Skip to content Skip to footer

Git without a forge by todsacerdoti

16 Comments

  • Post Author
    ndegruchy
    Posted March 5, 2025 at 9:16 pm

    This is what I love about Fossil[1]. You get all of those extra tools (wiki, chat, forums, bug tracker) in the server that is also in the binary that you use to manage the repo.

    So, if you want to serve it, just `fossil server file.fossil` or serve a whole directory of them. Or, if you want, you can just `fossil ui` and muck around yourself, locally. The server supports SSH and HTTPS interactions for cloning and pushing.

    All by the same people who make SQLite, Pikchr, and more.

    [1]: https://fossil-scm.org

  • Post Author
    AndrewDucker
    Posted March 5, 2025 at 9:29 pm

    For some context, Simon is the maintainer of PuTTY, as well as various other cool bits of software.

  • Post Author
    MaxBarraclough
    Posted March 5, 2025 at 9:41 pm

    This reminds me of Drew DeVault's advocacy for the traditional email-driven git workflow. [0][1] (Drew is the creator of SourceHut, an email-oriented git forge.)

    I think his (Simon's) objection to git send-email emails could be addressed with better tooling, or better use of them. It's 'just' a matter of exporting the emails into a single mailbox file, right? (I'm not experienced with git's email-driven features.)

    It seems to work smoothly for the Linux kernel folks; clearly it doesn't have to be clunky.

    > because git format-patch doesn’t mention what commit the patches do apply against, I’m more likely to encounter a conflict in the first place when trying to apply them.

    This is what the –base flag is for. [2]

    [0] https://git-send-email.io/

    [1] https://git-am.io/

    [2] https://git-scm.com/docs/git-format-patch#Documentation/git-…

  • Post Author
    fsdkfdsf
    Posted March 5, 2025 at 9:42 pm

    [flagged]

  • Post Author
    IshKebab
    Posted March 5, 2025 at 9:47 pm

    > Sometimes people just can’t work out how to send me patches at all.

    Yeah indeed. I have written but not submitted patches to a project (OpenSBI) because it made the submission process super complicated, requiring signing up to a mailing list, learning how to set up git send-email.

    I don't see how he can think creating a GitHub account (which almost everyone already has) is a big barrier when he freely admits his process is incomprehensible.

    I don't buy the GitHub locks you in either. It's pretty easy to copy issues and releases elsewhere if it really comes to it. Or use Gitlab or Codeberg if you must.

    https://docs.codeberg.org/advanced/migrating-repos/

    Any of those are far better than random mailing lists, bugzilla, and emailed patch files.

    Putty is great but please don't listen to this.

  • Post Author
    etaweb
    Posted March 5, 2025 at 9:52 pm

    > In particular, your project automatically gets a bug tracker – and you don’t get a choice about what bug tracker to use, or what it looks like. If you use Gitlab, you’re using the Gitlab bug tracker. The same goes for the pull request / merge request system.

    With Forgejo (Codeberg) you can toggle features such as pull requests, issues, etc.

    You can also configure any external issue tracker or wiki apparently, though I've never tried it, because those included with the forge are good enough for me.

  • Post Author
    adastra22
    Posted March 5, 2025 at 9:58 pm

    The way he prefers patches to him being sent (git repo URL + branch name) is basically what a forge does. Why make it more complicated for your users?

  • Post Author
    throw94040
    Posted March 5, 2025 at 10:07 pm

    》The simplest kind of git bundle – a full bundle – is a whole git repository, wrapped up into a single file.

    Git repo can have executable code! Git hooks are shell commands stored in dir ".git/hooks" executed on events such as merge, commit… That is not duplicated by git clone, I am not sure about bundles. But I would be VERY careful to accept something like compressed git repo from anyone!

  • Post Author
    zem
    Posted March 5, 2025 at 10:12 pm

    as someone who finds the whole forge interface a massive improvement in git collaboration workflow I was fully prepared to find the author's arguments against a lightweight self hosted forge unconvincing. but the "need to create an account" is an extremely valid drawback, and one I do not have a good answer to.

