How Debian Account Managers Grant Developer Status

The Debian Account Manager (DAM) holds the ultimate authority in deciding whether an applicant is granted official Debian Developer (DD) status. While prospective developers undergo a comprehensive review process with an assigned Application Manager (AM) and the New Member Front Desk, the DAM reviews all accumulated evidence, evaluates the applicant's identity and commitment to Debian's principles, and exercises final discretion before provisioning official project credentials.

The New Member Pipeline Preceding DAM Review

Before reaching the DAM, an applicant must progress through the structured New Member (NM) process. An applicant secures an endorsement from an existing Debian Developer (an advocate), works with an assigned Application Manager to complete checks on philosophy, procedures, and technical skills, and submits their portfolio of work.

Once the AM is satisfied, they produce a detailed final report summarizing the candidate’s answers, packaging track record, or non-packaging contributions. This report passes through the New Member Front Desk for procedural verification. Only after the Front Desk approves the file is it formally handed over to the DAM for final determination.

Identity Verification and the Web of Trust

A primary requirement evaluated by the DAM is the absolute verification of the applicant's identity. Debian relies on OpenPGP keys to secure its archive and communications:

  • Cryptographic Signatures: The candidate's OpenPGP key must be signed by at least two existing Debian Developers (or meet project-defined trust path alternatives).
  • Key Hygiene: The DAM checks that the key adheres to Debian's current cryptographic standards, verifying proper key lengths, secure digest algorithms, and valid subkeys.
  • Revocation and Ownership: The DAM ensures the applicant has full control over the key and maintains a valid revocation certificate to safeguard the infrastructure in the event of compromise.

Philosophy, Procedures, and Cultural Alignment

The DAM inspects the applicant's understanding of Debian's core governing documents. Technical proficiency alone is insufficient; developers hold voting rights and shape the project's direction. The DAM verifies that the applicant genuinely accepts and comprehends:

  • The Debian Social Contract: The commitment that Debian will remain 100% free and that the project prioritizes users and free software above all else.
  • The Debian Free Software Guidelines (DFSG): The precise criteria used to define what qualifies as free software.
  • Project Governance: The mechanics of the Debian Constitution, General Resolutions, and standard operating procedures across development teams.

The DAM reviews the candidate's answers recorded in the AM's report to determine whether the applicant understands the rationale behind these guidelines rather than simply reciting them.

Evaluation of Contributions and Community Conduct

The DAM examines the candidate's historical interaction with the project to ensure they will be a constructive member of the Debian community. This assessment includes:

  • Sustained Technical Work: The applicant must demonstrate a consistent history of maintenance, bug fixing, documentation, translation, or infrastructure work, usually spanning several months or years.
  • Communication and Collaboration: The DAM assesses how the candidate handles technical disagreements on mailing lists, issue trackers, and IRC. Unprofessional conduct, disregard for consensus, or recurring conflicts can pause or terminate the approval process.

Final Discretion and Account Activation

The DAM operates as an independent project delegate appointed by the Debian Project Leader (DPL). By project charter, the DAM is not required to automatically rubber-stamp the Application Manager's recommendation.

Upon reviewing the dossier, the DAM makes one of three determinations:

  1. Approval: The DAM accepts the application, adds the applicant's OpenPGP key to the Debian keyring, registers their user profile in the Debian LDAP database, and assigns a @debian.org address along with appropriate upload or voting privileges.
  2. Request for Further Work: If the DAM finds deficiencies in technical depth, cryptographic trust, or procedural comprehension, the dossier is returned to the applicant or AM with specific requirements for additional work or time.
  3. Rejection: If the applicant demonstrates incompatibility with project goals, unresolved conduct issues, or fraudulent credentials, the DAM denies the account request.

Through this final independent review, the Debian Account Manager safeguards both the technical security of the operating system's software archive and the cooperative integrity of the Debian community.