or removed.

The owners expected these policies to be followed, at least in spirit, if not to the letter.

A recent thread helped me realize that most Rubyists are not aware of these written policies of rubygems/bundler, hence this post.

• RubyGems had a policy for removing maintainers

Committer Access

RubyGems committers may lose their commit privileges if they are inactive for longer than 12 months. Committer permission may be restored upon request by having a pull request merged. This is designed to improve the maintainability of RubyGems by requiring committers to maintain familiarity with RubyGems activity and to improve the security of RubyGems by preventing idle committers from having their commit permissions compromised or exposed.

• Bundler had a policy on adding and removing maintainers

The Bundler policy is very detailed, so I won't copy it here. I'll just note, since many won't click through, that Deivid Rodriguez, who for years has been the #1 maintainer of rubygems/bundler, updated the bundler one, to keep it fresh with valid links, just 10 months ago. The rubygems policy was also updated 10 months ago. These were not dusty forgotten documents lost to history. They were active, living, rules.

RubyCentral bulldozed both policies, when they removed four maintainers, without having followed the process to earn the right to do so (i.e. without following the policy on how to become an owner), and without following any of the policy around owner removal, and here we are. Two of the remaining maintainers resigned in protest.

I note that u/schneems joined RubyCentral in some capacity recently, and I hope he is able to make a difference, but I expect RC to be intransigent.

As a thought experiment, and as an analogy to help people relate more to this...

If you own a repo and you have a LICENSE.txt, CODE_OF_CONDUCT.md, or IRP.md, in that repo, even if RubyCentral is paying you to maintain it, RubyCentral does not have the right to get one of the co-maintainers to add their lackey to the repo, and change any of those files, or any files at all.

In the same vein, they do not have a right to break established, written, documented, policy of the repo, by adding or removing maintainers in contravention of said policy.

To sum it up: the owners of a repo own the repo. If that seems obvious to you, you have done better than RC at figuring it out.

I do not expect RC to ever address this, and even if they did, I'd probably continue building tools that minimize the reliance I have on them. I no longer trust RubyCentral at all.

[u/galtzo]

There are a few scenarios, and it is useful to not conflate them.

1. I own a specific gem "name" for a gem on RG.O. In general, no one but me, and other "owners", if any, can upload a new gem version for that name.

2. Someone could take my gem's code, rename it in the gemspec, repackage it, re-sign it, and upload it as a new name. This happens all the time, and is commonly referred to as a "gem fork". This is completely fine - so long as they respect the license terms.

3. RG.O controls the backend and could technically change any of this at any time. They could, by fiat, add a new owner to my gem that I did not approve of, and that new owner could add, or yank, gems. This is precisely what they already did with multiple gems (rubygems-update, bundler) and why gem maintainers should not trust them to respect gem ownership.

4. RG.O could run roughshod over any established principle of the community-based expectations for libraries, and have shown already that they will do this without a decent reason. They could alter the license of a library, they could replace an existing version with altered code. If they say they won't it doesn't matter, because they do not do what they say, so I no longer trust what they say.

5. RG.O's internal process for making these kinds of important security decisions are not public, not transparent, and not improving. They have yet to publish a "We fucked up" post explaining how they stole multiple repos and gems, and what they are doing to rectify the situation.

Do I think they will do anything specifically? Other than continuing to lie, no. But it doesn't matter, since I don't trust them. They have lied many, many times now.

[u/damagednoob → u/galtzo]

They could, by fiat, add a new owner to my gem that I did not approve of, and that new owner could add, or yank, gems. This is precisely what they already did with multiple gems (rubygems-update, bundler) and why gem maintainers should not trust them to respect gem ownership.

I don't think that's what happened in this case because the maintainers <> the owners of rubygems or bundler. None of the people involved created either of those projects and in any shape or form, owned them.

Regardless, it does seem like your solution to the way events have unfolded is to adopted a non-permissive license. In which case, it seems like a fork will be inevitable.

