Re: [gentoo-project] Gentoo, GitHub, and the Social Contract

[Kristian Fiskerstrand <k_f@gentoo.org>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

On 02/14/2015 09:55 PM, Anthony G. Basile wrote:
> On 02/14/15 15:48, Andreas K. Huettel wrote:
>> Hi all,
>> 


..


>> 
>> Many arguments have already been made. Feel free to summarize
>> your points again in a reply to this e-mail.
>> 
>> Cheers, Andreas
>> 

First of all, thank you Andreas for brining this up in an appropriate
thread of its own.

> 
> I didn't know that was in our social contract, but I totally stand 
> behind it.  I feel very uneasy about our increasing use/dependency
> on github.  I'd like to see the stuff we have on github migrate
> back to our infra.
> 

The most important part here is "depend upon". As long as the primary
repository and developer workflow internally happens on infra hosted
systems, having a copy of the repository on github to allow external
contributions is no issue the way I interpret it, and it can only be a
positive thing if we get such contributions. However, this should not
be used as a primary component of the workflow, and people should
certainly keep the social contract in mind when structuring projects.

It would of course be even better if we had our own infrastructure, or
procedures, in place to enable this within our own infrastructure. But
from what I can see in the various discussion, the review tools that
have been mentioned really are not up to par in terms of release
management and possibility to keep up to date and secure in any sane
way. How this can be the situation in the first place is a longer (and
perhaps scarier) discussion.

- -- 
Kristian Fiskerstrand
Public PGP key 0xE3EDFAE3 at hkp://pool.sks-keyservers.net
fpr:94CB AFDD 3034 5109 5618 35AA 0B7F 8B60 E3ED FAE3
-----BEGIN PGP SIGNATURE-----

iQEcBAEBCgAGBQJU37mMAAoJEP7VAChXwav6ffUH/0E4lez3noTIVu2FqdLn0nfK
sUwJdRk7KG8AV+E6o39JNasC6Ku4O6/2kl+sNIRp3FpStvXfs1GM1ImhtxHrw8K/
+KzikyfLv8TfwHj10qsQHY1/RPUtmQfJ+RgRyHDTGUKpUqx4+UJlUovPFkR3egC7
qbEBdpu2hb3ZC1WxAxS1w/RzxuyDT67UixvozzC8UErliVp5gj10BxTZJ/C7Dr4K
opLMgmu3rbMnh36W3bgXWItSwiTDFuaj2R1D27qmcOcQgv7oGecEPmt6Oxyc7AJ1
uken67qfJLjO2PG1UC+tBfUA1Hl53hdz8RqUjCED4lQMF/VRD7ZDQS5G9LFPvRo=
=55Qz
-----END PGP SIGNATURE-----