Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Meeting notes between Forgejo and the Dutch government via Git commits

codeberg.org

Post reply on HN
Print view View original

11–20 of 46 posts

Re: Meeting notes between Forgejo and the Dutch government via Git commits

#11

Post by bwblabs »

0cf8612b2e1e wrote: post #8
bwblabs wrote: post #4

Very positive to have a governmental hosted git/code platform, although I would still advise Gitea (it's not documented that pick is explored). I'm a self hosting GoGogs / Gitea user for almost 10 years, I did follow the Gitea fork. However regarding the Forgejo fork: the main contributors stayed with Gitea. The ideologically forked Forgejo made some license changes and hard fork decisions that increased the maintena…

The Forgejo people say that it is Gitea who is compromising security [0]. Not involved either way, but I have seen enough rug pulls that I will prefer the product which does not have a commercial offering and financial incentives to sabotage it. https://forgejo.org/compare-to-gitea/

I know the claims, but look at Gitea version v1.24.7 (with some security fixes), released on October 25th, which includes 'fix LFS auth bypass, fix symlink bypass' that was merged on October 20th (#35708). This was fixed in Forgejo on the 25th https://codeberg.org/forgejo/forgejo/commit/fa1a2ba669301238... and released on the 26th, although "Originally scheduled for 7 November, the release date of these patches was advanced because a vulnerability had been leaked publicly." (https://codeberg.org/forgejo/forgejo/src/branch/forgejo/rele...)

Security wise, Gitea was safer in this case.

Also note the SECURITY.md was deleted: https://codeberg.org/forgejo/forgejo/commit/277dd02e706b6e51..., there is a security https://forgejo.org/docs/next/contributor/discussions/#secur... but it's a bit harder to find.

The problem is, Forgejo changed the license (https://codeberg.org/forgejo/governance/pulls/24#issuecommen...) and ended up doing a hard fork (https://forgejo.org/2024-02-forking-forward/#consequences-of...) which creates quite some maintenance burden. There used to be a (weekly) gitea chery-pick (e.g. https://codeberg.org/forgejo/forgejo/pulls?state=closed&labe...) but the TODO section was getting ever larger, and it seems it stopped in July (week 26).

So they start missing stuff, e.g. features like https://codeberg.org/forgejo/forgejo/issues/9552

Re: Meeting notes between Forgejo and the Dutch government via Git commits

#12

Post by ekjhgkejhgk »

It's a shame that oliverpool uses the language of "open source software", especially given that forgejo has a Free license.

Words matter, and this would've been a great opportunity to raise awareness to the problem of oppressive software. I think these days most people have an intuition that this is happening.

Re: Meeting notes between Forgejo and the Dutch government via Git commits

#13

Post by mfld »

bwblabs wrote: post #4

Very positive to have a governmental hosted git/code platform, although I would still advise Gitea (it's not documented that pick is explored). I'm a self hosting GoGogs / Gitea user for almost 10 years, I did follow the Gitea fork. However regarding the Forgejo fork: the main contributors stayed with Gitea. The ideologically forked Forgejo made some license changes and hard fork decisions that increased the maintena…

Based on those meeting notes, the conflict of interest that arises when attempting to add features that compete with paid ones is real. So its that ideology that it is actually needed for a Government user/contributor.

Re: Meeting notes between Forgejo and the Dutch government via Git commits

#14

Post by bwblabs »

krick wrote: post #5
bwblabs wrote: post #4

Very positive to have a governmental hosted git/code platform, although I would still advise Gitea (it's not documented that pick is explored). I'm a self hosting GoGogs / Gitea user for almost 10 years, I did follow the Gitea fork. However regarding the Forgejo fork: the main contributors stayed with Gitea. The ideologically forked Forgejo made some license changes and hard fork decisions that increased the maintena…

Thanks. I was wondering what is the status of it, given that Forgejo is being pushed more in the media lately. TBH, I haven't understood the controversy even after reading a couple of recaps. I remember it being about having "suddenly revealed" a couple of years ago that the guy on top is the owner of the trademark. Doesn't sound like a big deal to me, given that he actually was the main contributor and de-facto the…

See https://news.ycombinator.com/item?id=45929247#45930310

Forgejo used to be a set of patches applied on Gitea, but they moved to a fork with cherry picking Gitea commits, this is more work. In my view they don't have the development to keep up with Gitea.

Re: Meeting notes between Forgejo and the Dutch government via Git commits

#15

Post by bwblabs »

mfld wrote: post #13
bwblabs wrote: post #4

Very positive to have a governmental hosted git/code platform, although I would still advise Gitea (it's not documented that pick is explored). I'm a self hosting GoGogs / Gitea user for almost 10 years, I did follow the Gitea fork. However regarding the Forgejo fork: the main contributors stayed with Gitea. The ideologically forked Forgejo made some license changes and hard fork decisions that increased the maintena…

Based on those meeting notes, the conflict of interest that arises when attempting to add features that compete with paid ones is real. So its that ideology that it is actually needed for a Government user/contributor.

