6 ms·

GitPub: An extenstion to ActivityPub for web-based Git services federation

168 points by okket 8y ago

giancarlostoro 8y ago
I think if done right and spec'd out correctly this could be a reasonable way to federate git over the web.
mikece 8y ago
Not only is this a great idea but there's no reason this couldn't be an API layer over any number of underlying source control implementations (Git, Mercurial, Bazaar, TFVC, SVN, etc). Could open up all kinds of possibilities for CI/CD tooling and workflows as well.
- Arkanosis 8y ago
  This is actually being discussed as well: https://framalistes.org/sympa/arc/git-federation/2018-06/msg00023.html https://framalistes.org/sympa/arc/git-federation/2018-06/msg... The scope of GitPub is still under active definition, and it might end up not being specific to git only. If you're a stakeholder of any service that could federate based on Mercurial, Bazaar… you're more than welcome to give your input to the working group.
  - mikece 8y ago
    First thing first: I would hope that "Git" would be removed from the GitPub name. I'm in favor of replacing Git in the process and having both a new client source control implementation and server API set (SourcePub?) that are designed with each other in mind, eases federation, and is both powerful and easier for new devs than Git (Hg managed this... not sure why a Git replacement can't do the same).
    - deleted 8y ago
      [deleted]
    - Arkanosis 8y ago
      GitPub (or whatever it'll be named then) does not intend to replace git or any other VCS. Its stated goal is to enable federation between services such as GitHub, GitLab, Gogs, Gitea, Pagure… which happen to use git. In other words, it means that if GitPub was adopted by these services, you could submit a merge request from Pagure to Gitlab, or star a GitHub project from your own Gitea instance, among many other things.
      - ReverseCold 8y ago
        > star a GitHub project from your own Gitea instance How do federated networks prevent someone from making a few hundred accounts and starring/liking a bunch of posts?
        r3bl 8y ago
        Does it need to prevent them? Do stars in a repo represent something significant?
        OJFord 8y ago
        How does a centralised network prevent someone from making a few hundred accounts and starring/liking a bunch of posts? We seem to be doing OK by not caring much.
        Rjevski 8y ago
        Well in this case why Github, GitLab, etc.. do not allow you to "star" a repo more than once? I'm fine with stars not being significant, but it's still not good if a malicious actor can suddenly spoof hundreds of accounts and spam stars, comments and what-not.
        OJFord 8y ago
        Because that's a completely different interaction. You can still create another account and star it again. Sure, your IP will be rate-limited (GH at least) if you script it and start hammering stars, but that's not because it wants to protect the integrity of the repo star count.
  - sytse 8y ago
    Great to see this initiative, at GitLab we're actively following this, thanks for keeping us posted https://gitlab.com/gitlab-org/gitlab-ce/issues/4013#note_79942659 https://gitlab.com/gitlab-org/gitlab-ce/issues/4013#note_799...
    - cjslep 8y ago
      Glad to hear! I hope GitLab will also provide feedback to the community group.
      - sytse 8y ago
        For sure, is there already a proposal for federated merge requests? Or can you make those from the activity stream? That would by the minimal viable change as far as I can see.
        Arkanosis 8y ago
        Federated merge requests are being discussed in this thread: https://framalistes.org/sympa/arc/git-federation/2018-06/msg00122.html https://framalistes.org/sympa/arc/git-federation/2018-06/msg... It's way too early for a proposal, but if someone from GitLab wants to give some input, that's more than welcome. Thanks!
        sytse 8y ago
        Thanks for the pointer!
    - deleted 8y ago
      [deleted]
- politician 8y ago
  I really hope they stick with Git and produce something concrete rather than trying to shoehorn a diverse collection of version control models into the same API. The last thing you want is the sort of lowest common denominator solution that everyone agrees on but is otherwise useless. Later, after the GitPub federation approach is proven, let another team take up the torch for AnyPub.
  - doubleunplussed 8y ago
    To me it seems like the real power of and differences between tools is apparent mostly in the context of offline history editing. Once you're making pull requests, nobody wants anything complex in the PR. Lowest common denominator - "here is a set of commits" might be fine.
mrmr1993 8y ago
