Hi,
We have some of our content currently hosted on gitorious.org that we mirror from git.centos.org - the intention being that git.centos.org is still the authority, but people can use the easier contribution path at gitorious to build karma and then get direct git commit access at git.centos.org
since gitorious is going away, what are everyone's thoughts to consolidating all of this external contribution path on github.com/CentOS - we already host a bunch of content there.
Regards
Keep git.centos.org as authority, use github instead of gitorious; everybody is there already anyway.
Lucian
-- Sent from the Delta quadrant using Borg technology!
Nux! www.nux.ro
----- Original Message -----
From: "Karanbir Singh" kbsingh@centos.org To: "The CentOS developers mailing list." centos-devel@centos.org Sent: Thursday, 5 March, 2015 11:30:38 Subject: [CentOS-devel] moving from gitorious
Hi,
We have some of our content currently hosted on gitorious.org that we mirror from git.centos.org - the intention being that git.centos.org is still the authority, but people can use the easier contribution path at gitorious to build karma and then get direct git commit access at git.centos.org
since gitorious is going away, what are everyone's thoughts to consolidating all of this external contribution path on github.com/CentOS - we already host a bunch of content there.
Regards
-- Karanbir Singh, Project Lead, The CentOS Project +44-207-0999389 | http://www.centos.org/ | twitter.com/CentOS GnuPG Key : http://www.karan.org/publickey.asc _______________________________________________ CentOS-devel mailing list CentOS-devel@centos.org http://lists.centos.org/mailman/listinfo/centos-devel
On 03/05/2015 05:58 AM, Nux! wrote:
Keep git.centos.org as authority, use github instead of gitorious; everybody is there already anyway.
Lucian
+1 from me
----- Original Message -----
From: "Karanbir Singh" kbsingh@centos.org To: "The CentOS developers mailing list." centos-devel@centos.org Sent: Thursday, 5 March, 2015 11:30:38 Subject: [CentOS-devel] moving from gitorious
Hi,
We have some of our content currently hosted on gitorious.org that we mirror from git.centos.org - the intention being that git.centos.org is still the authority, but people can use the easier contribution path at gitorious to build karma and then get direct git commit access at git.centos.org
since gitorious is going away, what are everyone's thoughts to consolidating all of this external contribution path on github.com/CentOS - we already host a bunch of content there.
Regards
-- Karanbir Singh, Project Lead, The CentOS Project
On Thu, Mar 5, 2015 at 7:26 AM, Johnny Hughes johnny@centos.org wrote:
On 03/05/2015 05:58 AM, Nux! wrote:
Keep git.centos.org as authority, use github instead of gitorious; everybody is there already anyway.
Lucian
+1 from me
I appreciate github and use it a great deal. (Look over there for my daemontools, rt4 for RHEL 6, samb 4 for CentOS 6, and other toolkits.) And repoforge also used it effectively. I'm delighted to see it suggested, and suspect it will be much, much faster to pull from github.com than it generally is from git.centos.org.
However, we're right back to the problem I mentioned when I first saw git.centos.org: "provenance". If all CentOS and upstream RHEL source is published on a central website, one can try to verify the chain of ownership and verify the source by verifying it directly against that central repository with its owned SSL certificate and the chain of trust there. As soon as people are cloning from there to another site, and cloning off of those instead of against the central repository, you have a potentially risky step on any third party hosted repository. And you have an expensive verification step to *keep checking it against the central repo*.
So, how can we make sure that what is at github.com actually matches what came from git.centos.org? Especially since the information about what actually went into a SRPM is a log message, tied to a revision that can be excluded and replaced or corrupted in a third party hosted clone?
Oh, right! It's already there. GPG signed git tags are a core git facility, CentOS buld systems already handle GPG tags to sign the SRPM's they build, and it already does what the "git log" interpretation tools tried to do and which they cannot provide for the growing number of git mirrors and third-party hosted repositoryes. I hope this provides a solid reason to activate real tags. It should be possible to do on top of the existing structure without altering the existing logs at all.
