On Thu, 2015-12-03 at 21:00 +0100, Jakub Hrozek wrote:
Hi,
I was looking at options we have for setting up an automated way to
mirror our
fedorahosted.org repo to
github.com. Unfortunately, the
github mirror functionality seems to be discontinued[*], so the next
best thing to do is to set up a github deploy key:
https://developer.github.com/guides/managing-deploy-keys/#deploy-keys
The private key would be on the machine we'd mirror from, the public key
would be uploaded to github. My question is -- do we want to set up the
push job on
fedorahosted.org or one of our machines?
1)
fedorahosted.org
[+] We don't have to manage the machine, dedicated admins do
[-] We'd have to give read ACL to an identity that pushes /all/
fedorahosted.org projects.
I do not see why the above is a minus, isn't the repo already readable
by anyone ?
2) Our own (CI?) machines
[+] We manage the machine with the private key. We keep control of the
key.
[-] We manage the machine with the private key. We're developers, not
admins.
I would personally prefer 1) because if the git user on fedorahosted is
compromised, all bets are off anyway and the concern about a push key to
our /mirror/ repo would not be the primary one. But at the same time, I
don't feel comfortable doing the decision without asking the
list.
So -- is anyone opposed to me asking
fedorahosted.org to generate a keypair
and giving us the public key that I would upload to github?
Once you have a mirror there have you made any determination about how
to deal with PRs ? I assume you disable the issue tracker ?
Simo.
Thanks!
[*] github has gained enough traction already, so they don't care about
this functionality anymore..
They start to become hostile to "competition" I guess... not a good
sign, oh well.
--
Simo Sorce * Red Hat, Inc * New York