Gentoo Archives: gentoo-project

From: Alexis Ballier <aballier@g.o>
To: gentoo-project@l.g.o
Subject: Re: [gentoo-project] [RFC] New project: GURU [Gentoo User Repository, Unreviewed]
Date: Mon, 04 Feb 2019 13:48:37
Message-Id: 20190204144828.2c2398e8@gentoo.org
On Mon, 04 Feb 2019 14:28:28 +0100
Michał Górny <mgorny@g.o> wrote:

> On Mon, 2019-02-04 at 11:58 +0100, Alexis Ballier wrote: > > On Sun, 03 Feb 2019 20:28:49 +0100 > > Michał Górny <mgorny@g.o> wrote: > > > > > --- > > > What do you think? > > > > > > > What is the difference with sunrise ? > > The difference, as noted in the mail, is that it doesn't rely > on developers having time to review ebuilds. Therefore, it is less > likely to die because of developers lacking time to review stuff.
Then I fear you will see the same pitfalls, and it already started: I recall sunrise haters being very strongly against the idea because, TBH, our sandboxing mechanism isn't a real sandbox. It may have improved, but I doubt it's up to the point that we can safely run untrusted code there.
> > > One of the advantages of sunrise is that it had 2 repos: One > > unreviewed, without Gentoo official name and big fat warnings, one > > reviewed by devs more widely available. > > No. > > First of all, they weren't really two repos -- they were more like > private and public branches which were made into two repos due to > technical limitations. With the public branch getting all the commits > from private branch merged.
Yeah, that's the same idea but modernized.
> Secondly, both branches were reviewed. The difference is that people > were supposed to ask for (IRC) review before committing to the first > branch, and only developers were allowed to merge to the second > branch.
That's also the same idea to me.
> Thirdly, I have no clue what 'Gentoo official name' is in this > contexts and I certainly don't recall big fat warnings. The only > difference was that the public repo was advertised publicly while the > former was intended for development.
It was officially strongly discouraged to use the non dev-merged branch. That is what I would call a big fat warning. Don't get me wrong: I like the idea. Just making sure not to repeat past mistakes.