[RFC] time to move to github?

Jeffrey Blank blank at eclipse.ncsc.mil
Wed Feb 19 16:17:55 UTC 2014


This is a very interesting question.

>From my perspective, the greatest pro is improved project management
options on GitHub (easier branching etc).  The others are fairly minor
(and many are resolved by viewing the project wiki).

I am not sure I view one thing listed as a "pro" to be such, and this is
the ease of forking.  I do not want a variety of government agencies
creating Frankenstein forks of scap-security-guide.  I want them to use
the profiling mechanisms of XCCDF to select what they need from a single
high-quality dictionary of compliance checks (for each product for which
such content exists).  One of the unstated goals of the project is to
keep the variety of government compliance machines under some control by
providing a solution which meets >95% of use cases.

Also, the association of the project with Red Hat (in this case, by
providing hosting) is very important from the Government perspective,
which I represent.

So, I am not totally convinced of the value in doing this...yet.  But it
deserves thorough consideration, and I look forward to more discussion.



On 02/16/2014 04:03 PM, Shawn Wells wrote:
> As the SSG development community grows, so does the need for matured
> tools and workflow. There's been some discussion of moving to GitHub.
> 
> On the pro side:
>     * Easier to signup and request commit access
>     * Most committers likely to have GitHub account for other projects
> anyway
>     * Easier for community to fork SSG code (e.g. gitmachines project)
>     * Dramatically better ticketing system
>             - labels
>             - user-friendly GUI
>             - git commit hooks (put ticket # in patch title, auto
> resolves ticket)
>             - multi-developer collaboration on tickets easier through
> @name calls
>     * "Pull Request" concept: Patches centrally managed and merged,
> ensures no missed patches on mailing list
>     * Simplified branching (e.g. allows a -stable and -dev branch).
> Possible on FedoraHosted, not as intuitive
>     * Increased reliability of infrastructure (especially latency of git
> pulls)
> 
> On the cons:
>     * Slight developer hassle to migrate SSH keys
>     * "Not hosted by RedHat" -- concern from some that migrating from a
> redhat/fedora hosted URL will diminish project brand.
> 
> What does everyone think?
> 
> _______________________________________________
> scap-security-guide mailing list
> scap-security-guide at lists.fedorahosted.org
> https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide


More information about the scap-security-guide mailing list