www-infrastructure-dev mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From Mark Struberg <strub...@yahoo.de>
Subject Re: Writable github repos?
Date Fri, 27 Jun 2014 20:50:17 GMT
as stated tons of times already.

There is imo one huge blocker: how to make sure that a pull request which subsequently contains
e.g. a commit from ke4qqq@apache.org is REALLY from you?

EVERYONE can create such a commit on github! There is NO authorization required! just git-config
the email and name. There is no GPG for commits in git, only for tags.

People pulling in changes will likely see 'oh a commit from David, fine' and will pull that
in. 

How to prevent that?

I asked this 4 years ago and there is still no good answer to it afaik. Without this solved
we CANNOT SUFFICIENTLY TRACK OUR CODE PROVENANCE! 

Or did I miss something?


... and sorry for yelling ;)


LieGrue,
strub



On Friday, 27 June 2014, 22:41, David Nalley <david@gnsa.us> wrote:
 

>
>
>Hi folks,
>
>Do you have a cup of coffee/tea handy? If not you might want to go get
>one first, this will be a long email with lots of pondering which
>would likely be assisted by a warm beverage.
>
>I am pondering whether it's possible for projects at the ASF to use
>github writable repos.
>
>Let me set the stage for what we have today with github:
>
>* We mirror hundreds of repositories to github [1]
>* We have a comprehensive integration with github [2]
>* A majority of projects that use git as their VCS are using the
>integration and using github as the locus for contribution.
>
>In the github integration model we essentially sync all of the
>happenings from github back to the projects mailing list. (and vice
>versa for those folks who choose to use the mailing list.)
>
>My personal preference is that the ASF is the locus for development
>activity; but I also want to be pragmatic and not force my preferences
>on all of the individual projects. I also recognize that we are part
>way there; by accepting contributions at github and using that
>workflow, we've moved in that direction a bit.
>
>That led me to wondering - what's keeping us from using a writable git
>repo? It's not without problems and challenges.
>
>So that led me tossing together a straw-man proposal in my head for
>what we'd use as an experiment:
>
>Requirements:
>* No guarantee that this will ever emerge from a test, and may be
>discontinued at any time during the test.
>* 6 month term, with monthly reporting for the duration.
>* Test shall consist of a single, mature, healthy, TLP
>* github repo must reside within the Apache organization on github
>* Access would be managed by infra (e.g. projects would not get admin
>access to their repos.
>* Github integration must be enabled with activity flowing to lists.
>* Force rewrites disabled (this is something that must be performed
>out of band by GH staff at present)
>* Commit mails directed to commits@$foo.a.o
>* Github repo synced frequently somewhere on a.o - and backed up.
>
>I've also reached out to folks from Eclipse to discuss their
>experience. Their concerns were project continuity (should github pull
>a CodeSpaces[3]), and IP/Legal concerns. They require a CLA be signed
>for each contribution, so some of that is easily obviated because we
>have no need to audit the author of each pull request to confirm that
>they have a CLA signed. They also have admin access restricted to
>their infrastructure team.
>
>I am sure there are other concerns that I haven't thought about yet;
>so what are they?
>
>Thoughts, comments, flames?
>
>--David
>
>[1] https://github.com/apache
>[2] https://blogs.apache.org/infra/entry/improved_integration_between_apache_and
>[3] http://codespaces.com
>
>
>
Mime
  • Unnamed multipart/alternative (inline, None, 0 bytes)
View raw message