Re: Gnome chose Git

["Shawn O. Pearce" <spearce@spearce.org>]

Pat Notz <patnotz@gmail.com> wrote:
> On Thu, Mar 19, 2009 at 7:50 AM, Michael J Gruber
> <git@drmicha.warpmail.net> wrote:
> > Pat Notz venit, vidit, dixit 19.03.2009 14:43:
> >> On Thu, Mar 19, 2009 at 7:33 AM, Michael J Gruber
> >> <git@drmicha.warpmail.net> wrote:
> >>>
> >>> Also, they need push tracking for pushing through ssh, which is a common
> >>> requirement for many large projects. Do we have something to support
> >>> that? git-notes comes to my mind.
> >>>
> >>> Their current approach is writing to a single log file (receive-hook).
> >>> That may support a linear push history best, but looking up who pushed
> >>> what, given "what"?
> >>
> >> That's also something we do. ?Since the post-receive hook gives you
> >> the refname and the old and new refs you should have everything you
> >> need. ?We basically record the user name, UTC timestamp and the ref
> >> info. ?With a little bit more scripting you should be able to figure
> >> everything else out (though post-receive isn't called for local
> >> commits).

Why are people reinventing the reflog, and core.logallrefupdates ?

> > I know the info is there. It might just make more sense to have it in
> > the git repo the way notes are/will be: It's public, it's connected to
> > the commits, it's tamper proof (anyone would notice rewrites).
> 
> Ahh, yes.  We'd like that too.

Eclipse is also talking about Git, and has a similar problem.

Anytime you start talking about "who put what" though, you get into a
"where, and why does it matter?"

Imagine you are Eclipse Foundation or GNOME, you need to know which
authorized developer put the code on your servers.

But imagine you are an ISV like Oracle or IBM and you consume
code from the upstream project (Eclipse), put it on your servers,
add some "extra sauce", and distribute the result in some form.
Who put what on the Eclipse server isn't relevant, but what employee
your clone to use 3.4.1 instead of 3.4.0 matters a whole lot more.
For the most part, you just trust the upstream to do their own
IP tracking and diligence, as they have the contributor license
agreements, and you don't.

Its a thorny problem.  We've talked about trying to add some sort
of GnuPG signature into a push stream (for example) to allow the
server to store a record of who-did-what-when and later distribute
that back.

  http://thread.gmane.org/gmane.comp.version-control.git/71849

-- 
Shawn.