Re: Transfer of the GNU Midnight Commander repository

[Mathieu Roy <yeupou gnu org>]

Pavel, any news from GNOME people? Are you able to or know someone
able to make a tarball of your CVS?


Pavel Roskin <proski gnu org> said:

> Hello!
> 
> I'd like to move the repository of GNU Midnight Commander from
> cvs.gnome.org to subversions.gnu.org
> 
> The issue was discussed on the developers' mailing list
> (mc-devel gnome org) and there were no objections.
> 
> The reasons as I see them are following:
> 
> 1) GNU Midnight Commander is currently unrelated to the GNOME project.
> Neither GNOME is required to build GNU Midnight Commander, not GNU
> Midnight Commander is a part of GNOME.
> 
> 2) The developers of GNU Midnight Commander and GNOME are different
> people.  Permissions of the developers of GNU Midnight Commander,
> including write access to the repository, should be managed in a
> flexible way by the developers themselves.  Savannah provides this
> facility, GNOME CVS doesn't.
> 
> 3) pserver access with password is unsafe by design.  The password is
> trivially encoded when it's transmitted over the network.  If more
> developers get write access to the project, the risk of compromising the
> code becomes unacceptable.  Unlike GNOME, it's common for GNU Midnight
> Commander to be run as root, which increases the risk even more.
> 
> 4) Anonymous access to the GNOME repository is provided by two servers
> with the same hostname anoncvs.gnome.org.  Those servers are not always
> synchronized with the master server.  Worse yet, they are not always
> synchronized with each other, so "cvs update" may cause downgrading to
> an older revision.  This has confused contributors more than once.
> 
> I'd like the repository to be transferred directly, but if it's not
> possible, please let me know how I can download and upload it.
> 
> Once the repository is transferred, the files on the GNOME side should
> be removed using "cvs remove" to preserve history, especially gmc code
> needed to build old GNOME.  Only the README file should be left with a
> message pointing to the new repository location.
> 
> I'm sorry for asking you to spend your precious time on this issue, but
> I believe that it's the right thing to do and that it's vital for
> keeping GNU Midnight Commander an active project and attracting new
> developers without compromising security.
> 
> Some technical details.
> 
> GNU Midnight Commander on Savannah:
> https://savannah.gnu.org/projects/mc/
> 
> The name of the repository on both sides is "mc".
> 
> My login name is "proskin" on GNOME CVS and "proski" on Savannah.
> Andrew Samoilov is "andrew" on GNOME CVS and "sav" on Savannah.
> Although not critical, I would prefer those two names to be converted if
> it can be done safely.
> 
> My public key can be found at http://www.red-bean.com/~proski/proski.key
> and on public keyservers.
> 
> --
> Regards,
> Pavel Roskin
> 
> _______________________________________________
> Savannah-hackers mailing list
> Savannah-hackers gnu org
> http://mail.gnu.org/mailman/listinfo/savannah-hackers

-- 
Mathieu Roy
 
  Homepage:
    http://yeupou.coleumes.org
  Not a native english speaker: 
    http://stock.coleumes.org/doc.php?i=/misc-files/flawed-english