don't require signoff from everyone for product-less permissions
Opened this issue · 0 comments
bhearsum commented
One of the rough edges to the new Multiple Signoffs system is that product-less permissions (eg: full admins) end up requiring signoff from all groups that are listed in any permissions required signoff.
For example, if we have the following Permissions Required Signoffs:
- Firefox Permissions, 1 releng, 1 relman
- SystemAddons Permissions, 1 releng, 1 relman, 1 gofaster
- Thunderbird Permissions, 1 releng, 1 tbird
...then adding a full fledged admin requires signoff from 1 releng, 1 relman, 1 gofaster, and 1 tbird.
I can think of a ways to improve this, but each has drawbacks:
- Ignore signoffs for permissions that don't specify a product (lets us add full fledged admins with no oversight).
- If product isn't specified, look explictly at only Firefox permission signoffs, because those are likely to be a good set of signoffs to require (probably ends up needing relman signoff for things they don't care about, kindof hacky)
- If product isn't specified, use a sentinel value in its place. Eg: look for permissions required signoffs that apply to a "NOPRODUCT" product. This would give us the best control over this case, but it's still kindof hacky.
(Imported from https://bugzilla.mozilla.org/show_bug.cgi?id=1343904)