Nico Kadel-Garcia
----- Original Message -----
From: "Karanbir Singh" kbsingh@centos.org To: "The CentOS developers mailing list." centos-devel@centos.org Sent: Thursday, 5 March, 2015 11:30:38 Subject: [CentOS-devel] moving from gitorious
Hi,
We have some of our content currently hosted on gitorious.org that we mirror from git.centos.org - the intention being that git.centos.org is still the authority, but people can use the easier contribution path at gitorious to build karma and then get direct git commit access at git.centos.org
since gitorious is going away, what are everyone's thoughts to consolidating all of this external contribution path on github.com/CentOS - we already host a bunch of content there.
Regards
-- Karanbir Singh, Project Lead, The CentOS Project
CentOS-devel mailing list CentOS-devel@centos.org http://lists.centos.org/mailman/listinfo/centos-devel
On 03/05/2015 08:31 AM, Nico Kadel-Garcia wrote:
On Thu, Mar 5, 2015 at 7:26 AM, Johnny Hughes johnny@centos.org wrote:
On 03/05/2015 05:58 AM, Nux! wrote:
Keep git.centos.org as authority, use github instead of gitorious; everybody is there already anyway.
Lucian
+1 from me
I appreciate github and use it a great deal. (Look over there for my daemontools, rt4 for RHEL 6, samb 4 for CentOS 6, and other toolkits.) And repoforge also used it effectively. I'm delighted to see it suggested, and suspect it will be much, much faster to pull from github.com than it generally is from git.centos.org.
However, we're right back to the problem I mentioned when I first saw git.centos.org: "provenance". If all CentOS and upstream RHEL source is published on a central website, one can try to verify the chain of ownership and verify the source by verifying it directly against that central repository with its owned SSL certificate and the chain of trust there. As soon as people are cloning from there to another site, and cloning off of those instead of against the central repository, you have a potentially risky step on any third party hosted repository. And you have an expensive verification step to *keep checking it against the central repo*.
So, how can we make sure that what is at github.com actually matches what came from git.centos.org? Especially since the information about what actually went into a SRPM is a log message, tied to a revision that can be excluded and replaced or corrupted in a third party hosted clone?
Oh, right! It's already there. GPG signed git tags are a core git facility, CentOS buld systems already handle GPG tags to sign the SRPM's they build, and it already does what the "git log" interpretation tools tried to do and which they cannot provide for the growing number of git mirrors and third-party hosted repositoryes. I hope this provides a solid reason to activate real tags. It should be possible to do on top of the existing structure without altering the existing logs at all.
You can't .. you just need to trust us, or use something else
Nico Kadel-Garcia----- Original Message -----
From: "Karanbir Singh" kbsingh@centos.org To: "The CentOS developers mailing list." centos-devel@centos.org Sent: Thursday, 5 March, 2015 11:30:38 Subject: [CentOS-devel] moving from gitorious
Hi,
We have some of our content currently hosted on gitorious.org that we mirror from git.centos.org - the intention being that git.centos.org is still the authority, but people can use the easier contribution path at gitorious to build karma and then get direct git commit access at git.centos.org
since gitorious is going away, what are everyone's thoughts to consolidating all of this external contribution path on github.com/CentOS - we already host a bunch of content there.
Regards
-- Karanbir Singh, Project Lead, The CentOS Project
CentOS-devel mailing list CentOS-devel@centos.org http://lists.centos.org/mailman/listinfo/centos-devel
----- Original Message -----
From: "Karanbir Singh" kbsingh@centos.org To: "The CentOS developers mailing list." centos-devel@centos.org Sent: Thursday, March 5, 2015 3:30:38 AM Subject: [CentOS-devel] moving from gitorious
Hi,
We have some of our content currently hosted on gitorious.org that we mirror from git.centos.org - the intention being that git.centos.org is still the authority, but people can use the easier contribution path at gitorious to build karma and then get direct git commit access at git.centos.org
since gitorious is going away, what are everyone's thoughts to consolidating all of this external contribution path on github.com/CentOS - we already host a bunch of content there.