  • Post Author
    aard
    Posted March 5, 2025 at 10:18 pm

    I very much support this sentiment! If we want a decentralized internet, we need to stop relying on large companies to manage everything for us. Git was designed to be a p2p system, but we very quickly centralized it with forges like Github. It is very discouraging. Most of the internet is like this now–managed by a handful of very powerful organizations. There is no end to the problems this will cause.

  • Post Author
    wahern
    Posted March 5, 2025 at 10:25 pm

    > People can ‘git clone’ my code, and there’s a web-based browsing interface (the basic gitweb) for looking around without having to clone it at all.

    I host my own public Git repositories, but statically–read-only, no HTML views. I don't want to run any specialized server-side code, whether dynamic or preprocessed, as that's a security vector and system administration maintenance headache I don't want to deal with. You can host a Git repository as a set of static files using any web server, without any special configuration. Just clone a bare repo into an existing visible directory. `git update-server-info` generates the necessary index files for `git clone https://…` to work transparently. I add a post-receive hook to my read-write Git repositories that does `cd /path/to/mirror.git && git fetch && git –bare update-server-info` to keep the public repo updated.

    In theory something like gitweb could be implemented purely client-side, using JavaScript or WASM to fetch the Git indices and packs on-demand and generate the HTML views. Some day I'd like to give that a try if someone doesn't beat me to it. You could even serve it as index.html from the Git repository directory, so the browser app and the Git clone URL are identical.

  • Post Author
    paulddraper
    Posted March 5, 2025 at 10:50 pm

    I was expecting the justification to be a stodgy get of my lawn rant.

    But the author does a very good and reasonable job of explaining it.

    It didn't convince me to do the same thing, but I can't help but nod along to the even-handed pros and cons that he lays out.

  • Post Author
    rlpb
    Posted March 5, 2025 at 11:44 pm

    > Multiple files to herd. When I get an email with five patch attachments, I have five files to copy around instead of one, with long awkward names.

    That’s not correct. You can write the email to an mbox file (your MUA lets you do that, right?) and then use `git am` to pull it all into git.

    > Why I don’t like it: because the patch series is split into multiple emails, they arrive in my inbox in a random order, and then I have to save them one by one to files, and manually sort those files back into the right order by their subject lines.

    The patch series arrives threaded, so your MUA should be able to display them in order. Export them to an mbox file, and then use `git am` again.

    There might be ways that someone can send you email in this way and for the patches to be broken such that `git am` won’t work, of course. I take no issue with that part of the argument.

  • Post Author
    agf
    Posted March 5, 2025 at 11:44 pm

    Gotta plug the Portable Puzzle Collection, by the same author as this post: https://www.chiark.greenend.org.uk/~sgtatham/puzzles/

  • Post Author
    oneplane
    Posted March 6, 2025 at 12:13 am

    I wonder if (especially after finishing the bottom part of the article) a mailing list type of interaction, but with Git, is exactly the sort of "in the open" version that is described as a potential improvement.

    I'm not sure to what degree that natively allows for integration between Git and an MTA but it would still have most of the desired aspects.

  • Post Author
    ajross
    Posted March 6, 2025 at 12:36 am

    The security analysis in this piece is awful. Basically, author uses git because they don't trust "forges", then proceeds to discuss how a direct attack against the repository history is very hard but "not impossible"[1], while failing to recognize that the by-far-most-robust protection against such an attack is to push it to MORE repositories and MORE clones hosted by MORE entities and not keeping it secret on… your own piece of random hardware you probably got from Amazon.

    The rest of it is reasonable advice as far as it goes. Learn how to replicate patches between raw repositories as a good practice, as you'll want to be able to do that anyway. Don't lean too hard on the GitHub abstraction of a "Pull Request" as that won't match what kernel people want, etc…

    [1] Technically true, but in practice a ridiculous whopper.

Leave a comment

In the Shadows of Innovation”

© 2025 HackTech.info. All Rights Reserved.

Sign Up to Our Newsletter

Be the first to know the latest updates

Whoops, you're not connected to Mailchimp. You need to enter a valid Mailchimp API key.