Appimagekit: Move to GitLab?

[probonopd]

Now that GitHub is being acquired by Microsoft, we should consider to move our repositories to GitLab.

GitLab provides a tool for #movingtogitlab but it does not take care of Travis CI.

And, as @Aztorius writes it is even possible to mirror the moved project back on GitHub:

You can first import the GitHub project to GitLab. Then on GitLab, on the project page -> Settings -> Repository, "Push to a remote repository" you can add a link to the GitHub repo, something like : https://Aztorius:[email protected]/Aztorius/magicfountain.git where TOKEN is a Personal Access Token created on GitHub with public_repo access allowed.
More here : https://docs.gitlab.com/ee/workflow/repository_mirroring.html

GitHub writes:

To set up your own mirror, you can configure a post-receive hook on your official project repository to automatically push commits to a mirror repository on GitHub.com (or GitHub Enterprise)

without further details nor an example.

Main showstopper for migrating from GitHub to GitLab appear to be the .travis.yml that have been carefully nurtured over the years?

[probonopd]

As a test project, I a moving https://github.com/probonopd/gs-plugin-appimage to https://gitlab.com/probono/gs-plugin-appimage

[probonopd]

Pros

• Infrastructure not owned by Microsoft
• Infrastructure open source
• Infrastructure could be self-hosted, should it ever become necessary for whatever reason
• CI built right into GitLab; do not need to set up GITHUB_TOKEN
• Can upload artifacts for each build without needing tricks like uploadtool ("With GitLab CI you can upload your job artifacts in GitLab itself without the need of an external service. Because of this, artifacts are also browsable through GitLab’s web interface")
• May be able to build on different architectures and then cross-package the output (e.g., AppImage runtimes) into builds of the respective other architectures

Cons

• Need to invest work in converting .travis.yml files to .gitlab-ci.yml

[antony-jr]

@probonopd I think you are coming to the wrong conclusion , being acquired by Microsoft does not mean that github will not have privacy... I think we need to think on the perspective of github too , Github had some large losses recently (approximately $60 Million) so I think Microsoft helped to keep github going on.

[antony-jr]

Take a look , something is already wrong with gitlab.

EDIT : 5xx implies internal server error... 502 specifically means bad gateway.

Dated: June 12 2018, 04:00:52. ( Changed the wrong date , I simply copied it from a python shell )

[probonopd]

Indeed... that's worrisome. Seems like we are stuck between a rock and a hard place... err, Microsoft and error 502 type issues

[antony-jr]

Lets stick with github , its not like AppImage codebase is private , So it does not matter if anyone views or copies the code. Even the MIT License allows it. :+1:

EDIT : Besides , The AppImage repo will lose all the reputation(i.e The stars , forks and shared links) and All users who uses hardcoded AppImage tool's urls will have a build error , Even Microsoft uses AppImages.

[TheAssassin]

Indeed... that's worrisome. Seems like we are stuck between a rock and a hard place... err, Microsoft and error 502 type issues

One single error at one time when it is known that they're working on scaling their infrastructure (I mean, they have a lot more views per second now, I'd guess) doesn't prove _anything_. Don't get hysteric...

@probonopd I think you are coming to the wrong conclusion , being acquired by Microsoft does not mean that github will not have privacy... I think we need to think on the perspective of github too , Github had some large losses recently (approximately $60 Million) so I think Microsoft helped to keep github going on.

Lets stick with github , its not like AppImage codebase is private , So it does not matter if anyone views or copies the code. Even the MIT License allows it. 

It's not about code privacy but user data privacy. And also about annoying "features" like "deploy to azure"...

[antony-jr]

One single error at one time when it is known that they're working on scaling their infrastructure (I mean, they have a lot more views per second now, I'd guess) doesn't prove anything. Don't get hysteric...

@TheAssassin I do agree with that(They are back again) but , Are you really planning on leaving github , Its really been the defacto for open source(and social coding) for a long time. Not to mention , still now a lot of projects are built on github , if AppImage moves to gitlab then there will be less support for github users and not all will be happy with this...

It's not about code privacy but user data privacy. And also about annoying "features" like "deploy to azure"...

I don't see any changes in the privacy terms and conditions ?

Anyways I don't see any wrong with microsoft aquiring github , Its for the greater good , We all know that money is important too(We all depend on proprietary software development jobs)... Github can't just throw unlimited storage for users and I think its the best move to make a deal with microsoft.
We just need to calm the hell out!

[hideout]

lol

2018-06-12 21:03 GMT+02:00 Antony jr [e-mail]:

One single error at one time when it is known that they're working on
scaling their infrastructure (I mean, they have a lot more views per second
now, I'd guess) doesn't prove anything. Don't get hysteric...

