You are viewing a plain text version of this content. The canonical link for it is here.

Posted to dev@cloudstack.apache.org by Rohit Yadav <ro...@shapeblue.com> on 2014/08/29 13:57:15 UTC

[DISCUSS] Prevent force push on release and master branches

Hi all,

I found by accident that you can force push on branches on our ACS/ASF repo.

So, I’m concerned that anyone could do a force push, sneak in changes on ACS/ASF branches; opensource projects have had issues with people changing histories, putting backdoors and whatnot, so I would like to avoid that. For example, I would like us to disable force-push(es) on our git repos to avoid a situation like Jenkins had:

https://groups.google.com/forum/#!searchin/jenkinsci-dev/force$20push/jenkinsci-dev/-myjRIPcVwU/mrwn8VkyXagJ

So, I requested the infra team [1] to disable force pushes on release and master branches because that made sense and I was told that they don’t allow force pushes on master (relief!) but not on release branches because it would be hard to track the release branch names. I asked them if we should disable force pushed on all branches at all and if they people want to do it, they can do it in their own private/github repos/forks.

So, I’m told that we need to discuss this issue and only after a decision/voting they would implement such a change? What do you think, what are the pros and cons of disabling force pushes and should we do it?

[1] https://issues.apache.org/jira/browse/INFRA-8228

Regards,
Rohit Yadav
Software Architect, ShapeBlue
M. +41 779015219 | rohit.yadav@shapeblue.com
Blog: bhaisaab.org | Twitter: @_bhaisaab

Find out more about ShapeBlue and our range of CloudStack related services

IaaS Cloud Design & Build<http://shapeblue.com/iaas-cloud-design-and-build//>
CSForge – rapid IaaS deployment framework<http://shapeblue.com/csforge/>
CloudStack Consulting<http://shapeblue.com/cloudstack-consultancy/>
CloudStack Infrastructure Support<http://shapeblue.com/cloudstack-infrastructure-support/>
CloudStack Bootcamp Training Courses<http://shapeblue.com/cloudstack-training/>

This email and any attachments to it may be confidential and are intended solely for the use of the individual to whom it is addressed. Any views or opinions expressed are solely those of the author and do not necessarily represent those of Shape Blue Ltd or related companies. If you are not the intended recipient of this email, you must neither take any action based upon its contents, nor copy or show it to anyone. Please contact the sender if you believe you have received this email in error. Shape Blue Ltd is a company incorporated in England & Wales. ShapeBlue Services India LLP is a company incorporated in India and is operated under license from Shape Blue Ltd. Shape Blue Brasil Consultoria Ltda is a company incorporated in Brasil and is operated under license from Shape Blue Ltd. ShapeBlue SA Pty Ltd is a company registered by The Republic of South Africa and is traded under license from Shape Blue Ltd. ShapeBlue is a registered trademark.

Re: [DISCUSS] Prevent force push on release and master branches

Posted by ilya musayev <il...@gmail.com>.

+1 on disable force push.

On 8/29/14, 8:39 AM, Nate Gordon wrote:
> +1 Rewrite history on a public repo opens the door for very catastrophic
> situations.
>
>
> On Fri, Aug 29, 2014 at 7:23 AM, Ian Duffy <ia...@ianduffy.ie> wrote:
>
>>> So, I’m told that we need to discuss this issue and only after a
>> decision/voting they would implement such a change? What do you think, what
>> are the pros and cons of disabling force pushes and should we do it?
>>
>> Definitely a +1 on disabling. forced pushing in my view should be never
>> used on a public repository. It can break somebodies pull and reset/rewrite
>> history in a repo.
>>
>> There should be no reason for anybody to ever have a requirement to do a
>> force push. Git supplies us with a revert that will allow us to undo
>> commits without destroying history.
>>
>>
>> On 29 August 2014 12:57, Rohit Yadav <ro...@shapeblue.com> wrote:
>>
>>> Hi all,
>>>
>>> I found by accident that you can force push on branches on our ACS/ASF
>>> repo.
>>>
>>> So, I’m concerned that anyone could do a force push, sneak in changes on
>>> ACS/ASF branches; opensource projects have had issues with people
>> changing
>>> histories, putting backdoors and whatnot, so I would like to avoid that.
>>> For example, I would like us to disable force-push(es) on our git repos
>> to
>>> avoid a situation like  Jenkins had:
>>>
>>>
>>>
>> https://groups.google.com/forum/#!searchin/jenkinsci-dev/force$20push/jenkinsci-dev/-myjRIPcVwU/mrwn8VkyXagJ
>>> So, I requested the infra team [1] to disable force pushes on release and
>>> master branches because that made sense and I was told that they don’t
>>> allow force pushes on master (relief!) but not on release branches
>> because
>>> it would be hard to track the release branch names. I asked them if we
>>> should disable force pushed on all branches at all and if they people
>> want
>>> to do it, they can do it in their own private/github repos/forks.
>>>
>>> So, I’m told that we need to discuss this issue and only after a
>>> decision/voting they would implement such a change? What do you think,
>> what
>>> are the pros and cons of disabling force pushes and should we do it?
>>>
>>> [1] https://issues.apache.org/jira/browse/INFRA-8228
>>>
>>>
>>> Regards,
>>> Rohit Yadav
>>> Software Architect, ShapeBlue
>>> M. +41 779015219 | rohit.yadav@shapeblue.com
>>> Blog: bhaisaab.org | Twitter: @_bhaisaab
>>>
>>>
>>>
>>> Find out more about ShapeBlue and our range of CloudStack related
>> services
>>> IaaS Cloud Design & Build<
>>> http://shapeblue.com/iaas-cloud-design-and-build//>
>>> CSForge – rapid IaaS deployment framework<http://shapeblue.com/csforge/>
>>> CloudStack Consulting<http://shapeblue.com/cloudstack-consultancy/>
>>> CloudStack Infrastructure Support<
>>> http://shapeblue.com/cloudstack-infrastructure-support/>
>>> CloudStack Bootcamp Training Courses<
>>> http://shapeblue.com/cloudstack-training/>
>>>
>>> This email and any attachments to it may be confidential and are intended
>>> solely for the use of the individual to whom it is addressed. Any views
>> or
>>> opinions expressed are solely those of the author and do not necessarily
>>> represent those of Shape Blue Ltd or related companies. If you are not
>> the
>>> intended recipient of this email, you must neither take any action based
>>> upon its contents, nor copy or show it to anyone. Please contact the
>> sender
>>> if you believe you have received this email in error. Shape Blue Ltd is a
>>> company incorporated in England & Wales. ShapeBlue Services India LLP is
>> a
>>> company incorporated in India and is operated under license from Shape
>> Blue
>>> Ltd. Shape Blue Brasil Consultoria Ltda is a company incorporated in
>> Brasil
>>> and is operated under license from Shape Blue Ltd. ShapeBlue SA Pty Ltd
>> is
>>> a company registered by The Republic of South Africa and is traded under
>>> license from Shape Blue Ltd. ShapeBlue is a registered trademark.
>>>
>
>

