"H. Peter Anvin" <hpa@zytor.com> writes: > Eric W. Biederman wrote: >> If I really care what developer xyz tagged I will pull from them, >> or a mirror I trust. And since developer xyz doesn't pull his >> own global tags from other repositories that should be sufficient. >> > > You're missing something totally and utterly fundamental here: I'm talking about > creating an infrastructure (think sourceforge) where there is only one git > repository for the whole system, period, full stop, end of story. Could be I'm certainly not up to speed on git yet. However all you have to do for your single system git repository is to filter tags at creation time. So for a person to upload something you need a git aware tool and you need authentication so you are certain it is the right person creating the tag. Since it is a shared repository you probably want rules like you can only create tags that belong to yourself or are owned by people who do not have accounts on the system. Likewise in a system like sourceforge it is desirable to check all of the committer information in commits as well, so you have a reasonable audit trail, and it make sense to check little things like the file under a sha1 key actually matches the sha1 key. Downstream mirrors can happily rsync just fine. So long as they verify the upstream source. Tags that you mirror are of course suspect but they will always be. The primary tags created by people with accounts should be reliable though. So in essence I see nothing with my proposal that is any worse than any other part of git. That being said, it sounds like there is a slightly more git knowledgeable/native version suggested having to do with multiple heads. Eric - To unsubscribe from this list: send the line "unsubscribe git" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.htmlReceived on Sat Jul 09 16:28:57 2005
This archive was generated by hypermail 2.1.8 : 2005-07-09 16:28:58 EST