[prev in list] [next in list] [prev in thread] [next in thread] 

List:       gentoo-dev
Subject:    Re: [gentoo-dev] RFI: A better workflow for github pull requests
From:       James Le Cuirot <chewi () gentoo ! org>
Date:       2015-09-20 8:45:07
Message-ID: 20150920094507.7256d8b2 () symphony ! aura-online ! co ! uk
[Download RAW message or body]


On Sat, 19 Sep 2015 20:12:06 -0400
Michael Orlitzky <mjo@gentoo.org> wrote:

> Has anyone ever set up Gitlab or Gerrit, managed by a package manager,
> in a way that a small bug won't grant anonymous write access to every
> single repository?
> 
> Web projects tend to assume that they're the only application/user on
> the server. And as far as security is concerned, that the server is
> in a locked closet with no internet connection. Most of them crash
> when you try to fix those assumptions.

We use GitLab at work and I do like it but I don't know how it fares
for much larger projects. I know less about Gerrit but it is used by
high profile projects like CyanogenMod. We've also had it recommended
numerous times in #gentoo-java by zxiiro, who works for the Linux
Foundation and used to work for the Eclipse Foundation. I think it's
worth a try but no, I'm not volunteering. ;) Having said that, it is
written in Java and if we insist on installing these things through
Portage (I suppose we should eat our own dog food) then I would be
willing to make a push on getting it into the tree. It might be tricky
though, not least because it uses the Buck build system, which I've
never seen used anywhere else and isn't currently in the tree either.

-- 
James Le Cuirot (chewi)
Gentoo Linux Developer

[Attachment #3 (application/pgp-signature)]

[prev in list] [next in list] [prev in thread] [next in thread]