@TheAssassin https://github.com/TheAssassin I do agree with that(They
are back again) but , Are you really planning on leaving github , Its
really been the defacto for open source(and social coding) for a long time.
Not to mention , still now a lot of projects are built on github , if
AppImage moves to gitlab then there will be less support for github users
and not all will be happy with this...

It's not about code privacy but user data privacy. And also about annoying
"features" like "deploy to azure"...

I don't see any changes in the privacy terms and conditions ?

Anyways I don't see any wrong with microsoft aquiring github , Its for the
greater good , We all know that money is important too(We all depend on
proprietary software development jobs)... Github can't just throw unlimited
storage for users and I think its the best move to make a deal with
microsoft.
We just need to calm the hell out!

—
You are receiving this because you are subscribed to this thread.
Reply to this email directly, view it on GitHub
https://github.com/AppImage/AppImageKit/issues/803#issuecomment-396699069,
or mute the thread
https://github.com/notifications/unsubscribe-auth/AAjGjb-6Pu-Q7odJeTt4_emETR0mJFdkks5t8BCIgaJpZM4UhPFH
.

[shoogle]

@probonopd, I think it's a bit premature to move before we've seen how things will turn out, but there is nothing to stop you from mirroring AppImage on GitLab simply for the sake of having a backup. Keep using GitHub for contributions, and if it starts to go downhill then you will have the mirror already in place ready for you to switch to it.

[TheAssassin]

Why are you so often this hysteric, @antony-jr? Same goes for @probonopd. Guys, __calm down__.

@antony-jr please do some research on the topic before posting here. Let me clarify a few of your claims.

I don't see any changes in the privacy terms and conditions ?

Did you expect this to happen like within the first week? GitHub has been _sold_ but AFAICS will be transferred by the end of 2018. There's no rush in looking for alternatives before that date.

Lets stick with github , its not like AppImage codebase is private , So it does not matter if anyone views or copies the code. Even the MIT License allows it. +1

I don't see _any_ relation to the discussion with that.

What we need to keep in mind is the general data privacy issue with GitHub. I don't fully trust them. There's tracking everywhere, I'm pretty sure all my actions are logged forever (even non-public things like profile changes), etc.

You can't expect that to get better with Microsoft. The best we can hope for it won't get worse. But... let's keep in mind who won a Big Brother Award in 2018 for their Windows 10 "telemetry" which can't be turned off and is potentially illegal in Europe...

@probonopd I think you are coming to the wrong conclusion , being acquired by Microsoft does not mean that github will not have privacy... I think we need to think on the perspective of github too , Github had some large losses recently (approximately $60 Million) so I think Microsoft helped to keep github going on.

GitHub hasn't been profitable in their first decade. That's nothing new, though. Ever heard of this platform called Twitter...?

Just because they needed some fresh money also didn't mean they had to sell their platform to Microsoft. And the price Microsoft paid for GitHub is _humongous_. Experts estimated 2/3 of the price Microsoft _actually_ paid.

GitHub must have known how sceptical the free software movement is towards Microsoft _with good reasons_. It's a betrayal to sell the biggest platform around free software (which is itself not even free software, which makes this even more impressive IMO) to the ultimate enemy of the free software movement...

Pros

• Infrastructure not owned by Microsoft

You can never know whether they host their live service on Azure, can you? This isn't really an issue I'd say, the majority of pages don't maintain their own infrastructure any more (which I'd appreciate, as this would probably improve privacy greatly, as there's no 3rd parties involved except for maybe the datacenter provider)

• Infrastructure open source

Can we know how much of the gitlab.com code is open source? Sure, a lot. But it's highly different from both CE and commercial version IME. At least they're a bit further than GitHub. But even GitHub released their JavaScript as free software.

• Infrastructure could be self-hosted, should it ever become necessary for whatever reason

Is there a magical "From gitlab.com to " button? If not, that's not a plus for GitLab, as we could migrate to _any_ other system with the same effort.

• CI built right into GitLab; do not need to set up GITHUB_TOKEN
• Can upload artifacts for each build without needing tricks like uploadtool ("With GitLab CI you can upload your job artifacts in GitLab itself without the need of an external service. Because of this, artifacts are also browsable through GitLab’s web interface")

Travis CI can do the same. We only use uploadtool to support our highly specific continuous release scheme. AFAICS GitLab would require the same workarounds as Travis so we could use the built-in artifact uploader (that is, tagging the latest commit as continuous in a first build, triggering a build of the new tag which then actually builds the artifacts and uploads them).

• May be able to build on different architectures and then cross-package the output (e.g., AppImage runtimes) into builds of the respective other architectures

I think we could do that only on self-hosted infrastructure. It's at least possible to make gitlab.com use own systems. This feature is lacking in GitHub. But if I went that step, I'd anyway host the CI system myself. That's more efficient, and doesn't require sharing secrets with GitLab.

