I think this could be easier and probably safer if we use the @fedoraproject.org email alias, i.e. user["email_hash"].
That way we don't have to randomly pick one email if the user has multiple address associated and the avatar remains associated to just the Fedora username - if the user changes their email they don't have to update libravatar association.

If that's ok, I can submit a one line change PR (user["openid_hash"] = user["email_hash"])

@mattia +1

The @fedoraproject.org e-mail alias is unique and doesn't change for the user.

But do note that the alias itself only exists for 'fedora-contributors' (ie, in at least one non fpca group.

I don't know if there's any email flow here... when creating a libravatar account?

oh, yes, it makes sense that a confirmation email is sent when adding a new email or upon registration.
Looking at the code, that don't happen when using the "login with Fedora" button, but if I read it right OIDC will just register the new user with the email set in FAS, not the @fedoraproject.org e-mail alias.

So users which are not part of 'fedora-contributors' will not be able to set their @fedoraproject.org e-mail alias.

Unless a change is made in libravatar, so that logging in with Fedora will register the user with the fedoraproject alias instead of their real email... I think this would also avoid the trouble of setting up the avatar every time a user change their email in FAS, as the avatar will be bonded to the Fedora username.

Triaging old tickets.

I wonder... perhaps we should just drop the avatars there? They are pretty small on the page, I am not sure how much they add to things anyhow?

This issue has been migrated to Fedora Forge:
https://forge.fedoraproject.org/infra/tickets/issues/12471

Please continue any further discussion there.