Re: Moving sourceware to the Linux Foundation? No thanks.

[Carlos O'Donell <carlos@redhat.com>]

On 9/26/22 15:57, Frank Ch. Eigler via Overseers wrote:
> Hi -
> 
>> I see two important points that ought to be discussed on this topic.
> 
> Thanks for joining the discussion.
> 
>> The first is succession planning.  Sourceware is essentially a community
>> project with a relatively small number of people keeping it going.  It
>> needs trusted and capable people to step it to continue to maintain it.
>> Where are those people going to come from?  We shouldn't simply hope
>> that it will keep carrying on as before.
> 
> Fair, we need to attend to recruiting more helpers.  (It was with this
> in mind that some folks got root on sourceware in the last few years.)
> With some moderate funding, the small amount of IT effort this place
> requires could be filled out with talented part-timers.  OTOH, it's
> not an emergency, and the system is not complicated, running
> off-the-shelf basic RHEL8 for the core stuff (git, mail, mailing
> lists, http, ssh, authentication).

I think it's more than just recruiting more helpers.

Succession planning means taking Ian's comment seriously, planning out the costs
if the volunteers don't show up, and making sure there is funding in place for
projected costs.

It's a hard problem because tracking down funding is hard, and estimation is also
hard.
 
>> The second, mentioned in Mark's e-mail, is security.  I hope that we
>> can all agree that there are highly intelligent, highly motivated
>> people seeking to break security on GNU/Linux and other free
>> operating systems.  [...]  sourceware be defended against these
>> kinds of attacks with mechanisms for prevention and detection and
>> restoration.  [...]
> 
> Luckily, sourceware is a pure upstream source repo, ships no binaries,
> and holds no secrets.  As long as the integrity of the data is assured
> (for example by some mixture of crypto signed git-everything, broad
> backups of the git data, and project reviewers/maintainers doing their
> jobs), I don't think Thompson's hypothetical attack can be effective.
> Certainly, suggestions to improve infrastructure stability /
> resilience would be welcome, but it seems like projects can already
> self-serve code-repo security, if they choose to.

(a) Today - Shipping binary artifacts.

Where are the Cygwin windows binaries hosted?

For example: https://cygwin.com/setup-x86_64.exe

(b) Tomorrow - Shipping binary artifacts.

There might be a future where we want to ship cross-tooling directly for the
GNU Toolchain to make it easier, like djgpp did, to bring FOSS to an ever expanding
and wider audience.

Even if we don't ship binaries, shipping source tarballs also might be of interest
(currently only shipped via the GNU Project repositories).

-- 
Cheers,
Carlos.