Not sure: the government could just buy Gitea Enterprise license right? And thereby not really run true 'open source' software, but it would support the main development behind Gitea.

Re: Meeting notes between Forgejo and the Dutch government via Git commits

#16

Post by homebrewer »

mfld wrote: post #13
bwblabs wrote: post #4

Very positive to have a governmental hosted git/code platform, although I would still advise Gitea (it's not documented that pick is explored). I'm a self hosting GoGogs / Gitea user for almost 10 years, I did follow the Gitea fork. However regarding the Forgejo fork: the main contributors stayed with Gitea. The ideologically forked Forgejo made some license changes and hard fork decisions that increased the maintena…

Based on those meeting notes, the conflict of interest that arises when attempting to add features that compete with paid ones is real. So its that ideology that it is actually needed for a Government user/contributor.

To this day anything of worth that's been added to Gitea is released under MIT. Their business model is: you pay us to develop the features we need, we release them for everybody, which is how their collaboration with Blender has been working thus far. If it's good enough for Blender, who decided to stay with Gitea, it's good enough for me.

Re: Meeting notes between Forgejo and the Dutch government via Git commits

#17

Post by homebrewer »

krick wrote: post #5
bwblabs wrote: post #4

Very positive to have a governmental hosted git/code platform, although I would still advise Gitea (it's not documented that pick is explored). I'm a self hosting GoGogs / Gitea user for almost 10 years, I did follow the Gitea fork. However regarding the Forgejo fork: the main contributors stayed with Gitea. The ideologically forked Forgejo made some license changes and hard fork decisions that increased the maintena…

Thanks. I was wondering what is the status of it, given that Forgejo is being pushed more in the media lately. TBH, I haven't understood the controversy even after reading a couple of recaps. I remember it being about having "suddenly revealed" a couple of years ago that the guy on top is the owner of the trademark. Doesn't sound like a big deal to me, given that he actually was the main contributor and de-facto the…

Have a look at this: https://lwn.net/Articles/963608/

Re: Meeting notes between Forgejo and the Dutch government via Git commits

#18

Post by mindcrash »

Not sure if it's mentioned because I didn't read the whole thing but maybe it's good to know for those of you not familiar with Dutch government that most open source code (and possibly even private code) from all Dutch government orgs is currently hosted on private/public GitHub repositories.

If they move to self hosted Forgejo (which I assume this meeting is all about) Microsoft is going to lose a pretty big customer.

And yes, (good) CI is still is a big blocker to move to Forgejo for any org (or self hosting). Hope they can speed things up a bit there now they now a gov org is seriously interested.

Re: Meeting notes between Forgejo and the Dutch government via Git commits

#19

Post by ekjhgkejhgk »

bwblabs wrote: post #4

Very positive to have a governmental hosted git/code platform, although I would still advise Gitea (it's not documented that pick is explored). I'm a self hosting GoGogs / Gitea user for almost 10 years, I did follow the Gitea fork. However regarding the Forgejo fork: the main contributors stayed with Gitea. The ideologically forked Forgejo made some license changes and hard fork decisions that increased the maintena…

> The ideologically forked Forgejo made some license changes

Lets be clear. These "some license changes" that you reference was Forgejo forked Gitea and replaced MIT license with GPLv3. Forgejo doesn't want to be contributing to receiving effort from contributors into a project that then gets re-used, re-branded, and exploited by a big corp. By making the project copyleft they ensured that the contributions stay Free. This was an ethical move.

Gitea on the other hand doesn't mind sucking up free-of-charge contributions and handing them to a company to build their walled garden around.

Re: Meeting notes between Forgejo and the Dutch government via Git commits

#20

Post by homebrewer »

krick wrote: post #10
szszrk wrote: post #6

Earlier quoted context omitted.

Why would they rather talk to gitea? Isn't it sensible for a European government to talk to a player that is being backed by European companies and has a cleaner approach to open source? I'm not arguing, I'm asking what's the rationale here.

It appears to me that the rationale was clearly stated in GP: > resulting in missing upstream features and decreased security I.e. it's a matter of technical superiority, which, to me, how the decisions should be made. Not by having friends in the community and all of us being Europeans and so on. (But, of course, I would be glad to hear more particular details/examples of Forgejo lagging behind.)

You should simply compare release notes over the same time period for both projects, what's been done and how much. There's lots of nonsense repeated on this site and others, just do the research yourself, it won't take long. They both have very predictable release schedules.

We've stuck with Gitea, after not being impressed by the extremely FUDish behavior of the main driver of the fork, and this has proven to be the right choice so far. In spite of what some people claim, all of the major contributors to Gitea have continued developing it, none of the "heavy hitters" have left. It shows.

The database can be downgraded anyway. I've been doing backwards migrations for each new version all the way back to 1.22 (which is the last Gitea version that is "side-gradable" to Forgejo).

Post reply on HN