Re: [DISCUSS] Prevent force push on release and master branches

Posted by Nate Gordon <na...@appcore.com>.

+1 Rewrite history on a public repo opens the door for very catastrophic
situations.


On Fri, Aug 29, 2014 at 7:23 AM, Ian Duffy <ia...@ianduffy.ie> wrote:

> > So, I’m told that we need to discuss this issue and only after a
> decision/voting they would implement such a change? What do you think, what
> are the pros and cons of disabling force pushes and should we do it?
>
> Definitely a +1 on disabling. forced pushing in my view should be never
> used on a public repository. It can break somebodies pull and reset/rewrite
> history in a repo.
>
> There should be no reason for anybody to ever have a requirement to do a
> force push. Git supplies us with a revert that will allow us to undo
> commits without destroying history.
>
>
> On 29 August 2014 12:57, Rohit Yadav <ro...@shapeblue.com> wrote:
>
> > Hi all,
> >
> > I found by accident that you can force push on branches on our ACS/ASF
> > repo.
> >
> > So, I’m concerned that anyone could do a force push, sneak in changes on
> > ACS/ASF branches; opensource projects have had issues with people
> changing
> > histories, putting backdoors and whatnot, so I would like to avoid that.
> > For example, I would like us to disable force-push(es) on our git repos
> to
> > avoid a situation like  Jenkins had:
> >
> >
> >
> https://groups.google.com/forum/#!searchin/jenkinsci-dev/force$20push/jenkinsci-dev/-myjRIPcVwU/mrwn8VkyXagJ
> >
> > So, I requested the infra team [1] to disable force pushes on release and
> > master branches because that made sense and I was told that they don’t
> > allow force pushes on master (relief!) but not on release branches
> because
> > it would be hard to track the release branch names. I asked them if we
> > should disable force pushed on all branches at all and if they people
> want
> > to do it, they can do it in their own private/github repos/forks.
> >
> > So, I’m told that we need to discuss this issue and only after a
> > decision/voting they would implement such a change? What do you think,
> what
> > are the pros and cons of disabling force pushes and should we do it?
> >
> > [1] https://issues.apache.org/jira/browse/INFRA-8228
> >
> >
> > Regards,
> > Rohit Yadav
> > Software Architect, ShapeBlue
> > M. +41 779015219 | rohit.yadav@shapeblue.com
> > Blog: bhaisaab.org | Twitter: @_bhaisaab
> >
> >
> >
> > Find out more about ShapeBlue and our range of CloudStack related
> services
> >
> > IaaS Cloud Design & Build<
> > http://shapeblue.com/iaas-cloud-design-and-build//>
> > CSForge – rapid IaaS deployment framework<http://shapeblue.com/csforge/>
> > CloudStack Consulting<http://shapeblue.com/cloudstack-consultancy/>
> > CloudStack Infrastructure Support<
> > http://shapeblue.com/cloudstack-infrastructure-support/>
> > CloudStack Bootcamp Training Courses<
> > http://shapeblue.com/cloudstack-training/>
> >
> > This email and any attachments to it may be confidential and are intended
> > solely for the use of the individual to whom it is addressed. Any views
> or
> > opinions expressed are solely those of the author and do not necessarily
> > represent those of Shape Blue Ltd or related companies. If you are not
> the
> > intended recipient of this email, you must neither take any action based
> > upon its contents, nor copy or show it to anyone. Please contact the
> sender
> > if you believe you have received this email in error. Shape Blue Ltd is a
> > company incorporated in England & Wales. ShapeBlue Services India LLP is
> a
> > company incorporated in India and is operated under license from Shape
> Blue
> > Ltd. Shape Blue Brasil Consultoria Ltda is a company incorporated in
> Brasil
> > and is operated under license from Shape Blue Ltd. ShapeBlue SA Pty Ltd
> is
> > a company registered by The Republic of South Africa and is traded under
> > license from Shape Blue Ltd. ShapeBlue is a registered trademark.
> >
>



-- 


*Nate Gordon*Director of Technology | Appcore - the business of cloud
computing®

Office +1.800.735.7104  |  Direct +1.515.612.7787
nate.gordon@appcore.com  |  www.appcore.com

----------------------------------------------------------------------

The information in this message is intended for the named recipients only.
It may contain information that is privileged, confidential or otherwise
protected from disclosure. If you are not the intended recipient, you are
hereby notified that any disclosure, copying, distribution, or the taking
of any action in reliance on the contents of this message is strictly
prohibited. If you have received this e-mail in error, do not print it or
disseminate it or its contents. In such event, please notify the sender by
return e-mail and delete the e-mail file immediately thereafter. Thank you.

Re: [DISCUSS] Prevent force push on release and master branches

Posted by Ian Duffy <ia...@ianduffy.ie>.

> So, I’m told that we need to discuss this issue and only after a
decision/voting they would implement such a change? What do you think, what
are the pros and cons of disabling force pushes and should we do it?

Definitely a +1 on disabling. forced pushing in my view should be never
used on a public repository. It can break somebodies pull and reset/rewrite
history in a repo.

