holy fuck this is awful. anyone requiring this nonsense is gatekeeping. sorry to break it to you.
I have a blog post about doing this here but it doesn't cover using OAuth2 which is definitely a better strategy. It turns out, you can do that, but it's painful:
the one (1) time i actually did try to contribute something, it took months to get accepted to the mailing list and the patch has been languishing unacknowledged for 3 months now (also it's a cvs-based project so there's nothing as easy as git-send-email for sending the patch)
