From mboxrd@z Thu Jan 1 00:00:00 1970 From: Ian Barton Subject: Re: Why no secure code retrieval Date: Sat, 2 Jul 2016 17:51:30 +0100 Message-ID: <20160702165130.GA1401@scamper2.bantercat.co.uk> References: <87mvm4sewl.fsf@systemreboot.net> <87y45m28vp.fsf@saiph.selenimh> <87lh1k5dj1.fsf@free.fr> Reply-To: lists@wilkesley.net Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Return-path: Received: from eggs.gnu.org ([2001:4830:134:3::10]:42698) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1bJO95-0003TZ-96 for emacs-orgmode@gnu.org; Sat, 02 Jul 2016 12:51:56 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1bJO93-0008Fk-3w for emacs-orgmode@gnu.org; Sat, 02 Jul 2016 12:51:54 -0400 Content-Disposition: inline In-Reply-To: <87lh1k5dj1.fsf@free.fr> List-Id: "General discussions about Org-mode." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: emacs-orgmode-bounces+geo-emacs-orgmode=m.gmane.org@gnu.org Sender: "Emacs-orgmode" To: Bastien Guerry Cc: Arun Isaac , emacs-orgmode@gnu.org, Konstantin Kliakhandler , Nicolas Goaziou On Sat, Jul 02, 2016 at 04:18:42PM +0200, Bastien Guerry wrote: > Hi Nicolas, > > Nicolas Goaziou writes: > > > GPG signing tags is OK, but I wouldn't like to request every commit to > > be signed. > > Agreed. > > >>> I know that https can be a bit tedious to setup so I am not asking for it > >>> (though I do think it would be great if it was enabled on the site in some > >>> fashion). > >> > >> HTTPS is not so tedious these days with Let's Encrypt. > >> > >> https://letsencrypt.org/ > >> > >> We should set up HTTPS as well. > > > I'm considering paying for a digitalocean instance, with https via > letsencrypt for both the website and git. > > I'm also considering switching from our current git setup to using > Gogs (https://gogs.io): this would ease the process of adding new > contributors, welcoming more org repositories, etc. > > The other solution would simply to use https://savannah.gnu.org. > > One remaining problem for both gogs and savannah is to ensure web > references to commits are correctly redirected, which I think is > one line of nginx configuration. > > I'm curious to know what people think about the switch to something > like gogs*. > > Thanks, > > * gitlab seems too heavy, and I'm more experienced in maintaining > gogs instances than gitlab instances. > > -- > Bastien > Not heard of Gogs before, although it looks nice. Another possiblity would be gitolite with cgit. Gitolite is very flexible and as a consequence can be hard to set up initially. The documentation is very comprehensive. It supports mirroring of repos. -- Best wishes, Ian.