On 02/14/2015 02:48 PM, Andreas K. Huettel wrote:
> 
> Hi all, 
> 
> whenever the suggestion comes up to enable contributions to Gentoo via Github 
> pull requests, we also encounter discussion of the Gentoo Social Contract.
> 
> The two points that are seen as conflicting are
> 
> * The software running Github is closed source, proprietary.
> 
> * The Gentoo Social Contract states [1]:
> "Gentoo will never depend upon a piece of software or metadata unless it 
> conforms to the GNU General Public License, the GNU Lesser General Public 
> License, the Creative Commons - Attribution/Share Alike or some other license 
> approved by the Open Source Initiative (OSI)."
> 
> We need to resolve this discussion somehow, by formulating a clear policy. 
> Which is why I'm putting it up here for discussion and will ask to add it to 
> the next council meeting agenda. 
> 
> Many arguments have already been made. Feel free to summarize your points 
> again in a reply to this e-mail.
> 
> Cheers, 
> Andreas
> 
> [1] http://www.gentoo.org/main/en/contract.xml
> 
While Gentoo should use open source software where it can, I don't think
we can all the time, everywhere.  It would be nice to have our primary
repo on an infrastructure that facilitates working with the community
(github / bitbucket or better yet gitlab or gogs).

From an infra side I've looked at packaging gitlab, but it, like many
other projects these days, just installs to /opt.  It's update mechanism
doesn't even support Gentoo (chef based and chef on Gentoo is in the
same boat...).  I don't know what the state of gogs is, but given what I
know about go packaging it's not going to work well either.

What we are doing now is nice and works well I think.  We have the
portage mirror on github, accepting pull requests.  We even have a way
to take the pull request and apply it to CVS.  For now that's good, but
a smoother solution would of course be better (gitlab or gogs as
mentioned above).

I do agree, that from a security perspective at least, github should not
be our source of truth.

-- 
-- Matthew Thode (prometheanfire)