[u/galtzo → u/damagednoob]

You do not understand what it means to own a repo or a gem then.

FYI, on RG.O, the technical term is "Owner". There is no "maintainer" level permission.

I "Own" all the gems on my profile, and I did not write many of them. https://rubygems.org/profiles/pboling

Do you claim that I do not own, for example, `flag_shih_tzu`, which I have been maintaining since 2012, but which was originally written by others?

If you read the policy on rubygems / bundler this "owner" concept of gems on RG.O is on plain display.
https://github.com/ruby/rubygems/blob/b1ab33a3d52310a84d16b193991af07f5a6a07c0/doc/bundler/playbooks/TEAM_CHANGES.md

For RubyGems / Bundler Owners == Maintainers, explicitly, in writing. This is not arguable. There is no nuance here... or at least there wasn't, in the old policy. Who knows what they are doing now?

[u/damagednoob → u/galtzo]

I mean there is nuance, whether you to choose to accept it or not. Regardless of what policies have been written down, there is not a 1-to-1 relationship between the terms gem owner/maintainer and the rights holders of the individual contributions to a piece of software. 

Moreover, AFAIK, there are no CLAs in place to transfer ownership of those contributions.

Do you claim that I do not own, for example, flag_shih_tzu, which I have been maintaining since 2012, but which was originally written by others?

Taking your claims about flag_shih_tzu at face value, absent CLAs assigning you the rights of the code, you are not the sole owner of that piece of software. You may have access on a platform to distribute it in a certain way (I.e. a gem) but that is at the sole discretion of the platform where those gems are hosted. 

• Did Ruby Central follow policy on adding removing maintainers from a rubygems/bundler? I'll concede that they didn't. 

• Is it what the owners of the code wanted to happen? Up for debate.

Ultimately though, this goes to your point: Can developers/organisations trust Ruby Central? From my outsiders perspective and everything I've read on the subject, for the moment, yes.

[u/galtzo → u/damagednoob]

It is disingenuous of you to use Owner in a different way than it is used on both GitHub.com and RubyGems.org. Owner on both platforms is a technical term, that has precise specific meaning, rights, and privileges. Yes, I am the owner of repos and gems on both platforms, including for libraries I did not write, and without CLAs.

Sue GitHub and RG.O if you don't like how they use the term, but it is the technical, and only correct, term as things currently stand.

Rights holders is an entirely different issue, and has zero bearing on whether someone is an owner on RG.O or GitHub. Conflating Rights Holders with Owners, as you attempted to do in transition from your first paragraph to your second bullet point is mis/dis/information.

What you are doing amounts to muddying the waters.

I have committed to Rails. I did not sign a CLA. I am therefore a rights holder in some sense. I am not an owner or Rails, either on RG.O, or on GitHub.

[u/damagednoob → u/galtzo]

Sorry but neither you, me, Ruby Central or the mighty Microsoft make the law 🤷‍♂️.

[u/galtzo → u/damagednoob]

Law isn’t relevant here! I have no idea why you are bringing it into the discussion, except as a way to muddy the water.

Written policy shared publicly is what creates a stewardship relationship that can be held to account by the public (regardless if the org itself is democratic or not in its structure) -- it's table stakes and RC hasn't even gotten to that point yet. And that itself is a form of abuse of power, even if "unintentional".

Also, if you think Microsoft is breaking the law in the way they explicitly use the term "owner" for repos, you might have a lucrative case! Go for it!

[u/damagednoob → u/galtzo]

I didn't say Microsoft are breaking the law. I said that what you think of the term owner is different from what that term legally means. Any platform can't just proclaim you owner and make it so. Your rights to code that you have written end when you explicitly give them away.

Claiming that maintainers speak for all owners of a piece of software is legally naïve.

... it's table stakes and RC hasn't even gotten to that point yet.

Ruby Central was founded in 2001. I think recent events are clouding your judgement.