OWNERS *must* be committers, by policy: https://chromium.googlesource.com/chromium/src/+/master/docs/code_reviews.md#OWNERS-files

That doc also says:

> Seldom-updated directories may have exceptions. Directories in third_party should list those most familiar with the library.

Which exactly matches the related case.

Aaron, please see my previous comment.

That exception is for requirements like "Have committed or reviewed substantial work to the affected directory within the last 90 days" and "Have submitted a substantial number of non-trivial changes to the affected directory", which are obviously not true for a third-party library which is barely- or un-modified and seldom updated.

That exception does not apply to the requirement to be a committer.

agable@, it is not clear to me at all that this exception does not apply to that requirement in particular, but applies to others. Certainly, it's not written anywhere in that document. Can you update the doc to make it clear what this exception apply to?

> "Have submitted a substantial number of non-trivial changes to the affected directory", which are obviously not true for a third-party library which is barely- or un-modified and seldom updated.

The reason I am an owner of protobuf is precisely because updating protobuf requires some non-trivial work and expertise.

...and I've been doing protobuf updates in the past (sent the comment to early).

Aaron, ping.

Yep, happy to update the doc to make the situation clearer: https://canary-chromium-review.googlesource.com/c/chromium/src/+/754381

There are two good paths forward here that I see:
1) Become a committer
2) Pull third_party/protobuf into a separate repo, which can have its own committers list and you in the OWNERS file, and then simply submit DEPS rolls when appropriate.

Please recognize that the reason we have to restrict the ability to CR+1 changes is that the ability to do so is equivalent to direct Write access to the repository, albeit with a better audit trail. We are an open source project, and cannot grant that permission broadly, unlike Google's internal codebases which can grant wide-reaching access to all employees precisely because they're employees. And because we value being an open-source project, we don't even grant CR+1 permission to all Googlers: employees have to earn the right to be a committer just like everyone else.