From e59e95f9ef83e5d0fb42ec640e435800c054acb2 Mon Sep 17 00:00:00 2001 From: Ayla Croft Date: Wed, 23 Sep 2026 15:58:31 -0400 Subject: [PATCH] docs: two-factor authentication is required for write access The organisation now enforces two-factor authentication for every account with write access to this repository. Enforced rather than asked for: an account without it loses access instead of being reminded. Stated in GOVERNANCE.md rather than left as a setting nobody can see, because a project whose maintainers can be phished has no supply chain integrity whatever the rest of that document says. This is the OpenSSF Best Practices criterion require_2FA, which is a MUST at the gold level. MAINTAINERS.md also drops the note recording that one of the two invitations was pending acceptance. It has been accepted, so the note has done its job and the file now says what is true without a footnote about when it became true. Signed-off-by: Ayla Croft --- GOVERNANCE.md | 6 ++++++ MAINTAINERS.md | 6 +++--- 2 files changed, 9 insertions(+), 3 deletions(-) diff --git a/GOVERNANCE.md b/GOVERNANCE.md index 1972d81..72c78f9 100644 --- a/GOVERNANCE.md +++ b/GOVERNANCE.md @@ -19,6 +19,12 @@ If any one maintainer becomes unavailable, for any reason, the others hold the a keep the project running: each can create and close issues, accept proposed changes, and publish a release. Nothing in the ordinary workflow requires a specific individual. +Access is not given informally. Every account with write access to the repository must have +two-factor authentication enabled, and the organisation enforces that rather than asking for it: +an account without it loses access instead of being reminded. This is a requirement on the people +who can change what this project ships, and it is stated here because a project whose maintainers +can be phished has no supply chain integrity regardless of what the rest of this document says. + The exceptions are named here rather than left to be discovered. Administration of the GitHub organisation, the domain, and the security mailbox rest with the author. Restoring those to a surviving maintainer is a legal and administrative matter, not a technical one, and it is the first diff --git a/MAINTAINERS.md b/MAINTAINERS.md index 18bf150..05452cb 100644 --- a/MAINTAINERS.md +++ b/MAINTAINERS.md @@ -9,9 +9,9 @@ Three maintainers as of 2026-09-23, up from one. Any of them can accept a proposed change, close an issue and cut a release; administration of the GitHub organisation rests with the author. -Repository access for @mikehostetler was granted on 2026-09-23 and is pending acceptance at the -time of writing, which is recorded rather than glossed because a maintainers file is the sort of -document people check against the repository itself. + +**Two-factor authentication is required** for everyone with write access to this repository, +enforced by the organisation rather than asked for in a document. That asymmetry is written down rather than smoothed over, because "three maintainers" and "three people who can do everything" are different claims and only the first is true. `GOVERNANCE.md`