The project might need to change name; it seems like it may be violating the Git trademark rules[1]: > Portmanteaus ("GitFoo" or "FooGit") are out. Most of the cases run into this rule. For instance, we asked GitHub to not to use "DGit" to refer to their replicated Git solution, and they[1] rebranded. We also asked "GitTorrent" not to use that name based on this rule. [1]: https://public-inbox.org/git/20170202022655.2jwvudhvo4hmueaw@sigill.intra.peff.net/ https://public-inbox.org/git/20170202022655.2jwvudhvo4hmueaw...
- Arkanosis 8y ago
  That's a good point. This has been discussed as well for the renaming of Microsoft's GVFS. GitPub is still very young, and it might end up supporting (D)VCS other than git, so absolutely nothing in it is definitive right now, not even the name.
- tomxor 8y ago
  Why does "GitPub" violate git trademark names but "GitHub" and "GitLab" not? If it's only portmanteaus specifically then... why, (that seems weird), and i'm sure I can find an arbitrary lab and hub name to violate them.
  - anonymouz 8y ago
    From mrmr1993's link: > The USPTO initially rejected our application as confusingly similar to the existing trademark on GitHub, which was filed in 2008. While one might imagine where the "Git" in GitHub comes from, by the time we applied to the USPTO, both marks had been widely used in parallel for years. So we worked out an agreement with GitHub which basically says "we are mutually OK with the other trademark existing". > (There was another delay caused by a competing application from a proprietary version control company that wanted to re-brand portions of their system as "GitFocused" (not the real name, but similar in spirit). We argued our right to the name and refused to settle; they eventually withdrew their application). > So GitHub is essentially outside the scope of the trademark policy, due to the history. We also decided to explicitly grandfather some major projects that were using similar portmanteaus, but which had generally been good citizens of the Git ecosystem (building on Git in a useful way, not breaking compatibility). Those include GitLab, JGit, libgit2, and some others. The reasoning was generally that it would be a big pain for those projects, which have established their own brands, to have to switch names. It's hard to hold them responsible for picking a name that violated a policy that didn't yet exist.
ocdtrekkie 8y ago
Out of curiosity, since I always wonder about ActivityPub integration between unlike apps: If a Git server used GitPub, could I comment on a PR from my Mastodon account?
- Arkanosis 8y ago
  It all depends on the vocabulary used. The Mastodon vocabulary is well defined already, but no vocabulary has been defined for GitPub for the time being. Hopefully, GitPub will be the thinnest possible addition to ActivityPub, so that concepts (and vocabulary) are shared between GitPub and Mastodon, enabling comments between them.
frio 8y ago
This seems extremely sparse, and perhaps not ready to share? The latest draft appears to be here: https://github.com/git-federation/gitpub/blob/draft-0.1/SPECIFICATION.md https://github.com/git-federation/gitpub/blob/draft-0.1/SPEC...
- AsyncAwait 8y ago
  The reason for sharing this is to get more people involved.
fiatjaf 8y ago
Who's using ActivityPub? For what?
- Foxboron 8y ago
  Mastodon uses ActivityPub. https://en.wikipedia.org/wiki/Mastodon_(software) https://en.wikipedia.org/wiki/Mastodon_(software)
- buovjaga 8y ago
  Quoting from https://medium.com/we-distribute/faces-of-the-federation-christopher-allan-webber-on-mediagoblin-and-activitypub-24bbe212867e https://medium.com/we-distribute/faces-of-the-federation-chr... > Aardwolf, Bridgy Fed, distbin.com, dokieli, Funkwhale, Hubzilla, Kroeg, Mastodon, Nextcloud, Numaverse, PeerTube, places.pub, Pubstrate, Smilodon, tags.pub, Pleroma, Pump.io, and Rustodon are all either implementors of or are currently implementing ActivityPub. In addition to those, https://pixelfed.org/ https://pixelfed.org/ is in the process of implementing federation with AP.
smcameron 8y ago
Seems like a lot of work to paper over with a dubious web front end what essentially amounts to emailing a patch. I'm old... I'll go back to my pasture.
Sir_Cmpwn 8y ago
I like the idea of closing the gap where GitHub might fail, and I love ActivityPub-based services and the federated web, but I think this isn't the best solution. Git is already decentralized to the extent necessary to be useful for projects. An open source project will generally have one and only one canonical upstream location. If that location needs to move, git is accomodating. The better strategy is to work on encoding ticket tracking and such into git objects, in my opinion.
mike-cardwell 8y ago
I would be surprised if Github implements this. Especially with the Microsoft purchase. Microsoft is known for building walled gardens, not knocking them down. Why would they expend effort to make life easier for competitors?

