Re: [SVN-MIGRATION] GitHub and ACLs

Andrei Zmievski wrote:
> Travis Swicegood wrote:
>> As I understood Rasmus, GitHub was mentioned specifically because it
>> would allow PHP'ers to not *have* to worry about maintaining the
>> repository infrastructure.  Git makes offloading the repo hosting an
>> easy choice as we're not tied to them since everyone as there are
>> dozens (if not hundreds) of mirrors since each developer has a clone
>> of the entire repo history.  GitHub also provides some nice UI tools
>> for submitting simple patches (I believe spelling corrections in docs
>> was used as an example).
> 
> The only concern that comes to mind with offloading repo hosting is
> security. With a centralized server like CVS we have successfully
> avoided any malicious code injection over the years. I'm not saying that
> this will happen with Git, but that we will have to be more diligent in
> watching out for it.
> 
>> Referring back to Rasmus' "Github status" email on April 8th, it looks
>> like there's 10 yays, and 3-4 nays. (with you, Brian, as the maybe
>> nay).  The nays include some of the (maybe all of the?) largest
>> contributors to php-src, so that does seem like a big reason not to move.
> 
> So what was the point of voting then, if we're looking at the weight of
> the votes?

The point would be to see if we had a unanimous desire to move.  We
didn't.

I really hate making decisions on things I am not going to be working on
heavily myself, but I think we have been stalled on this for too long
now, and we should do something, anything, at this point.

So, since I don't think we are that far away from having a working
Subversion repository, I say we finish that work.  Github as-is isn't
where we need it to be yet anyway.  I still want to keep an eye on it,
and we should be looking at ways to separate our code repository from
our authentication system and the various other bits and pieces that are
driven off of the CVS password file today.

One thing I wanted to do years ago was to set up php.net as an OpenID
provider.  If we can get that up and running, then a future move to
Github (which supports OpenID), or some other mechanism, would be simpler.

-Rasmus