There should be no reason for anybody to ever have a requirement to do a
force push. Git supplies us with a revert that will allow us to undo
commits without destroying history.


On 29 August 2014 12:57, Rohit Yadav <ro...@shapeblue.com> wrote:

> Hi all,
>
> I found by accident that you can force push on branches on our ACS/ASF
> repo.
>
> So, I’m concerned that anyone could do a force push, sneak in changes on
> ACS/ASF branches; opensource projects have had issues with people changing
> histories, putting backdoors and whatnot, so I would like to avoid that.
> For example, I would like us to disable force-push(es) on our git repos to
> avoid a situation like  Jenkins had:
>
>
> https://groups.google.com/forum/#!searchin/jenkinsci-dev/force$20push/jenkinsci-dev/-myjRIPcVwU/mrwn8VkyXagJ
>
> So, I requested the infra team [1] to disable force pushes on release and
> master branches because that made sense and I was told that they don’t
> allow force pushes on master (relief!) but not on release branches because
> it would be hard to track the release branch names. I asked them if we
> should disable force pushed on all branches at all and if they people want
> to do it, they can do it in their own private/github repos/forks.
>
> So, I’m told that we need to discuss this issue and only after a
> decision/voting they would implement such a change? What do you think, what
> are the pros and cons of disabling force pushes and should we do it?
>
> [1] https://issues.apache.org/jira/browse/INFRA-8228
>
>
> Regards,
> Rohit Yadav
> Software Architect, ShapeBlue
> M. +41 779015219 | rohit.yadav@shapeblue.com
> Blog: bhaisaab.org | Twitter: @_bhaisaab
>
>
>
> Find out more about ShapeBlue and our range of CloudStack related services
>
> IaaS Cloud Design & Build<
> http://shapeblue.com/iaas-cloud-design-and-build//>
> CSForge – rapid IaaS deployment framework<http://shapeblue.com/csforge/>
> CloudStack Consulting<http://shapeblue.com/cloudstack-consultancy/>
> CloudStack Infrastructure Support<
> http://shapeblue.com/cloudstack-infrastructure-support/>
> CloudStack Bootcamp Training Courses<
> http://shapeblue.com/cloudstack-training/>
>
> This email and any attachments to it may be confidential and are intended
> solely for the use of the individual to whom it is addressed. Any views or
> opinions expressed are solely those of the author and do not necessarily
> represent those of Shape Blue Ltd or related companies. If you are not the
> intended recipient of this email, you must neither take any action based
> upon its contents, nor copy or show it to anyone. Please contact the sender
> if you believe you have received this email in error. Shape Blue Ltd is a
> company incorporated in England & Wales. ShapeBlue Services India LLP is a
> company incorporated in India and is operated under license from Shape Blue
> Ltd. Shape Blue Brasil Consultoria Ltda is a company incorporated in Brasil
> and is operated under license from Shape Blue Ltd. ShapeBlue SA Pty Ltd is
> a company registered by The Republic of South Africa and is traded under
> license from Shape Blue Ltd. ShapeBlue is a registered trademark.
>

Re: [DISCUSS] Prevent force push on release and master branches

Posted by Daan Hoogland <da...@gmail.com>.

Rajani, I agree that moving tags is not best practice but with our release
candidate custom it is better then not tagging until certain.


On Mon, Sep 1, 2014 at 11:25 AM, Rajani Karuturi <ra...@apache.org> wrote:

> If force push is disabled, feature branches wont be able to rebase on
> master directly unless they create a temp branch or do a merge.[1]
>
> Moving tags aren't recommended. see discussion on "Re-tagging" in git-tag
> man page [2]
>
> [1]
>
> http://stackoverflow.com/questions/8939977/git-push-rejected-after-feature-branch-rebase
> [2] https://www.kernel.org/pub/software/scm/git/docs/git-tag.html
>
>
>
> ~Rajani
>
>
> On Mon, Sep 1, 2014 at 1:45 PM, Rohit Yadav <ro...@shapeblue.com>
> wrote:
>
> >
> > On 01-Sep-2014, at 9:55 am, Daan Hoogland <da...@gmail.com>
> wrote:
> >
> > > I worry that disabling force push will inhibit moving tags and deleting
> > > branches, two thing I definately want to keep on doing.
> >
> > I’ve worked on git hooks before, and you can still be able to delete tags
> > and branches if we were to disable force pushes. This is technically
> > possible.
> >
> >
> > >
> > >
> > > On Sat, Aug 30, 2014 at 3:15 AM, David Nalley <da...@gnsa.us> wrote:
> > >
> > >> Projects do not have the ability to specify their own hooks. You
> > >> essentially get the same set as every other project in the Foundation
> > >> using git. The reasons behind this are that essentially projects would
> > >> have an incredibly divergent set of hooks, they would be
> > >> unmaintainable long term. Infra has had experiences in the past where
> > >> commit (or pre-commit) hooks were configurable and ended up causing
> > >> massive performance impacts; and were incredibly difficult to trace
> > >> down.
> > >>
> > >> Most hook functionality (though not in the case) can be accomplished
> > >> with gitpubsub, which is what a majority of folks do who want
> > >> hook-like functionality.
> > >>
> > >> You can ask/make the recommendation that the foundation disable force
> > >> pushes across all branches of all repositories at the foundation. That
> > >> may actually make a lot of sense. But I don't know that everyone will
> > >> agree. (I tend to concur, I can't think of a good reason one would do
> > >> a force push).
> > >>
> > >> --David
> > >>
> > >> On Fri, Aug 29, 2014 at 3:13 PM, Rohit Yadav <
> rohit.yadav@shapeblue.com
> > >
> > >> wrote:
> > >>> Hi David,
> > >>>
> > >>> On 29-Aug-2014, at 6:59 pm, David Nalley <da...@gnsa.us> wrote:
> > >>>> force pushes on master are already prohibited.
> > >>>> The other branches allow that though.
> > >>>
> > >>> We already know this. The discussion is;
> > >>>
> > >>> 1. Should we put git hooks to prevent force pushes on all branches?
> > >> (people would be still able to delete any remote branches though,
> which
> > is
> > >> another issue IMO that you can delete any remote branch other than
> > master)
> > >>>
> > >>> 2. Any reason we should not do that, for example if anyone has a good
> > >> reason to use force push?
> > >>>
> > >>> Regards,
> > >>> Rohit Yadav
> > >>> Software Architect, ShapeBlue
> > >>> M. +41 779015219 | rohit.yadav@shapeblue.com
> > >>> Blog: bhaisaab.org | Twitter: @_bhaisaab
> > >>>
> > >>>
> > >>>
> > >>> Find out more about ShapeBlue and our range of CloudStack related
> > >> services
> > >>>
> > >>> IaaS Cloud Design & Build<
> > >> http://shapeblue.com/iaas-cloud-design-and-build//>
> > >>> CSForge – rapid IaaS deployment framework<
> > http://shapeblue.com/csforge/>
> > >>> CloudStack Consulting<http://shapeblue.com/cloudstack-consultancy/>
> > >>> CloudStack Infrastructure Support<
> > >> http://shapeblue.com/cloudstack-infrastructure-support/>
> > >>> CloudStack Bootcamp Training Courses<
> > >> http://shapeblue.com/cloudstack-training/>
> > >>>
> > >>> This email and any attachments to it may be confidential and are
> > >> intended solely for the use of the individual to whom it is addressed.
> > Any
> > >> views or opinions expressed are solely those of the author and do not
> > >> necessarily represent those of Shape Blue Ltd or related companies. If
> > you
> > >> are not the intended recipient of this email, you must neither take
> any
> > >> action based upon its contents, nor copy or show it to anyone. Please
> > >> contact the sender if you believe you have received this email in
> error.
> > >> Shape Blue Ltd is a company incorporated in England & Wales. ShapeBlue
> > >> Services India LLP is a company incorporated in India and is operated
> > under
> > >> license from Shape Blue Ltd. Shape Blue Brasil Consultoria Ltda is a
> > >> company incorporated in Brasil and is operated under license from
> Shape
> > >> Blue Ltd. ShapeBlue SA Pty Ltd is a company registered by The Republic
> > of
> > >> South Africa and is traded under license from Shape Blue Ltd.
> ShapeBlue
> > is
> > >> a registered trademark.
> > >>
> > >
> > >
> > >
> > > --
> > > Daan
> >
> > Regards,
> > Rohit Yadav
> > Software Architect, ShapeBlue
> > M. +41 779015219 | rohit.yadav@shapeblue.com
> > Blog: bhaisaab.org | Twitter: @_bhaisaab
> >
> >
> >
> > Find out more about ShapeBlue and our range of CloudStack related
> services
> >
> > IaaS Cloud Design & Build<
> > http://shapeblue.com/iaas-cloud-design-and-build//>
> > CSForge – rapid IaaS deployment framework<http://shapeblue.com/csforge/>
> > CloudStack Consulting<http://shapeblue.com/cloudstack-consultancy/>
> > CloudStack Infrastructure Support<
> > http://shapeblue.com/cloudstack-infrastructure-support/>
> > CloudStack Bootcamp Training Courses<
> > http://shapeblue.com/cloudstack-training/>
> >
> > This email and any attachments to it may be confidential and are intended
> > solely for the use of the individual to whom it is addressed. Any views
> or
> > opinions expressed are solely those of the author and do not necessarily
> > represent those of Shape Blue Ltd or related companies. If you are not
> the
> > intended recipient of this email, you must neither take any action based
> > upon its contents, nor copy or show it to anyone. Please contact the
> sender
> > if you believe you have received this email in error. Shape Blue Ltd is a
> > company incorporated in England & Wales. ShapeBlue Services India LLP is
> a
> > company incorporated in India and is operated under license from Shape
> Blue
> > Ltd. Shape Blue Brasil Consultoria Ltda is a company incorporated in
> Brasil
> > and is operated under license from Shape Blue Ltd. ShapeBlue SA Pty Ltd
> is
> > a company registered by The Republic of South Africa and is traded under
> > license from Shape Blue Ltd. ShapeBlue is a registered trademark.
> >
>



-- 
Daan

Re: [DISCUSS] Prevent force push on release and master branches

Posted by Rajani Karuturi <ra...@apache.org>.

If force push is disabled, feature branches wont be able to rebase on
master directly unless they create a temp branch or do a merge.[1]

Moving tags aren't recommended. see discussion on "Re-tagging" in git-tag
man page [2]

[1]
http://stackoverflow.com/questions/8939977/git-push-rejected-after-feature-branch-rebase
[2] https://www.kernel.org/pub/software/scm/git/docs/git-tag.html



~Rajani


On Mon, Sep 1, 2014 at 1:45 PM, Rohit Yadav <ro...@shapeblue.com>
wrote:

