Gentoo Archives: gentoo-dev

From: Rich Freeman <rich0@g.o>
To: gentoo-dev <gentoo-dev@l.g.o>
Cc: Alexander Berntsen <bernalex@g.o>
Subject: Re: rsync mirror security (WAS: Re: [gentoo-dev] .gitignore)
Date: Tue, 11 Aug 2015 11:59:13
Message-Id: CAGfcS_nfbUNXdf8fLNzp1k2KFw7k2t-qJ9TeKToYvSn1cF98kQ@mail.gmail.com
In Reply to: Re: rsync mirror security (WAS: Re: [gentoo-dev] .gitignore) by Kent Fredric
1 On Tue, Aug 11, 2015 at 5:07 AM, Kent Fredric <kentfredric@×××××.com> wrote:
2 >
3 > Having a quality infrastructure should happen in parallel to github mirrors.
4 >
5 > Uses may use the proprietary one or the opensource one.
6 >
7
8 While I generally tend to agree with you, if we're just talking about
9 mirroring is this a real problem?
10
11 Right now Gentoo has a large number of rsync/http mirrors. As far as
12 any of us are concerned, they're just an DNS address that speaks
13 rsync/http. None of us have any idea what OS or software they're
14 running. If one of our mirrors is IIS running on Windows 7, that is
15 pretty transparent to the end user. They're just mirrors.
16
17 That is basically all github is in this case. A commit shows up in
18 the gentoo infra repository, and some process somewhere pushes it to
19 the github repository. If we were to set up an independent network of
20 git mirrors, they'd probably work the same way. (Git should actually
21 be pretty easy to mirror.) To an end user all they see is a DNS name
22 that talks whatever protocol git uses. Short of an on-site inspection
23 you'd never be able to prove that it is actually FOSS.
24
25 Apologies if I sounds like an MS "open standards, not open source"
26 shill - but to some extent when you're talking about networked
27 services they work out to be the same thing. I think it is far more
28 important to keep the infrastructure that creates the tree pure-FOSS
29 (and documented/published so that anybody who wants to could basically
30 "roll their own Gentoo"). If we use a more commercial service to just
31 help scale it up like a CDN or something like github, that isn't
32 really as essential to the essence of Gentoo. I do think that people
33 who complain about depending on a github-based workflow have a
34 legitimate concern, but that isn't what we're talking about here.
35
36 In any case, nobody is getting rid of the rsync mirrors anytime soon,
37 so we don't have to be in any rush to figure this out. Consider this
38 thinking out loud if you will...
39
40 --
41 Rich