Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:114238
MIME-Version: 1.0
References: <1fadb99e-8880-b491-9db6-a9923c4d02d2@gmx.de> <CAF+90c99afneHo9FGEWTxwF3_0AW=M6FvsXiDB=HfdjEz1LVSQ@mail.gmail.com>
 <CAOwTYAsmEOeUDhwcV-7f9OzkcEYBvTtWW5xVhrs2hwpTs=U=cQ@mail.gmail.com>
In-Reply-To: <CAOwTYAsmEOeUDhwcV-7f9OzkcEYBvTtWW5xVhrs2hwpTs=U=cQ@mail.gmail.com>
Date: Wed, 28 Apr 2021 16:23:13 +0200
Message-ID: <CAOwTYAsz0Y_9QR_86X=-RPWEeOxK7svXfGDRk9pYUf5cqtcXsw@mail.gmail.com>
To: Nikita Popov <nikita.ppv@gmail.com>
Cc: "Christoph M. Becker" <cmbecker69@gmx.de>, PHP internals <internals@lists.php.net>
Content-Type: multipart/alternative; boundary="0000000000001cb56f05c1091f8b"
Subject: Re: [PHP-DEV] Retire distributions repo in favor of something more suitable
From: krakjoe@gmail.com (Joe Watkins)

--0000000000001cb56f05c1091f8b
Content-Type: text/plain; charset="UTF-8"

Actually the detached signatures are not part of the normal commit process
(doesn't look like they'll be in logs either), but the tag that you need to
make the release archive is ...

So we'd really want restriction on creating tags, somehow ...

Possibly we could also emulate some of the protection that version files
used to have.

It's not so simple ...

Cheers
Joe

On Wed, 28 Apr 2021 at 16:18, Joe Watkins <krakjoe@gmail.com> wrote:

> That's a good point.
>
> I suppose the most we can do is prevent accidental committing of such
> things.
>
> Appears to be two "solutions" ...
>
> We could distribute a pre-commit hook, which is somewhere between "not
> bad", and "pretty awkward" if your git installation is old.
> We could setup one of the unused boxes we have and leverage
> api/actions/whatever and catch bad commits after they happen.
>
> Neither of these are perfect solutions ... and I've never tried using
> hooks with github, but with a quick read it seems people do it - it's
> another paragraph in the git/vcs readme on the wiki.
>
> Any more ideas ?
>
> Cheers
> Joe
>
> On Wed, 28 Apr 2021 at 15:52, Nikita Popov <nikita.ppv@gmail.com> wrote:
>
>> On Tue, Apr 27, 2021 at 4:41 PM Christoph M. Becker <cmbecker69@gmx.de>
>> wrote:
>>
>> > Hi all,
>> >
>> > the distributions repo[1] is huge (current ~ 26GiB), and it will grow
>> > further over time; that causes issues when trying to check it out[2],
>> > and frankly, I don't see why were having the tarballs in a VCS at all.
>> >
>> > Wouldn't it be more suitable to make the tarballs available somewhere
>> > else?  Since we're using Github anyway, an appropriate place could be
>> > the tags, where it is already possible to add attachments.
>> >
>> > From what I can tell, that would require some modifications to web-php
>> > and web-qa, so that the proper download links would be available there,
>> > but otherwise shouldn't be a big issue.
>> >
>>
>> One possible issue I see is that anyone with write access to the repo can
>> upload release artifacts (I think), and I'm not even sure if changes in
>> artifacts show up in the audit log.
>>
>> Nikita
>>
>

--0000000000001cb56f05c1091f8b--