Re: [fossil-users] Using bundles for pull requests

2018-06-17 Thread Eduard
A simpler alternative to having a dedicated pull-request feature in fossil is to just have a second "free-for-all" repository where commit capability is granted to pretty much any passerby willing to fill out a CAPTCHA and register an account. Said passerby can then just use the ticket system (or

Re: [fossil-users] Using bundles for pull requests

2018-06-17 Thread Florian Balmer
Richard Hipp: > (5) The server accepts the bundle and parks it in a separate holding > table, but does not merge it or otherwise make it available to average > passers by. The server then sends email notifications to developers > with appropriate privileges to let them know that a pull request has

Re: [fossil-users] Using bundles for pull requests

2018-06-16 Thread Florian Balmer
Another issue with bundles: "push requests" derived from local private branches. It may be not only the receiver of a "push request" to decide to import only the final "accumulated patch", without all the detailed "commit-by-commit" history. It may also be the submitter to decide to keep the deve

Re: [fossil-users] Using bundles for pull requests

2018-06-16 Thread Eduard
>> ... it's possible to introduce unwanted contents (and random >> control artifacts) ... I can foresee another attack that could be used to inject malicious control artifacts into the repository (depending on the bundle implementation). The attacker creates a delta control artifact referencin

Re: [fossil-users] Using bundles for pull requests

2018-06-16 Thread Florian Balmer
More thoughts: > fossil merge --bundle BUNDLE ?--cherrypick|--backout CHECK-IN? * BUNDLE could be a disk file, or something like "bundle:ID" to refer to a bundle submitted via "push request", and queued in a separate repository db table. * If the current check-out is different from the root of t

Re: [fossil-users] Using bundles for pull requests

2018-06-16 Thread Florian Balmer
> Let me decide whether the bundle is committed "step-by-step" > ... or "all-at-once" ... I think this is what I'm looking for: fossil merge --bundle BUNDLE ?--cherrypick|--backout CHECK-IN? > But I would like to have some more flexibility and control when > "applying" (or importing) bundles by

[fossil-users] Using bundles for pull requests

2018-06-16 Thread Florian Balmer
Fossil bundles are a great feature, and may be useful to implement pull (or "push") requests. But I would like to have some more flexibility and control when "applying" (or importing) bundles by third parties: * Let me decide where the bundle is committed, be it directly on trunk instead of on a