+1
Regards
-- Karanbir Singh, Project Lead, The CentOS Project +44-207-0999389 | http://www.centos.org/ | twitter.com/CentOS GnuPG Key : http://www.karan.org/publickey.asc _______________________________________________ CentOS-devel mailing list CentOS-devel@centos.org http://lists.centos.org/mailman/listinfo/centos-devel
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1
On 03/05/2015 03:30 AM, Karanbir Singh wrote:
Hi,
We have some of our content currently hosted on gitorious.org that we mirror from git.centos.org - the intention being that git.centos.org is still the authority, but people can use the easier contribution path at gitorious to build karma and then get direct git commit access at git.centos.org
since gitorious is going away, what are everyone's thoughts to consolidating all of this external contribution path on github.com/CentOS - we already host a bunch of content there.
I'll give a +0 explained this way:
There is a risk with using GitHub's services under a few conditions:
* We get reliant on the proprietary workflow software. * We allow it to become a canonical source. * Our use of the service is seen as tacit or explicit support of their company or model of working with open source software.
On the first two points as long as we continue our practice of doing workflow using open source tools on *.centos.org (e.g. bugs.centos.org) while keeping git.centos.org canonical, then we continue to avoid the risk.
On the last point, the tide of practice is currently flowing another way (toward using a closed tool for open development), our using or not using the service won't really make much of a difference. Since the best thing about GitHub is the social coding (access to existing contributors who do stuff), the benefit to the CentOS Project is greater than the risk to our reputation and brand.
One thing we can do to keep mitigating the risks is to keep our eyes open for a future open development community that serves the same purposes and be willing to go there as well. Such as gitlab.com. :)
Regards,
- - Karsten - -- Karsten 'quaid' Wade .^\ CentOS Doer of Stuff http://TheOpenSourceWay.org \ http://community.redhat.com @quaid (identi.ca/twitter/IRC) \v' gpg: AD0E0C41
On 03/05/2015 09:26 PM, Karsten Wade wrote:
I'll give a +0 explained this way:
There is a risk with using GitHub's services under a few conditions:
- We get reliant on the proprietary workflow software.
- We allow it to become a canonical source.
- Our use of the service is seen as tacit or explicit support of their
company or model of working with open source software.
as we move from gitorious.org, so we can move from github should there be a need.
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1
On 03/06/2015 07:21 AM, Karanbir Singh wrote:
On 03/05/2015 09:26 PM, Karsten Wade wrote:
I'll give a +0 explained this way:
There is a risk with using GitHub's services under a few conditions:
- We get reliant on the proprietary workflow software. * We allow
it to become a canonical source. * Our use of the service is seen as tacit or explicit support of their company or model of working with open source software.
as we move from gitorious.org, so we can move from github should there be a need.
Thanks, yes, that's the gist of it.
I appreciate greatly that everyone here understands the value of open source and avoiding lock-in and such. I'll often make a point about such things just to "wave the flag" so to speak -- make a clear point in the public record about our stance on freedom, etc. So if people say, in this example, "Look, CentOS Project is embracing GitHub," we have a discussion thread to point to.
Regards,
- - Karsten - -- Karsten 'quaid' Wade .^\ CentOS Doer of Stuff http://TheOpenSourceWay.org \ http://community.redhat.com @quaid (identi.ca/twitter/IRC) \v' gpg: AD0E0C41
----- Original Message -----
From: "Karsten Wade" kwade@redhat.com To: centos-devel@centos.org Sent: Friday, March 6, 2015 11:57:24 AM Subject: Re: [CentOS-devel] moving from gitorious
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1
On 03/06/2015 07:21 AM, Karanbir Singh wrote:
On 03/05/2015 09:26 PM, Karsten Wade wrote:
I'll give a +0 explained this way:
There is a risk with using GitHub's services under a few conditions:
- We get reliant on the proprietary workflow software. * We allow
it to become a canonical source. * Our use of the service is seen as tacit or explicit support of their company or model of working with open source software.
as we move from gitorious.org, so we can move from github should there be a need.
