[Date Prev][Date Next] [Thread Prev][Thread Next] [Date Index] [Thread Index]

Re: salsa.debian.org maintenance (GitLab 11.1.4 upgrade, external storage migration)



Hello,

Am 11.08.2018 um 16:20 schrieb Bastian Blank:
> We will do maintenance on salsa.debian.org today, 2018-08-11, between
> 1600 and 1800 UTC.
> 
> We will upgrade the GitLab instance to 11.1.4.

Thanks a ton for all your maintenance work for salsa. It's a huge
improvement for packaging and team maintenance work to have salsa around!

> We will also start moving some of the large data stores with public
> accessible files off to Google Cloud storage.  Using an external storage
> allows us to store a much larger amount of data in our GitLab instance.
> All access to it will be proxied, without providing user identifying
> data to the storage provider.

Hrmpf! I have to say that I was somewhat surprised by this announcement.
To be honest, I don't like the idea of making our infrastructure as a
project rely on closed and proprietary systems like Google Cloud. Isn't
it important to us as a project anymore to run our infrastructure on
free software and under our own control? [1]

[1] https://mako.cc/writing/hill-free_tools.html

We already switched to proprietary CDNs as our default mirrors. While I
don't like this decision either, there's a difference: most mirrors
where not maintained by the DSA or other project-internal teams either
before. But since there's hundreds of them, we don't rely on a single
one to keep working and we could easily change the DNS records for
deb.debian.org if one of the CDN providers does evil things.

With salsa it is different. It is meant to be a home for our packages
and software projects, and to my knowledge its predecessor Alioth had
been invented to provide an alternative to platforms Sourceforge and
Github and to make us independent from proprietary solutions. If we now
start moving the salsa storage to a proprietary cloud solution, this
leaves a bad taste in my mouth.

At the very least, I would love to have seen this discussed publically
before action was taken.

Cheers,
 jonas

Attachment: signature.asc
Description: OpenPGP digital signature


Reply to: