So adding or removing a maintainer is an event that causes everyone’s package installs to break? In a large enough project that would mean nearly every depende

So adding or removing a maintainer is an event that causes everyone’s package installs to break? In a large enough project that would mean nearly every dependency change would trigger this condition. > Generally I wouldn’t be too happy using a dependency where there are lots of users with access to create official releases. I’m curious, do you use any open source software? Most larger projects have a number of maintainers with release rights. I want to clarify that I’m not against package signing. For example, I think this proposal is well-thought-out and would be a positive change. The key reason this is better IMO is that it introduces a centralized trust mechanism and a certificate transparency log: https://github.com/rubygems/rfcs/pull/37 https://github.com/rubygems/rfcs/pull/37