Is it possible to lock publish contract with set permission?

Question

Is it possible to setup a lock (multisig) for the command cleos set contract ? in order to request one or more signatures to deploy a contract ?

cleos set action permission eosio eosio  set  permission

Answer 1

Yes this is possible. Consider the following account key structures:

• Owner
  • Active
    • Deployer

and

• Owner
  • Active
  • Deployer

In the first example, if you give the Deployer key the ability to execute the set contract function, Owner, Active and deployer will be able to execute the set contract action. (Note, the Deployer key is a child to the Active key)

In the second example, if you give the Deployer key the ability to execute the set contract function, only Owner and Deployer will be able to execute that action. You can then configure the Deployer key to do all the fancy multi-sig stuff you would like. (Note, the Deployer key here is a child to the Owner key & sibling of the Active key).

tl;dr : If you give permissions to a custom key which is a child to the Active key, both keys will be able to execute the tx. If you're custom key and the active key are siblings (same parent), the custom key will be able to execute the tx, but the active key will not.