OpenMandriva Says Ex-Contributor Deleted Years of Repository Work and Sabotaged Its Cooker Branch

Overview

The OpenMandriva Linux project says a former contributor used administrative access he still held to delete part of its GitHub repository history and publish a broken package into its rolling development branch, in what the project is calling an attempted act of “distribution sabotage.” In a forum statement posted July 8, 2026 by a maintainer using the handle AngryPenguin, OpenMandriva said “our distribution has experienced several disruptions that we need to inform our community about,” and named the former contributor as Davide Beatrici, a developer previously known for his work on the Mumble instant-messaging application, according to BleepingComputer.

What We Know

Beatrici had gained trusted status on the project after offering to migrate OpenMandriva’s repository infrastructure from GitHub to his privately operated OneDev instance, mirroring several dozen repositories in the process, according to The Register. OpenMandriva’s own statement said: “The team had no hesitation in trusting him; after all, he was such a well-known figure.”

The dispute began after two other contributors joined the project alongside Beatrici, and one of them “began to behave in abusive ways towards certain users and members of the distribution,” per the forum statement — conduct The Register described as “repeated abusive behavior toward users and project members, much of it in private messages.” AngryPenguin wrote that after the behavior continued, “I decided to take action and kicked the attacker out” of the project’s Matrix chat. In protest, two people then resigned from the distribution, “including Davide, a friend of the attacker,” the statement said.

After OpenMandriva began disconnecting from the private repository mirror Beatrici had set up, the statement says the situation escalated: “This infuriated Davide so much that, abusing of the administrative privileges he still had, he sabotaged the distribution today in the early morning hours.” According to the forum post, Beatrici “deleted part of our repository from GitHub — things we’d been working on for many years, and I myself had been working on for a decade,” and “also decided to publish an empty package in the cooker repository, which obsoleted all gnome and cosmic packages,” an action OpenMandriva said “could have damaged the systems of people using gnome or cosmic.”

Cooker is OpenMandriva’s rolling development branch rather than a stable release, so the practical damage “appears to have been confined to bleeding-edge users,” per The Register. OpenMandriva says it is restoring the deleted repositories and repairing the affected packages, and that a full system audit found “no other violations” beyond the removed packages, according to Linuxiac.

Despite calling the conduct criminal, OpenMandriva said it will not pursue legal action. “We understand that Davide’s actions were unacceptable and shameful, and that we could have pursued legal action because Davide’s actions constituted a criminal offense, but we have decided not to do so,” the project said, as quoted by FOSS Force.

Beatrici disputed the sabotage characterization in comments reported by BleepingComputer. “Let me state right away that this was by no means a ‘sabotage,’” he said. “The objective was not to harm the distribution I cared for and contributed to for the past 3 years.” He said the underlying conflict was “triggered by a few members of the project who did not agree with OpenMandriva’s focus on KDE and LXQt.”

What We Don’t Know

OpenMandriva’s statement does not name the other contributor removed from its Matrix chat for abusive behavior, nor the second person who resigned alongside Beatrici. The project has not published a full technical accounting of every repository or file affected beyond the GitHub deletions and the empty Cooker package, and it is unclear whether the restoration work is complete.

Analysis

The episode underscores a recurring governance risk in volunteer-run open source projects: infrastructure control concentrated in a single trusted contributor can become a liability once a personal dispute turns adversarial. OpenMandriva’s own account shows the project was aware of the risk when Beatrici first proposed mirroring its repositories to his private OneDev instance, but proceeded anyway on the strength of his reputation — a decision the project is now unwinding under public scrutiny.