>
> On 01-Sep-2014, at 9:55 am, Daan Hoogland <da...@gmail.com> wrote:
>
> > I worry that disabling force push will inhibit moving tags and deleting
> > branches, two thing I definately want to keep on doing.
>
> I’ve worked on git hooks before, and you can still be able to delete tags
> and branches if we were to disable force pushes. This is technically
> possible.
>
>
> >
> >
> > On Sat, Aug 30, 2014 at 3:15 AM, David Nalley <da...@gnsa.us> wrote:
> >
> >> Projects do not have the ability to specify their own hooks. You
> >> essentially get the same set as every other project in the Foundation
> >> using git. The reasons behind this are that essentially projects would
> >> have an incredibly divergent set of hooks, they would be
> >> unmaintainable long term. Infra has had experiences in the past where
> >> commit (or pre-commit) hooks were configurable and ended up causing
> >> massive performance impacts; and were incredibly difficult to trace
> >> down.
> >>
> >> Most hook functionality (though not in the case) can be accomplished
> >> with gitpubsub, which is what a majority of folks do who want
> >> hook-like functionality.
> >>
> >> You can ask/make the recommendation that the foundation disable force
> >> pushes across all branches of all repositories at the foundation. That
> >> may actually make a lot of sense. But I don't know that everyone will
> >> agree. (I tend to concur, I can't think of a good reason one would do
> >> a force push).
> >>
> >> --David
> >>
> >> On Fri, Aug 29, 2014 at 3:13 PM, Rohit Yadav <rohit.yadav@shapeblue.com
> >
> >> wrote:
> >>> Hi David,
> >>>
> >>> On 29-Aug-2014, at 6:59 pm, David Nalley <da...@gnsa.us> wrote:
> >>>> force pushes on master are already prohibited.
> >>>> The other branches allow that though.
> >>>
> >>> We already know this. The discussion is;
> >>>
> >>> 1. Should we put git hooks to prevent force pushes on all branches?
> >> (people would be still able to delete any remote branches though, which
> is
> >> another issue IMO that you can delete any remote branch other than
> master)
> >>>
> >>> 2. Any reason we should not do that, for example if anyone has a good
> >> reason to use force push?
> >>>
> >>> Regards,
> >>> Rohit Yadav
> >>> Software Architect, ShapeBlue
> >>> M. +41 779015219 | rohit.yadav@shapeblue.com
> >>> Blog: bhaisaab.org | Twitter: @_bhaisaab
> >>>
> >>>
> >>>
> >>> Find out more about ShapeBlue and our range of CloudStack related
> >> services
> >>>
> >>> IaaS Cloud Design & Build<
> >> http://shapeblue.com/iaas-cloud-design-and-build//>
> >>> CSForge – rapid IaaS deployment framework<
> http://shapeblue.com/csforge/>
> >>> CloudStack Consulting<http://shapeblue.com/cloudstack-consultancy/>
> >>> CloudStack Infrastructure Support<
> >> http://shapeblue.com/cloudstack-infrastructure-support/>
> >>> CloudStack Bootcamp Training Courses<
> >> http://shapeblue.com/cloudstack-training/>
> >>>
> >>> This email and any attachments to it may be confidential and are
> >> intended solely for the use of the individual to whom it is addressed.
> Any
> >> views or opinions expressed are solely those of the author and do not
> >> necessarily represent those of Shape Blue Ltd or related companies. If
> you
> >> are not the intended recipient of this email, you must neither take any
> >> action based upon its contents, nor copy or show it to anyone. Please
> >> contact the sender if you believe you have received this email in error.
> >> Shape Blue Ltd is a company incorporated in England & Wales. ShapeBlue
> >> Services India LLP is a company incorporated in India and is operated
> under
> >> license from Shape Blue Ltd. Shape Blue Brasil Consultoria Ltda is a
> >> company incorporated in Brasil and is operated under license from Shape
> >> Blue Ltd. ShapeBlue SA Pty Ltd is a company registered by The Republic
> of
> >> South Africa and is traded under license from Shape Blue Ltd. ShapeBlue
> is
> >> a registered trademark.
> >>
> >
> >
> >
> > --
> > Daan
>
> Regards,
> Rohit Yadav
> Software Architect, ShapeBlue
> M. +41 779015219 | rohit.yadav@shapeblue.com
> Blog: bhaisaab.org | Twitter: @_bhaisaab
>
>
>
> Find out more about ShapeBlue and our range of CloudStack related services
>
> IaaS Cloud Design & Build<
> http://shapeblue.com/iaas-cloud-design-and-build//>
> CSForge – rapid IaaS deployment framework<http://shapeblue.com/csforge/>
> CloudStack Consulting<http://shapeblue.com/cloudstack-consultancy/>
> CloudStack Infrastructure Support<
> http://shapeblue.com/cloudstack-infrastructure-support/>
> CloudStack Bootcamp Training Courses<
> http://shapeblue.com/cloudstack-training/>
>
> This email and any attachments to it may be confidential and are intended
> solely for the use of the individual to whom it is addressed. Any views or
> opinions expressed are solely those of the author and do not necessarily
> represent those of Shape Blue Ltd or related companies. If you are not the
> intended recipient of this email, you must neither take any action based
> upon its contents, nor copy or show it to anyone. Please contact the sender
> if you believe you have received this email in error. Shape Blue Ltd is a
> company incorporated in England & Wales. ShapeBlue Services India LLP is a
> company incorporated in India and is operated under license from Shape Blue
> Ltd. Shape Blue Brasil Consultoria Ltda is a company incorporated in Brasil
> and is operated under license from Shape Blue Ltd. ShapeBlue SA Pty Ltd is
> a company registered by The Republic of South Africa and is traded under
> license from Shape Blue Ltd. ShapeBlue is a registered trademark.
>

Re: [DISCUSS] Prevent force push on release and master branches

Posted by Rohit Yadav <ro...@shapeblue.com>.

On 01-Sep-2014, at 9:55 am, Daan Hoogland <da...@gmail.com> wrote:

> I worry that disabling force push will inhibit moving tags and deleting
> branches, two thing I definately want to keep on doing.

I’ve worked on git hooks before, and you can still be able to delete tags and branches if we were to disable force pushes. This is technically possible.


