Hi Robert, see my comment inline > On 9. Oct 2017, at 10:54, Robert Munteanu <[email protected]> wrote: > > Hi, > > On Mon, 2017-10-09 at 10:35 +0200, Konrad Windszus wrote: >> I understand that I can commit to both the Gitbox repo as well as the >> linked Github repo now. The former works without further actions for >> the latter 2fa needs to be enabled on github and the account needs to >> be properly linked. >> I am wondering which of the two URLs should be used within the >> pom.xmls? >> For me it would rather be the native gitbox URL (as documented now in >> https://reference.apache.org/committer/git) instead of the Github >> one. Mostly because gitbox is controlled by the ASF Infra team while >> Github is not. >> Also for documentation purposes we should always point to mainly the >> Apache one and mention the Github repo as an additional option. >> >> With https://github.com/apache/sling- >> site/commit/2f5dbedefff3fcaa0639716d59c0806620337fd0 the pubScmUrl >> has been changed from git-wip to Github. IMHO this should rather be >> the gitbox url as this allows every committer to publish, even if >> she/he has not yet set-up the linking of the Github account. This >> makes publishing less error-prone as for the gitbox URL no further >> prerequisites need to be fulfilled and one can just commit with the >> Apache LDAP ID and password. > > Thanks for bringing this up, I don't think we explicitly discussed it. > > I think that github should be the canonical URL, for the following > reasons: > > - account linking and personal access token generation are one-time > actions that take little time to perform right, but at least for the sling-site case committing to gitbox is even less effort, because every committer already has HTTPS write access to that repo. I had some troubles with the linking because it seems that after enabling 2fa on Github there is a delay of up to 30 minutes until the daemon picks up the change on ASF side. > - making github the preferred push repository makes me more confident > that we won't have any conflicts due to merging pull requests not sure how ASF gitbox and Github are syncing exactly and what happens in case of conflicts. Do you have any source available which explains the process more in detail? Also to me it is not clear which URL to include there: SSH based or HTTPS based? > - automation is more readily available with github rather than gitbox > and we may choose to add more automation in the future you are probably referring to the Github API for which there is no alternative on the ASF side. I agree with that as well. Also having SSH authentication available at Github is a big pro (but should not be required for publishing the sling site though)
But please also consider the other points: > > Also, pushing to github is a supported setup, this was why we decided > to go with gitbox in the first place [1]. Pushing to the ASF repos sort > of defeats the purpose of that. Don't agree with that. Pushing to ASF repos does not prevent anyone from using the Github repos. It is just less obvious that you can also use Github. The main question to me is: how stable do we consider each of the two repos? IMHO the gitbox repo URL is much more stable as Github could theoretically end at any point in time the collaboration with the ASF and just would no longer provide that service for free. Modifying the documentation and poms afterwards would be a big hassle. I guess providing Maven artifacts not only via Maven Central but primarily through the ASF dist server is a very similar requirement (http://www.apache.org/dev/release-publishing.html#distribution). What do others think? > > Robert > > [1]: https://lists.apache.org/thread.html/5ec516396d30c5c6b722da8095230 > a792f0972ab25dd651a96dd56be@%3Cdev.sling.apache.org%3E
