I'm away at the moment but I do believe that signed commits was acknowledged.
board: r62882 - /foundation/board/github-discussion/explorations/signed-commits.txt Feel free to share anonimized content from that file. On Mar 19, 2016 2:12 PM, "sebgoa" <run...@gmail.com> wrote: > > > On Mar 19, 2016, at 3:59 PM, Sam Ruby <ru...@intertwingly.net> wrote: > > > > The initial action (creating the fork) was not clearly done by the PMC > > as a whole, that is now being rectified by a retroactive vote being > > taken. Even that I wouldn't suggest be done any differently: many > > parts of the ASF prefer a Commit then Review (CTR). Under normal > > circumstances, a vote would not be necessary. > > > > To be transparent and avoid any hint at back door conversations (which are > sadly too often alluded too). Let me highlight a few historical steps: > > - We switched to GitHub PR almost a year ago and stopped using RB. > - Through fall Remi and co worked on a new commit workflow to speed > releases, their productivity was “damaged” by lack of github access, > namely: -no labels, no ability to close PR, no access to issues, no access > to triggers/hooks. > - Remi reached out to VP infra (David) couple times I believe and a > discussion in Dublin (~Oct). > -Through our PMC project report (written by me as VP and LGTM’d by the > PMC), I made several mention of our intent to use Github (and docker Hub) > more efficiently. I even said that if we where getting early access to the > “Whimsy experiment” we would quickly VOTE in our community to decide on > such a move. > - I never got any replies or comments (even though I mentioned that lack > of github access was putting our community at risk of fragmentation). > - Wido reached out to Github back in december when he saw there was > already a cloudstack org ( not sure who created it and controlled it > actually.) > - Schuberg forked and created cosmic in feb sometime. > - Finally last week, I took unilateral decision to click ‘fork’ on > apache/cloudstack and put a copy in cloudstack/cloudstack , thinking this > would kick the tires and would give us a playground to start experimenting > with CI taking advantage of full control of github settings. > > As a member of ASF I had witnessed several threads around the use of > GitHub and there are clearly strong feelings on the issue. I tried to > participate in those threads and even demoed with another member that we > could clearly guarantee provenance by signing all commits with ASF issued > GPG keys, but that was not even acknowledged. > > Moving to Github (in some fashion) is indeed problematic to the ASF and a > fully independent open source project. We end up depending on a vendor for > hosting our repo and this puts us at risk if Github were to go bonkers. We > can argue about such a risk, and we can also raise examples of other > vendor/proprietary software being used/depended on by ASF projects (JIRA, > Slack…). It also “moves” the community. While we are on the dev@ and > other ML, the issue that we may move the community to Github and give the > impression that project is not at ASF project is real. But to be honest > there is already such confusion in OSS with projects on ASF v2 license > being perceived by most as ASF projects. > > Personally I have always thought that this is a very serious issue and > trend in open source projects and that ASF (and the board in particular) > should try to proactively address. What is the future of ASF in a GitHub > world ? Can an ASF project live outside of ASF infra, especially in a Cloud > world ? Sadly I never saw any clear proactivity from the board. > > Hence yes, as my last action as VP I clicked on “fork”, and now I hope we > will move forward, and get the board to proactively do something. > > -Sebastien > > > > > > >