>
>
> On Sat, Aug 30, 2014 at 3:15 AM, David Nalley <da...@gnsa.us> wrote:
>
>> Projects do not have the ability to specify their own hooks. You
>> essentially get the same set as every other project in the Foundation
>> using git. The reasons behind this are that essentially projects would
>> have an incredibly divergent set of hooks, they would be
>> unmaintainable long term. Infra has had experiences in the past where
>> commit (or pre-commit) hooks were configurable and ended up causing
>> massive performance impacts; and were incredibly difficult to trace
>> down.
>>
>> Most hook functionality (though not in the case) can be accomplished
>> with gitpubsub, which is what a majority of folks do who want
>> hook-like functionality.
>>
>> You can ask/make the recommendation that the foundation disable force
>> pushes across all branches of all repositories at the foundation. That
>> may actually make a lot of sense. But I don't know that everyone will
>> agree. (I tend to concur, I can't think of a good reason one would do
>> a force push).
>>
>> --David
>>
>> On Fri, Aug 29, 2014 at 3:13 PM, Rohit Yadav <ro...@shapeblue.com>
>> wrote:
>>> Hi David,
>>>
>>> On 29-Aug-2014, at 6:59 pm, David Nalley <da...@gnsa.us> wrote:
>>>> force pushes on master are already prohibited.
>>>> The other branches allow that though.
>>>
>>> We already know this. The discussion is;
>>>
>>> 1. Should we put git hooks to prevent force pushes on all branches?
>> (people would be still able to delete any remote branches though, which is
>> another issue IMO that you can delete any remote branch other than master)
>>>
>>> 2. Any reason we should not do that, for example if anyone has a good
>> reason to use force push?
>>>
>>> Regards,
>>> Rohit Yadav
>>> Software Architect, ShapeBlue
>>> M. +41 779015219 | rohit.yadav@shapeblue.com
>>> Blog: bhaisaab.org | Twitter: @_bhaisaab
>>>
>>>
>>>
>>> Find out more about ShapeBlue and our range of CloudStack related
>> services
>>>
>>> IaaS Cloud Design & Build<
>> http://shapeblue.com/iaas-cloud-design-and-build//>
>>> CSForge – rapid IaaS deployment framework<http://shapeblue.com/csforge/>
>>> CloudStack Consulting<http://shapeblue.com/cloudstack-consultancy/>
>>> CloudStack Infrastructure Support<
>> http://shapeblue.com/cloudstack-infrastructure-support/>
>>> CloudStack Bootcamp Training Courses<
>> http://shapeblue.com/cloudstack-training/>
>>>
>>> This email and any attachments to it may be confidential and are
>> intended solely for the use of the individual to whom it is addressed. Any
>> views or opinions expressed are solely those of the author and do not
>> necessarily represent those of Shape Blue Ltd or related companies. If you
>> are not the intended recipient of this email, you must neither take any
>> action based upon its contents, nor copy or show it to anyone. Please
>> contact the sender if you believe you have received this email in error.
>> Shape Blue Ltd is a company incorporated in England & Wales. ShapeBlue
>> Services India LLP is a company incorporated in India and is operated under
>> license from Shape Blue Ltd. Shape Blue Brasil Consultoria Ltda is a
>> company incorporated in Brasil and is operated under license from Shape
>> Blue Ltd. ShapeBlue SA Pty Ltd is a company registered by The Republic of
>> South Africa and is traded under license from Shape Blue Ltd. ShapeBlue is
>> a registered trademark.
>>
>
>
>
> --
> Daan

Regards,
Rohit Yadav
Software Architect, ShapeBlue
M. +41 779015219 | rohit.yadav@shapeblue.com
Blog: bhaisaab.org | Twitter: @_bhaisaab



Find out more about ShapeBlue and our range of CloudStack related services

IaaS Cloud Design & Build<http://shapeblue.com/iaas-cloud-design-and-build//>
CSForge – rapid IaaS deployment framework<http://shapeblue.com/csforge/>
CloudStack Consulting<http://shapeblue.com/cloudstack-consultancy/>
CloudStack Infrastructure Support<http://shapeblue.com/cloudstack-infrastructure-support/>
CloudStack Bootcamp Training Courses<http://shapeblue.com/cloudstack-training/>

This email and any attachments to it may be confidential and are intended solely for the use of the individual to whom it is addressed. Any views or opinions expressed are solely those of the author and do not necessarily represent those of Shape Blue Ltd or related companies. If you are not the intended recipient of this email, you must neither take any action based upon its contents, nor copy or show it to anyone. Please contact the sender if you believe you have received this email in error. Shape Blue Ltd is a company incorporated in England & Wales. ShapeBlue Services India LLP is a company incorporated in India and is operated under license from Shape Blue Ltd. Shape Blue Brasil Consultoria Ltda is a company incorporated in Brasil and is operated under license from Shape Blue Ltd. ShapeBlue SA Pty Ltd is a company registered by The Republic of South Africa and is traded under license from Shape Blue Ltd. ShapeBlue is a registered trademark.

Re: [DISCUSS] Prevent force push on release and master branches

Posted by Daan Hoogland <da...@gmail.com>.

I worry that disabling force push will inhibit moving tags and deleting
branches, two thing I definately want to keep on doing.


On Sat, Aug 30, 2014 at 3:15 AM, David Nalley <da...@gnsa.us> wrote:

> Projects do not have the ability to specify their own hooks. You
> essentially get the same set as every other project in the Foundation
> using git. The reasons behind this are that essentially projects would
> have an incredibly divergent set of hooks, they would be
> unmaintainable long term. Infra has had experiences in the past where
> commit (or pre-commit) hooks were configurable and ended up causing
> massive performance impacts; and were incredibly difficult to trace
> down.
>
> Most hook functionality (though not in the case) can be accomplished
> with gitpubsub, which is what a majority of folks do who want
> hook-like functionality.
>
> You can ask/make the recommendation that the foundation disable force
> pushes across all branches of all repositories at the foundation. That
> may actually make a lot of sense. But I don't know that everyone will
> agree. (I tend to concur, I can't think of a good reason one would do
> a force push).
>
> --David
>
> On Fri, Aug 29, 2014 at 3:13 PM, Rohit Yadav <ro...@shapeblue.com>
> wrote:
> > Hi David,
> >
> > On 29-Aug-2014, at 6:59 pm, David Nalley <da...@gnsa.us> wrote:
> >> force pushes on master are already prohibited.
> >> The other branches allow that though.
> >
> > We already know this. The discussion is;
> >
> > 1. Should we put git hooks to prevent force pushes on all branches?
> (people would be still able to delete any remote branches though, which is
> another issue IMO that you can delete any remote branch other than master)
> >
> > 2. Any reason we should not do that, for example if anyone has a good
> reason to use force push?
> >
> > Regards,
> > Rohit Yadav
> > Software Architect, ShapeBlue
> > M. +41 779015219 | rohit.yadav@shapeblue.com
> > Blog: bhaisaab.org | Twitter: @_bhaisaab
> >
> >
> >
> > Find out more about ShapeBlue and our range of CloudStack related
> services
> >
> > IaaS Cloud Design & Build<
> http://shapeblue.com/iaas-cloud-design-and-build//>
> > CSForge – rapid IaaS deployment framework<http://shapeblue.com/csforge/>
> > CloudStack Consulting<http://shapeblue.com/cloudstack-consultancy/>
> > CloudStack Infrastructure Support<
> http://shapeblue.com/cloudstack-infrastructure-support/>
> > CloudStack Bootcamp Training Courses<
> http://shapeblue.com/cloudstack-training/>
> >
> > This email and any attachments to it may be confidential and are
> intended solely for the use of the individual to whom it is addressed. Any
> views or opinions expressed are solely those of the author and do not
> necessarily represent those of Shape Blue Ltd or related companies. If you
> are not the intended recipient of this email, you must neither take any
> action based upon its contents, nor copy or show it to anyone. Please
> contact the sender if you believe you have received this email in error.
> Shape Blue Ltd is a company incorporated in England & Wales. ShapeBlue
> Services India LLP is a company incorporated in India and is operated under
> license from Shape Blue Ltd. Shape Blue Brasil Consultoria Ltda is a
> company incorporated in Brasil and is operated under license from Shape
> Blue Ltd. ShapeBlue SA Pty Ltd is a company registered by The Republic of
> South Africa and is traded under license from Shape Blue Ltd. ShapeBlue is
> a registered trademark.
>



-- 
Daan

Re: [DISCUSS] Prevent force push on release and master branches

Posted by Rohit Yadav <ro...@shapeblue.com>.

I think you could still delete remote tag and retag and push, instead of doing a force push?
But yeah, if this is needed we should keep things as it is.

I just wanted to bring this issue to everyone and see if we should do something about it.

On 01-Sep-2014, at 2:04 pm, Leo Simons <LS...@schubergphilis.com> wrote:

> On Aug 30, 2014, at 3:15 AM, David Nalley <da...@gnsa.us> wrote:
>> You can ask/make the recommendation that the foundation disable force
>> pushes across all branches of all repositories at the foundation. That
>> may actually make a lot of sense. But I don't know that everyone will
>> agree. (I tend to concur, I can't think of a good reason one would do
>> a force push).
>
> You know I am a little surprised force push is allowed.
>
> When Paul first looked into setting up r/w git, a major foundation concern was getting a sufficiently auditable revision history (a strong point of svn), and IIRC quite some effort was spent locking things down [1].
>
> The fact it _isn’t_ fully locked down right now is a deviation from the original plan. Seems pretty likely to me there was a use case that required opening it up. I would guess tag moving to be a major argument, which I _think_ requires forcing.
>
>
> cheers,
>
>
> Leo
>
> [1] http://apache.markmail.org/thread/7ztq2pwm6456zqmy
>

Regards,
Rohit Yadav
Software Architect, ShapeBlue
M. +41 779015219 | rohit.yadav@shapeblue.com
Blog: bhaisaab.org | Twitter: @_bhaisaab

Find out more about ShapeBlue and our range of CloudStack related services

IaaS Cloud Design & Build<http://shapeblue.com/iaas-cloud-design-and-build//>
CSForge – rapid IaaS deployment framework<http://shapeblue.com/csforge/>
CloudStack Consulting<http://shapeblue.com/cloudstack-consultancy/>
CloudStack Infrastructure Support<http://shapeblue.com/cloudstack-infrastructure-support/>
CloudStack Bootcamp Training Courses<http://shapeblue.com/cloudstack-training/>

This email and any attachments to it may be confidential and are intended solely for the use of the individual to whom it is addressed. Any views or opinions expressed are solely those of the author and do not necessarily represent those of Shape Blue Ltd or related companies. If you are not the intended recipient of this email, you must neither take any action based upon its contents, nor copy or show it to anyone. Please contact the sender if you believe you have received this email in error. Shape Blue Ltd is a company incorporated in England & Wales. ShapeBlue Services India LLP is a company incorporated in India and is operated under license from Shape Blue Ltd. Shape Blue Brasil Consultoria Ltda is a company incorporated in Brasil and is operated under license from Shape Blue Ltd. ShapeBlue SA Pty Ltd is a company registered by The Republic of South Africa and is traded under license from Shape Blue Ltd. ShapeBlue is a registered trademark.

Re: [DISCUSS] Prevent force push on release and master branches

Posted by Leo Simons <LS...@schubergphilis.com>.

On Aug 30, 2014, at 3:15 AM, David Nalley <da...@gnsa.us> wrote:
> You can ask/make the recommendation that the foundation disable force
> pushes across all branches of all repositories at the foundation. That
> may actually make a lot of sense. But I don't know that everyone will
> agree. (I tend to concur, I can't think of a good reason one would do
> a force push).

You know I am a little surprised force push is allowed.

When Paul first looked into setting up r/w git, a major foundation concern was getting a sufficiently auditable revision history (a strong point of svn), and IIRC quite some effort was spent locking things down [1].

The fact it _isn’t_ fully locked down right now is a deviation from the original plan. Seems pretty likely to me there was a use case that required opening it up. I would guess tag moving to be a major argument, which I _think_ requires forcing.

cheers,

Leo

[1] http://apache.markmail.org/thread/7ztq2pwm6456zqmy

Re: [DISCUSS] Prevent force push on release and master branches

Posted by David Nalley <da...@gnsa.us>.

Projects do not have the ability to specify their own hooks. You
essentially get the same set as every other project in the Foundation
using git. The reasons behind this are that essentially projects would
have an incredibly divergent set of hooks, they would be
unmaintainable long term. Infra has had experiences in the past where
commit (or pre-commit) hooks were configurable and ended up causing
massive performance impacts; and were incredibly difficult to trace
down.

Most hook functionality (though not in the case) can be accomplished
with gitpubsub, which is what a majority of folks do who want
hook-like functionality.

You can ask/make the recommendation that the foundation disable force
pushes across all branches of all repositories at the foundation. That
may actually make a lot of sense. But I don't know that everyone will
agree. (I tend to concur, I can't think of a good reason one would do
a force push).

