I have a request from a developer who implemented an updated jinja2 template for roundup
(see issue2551308).

He would like to publish the template on sourceforge under the roundup umbrella.

It looks like it's possible to do this. I have created a test mercurial (could be
git if we decide that's a better choice for 3rd party) repo at
https://sourceforge.net/p/roundup/templates/ref/default/.

I don't want to create/manage multiple third party repos. I am also concerned about
the security model for this. A DVCS is pretty much full access to everything.
I don't think publishing multiple tracker templates into one DVCS repo will
work. Unlike with centralized repos (SVN) we can't restrict access to a subpath
in the repo.

We also have governance issues. If a template is broken, what do we do?
It's under our namespace so we have some responsibility for it. Similar
issue for abandoned templates. Keeping our currently supplied templates up to
date is difficult enough.

New issues are cc'ed to the roundup-devel list IIRC. I'll bring this up
separately as well if needed.

I am able to add a hook to the repo on sf.net to prevent commits outside
a specified subdirectory for certain users.

But this would still leave the other aspects you mentioned, so I would
recommend applying the usual criteria for allowing push access, e.g. a
track record of being active in Roundup development instead of just
being a one-time contributor.