[RFC] time to move to github?
Spencer Shimko
spencer at quarksecurity.com
Wed Feb 19 17:03:58 UTC 2014
On Wed, Feb 19, 2014 at 11:17 AM, Jeffrey Blank <blank at eclipse.ncsc.mil> wrote:
> This is a very interesting question.
>
> From my perspective, the greatest pro is improved project management
> options on GitHub (easier branching etc). The others are fairly minor
> (and many are resolved by viewing the project wiki).
>
> I am not sure I view one thing listed as a "pro" to be such, and this is
> the ease of forking. I do not want a variety of government agencies
> creating Frankenstein forks of scap-security-guide. I want them to use
> the profiling mechanisms of XCCDF to select what they need from a single
> high-quality dictionary of compliance checks (for each product for which
> such content exists). One of the unstated goals of the project is to
> keep the variety of government compliance machines under some control by
> providing a solution which meets >95% of use cases.
Nothing prevents them from forking now and hosting it on an internal
system, forge.mil, etc. This is an open source project, and
text-based to begin with, so I think preventing forks by using Fedora
Hosted is a losing battle.
If you're worried that other source code repositories containing SSG
content may confuse people, that is possible. However, I believe the
targeted consumers of the SSG content will get it from vendors who
know where the proper upstream project resides and knows to pull the
content from their repository.
>
> Also, the association of the project with Red Hat (in this case, by
> providing hosting) is very important from the Government perspective,
> which I represent.
Based on interactions on other lists like MIL-OSS and Gov-Sec I think
what a lot of the Government customers care about is that it is
packaged, shipped, and supported by Red Hat. I might be wrong on
this, but there doesn't seem to be a lot of questions raised regarding
the site used to host the source code during development.
Thanks,
--Spencer
>
> So, I am not totally convinced of the value in doing this...yet. But it
> deserves thorough consideration, and I look forward to more discussion.
>
>
>
> On 02/16/2014 04:03 PM, Shawn Wells wrote:
>> As the SSG development community grows, so does the need for matured
>> tools and workflow. There's been some discussion of moving to GitHub.
>>
>> On the pro side:
>> * Easier to signup and request commit access
>> * Most committers likely to have GitHub account for other projects
>> anyway
>> * Easier for community to fork SSG code (e.g. gitmachines project)
>> * Dramatically better ticketing system
>> - labels
>> - user-friendly GUI
>> - git commit hooks (put ticket # in patch title, auto
>> resolves ticket)
>> - multi-developer collaboration on tickets easier through
>> @name calls
>> * "Pull Request" concept: Patches centrally managed and merged,
>> ensures no missed patches on mailing list
>> * Simplified branching (e.g. allows a -stable and -dev branch).
>> Possible on FedoraHosted, not as intuitive
>> * Increased reliability of infrastructure (especially latency of git
>> pulls)
>>
>> On the cons:
>> * Slight developer hassle to migrate SSH keys
>> * "Not hosted by RedHat" -- concern from some that migrating from a
>> redhat/fedora hosted URL will diminish project brand.
>>
>> What does everyone think?
>>
>> _______________________________________________
>> scap-security-guide mailing list
>> scap-security-guide at lists.fedorahosted.org
>> https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide
> _______________________________________________
> scap-security-guide mailing list
> scap-security-guide at lists.fedorahosted.org
> https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide
--
Spencer Shimko
Quark Security, Inc
quarksecurity.com
O: 443-457-8275 x1000
M: 858-877-3623
More information about the scap-security-guide
mailing list