Thanks, yes, that's the gist of it.
I appreciate greatly that everyone here understands the value of open source and avoiding lock-in and such. I'll often make a point about such things just to "wave the flag" so to speak -- make a clear point in the public record about our stance on freedom, etc. So if people say, in this example, "Look, CentOS Project is embracing GitHub," we have a discussion thread to point to.
Should we be more explicitly considering gitlab.com then? There's a conversion path from gitorious.
Jason
Regards,
- Karsten
Karsten 'quaid' Wade .^\ CentOS Doer of Stuff http://TheOpenSourceWay.org \ http://community.redhat.com @quaid (identi.ca/twitter/IRC) \v' gpg: AD0E0C41 -----BEGIN PGP SIGNATURE----- Version: GnuPG v1
iEUEARECAAYFAlT6BqQACgkQ2ZIOBq0ODEEeXQCXSPFoNecToWgwcbQ2Y/XWEW7+ FgCfeWTMxiJOzspMKh0VSFs5JQfNRxQ= =fjXi -----END PGP SIGNATURE----- _______________________________________________ CentOS-devel mailing list CentOS-devel@centos.org http://lists.centos.org/mailman/listinfo/centos-devel
On 03/06/2015 10:03 PM, Jason Brooks wrote:
Should we be more explicitly considering gitlab.com then? There's a conversion path from gitorious.
One thing that leaves a sour taste is that its the gitlab folks causing gitorious.org to shut down - it looks clearly like a move to consolidate a competitive resource.
Does gitlab.com give us anything more than git.centos.org ? If not, we might as well go where the users are.
Exactly. It's like choosing Vmware for your dev cloud after finding out they violate the GPL, maybe a too strong example, but you get the idea.
Everyone is on github already and the site has good functionality, it might probably be the single most important move to encourage contributions.
Yes, github is also one big SPOF, but use it for what it's best: collaboration, use git.centos.org for availability and authority.
/IMHO Lucian
-- Sent from the Delta quadrant using Borg technology!
Nux! www.nux.ro
----- Original Message -----
From: "Karanbir Singh" mail-lists@karan.org To: centos-devel@centos.org Sent: Saturday, 7 March, 2015 08:38:02 Subject: Re: [CentOS-devel] moving from gitorious
On 03/06/2015 10:03 PM, Jason Brooks wrote:
Should we be more explicitly considering gitlab.com then? There's a conversion path from gitorious.
One thing that leaves a sour taste is that its the gitlab folks causing gitorious.org to shut down - it looks clearly like a move to consolidate a competitive resource.
Does gitlab.com give us anything more than git.centos.org ? If not, we might as well go where the users are.
-- Karanbir Singh +44-207-0999389 | http://www.karan.org/ | twitter.com/kbsingh GnuPG Key : http://www.karan.org/publickey.asc _______________________________________________ CentOS-devel mailing list CentOS-devel@centos.org http://lists.centos.org/mailman/listinfo/centos-devel
On the GitLab blog it was stated that Gitorious wasn't profitable anymore.
Rolf Bjaanes, Gitorious CEO, gives some background on the reasons for the
acquisition: “At Gitorious we saw more and more organizations adopting GitLab. Due to decreased income from on-premises customers, running the free Gitorious.org was no longer sustainable. GitLab was solving the same problem that we were, but was solving it better.” “This acquisition will accelerate the growth of GitLab. With more than 100,000 organizations using it, it is already the most used on-premise solution for Git repository management, and bringing Gitorious into the fold will significantly increase that footprint.” says Sytse Sijbrandij, GitLab CEO. Starting today, Gitorious.org users can import their existing projects into GitLab.com by clicking the “Import projects from Gitorious.org” link when creating a new project. Gitorious.org will stay online until the end of May 2015 to give people time to migrate their repositories. Existing users of Gitorious on-premises can contact sales@gitlab.com for more information.
https://about.gitlab.com/2015/03/03/gitlab-acquires-gitorious/
GitLab can be hosted on-premises using their free and open source Community Edition.
