In recent days, our distribution has experienced several disruptions that we need to inform our community about to maintain full transparency.
Davide Beatrici, known for his work on the instant messaging app
Mumble, joined our distribution some time ago. The team had no hesitation in trusting him; after all, he was such a well-known figure that we didn’t expect anything bad. Although Davide didn’t make many contributions to the system, he offered to migrate our repository infrastructure from GitHub to his private instance, OneDev. He even performed a backup/mirror of several dozen of our repositories. Some of the team had mixed feelings, as we didn’t want to place our repository in the private hands of one person, we preferred a publicly available infrastructure like GitHub currently has.
Two other people joined the distribution along with Davide. And that’s where the problem began. After a while, one of them began to behave in abusive ways towards certain users and members of the distribution. Some people left the distribution because of this behavior. We didn’t know about every incident immediately, as many of these hateful behaviors occurred in PMs. However, the series didn’t end there, and when another person was attacked in our chat and on GitHub, I decided to take action and kicked the attacker out of the chat.
I didn’t ban him, just kicked him out of one of the chat (specifically, the matrix chat for the OpenMandriva-Cooker channel). We didn’t forbid him from further collaboration and didn’t impose a ban on him. Although, in retrospect, I personally regret not reacting sooner, as these steps should have been taken when some people left the distribution because of him - for which I apologize to everyone affected by this aggressive behavior
This triggered a cascade of events. In protest, two people left the distribution, including Davide, a friend of the attacker.
No longer seeing any point in maintaining a mirror to Davide’s private infrastructure, I decided to sever the connection (at least some of the mirrors that were in the packages of which I am maintainer).
This infuriated Davide so much that, abusing of the administrative privileges he still had, he sabotaged the distribution today in the early morning hours.
He deleted part of our repository from GitHub—things we’d been working on for many years, and I myself had been working on for a decade (specifying that the decade will end in September 2026). Davide also decided to publish an empty package in the cooker repository, which obsoleted all gnome and cosmic packages, which could have damaged the systems of people using gnome or cosmic.
We are currently working to restore the deleted repositories and restore the functionality of the obsolete packages.
We are writing this to be transparent with the community and to warn the open source community about Davide Beatrici (known for his work on the Mumble project, among other things) so they don’t repeat our mistakes.
We understand that Davide’s actions were unacceptable and shameful, and that we could have pursued legal action because Davide’s actions constituted a criminal offense, but we have decided not to do so.
We performed a full system audit and, aside from the removed packages, we found no other violations.
