Re: Concerns/questions around Software Heritage Archive

[MSavoritias]

On 3/17/24 18:20, Ian Eure wrote:

> MSavoritias <email@msavoritias.me> writes:
>
> > On 3/17/24 11:39, Lars-Dominik Braun wrote:
> > > Hey,
> > >
> > > > I have heard folks in the Guix maintenance sphere claim that we
> > > never rewrite git history in Guix, as a matter of policy. I believe
> > > we should revisit that policy (is it actually written anywhere?)
> > > with an eye towards possible exceptions, and develop a mechanism for
> > > securely maintaining continuity of Guix installations after history
> > > has been rewritten so that we maintain this as a technical
> > > possibility in the future, even if we should choose to use it
> > > sparingly.
> > > the fallout of rewriting Guix’ git history would be devastating. It
> > > would break every single Guix installation, because
> > >
> > > a) `guix pull` authenticates commits and we might lose our trust anchor
> > > if we rewrite history earlier than the introduction of this feature,
> > > b) `guix pull` outright rejects changes to the commit history to 
> > > prevent
> > > downgrade attacks.
> > >
> > > Additionally it would break every single existing usage of the
> > > time machine and thereby completely defeat the goal of providing
> > > reproducible software environments since the commit hash is used to
> > > identify the point in time to jump to.
> > >
> > > I doubt developing “mechanisms” – whatever they look like – would
> > > be worth the effort. Our contributors matter, but so do our users. 
> > > Never
> > > ever rewriting our git history is a tradeoff we should make for our 
> > > users.
> > >
> > > Lars
> > Thats a good point. in the sense that its a tradeoff here and I
> > absolutely agree.
> >
> >
> > But let me add some food for thought here:
> >
> > 1. Were the social aspects considered when the system came into place?
> >
> > 2. Is it more important for the system to stay as is than to welcome
> > new contributors?
> >
> > 3. You mention "its a tradeoff we should make for our users". How many
> > trans people where involved in that decision and how much did their
> > opinion matter in this?
> >
> >
> > I am saying this because giving power to people(what is called users)
> > is not only handling them code or make sure everything is free
> > software.
> >
> > Its also the hard part of making sure the voices of people that can
> > not code is heard and is participating and taking in mind.
>
> Just want to say that I appreciate and agree with your thoughtful words.
>
> I’d also note that name changes aren’t a concern limited to trans 
> people, and framing this as "we have to upend everything Because 
> Transgender" is both wrong and feels pretty bad to me.  Anyone can 
> change their name at any time for any reason, or no reason at all, and 
> may wish to update historical references to their previous names.  
> Having a mechanism to support this is, in my view, a matter of basic 
> decency and respect for all humans.
>
> Thanks,
>
>  — Ian

You are right. I failed to see how it could be desirable for other 
people too.

I agree it should be done for everybody.


MSavoritias