Best way to handle authors?

[ioquatix]

The author in rack.gemspec is fine, but I believe it would be a good idea to remove the personal email address (this is also a security issue).

I would personally like to list all active maintainers at the time of a release in the authors field, but I respect this might be challenging/cumbersome.

We could just set the author field to s.author = 'Leah Neukirchen' as it is, but should we replicate that as we split the gem up? i.e. rack-session and rack-mock gems etc. The other option is to use whomever creates the gem as the author, but that also doesn't seem to respect the lineage of the code very well.

Another option is to remove the field entirely? Can we release a Ruby gem without any author listed explicitly? We still call out contributors and alumni in the readme.

I'll also check what Rails does as they should have a similar problem I guess.

cc @leahneukirchen @raggi @tenderlove @jeremyevans @scytrin @josh

[ioquatix]

I checked Rails, and they list DHH as the gem author and no one else, who is also listed in the MIT-LICENSE without anyone else.

I personally think this can be a bit confusing as everyone who contributed has a Copyright, yet this isn't clearly reflected in the license. However I'm unsure about the technicalities/implications. I normally request any significant contribution to add themselves to the LICENSE file/section.

Would appreciate any guidance you might all have regarding this.

[matthewd]

Personally I lean towards an "[original author] and contributors" style (or even just "[project] authors" for a new project).

A full list gets unwieldy, and removing an existing named author -- especially an originating author -- is [appropriately] fraught. (The field is labelled "authors", not "active maintainers" -- and rubygems.org has a separate 'owners' concept that more directly maps to the latter.)

[ioquatix]

When I first came to maintain rack the list of owners was out of date, the main issue being inactive users without 2FA and insecure accounts. It makes someone hijacking a gem much more likely. So owners should be limited because it’s a security liability.

[jeremyevans]

I don't have strong feelings about authors in gemspec. It's required, so you cannot remove it (https://guides.rubygems.org/specification-reference/). Leaving it as-is seems fine, but I don't object to changes.

in terms of the LICENSE, I don't think we need to worry about people adding themselves there. The actual copyright information is contained in the repository history.

[leahneukirchen]

In all these years, having my email there never was a problem, but I'm also ok with changing the author to rack-core or something.

[ioquatix]

There is a (security) reason why RubyGems no longer publishes user email addresses. I’ve been asked not to discuss it in detail.

[raggi]

I find that reasoning very concerning, because I can't imagine what the issue is. The git history is full of email addresses, getting author emails for gems that mention GitHub will remain trivial in most cases. Given that you can't discuss what it is, I think it should not be mentioned or considered further in this discussion.

I think Leah's suggestion to use rack-core makes a lot of sense. It provides a means for contact.

[ioquatix]

Yeah, I'd be fine with using some place holder for the entire team/authors/contributors, "Awesome Rack Contributors" or something similar.

[ioquatix]

Based on the discussion we had here, for rack-session I'm going to start with:

s.author = "Rack Contributors"

Is everyone happy with that?