Federation?

SPI is looking at this to possibly help with their reimbursement tracking needs.

If Debian runs one instance, they'd want to be able to store the SPI-related requests on their side for the future. This implies some sort of federation / mirroring / export.

My initial thoughts: Federation is non-trivial, but not impossible. Simpler would be one-way export / mirror / log to SPI.

With the current approach, SPI needs access to set up access and exports from every instance that any project runs. That doesn't scale amazingly.