Cons

• Need to invest work in converting .travis.yml files to .gitlab-ci.yml

It's a lot worse than you think. I assume our scripts would need a couple of hours to work around the new limitations in GitLab CI to actually build. And I doubt there's any form of FUSE-enabled GitLab provided build machines which we could use to actually test our runtime (we do that by calling appimagetool.AppImage at the moment). We'd had to drop some of our most important artifact auto-tests. This'd make our continuous builds _way_ more fragile.

You see, the situation is a lot more complicated than you guys depict it...

[TheAssassin]

@shoogle backups are already created on one of my private Gitea instances.

[antony-jr]

I think AppImage should move to gitlab. (I will be moving too... )

[DanielRios549]

I think AppImage shouldn't move to Gitlab, because this is a open source project, so there is no reason to to move, everybody can see the code, and Microsoft was already able to see the code before...

[probonopd]

I'm not worried about Microsoft seeing the code. Heck, Microsoft is even using the code ;-)

[DanielRios549]

Because of this exists the licenses, I think it has to accept them before doing something, use the code and close it later is not permitted in some licenses, for exemple...

[TheAssassin]

This is also not a license issue. It's not about the code itself. It's more about user data, privacy, data protection, ...

[antony-jr]

@TheAssassin

This is also not a license issue. It's not about the code itself. It's more about user data, privacy, data protection, ...

You cannot always protect everything until you host everything yourself , Take startpage for example , can you assure hundred percent that it will not record any data based on IP ? everyone records IP and other stuff and it is inevitable. We are actually trading our privacy for the free storage they give us. I Hope this would change in the future.

We are in a dilemma that if we host our own space there is a large maintenance involved and if we use free hosting we lose our privacy.

@DanielRios549

This situation is really bad. Microsoft has no integrity in their work , Even their OS is a ripoff of CP/M.
Its not only about privacy or even data protection , But Microsoft screwed up every company they acquired , Nokia , Linkedin , and other good companies. So according to statistics I think Github will also have the same end result. But lose no hope , The new CEO of Github does seem to be promising. But we don't know what the future holds , So lets just wait and see.

In this situation all we can do is to make the AppImage upload and packaging in continuous integration more portable so in any situation we can move on without any lag.

[TheAssassin]

@antony-jr there is a difference in how companies process your personal data. Microsoft has shown so often that they don't respect privacy, or that they have any interest in complying with law.

Also, not everyone records IPs. That's just not true. For instance, I don't do this on https://appimage.org. Your IP is pseudonymized to the minimum amount of bytes that is needed in case of attacks to take measures (i.e., for IPv4, only the first two bytes are stored, for IPv6 the first 8 bytes are stored). There is also no tracking of any kind, except for the YouTube video stuff that I intend to make click-to-play soon.
There's also bigger companies which don't track or at least respect settings like Do-Not-Track.

Self hosting wouldn't be an issue at all. The maintenance effort for hosting e.g., Gitea, is very low. I know because I have >5 instances running.

In any case, running for GitLab hastily doesn't solve anything. I believe they're more interested in privacy, looking at their legal documents, but they're the next "big platform". If it was my decision, I would vote for more decentralization, and would set up our own development environment. If Gitea was too limited, I wouldn't even bother setting up GitLab but propose setting up a Phabricator instance. The only disadvantage there would be that it's much harder for people to contribute (harder than "I'm logged in on GitHub and I want to fix this typo so I hit edit and with three more clicks I can send a PR).

Anyway, _calm down_. Before the end of 2018, we don't have to do anything.

[antony-jr]

If it was my decision, I would vote for more decentralization, and would set up our own development environment.

@TheAssassin Why can't we use Dat to host Gitea. You said there are people in china who are willing to seed files for AppImages , So if they can host a Gitlab or Gitea instance for AppImage we don't have to worry about privacy or anything.

[probonopd]

Why can't we use Dat to host Gitea.

While I find p2p for git very interesting, I think the issue of global code search/discoverability is not solved yet, at least not on par with what GitHub provides.

[antony-jr]

Sounds fair.

[TheAssassin]

@TheAssassin Why can't we use Dat to host Gitea. You said there are people in china who are willing to seed files for AppImages , So if they can host a Gitlab or Gitea instance for AppImage we don't have to worry about privacy or anything.

This doesn't make any sense. Dat doesn't just "host" random software... And it's not like I couldn't start another Gitea instance on my host.

I don't know what China has to do with this....

[antony-jr]

I'm referring to people who are willing to seed files for AppImages. Dat does provide a way to host websites. But I think we can leave this for now.

[TheAssassin]

Interactive web application != web site...

[RalphPfeiffer]

Stay here please... 😋