2015-03-07 9:38 GMT+01:00 Karanbir Singh mail-lists@karan.org:
On 03/06/2015 10:03 PM, Jason Brooks wrote:
Should we be more explicitly considering gitlab.com then? There's a conversion path from gitorious.
One thing that leaves a sour taste is that its the gitlab folks causing gitorious.org to shut down - it looks clearly like a move to consolidate a competitive resource.
Does gitlab.com give us anything more than git.centos.org ? If not, we might as well go where the users are.
-- Karanbir Singh +44-207-0999389 | http://www.karan.org/ | twitter.com/kbsingh GnuPG Key : http://www.karan.org/publickey.asc _______________________________________________ CentOS-devel mailing list CentOS-devel@centos.org http://lists.centos.org/mailman/listinfo/centos-devel
Sorry for saying profitable, I mean sustainable.
2015-03-07 14:41 GMT+01:00 Jeroen de Neef jeroen52@gmail.com:
On the GitLab blog it was stated that Gitorious wasn't profitable anymore.
Rolf Bjaanes, Gitorious CEO, gives some background on the reasons for the
acquisition: “At Gitorious we saw more and more organizations adopting GitLab. Due to decreased income from on-premises customers, running the free Gitorious.org was no longer sustainable. GitLab was solving the same problem that we were, but was solving it better.” “This acquisition will accelerate the growth of GitLab. With more than 100,000 organizations using it, it is already the most used on-premise solution for Git repository management, and bringing Gitorious into the fold will significantly increase that footprint.” says Sytse Sijbrandij, GitLab CEO. Starting today, Gitorious.org users can import their existing projects into GitLab.com by clicking the “Import projects from Gitorious.org” link when creating a new project. Gitorious.org will stay online until the end of May 2015 to give people time to migrate their repositories. Existing users of Gitorious on-premises can contact sales@gitlab.com for more information.
https://about.gitlab.com/2015/03/03/gitlab-acquires-gitorious/
GitLab can be hosted on-premises using their free and open source Community Edition.
2015-03-07 9:38 GMT+01:00 Karanbir Singh mail-lists@karan.org:
On 03/06/2015 10:03 PM, Jason Brooks wrote:
Should we be more explicitly considering gitlab.com then? There's a conversion path from gitorious.
One thing that leaves a sour taste is that its the gitlab folks causing gitorious.org to shut down - it looks clearly like a move to consolidate a competitive resource.
Does gitlab.com give us anything more than git.centos.org ? If not, we might as well go where the users are.
-- Karanbir Singh +44-207-0999389 | http://www.karan.org/ | twitter.com/kbsingh GnuPG Key : http://www.karan.org/publickey.asc _______________________________________________ CentOS-devel mailing list CentOS-devel@centos.org http://lists.centos.org/mailman/listinfo/centos-devel
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1
On 06/03/15 20:57, Karsten Wade wrote:
On 03/06/2015 07:21 AM, Karanbir Singh wrote:
On 03/05/2015 09:26 PM, Karsten Wade wrote:
I'll give a +0 explained this way:
There is a risk with using GitHub's services under a few conditions:
- We get reliant on the proprietary workflow software. * We
allow it to become a canonical source. * Our use of the service is seen as tacit or explicit support of their company or model of working with open source software.
as we move from gitorious.org, so we can move from github should there be a need.
Thanks, yes, that's the gist of it.
I appreciate greatly that everyone here understands the value of open source and avoiding lock-in and such. I'll often make a point about such things just to "wave the flag" so to speak -- make a clear point in the public record about our stance on freedom, etc. So if people say, in this example, "Look, CentOS Project is embracing GitHub," we have a discussion thread to point to.
Regards,
- Karsten
Hi Karsten,
Yeah, and the reason why we used Gitorious instead of GitHub in the past, for the t_functional git repo, was the fact that the underlying platform/tool behind gitorious was open-source, while github isn't.
