feat: 去掉 author 邮箱限制，改为包名先到先得（按 GitHub login）#8
Merged
Conversation
Drop the requirement that a submission's Maintainer email match the uploader's verified GitHub emails. Ownership of a package name now belongs to the GitHub login that first uploaded it, recorded as `uploaded_by` in the release manifest; the email is kept only for contact/audit. - worker: submit/unpublish attribute ownership by login (derived from the Maintainer noreply address in the APT index as a best-effort pre-check; the packages Action re-checks against the recorded `uploaded_by`). - debparse: add `loginFromNoreply` helper (+ test). - packages-workflows: process-web-submission writes `uploaded_by`/ `uploader_email` and enforces ownership by login; process-web-unpublish verifies ownership by login. No email-vs-account matching. Co-authored-by: Cursor <cursoragent@cursor.com>
eggfly
force-pushed
the
feat/first-come-ownership
branch
from
July 21, 2026 08:55
2ff4e51 to
973963c
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
目的
dev.cardputer.cc上传/下架此前要求 deb 的 Maintainer 邮箱在上传者的 GitHub 验证邮箱里，才认作 owner。改为：谁先上传某个包名，谁就是 owner，owner 以上传者的 GitHub login 为准，并在 release manifest 里记录uploaded_by/uploader_email（邮箱仅用于联系/留痕）。改动
worker/src/index.js）：/api/submit与/api/unpublish改为按 login 判所有权。Worker 只能读到 APT 索引（Maintainer），所以从 Maintainer 的 noreply 地址反推 login 做尽力而为的预检；真正权威校验在 packages 仓库的 Action 里按uploaded_by复核。去掉了基于邮箱包含关系的not_owner判断和maskEmail。site/debparse.js：新增可复用/可测试的loginFromNoreply()（兼容login@与12345+login@users.noreply.github.com），补充单测。packages-workflows/process-web-submission.yml：去掉「Maintainer 邮箱必须匹配」的 Check；所有权改为按uploaded_bylogin（历史包从 Maintainer noreply 反推）；生成 manifest 时写入uploaded_by+uploader_email。packages-workflows/process-web-unpublish.yml：下架同样按记录的uploaded_bylogin 校验。Made with Cursor