Mailing-List: contact esme-dev-help@incubator.apache.org; run by ezmlm
Precedence: bulk
Reply-To: esme-dev@incubator.apache.org
MIME-Version: 1.0
In-Reply-To: <fa2d9f450908210311n1718459ala2b06594a86dcd84@mail.gmail.com>
References: <f767f0600908190121s37e66e72o132a1611ec76ffe3@mail.gmail.com>
	 <cdbebedf0908190851o26372e49pbc3e744423dd5d53@mail.gmail.com>
	 <3d89f1770908210115q1b7e4709v1d1da7fd656bea97@mail.gmail.com>
	 <f767f0600908210154v6baa684bi7c85bbf9fb3dd8de@mail.gmail.com>
	 <fa2d9f450908210311n1718459ala2b06594a86dcd84@mail.gmail.com>
Date: Fri, 21 Aug 2009 13:47:44 +0200
Message-ID: <f767f0600908210447s6608a59fyaf06e0ce8900034c@mail.gmail.com>
Subject: Re: ESME at GitHub (was: Turtles all the way down (or how I learned
	to love math in computing)
From: Bertrand Delacretaz <bdelacretaz@apache.org>
To: esme-dev@incubator.apache.org
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable

On Fri, Aug 21, 2009 at 12:11 PM, Richard Hirsch<hirsch.dick@gmail.com> wro=
te:
> ...What I don't quite understand is the problem - =C2=A0"git vs apache sv=
n" or
> "github vs apache svn"?...

Where the problem lies from the ASF point of view (omitting community
issues such as "stuff happening outside of the ASF world" for a
while), is in having a defined link from each line of committed code
to its author.

The idea is that code should only be committed to svn by its original
author, or from a JIRA contribution where the author has explicitely
granted permission.

Depending on how git or github are used (or any source code control
system outside of the ASF for that matter), code might be pulled in
from unknown people, and later committed to our svn without the
committer being the author of said code, and without the explicit
permission granted when attaching a patch to JIRA.

That's the core problem, and AFAIK (though I'd love to be proven
wrong, as distributed SCM and branching-like-mad is very cool),
there's no cryptographically safe way with git to verify the identity
of the original committer.

Restricting git pulls to ESME committers, as David suggests, would be
better by making sure no code from non-ASF committers is included.
Still, the final svn commits might contain code written by other
committers than whoever's committing to SVN, which is also a bit
problematic.

>
> I also don't know why we can't use the git instructions described at
> http://wiki.apache.org/general/GitAtApache.

That would be perfectly fine from the ASF's point of view, but AFAIK
that doesn't provide the full flexibility of git such as fast and easy
branching and merging.

-Bertrand