It would be hard for a sekrit society of developers to push through any changes that aren&#39;t documented publicly; we can all see the commit stream to Git, and if there are a sudden burst of patches being committed that violate the community&#39;s agreed-upon practices for submission and review, the community can call shenanigans on the person(s) doing the commits.<br>
<br>In the case of any critical security fix, it would be the Release Manager&#39;s and Release Maintainers&#39; responsibilities to justify the change set and the deviation from standard procedure; this is probably going to be as simple as &quot;fixes this security issue&quot; in the commit message.  Once it&#39;s committed, a more robust report can be written up somewhere and linked.<br>
<br>I don&#39;t think we&#39;re going to encounter these kinds of security issues often, so building a complex process to handle them seems counter-productive.  I&#39;d rather spend the time just finding/fixing any such issues.<br>
<br><br>-Ian<br><br><div class="gmail_quote">On Fri, Jun 3, 2011 at 8:38 AM, Owen Leonard <span dir="ltr">&lt;<a href="mailto:oleonard@myacpl.org">oleonard@myacpl.org</a>&gt;</span> wrote:<br><blockquote class="gmail_quote" style="margin: 0pt 0pt 0pt 0.8ex; border-left: 1px solid rgb(204, 204, 204); padding-left: 1ex;">
<div class="im">&gt; Op vrijdag 3 juni 2011 22:03:50 schreef MJ Ray:<br>
&gt;&gt; Please, no closed list for development discussions.<br>
<br>
</div>We&#39;re not talking about a secret cabal of self-chosen list members<br>
(anymore). Koha now has an (informally) elected list of officers who<br>
can be on the list: Release manager, release maintainer, QA manager.<br>
Let&#39;s keep it as simple as that.<br>
<br>
  -- Owen<br>
<font color="#888888"><br>
--<br>
Web Developer<br>
Athens County Public Libraries<br>
<a href="http://www.myacpl.org" target="_blank">http://www.myacpl.org</a><br>
</font><div><div></div><div class="h5">_______________________________________________<br>
Koha-devel mailing list<br>
<a href="mailto:Koha-devel@lists.koha-community.org">Koha-devel@lists.koha-community.org</a><br>
<a href="http://lists.koha-community.org/cgi-bin/mailman/listinfo/koha-devel" target="_blank">http://lists.koha-community.org/cgi-bin/mailman/listinfo/koha-devel</a><br>
website : <a href="http://www.koha-community.org/" target="_blank">http://www.koha-community.org/</a><br>
git : <a href="http://git.koha-community.org/" target="_blank">http://git.koha-community.org/</a><br>
bugs : <a href="http://bugs.koha-community.org/" target="_blank">http://bugs.koha-community.org/</a><br>
</div></div></blockquote></div><br><br clear="all"><br>-- <br>Ian Walls<br>Lead Development Specialist<br>ByWater Solutions<br>ALA Booth 732<br>Phone # (888) 900-8944<br><a href="http://bywatersolutions.com" target="_blank">http://bywatersolutions.com</a><br>
<a href="mailto:ian.walls@bywatersolutions.com" target="_blank">ian.walls@bywatersolutions.com</a><br>Twitter: @sekjal<br>