Re: [RFC] General Resolution to deploy tag2upload
Luca Boccassi <bluca@debian.org> writes:
> And on the implementation details, I really do not like the idea of
> having a competing git forge with Salsa. This dgit server seems to just
> be a ye olde git-web interface.
Does it support gitweb? I thought it only supported regular Git
operations, but I could be mistaken.
> If this goes forward, in my opinion it should exclusively use Salsa as
> the git server, to avoid duplicating infrastructure.
I think you want the Git archive to be entirely separate from Salsa so
that it's a reliable source of tracing information. You don't want to
support force pushes, for example; the whole point is that it should be
append-only, which would be a controversial choice for Salsa but which is
fine for the archives of the uploaded packages. I would also want a much
smaller attack surface for that type of record than than GitLab. GitLab
is designed as a place to do interactive work, not to keep a reliable
permanent record.
That Git archive is not parallel to or competitive with Salsa and doesn't
provide most of the functionality that Salsa does. It has a different
purpose.
--
Russ Allbery (rra@debian.org) <https://www.eyrie.org/~eagle/>
Reply to: