[gentoo-scm] Fwd: [gentoo-dev] CIA replacement

[Rich Freeman]

Re-posting for discussion on gentoo-scm (apologies if this is a dupe,
but I'm pretty sure I wasn't subscribed for the last attempt):

Looking at the tracker [1], we need a pre-upload hook (I'm not quite
sure why), an rsync conversion script, the ability to validate the
converted tree, and documentation.  There is still an open bug for
commit signing, and I'm not quite sure why as this was implemented.

It seems like a lot has already been done with validation.  Checking
the active tree is pretty trivial - just compare the trees and they
should be the same.  I guess we need to check history, but it seems to
me like the risk of problems is low, and if we just keep a backup of
the cvs repository if there is ever a concern about who made some
commit 5 years ago we can always dig it up.

It really seems to me like little remains to be done here.  Mostly we
just need somebody to push a decision on things like workflow.  A few
of the bugs have comments like "no sense working on this with other
stuff still needed" - which seems to be outdated thinking with so
little left to do.

Am I missing some big concern that just isn't obvious in these bugs?

I also fear that we're refusing to take action on a great solution
because it isn't a perfect solution.  Nobody in the world is using
tree-signing with git, and we aren't really using it in cvs either.
We now have the ability to do it with git, but depending on workflow
3rd-party signatures might not end up in the history of head, or we
might not be able to verify them in an automated fashion.  Honestly, I
think the appropriate response here is whoop-de-doo.  We can't do any
of that stuff with cvs, but moving to git would have a lot of other
benefits.  We can always change our processes later once somebody has
a solution for the signing problem.  Right now we're making do without
it on cvs, and so is every other project using git.  We can also
continue to sign manifests as a workaround, which is what we'll be
doing anyway if we never migrate to git.

The git migration just strikes me as one of those cases where anybody
is free to come up with a reason not to use something, but nobody has
to defend keeping the status quo.  I think the question isn't whether
there is anything wrong with using git, but whether the problems with
git are worse than the problems we already have.

Rich

[1] - https://bugs.gentoo.org/show_bug.cgi?id=333531