Migrating to codeberg ?

[LienRag]

Github has been a contradiction in the organization of free software for a long time, a platform with extremely convenient tools for hosting free software, but not free itself.

It falling under the clutches of evil made it even more visible and problematic, for quite some time now.

With Copilot experimentation, whose legal consequences are still quite difficult to analyze and predict, things have gotten real worse.
There is a definite possibility that any code hosted on Github, whatever its license, will be contributing to a privateering behemoth.

From what I understand, Codeberg is a free non-profit alternative to github for people who do not want to self-host their code.

As the federation of gitlab is still in limbo, is migrating to Codeberg a viable solution ?
Is there any plan to migrate the FreeOrion repository to it ?

[Geoff the Medio]

Is there any plan to migrate the FreeOrion repository to it ?

There is no plan to move hosting of FreeOrion code.

I don't personally care much about mostly-theoretical concerns about what Microsoft might do or might be doing with code on GitHub. I also don't really care much about how the hosting infrastructure for FreeOrion's code repository is run, as long as the FreeOrion code and assests remain freely available to view and modify with our chosen licenses. If it's clearly demonstrated that they are doing something via GitHub that is objectionable, then we might reconsider the situation.

Also, after a brief discussion in the monthly org meeting that's just finishing as I type this, there is likely a substantial cost to migration, and Codeberg is not something we can currently assume will continue to exist and be well-supported long term.

[LienRag]

as long as the FreeOrion code and assests remain freely available to view and modify with our chosen licenses.

Well, if it's re-used by Copilot it is definitely not "with our chosen licenses"...
Apparently that was the last straw that motivated SFConservancy to launch their "Give Up Github" campaign.

Also, after a brief discussion in the monthly org meeting that's just finishing as I type this, there is likely a substantial cost to migration,

There is some cost to migration, yes. And I'd be ready to help with that (the workload I mean).
It's also probably possible to get some help from other FOSS enthusiasts, as moving away from Github is a valuable objective.

Codeberg is not something we can currently assume will continue to exist and be well-supported long term.

Codeberg is a Gitea instance and clearly getting traction.
Also, Gitea federates now and Forge Federation is clearly the future.

Note that Gitea itself is pulling out of Github and finding that it's a very slow process so it could be wise to start soon.

[Oberlus]

There is some cost to migration, yes. And I'd be ready to help with that (the workload I mean).
It's also probably possible to get some help from other FOSS enthusiasts, as moving away from Github is a valuable objective.

You have my green light. Go migrate FreeOrion to Codeberg.
The licenses of FreeOrion allow anyone to do such thing and even start their own fork of FreeOrion.
Once migrated and working, devs could consider deleting FreeOrion in GitHub and sticking to Codeberg.

it's a very slow process so it could be wise to start soon.

Nah. There is some cost to migration. Not a a big cost, just some cost. But I'm not suggesting you to wait or anything. Go migrate FreeOrion to Codeberg.

[o01eg]

Is it possible to migrate issues and PRs with discussions? What about CI?

[LienRag]

Is it possible to migrate issues and PRs with discussions? What about CI?

From my test migrating PRs, Issues, Labels, Releases and Milestones requires an Access Token.
I infer from it that it's possible (if one has an access token, which I don't since the FreeOrion github repository does not belong to me).

I know nothing about CI though.

[LienRag]

I guess all of you Linux users/dev are aware of the XZ CVE.
Maybe you're less aware that Github closed their repo and suspended the account of their maintainer, who isn't to blame.

[Oberlus]

their maintainer, who isn't to blame.

You sure?

The malicious changes were submitted by JiaT75, one of the two main xz Utils developers with years of contributions to the project.

“Given the activity over several weeks, the committer is either directly involved or there was some quite severe compromise of their system,” Freund wrote. “Unfortunately the latter looks like the less likely explanation, given they communicated on various lists about the ‘fixes’”

https://arstechnica.com/security/2024/0 ... nnections/

[LienRag]

AFAIK, yes.
It's a serious attack, where someone infiltrated the team (which consisted mainly of the main maintainer) for long enough to gain trust and get accepted as a second maintainer.
The original maintainer (so, not JiaT75) has done no wrong except trusting a very patient attacker that took the time to build trust by contributing code.
Yet github suspended his account.

[wobbly]

I do notice that "as far as I know" = "a blog post that originates from a twitter thread". I'll also note that being in charge of a project or organization often comes with legal responsibilities whether its a paid position or volunteer work. It comes with the same responsibilities whether you have the time and legal knowledge, or not.

[Grummel7]

Reminds me of https://xkcd.com/2347/