Re: Next steps from GTI TAC meeting on 2023-03-08 - Evaluate cost of glibc migration.

On 5/24/23 17:27, Siddhesh Poyarekar wrote:
> On 2023-05-24 14:55, Brian Behlendorf wrote:
>>> Signed commits would be nice, but we're not there yet as a
>>> community.
>> 
>> It's not quite as easy as "hey just add -s to your git commands"
>> but it's not far from that. I'm not a part of the TAC so I won't go
>> further than to suggest that a migration, where there will no doubt
>> have to be some adjustments to process and flow, to introduce other
>> non-zero-effort but non-blocking changes that enhance overall
>> security/integrity.
> 
> The challenge with cryptographic signing of commits is not a
> technical one, there are folks who oppose it on an ideological basis.
> It's probably not that hard to drive consensus in the glibc community
> for this, but that's still going to be an additional hurdle to cross.
> I'm not sure if the initial migration is the right time to tackle
> this.
> 
> Likewise for a process change that requires a single trusted
> gatekeeper.  Even if it has technical merit (I'm still not a 100%
> convinced), it's going to be harder to bring in a non-trivial process
> change like that during the initial migration.

Agreed.

We should avoid contentious issues and cleanup only technical debt.

e.g.

* What are all the git hooks we use?
  * Which can be moved to webhooks?

* Stop supporting CVS/SVN and export tarball dumps.

* Migrate from moinmoin to readthedocs/sphinx.

-- 
Cheers,
Carlos.