--David

On Fri, Aug 29, 2014 at 3:13 PM, Rohit Yadav <ro...@shapeblue.com> wrote:
> Hi David,
>
> On 29-Aug-2014, at 6:59 pm, David Nalley <da...@gnsa.us> wrote:
>> force pushes on master are already prohibited.
>> The other branches allow that though.
>
> We already know this. The discussion is;
>
> 1. Should we put git hooks to prevent force pushes on all branches? (people would be still able to delete any remote branches though, which is another issue IMO that you can delete any remote branch other than master)
>
> 2. Any reason we should not do that, for example if anyone has a good reason to use force push?
>
> Regards,
> Rohit Yadav
> Software Architect, ShapeBlue
> M. +41 779015219 | rohit.yadav@shapeblue.com
> Blog: bhaisaab.org | Twitter: @_bhaisaab
>
>
>
> Find out more about ShapeBlue and our range of CloudStack related services
>
> IaaS Cloud Design & Build<http://shapeblue.com/iaas-cloud-design-and-build//>
> CSForge – rapid IaaS deployment framework<http://shapeblue.com/csforge/>
> CloudStack Consulting<http://shapeblue.com/cloudstack-consultancy/>
> CloudStack Infrastructure Support<http://shapeblue.com/cloudstack-infrastructure-support/>
> CloudStack Bootcamp Training Courses<http://shapeblue.com/cloudstack-training/>
>
> This email and any attachments to it may be confidential and are intended solely for the use of the individual to whom it is addressed. Any views or opinions expressed are solely those of the author and do not necessarily represent those of Shape Blue Ltd or related companies. If you are not the intended recipient of this email, you must neither take any action based upon its contents, nor copy or show it to anyone. Please contact the sender if you believe you have received this email in error. Shape Blue Ltd is a company incorporated in England & Wales. ShapeBlue Services India LLP is a company incorporated in India and is operated under license from Shape Blue Ltd. Shape Blue Brasil Consultoria Ltda is a company incorporated in Brasil and is operated under license from Shape Blue Ltd. ShapeBlue SA Pty Ltd is a company registered by The Republic of South Africa and is traded under license from Shape Blue Ltd. ShapeBlue is a registered trademark.

Re: [DISCUSS] Prevent force push on release and master branches

Posted by Rohit Yadav <ro...@shapeblue.com>.

Hi David,

On 29-Aug-2014, at 6:59 pm, David Nalley <da...@gnsa.us> wrote:
> force pushes on master are already prohibited.
> The other branches allow that though.

We already know this. The discussion is;

1. Should we put git hooks to prevent force pushes on all branches? (people would be still able to delete any remote branches though, which is another issue IMO that you can delete any remote branch other than master)

2. Any reason we should not do that, for example if anyone has a good reason to use force push?

Regards,
Rohit Yadav
Software Architect, ShapeBlue
M. +41 779015219 | rohit.yadav@shapeblue.com
Blog: bhaisaab.org | Twitter: @_bhaisaab

Find out more about ShapeBlue and our range of CloudStack related services

Re: [DISCUSS] Prevent force push on release and master branches

Posted by David Nalley <da...@gnsa.us>.

force pushes on master are already prohibited.
The other branches allow that though.

--David

On Fri, Aug 29, 2014 at 7:57 AM, Rohit Yadav <ro...@shapeblue.com> wrote:
> Hi all,
>
> I found by accident that you can force push on branches on our ACS/ASF repo.
>
> So, I’m concerned that anyone could do a force push, sneak in changes on ACS/ASF branches; opensource projects have had issues with people changing histories, putting backdoors and whatnot, so I would like to avoid that. For example, I would like us to disable force-push(es) on our git repos to avoid a situation like  Jenkins had:
>
> https://groups.google.com/forum/#!searchin/jenkinsci-dev/force$20push/jenkinsci-dev/-myjRIPcVwU/mrwn8VkyXagJ
>
> So, I requested the infra team [1] to disable force pushes on release and master branches because that made sense and I was told that they don’t allow force pushes on master (relief!) but not on release branches because it would be hard to track the release branch names. I asked them if we should disable force pushed on all branches at all and if they people want to do it, they can do it in their own private/github repos/forks.
>
> So, I’m told that we need to discuss this issue and only after a decision/voting they would implement such a change? What do you think, what are the pros and cons of disabling force pushes and should we do it?
>
> [1] https://issues.apache.org/jira/browse/INFRA-8228
>
>
> Regards,
> Rohit Yadav
> Software Architect, ShapeBlue
> M. +41 779015219 | rohit.yadav@shapeblue.com
> Blog: bhaisaab.org | Twitter: @_bhaisaab
>
>
>
> Find out more about ShapeBlue and our range of CloudStack related services
>
> IaaS Cloud Design & Build<http://shapeblue.com/iaas-cloud-design-and-build//>
> CSForge – rapid IaaS deployment framework<http://shapeblue.com/csforge/>
> CloudStack Consulting<http://shapeblue.com/cloudstack-consultancy/>
> CloudStack Infrastructure Support<http://shapeblue.com/cloudstack-infrastructure-support/>
> CloudStack Bootcamp Training Courses<http://shapeblue.com/cloudstack-training/>
>
> This email and any attachments to it may be confidential and are intended solely for the use of the individual to whom it is addressed. Any views or opinions expressed are solely those of the author and do not necessarily represent those of Shape Blue Ltd or related companies. If you are not the intended recipient of this email, you must neither take any action based upon its contents, nor copy or show it to anyone. Please contact the sender if you believe you have received this email in error. Shape Blue Ltd is a company incorporated in England & Wales. ShapeBlue Services India LLP is a company incorporated in India and is operated under license from Shape Blue Ltd. Shape Blue Brasil Consultoria Ltda is a company incorporated in Brasil and is operated under license from Shape Blue Ltd. ShapeBlue SA Pty Ltd is a company registered by The Republic of South Africa and is traded under license from Shape Blue Ltd. ShapeBlue is a registered trademark.