[gentoo-dev] Re: Bug #565566: Why is it still not fixed?

[Duncan]

Rich Freeman posted on Tue, 23 Feb 2016 21:53:45 -0500 as excerpted:

> In the degenerate case where nothing has changed, an rsync still needs
> to walk the full tree and send a file list, while git just sends a
> commit ID and terminates.

Technicality:  While I believe you're correct for pure rsync, AFAIK, 
portage (and presumably the others) and the gentoo mirrors use a hybrid 
rsync method, where first the timestamp file is compared, and if it 
hasn't changed the rsync itself doesn't occur.

So for gentoo rsync you'd need to argue the single-file single-line 
single-commit change case, not the zero-change case.  But your point 
stands.

>> For one thing we can't expect users to keep an up to date copy of all
>> gentoo developer's OpenPGP keys to verify each git commit, additionally
>> this will cause issues with retirement and similar situations
>> (certificate revocation, subkey rotations, expiries).
>
> Well, we could do something (eventually) to make tracking keys easier,
> but I'll still buy that the thick manifests are more secure.  Git commit
> signatures are only bound to their contents with sha1.  I get that
> nobody has demonstrated a practical attack on that, but I think most
> crypto experts wouldn't heartily endorse the design.

Which is why I mentioned that there isn't a proper replacement for secure 
webrsync yet, so it'd have to stay around.  But git, synced over a secure 
connection at least, is certainly not /worse/ than normal rsync, and it 
arguably has at least the potential to be far better.

> Keep in mind that we do have git mirrors that include metadata/etc
> hosted on Github.  I know people have concerns with their software being
> proprietary but as far as syncing goes it is just a mirror.  I doubt
> most of us audit all the distfiles mirrors we use to make sure they're
> only using FOSS ftp/http servers and so on.

This is why I don't have a problem syncing from github any more than I do 
from whatever rsync mirror, despite freedomware being a relatively high 
priority concern of mine in general.  As long as the protocols are open 
and there's freedomware solutions available, whether a particular host 
I'm connecting to actually runs 100% freedomware isn't typically 
something I worry about... unless of course I'm the admin responsible for 
deciding what that host runs, in which case I'm unlikely to run anything 
/but/ freedomware on it (above BIOS/firmware level, anyway).

> There really isn't any
> reason that it couldn't be hosted on infra either, assuming they wanted
> the extra load (and I don't see the point in it, since it is just a
> mirror, and if it ever goes away it is trivial to just point the scripts
> that generate it to push to some other mirror instead -
> git itself is completely FOSS).

I'd say doable, but wouldn't call it "trivial".  Consider the difficulty 
the kernel had when bitkeeper pulled the rug out from under the Linux 
kernel, thus creating the need for git in the first place.  The switch 
was doable, and eventually done (and like Linux itself, it ultimately 
became the world standard), but I wouldn't exactly call it "trivial".

Of course in this case we're talking repo mirrors not repo software, but 
if gentoo's full rsync volume were to switch to git using github, and 
then github were to pull the rug out from under us... procuring and 
getting up and running that sort of hosting power on a week or even 90-
day notice wouldn't be exactly "trivial", unless of course we suddenly 
have Trump's credit card or similar to charge it on!  (Sorry, I'm 
following Nevada Republican caucus results 2nite as well, so it's Trump's 
CC, not Gates' or Ellison's or ...)

> Again, I have nothing against devs maintaining rsync and changelogs,
> and users making use of them.  I just don't see it as the end of the
> world if devs decide to stop taking care of them.

Particularly when the basic changelog information is there, it's simply 
quibbling about chronological or reverse-chronological order we're doing 
now, and people who /really/ care about it by rights should be going 
straight to the git logs in the first place.

-- 
Duncan - List replies preferred.   No HTML msgs.
"Every nonfree program has a lord, a master --
and if you use the program, he is your master."  Richard Stallman