Now that Gitorious is shutting down, and that in the meantime we have several git repositories hosted under github.com/CentOS, all those facts lead me to the simple conclusion that hosting now t_functional under Github.com/CentOS makes just sense. (and it seems collaboration on github is easy, as we got several PR on those git repositories, while very few on gitorious, probably because almost everybody had an account on github, but not on gitorious)
Now, a longer debate around "do we have to move from Github to something else" is then another debate, but wider than the "t_functional repository needs to move now from gitorious"
So, I'd say "+1" on the move to github (short-term) - --
Fabian Arrotin The CentOS Project | http://www.centos.org gpg key: 56BEC54E | twitter: @arrfab
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1
On 07/03/15 14:27, Fabian Arrotin wrote:
On 06/03/15 20:57, Karsten Wade wrote:
<snip>
Now that Gitorious is shutting down, and that in the meantime we have several git repositories hosted under github.com/CentOS, all those facts lead me to the simple conclusion that hosting now t_functional under Github.com/CentOS makes just sense. (and it seems collaboration on github is easy, as we got several PR on those git repositories, while very few on gitorious, probably because almost everybody had an account on github, but not on gitorious)
Now, a longer debate around "do we have to move from Github to something else" is then another debate, but wider than the "t_functional repository needs to move now from gitorious"
So, I'd say "+1" on the move to github (short-term)
Trying to resurrect that thread a little bit.
If nodoby has real objection/doesn't mind about moving from gitorious to github, I'll proceed to that migration in the following days (as Gitorious.org will shut down end of May) Please note that this concerns *only* the current tests ran for QA validation (aka t_functional - see https://gitorious.org/testautomation/t_functional/), so we're not speaking about the srpms/source/spec/etc that are on git.centos.org (which will remain authoritative, and also from where the QA hosts are fetching t_functional from)
Cheers,
- --
Fabian Arrotin The CentOS Project | http://www.centos.org gpg key: 56BEC54E | twitter: @arrfab
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1
On 06/05/15 14:15, Fabian Arrotin wrote:
On 07/03/15 14:27, Fabian Arrotin wrote:
On 06/03/15 20:57, Karsten Wade wrote:
<snip>
Now that Gitorious is shutting down, and that in the meantime we have several git repositories hosted under github.com/CentOS, all those facts lead me to the simple conclusion that hosting now t_functional under Github.com/CentOS makes just sense. (and it seems collaboration on github is easy, as we got several PR on those git repositories, while very few on gitorious, probably because almost everybody had an account on github, but not on gitorious)
Now, a longer debate around "do we have to move from Github to something else" is then another debate, but wider than the "t_functional repository needs to move now from gitorious"
So, I'd say "+1" on the move to github (short-term)
Trying to resurrect that thread a little bit.
If nodoby has real objection/doesn't mind about moving from gitorious to github, I'll proceed to that migration in the following days (as Gitorious.org will shut down end of May) Please note that this concerns *only* the current tests ran for QA validation (aka t_functional - see https://gitorious.org/testautomation/t_functional/), so we're not speaking about the srpms/source/spec/etc that are on git.centos.org (which will remain authoritative, and also from where the QA hosts are fetching t_functional from)
Cheers,
Status update :
t_functional git repo is now available here : https://github.com/CentOS/sig-core-t_functional
The http://wiki.centos.org/QaWiki/AutomatedTests/WritingTests/t_functional wiki page has been updated to reflect that change, as well as Jenkins jobs on http://ci.dev.centos.org
- --
Fabian Arrotin The CentOS Project | http://www.centos.org gpg key: 56BEC54E | twitter: @arrfab
-
Christoph Galuschka -
Fabian Arrotin -
Jason Brooks -
Jeroen de Neef -
Johnny Hughes -
Karanbir Singh -
Karanbir Singh -
Karsten Wade -
Nico Kadel-Garcia -
Nux!