Mailing-List: contact general-help@incubator.apache.org; run by ezmlm
Precedence: bulk
Reply-To: general@incubator.apache.org
MIME-Version: 1.0
In-Reply-To: <1903368573.246127.1476452236478@mail.yahoo.com>
References: <c377204a-071c-903a-a2a1-2178bb793a81@intertwingly.net>
 <CABD8fLUHK0rJt1tgjw5Vbyd3mFBe6=Xaj-s8mXLpWM_1-+T+TA@mail.gmail.com>
 <CAFG6u8FcRhx=WEsCKExCVZ8uWPY5EdD4bjtiJggGO-CBo33fSg@mail.gmail.com>
 <CAOqetn_Ys7c6ncyaLiQ1yPKPko4s2_SGh8VopAk2bCGuRaizfA@mail.gmail.com>
 <9A5D707E-3313-4E6A-9994-8B476517E19B@adobe.com> <1903368573.246127.1476452236478@mail.yahoo.com>
From: Greg Stein <gstein@gmail.com>
Date: Fri, 14 Oct 2016 09:26:23 -0500
Message-ID: <CABD8fLXB7KKdvGcvoDi7uxmrTT6WUKz5VTNfyHq9uh9dRwVh1g@mail.gmail.com>
Subject: Re: [discuss] Apache OpenWhisk Incubator Proposal
To: general@incubator.apache.org, Mark Struberg <struberg@yahoo.de>
Content-Type: multipart/alternative; boundary=001a11449684c316d0053ed40270
archived-at: Fri, 14 Oct 2016 14:26:31 -0000

--001a11449684c316d0053ed40270
Content-Type: text/plain; charset=UTF-8

On Fri, Oct 14, 2016 at 8:37 AM, Mark Struberg <struberg@yahoo.de.invalid>
wrote:

> The problem with github is that we (ASF) cannot give any guarantees if the
> main stuff doesn't originate from our own hardware.
>

Git repositories are effectively cryptographically-signed (weak/strong,
immaterial to this discussion), so a readonly mirror on ASF hardware is
equivalent to a read/write repository living on GitHub.


> Not whether the ticket system doesn't loose all tickets (didn't that
> happen in the past?) nor whether really only IP clean stuff got committed.
>

All commits, issues, PRs, etc will/must be sent to ASF mailing lists for
archival. Some projects do/have used third party systems. The ASF doesn't
mind, as long as we capture that work into our archives.


> You e.g. have no clue if someone else uses your email and name in a commit
> and pushes it.
> Everyone else can create a commit with your email and name in GIT, there
> is no check. And when pulling in changes, a faked one might get piggy
> packed and introduce a backdoor. I know this might be close to paranoid but
> it is theoretically possible.
>

We require that anybody committing to a GitHub repository authenticates
with BOTH: GitHub, and the ASF. No commits without that multiple
authentication.
(this is based on our current experiments with Whimsy and Traffic Server;
same rules would apply to this podling)


> The workflow with git hosted @ASF is btw pretty much exactly the same for
> committers. And a PR integration does exist as well. So I don't see what
> you miss?
>

ASF repositories mirrored to GitHub cannot merge/close PRs. They cannot
manage issues. They cannot use labels. There is a large amount of GitHub
tooling that is not available to ASF-based projects/workflows. The Github
repository is a simple mirror. ... OpenWhisk proposes to continue using
their GitHub workflows and tooling during incubation. At the *end* of
incubation, the Foundation will allow them to stay (as we'll be allowing
other projects to similarly change their focal point of development), or
they will be required to shift their focal point to ASF-based workflows (as
we require today).

Cheers,
-g

--001a11449684c316d0053ed40270--