168 points by okket 8y ago

I think if done right and spec'd out correctly this could be a reasonable way to federate git over the web.

Not only is this a great idea but there's no reason this couldn't be an API layer over any number of underlying source control implementations (Git, Mercurial, Bazaar, TFVC, SVN, etc). Could open up all kinds of possibilities for CI/CD tooling and workflows as well.

Arkanosis 8y ago
This is actually being discussed as well: https://framalistes.org/sympa/arc/git-federation/2018-06/msg00023.html https://framalistes.org/sympa/arc/git-federation/2018-06/msg... The scope of GitPub is still under active definition, and it might end up not being specific to git only. If you're a stakeholder of any service that could federate based on Mercurial, Bazaar… you're more than welcome to give your input to the working group.
- mikece 8y ago
  First thing first: I would hope that "Git" would be removed from the GitPub name. I'm in favor of replacing Git in the process and having both a new client source control implementation and server API set (SourcePub?) that are designed with each other in mind, eases federation, and is both powerful and easier for new devs than Git (Hg managed this... not sure why a Git replacement can't do the same).
  - deleted 8y ago
    [deleted]
  - Arkanosis 8y ago
    GitPub (or whatever it'll be named then) does not intend to replace git or any other VCS. Its stated goal is to enable federation between services such as GitHub, GitLab, Gogs, Gitea, Pagure… which happen to use git. In other words, it means that if GitPub was adopted by these services, you could submit a merge request from Pagure to Gitlab, or star a GitHub project from your own Gitea instance, among many other things.
    - ReverseCold 8y ago
      > star a GitHub project from your own Gitea instance How do federated networks prevent someone from making a few hundred accounts and starring/liking a bunch of posts?
      - r3bl 8y ago
        Does it need to prevent them? Do stars in a repo represent something significant?
      - OJFord 8y ago
        How does a centralised network prevent someone from making a few hundred accounts and starring/liking a bunch of posts? We seem to be doing OK by not caring much.
        Rjevski 8y ago
        Well in this case why Github, GitLab, etc.. do not allow you to "star" a repo more than once? I'm fine with stars not being significant, but it's still not good if a malicious actor can suddenly spoof hundreds of accounts and spam stars, comments and what-not.
        OJFord 8y ago
        Because that's a completely different interaction. You can still create another account and star it again. Sure, your IP will be rate-limited (GH at least) if you script it and start hammering stars, but that's not because it wants to protect the integrity of the repo star count.
- sytse 8y ago
  Great to see this initiative, at GitLab we're actively following this, thanks for keeping us posted https://gitlab.com/gitlab-org/gitlab-ce/issues/4013#note_79942659 https://gitlab.com/gitlab-org/gitlab-ce/issues/4013#note_799...
  - cjslep 8y ago
    Glad to hear! I hope GitLab will also provide feedback to the community group.
    - sytse 8y ago
      For sure, is there already a proposal for federated merge requests? Or can you make those from the activity stream? That would by the minimal viable change as far as I can see.
      - Arkanosis 8y ago
        Federated merge requests are being discussed in this thread: https://framalistes.org/sympa/arc/git-federation/2018-06/msg00122.html https://framalistes.org/sympa/arc/git-federation/2018-06/msg... It's way too early for a proposal, but if someone from GitLab wants to give some input, that's more than welcome. Thanks!
        sytse 8y ago
        Thanks for the pointer!
  - deleted 8y ago
    [deleted]
politician 8y ago
I really hope they stick with Git and produce something concrete rather than trying to shoehorn a diverse collection of version control models into the same API. The last thing you want is the sort of lowest common denominator solution that everyone agrees on but is otherwise useless. Later, after the GitPub federation approach is proven, let another team take up the torch for AnyPub.
- doubleunplussed 8y ago
  To me it seems like the real power of and differences between tools is apparent mostly in the context of offline history editing. Once you're making pull requests, nobody wants anything complex in the PR. Lowest common denominator - "here is a set of commits" might be fine.

mrmr1993 8y ago

The project might need to change name; it seems like it may be violating the Git trademark rules[1]: > Portmanteaus ("GitFoo" or "FooGit") are out. Most of the cases run into this rule. For instance, we asked GitHub to not to use "DGit" to refer to their replicated Git solution, and they[1] rebranded. We also asked "GitTorrent" not to use that name based on this rule. [1]: https://public-inbox.org/git/20170202022655.2jwvudhvo4hmueaw@sigill.intra.peff.net/ https://public-inbox.org/git/20170202022655.2jwvudhvo4hmueaw...

Arkanosis 8y ago
That's a good point. This has been discussed as well for the renaming of Microsoft's GVFS. GitPub is still very young, and it might end up supporting (D)VCS other than git, so absolutely nothing in it is definitive right now, not even the name.
tomxor 8y ago
Why does "GitPub" violate git trademark names but "GitHub" and "GitLab" not? If it's only portmanteaus specifically then... why, (that seems weird), and i'm sure I can find an arbitrary lab and hub name to violate them.
- anonymouz 8y ago
  From mrmr1993's link: > The USPTO initially rejected our application as confusingly similar to the existing trademark on GitHub, which was filed in 2008. While one might imagine where the "Git" in GitHub comes from, by the time we applied to the USPTO, both marks had been widely used in parallel for years. So we worked out an agreement with GitHub which basically says "we are mutually OK with the other trademark existing". > (There was another delay caused by a competing application from a proprietary version control company that wanted to re-brand portions of their system as "GitFocused" (not the real name, but similar in spirit). We argued our right to the name and refused to settle; they eventually withdrew their application). > So GitHub is essentially outside the scope of the trademark policy, due to the history. We also decided to explicitly grandfather some major projects that were using similar portmanteaus, but which had generally been good citizens of the Git ecosystem (building on Git in a useful way, not breaking compatibility). Those include GitLab, JGit, libgit2, and some others. The reasoning was generally that it would be a big pain for those projects, which have established their own brands, to have to switch names. It's hard to hold them responsible for picking a name that violated a policy that didn't yet exist.

ocdtrekkie 8y ago

Out of curiosity, since I always wonder about ActivityPub integration between unlike apps: If a Git server used GitPub, could I comment on a PR from my Mastodon account?

Arkanosis 8y ago
It all depends on the vocabulary used. The Mastodon vocabulary is well defined already, but no vocabulary has been defined for GitPub for the time being. Hopefully, GitPub will be the thinnest possible addition to ActivityPub, so that concepts (and vocabulary) are shared between GitPub and Mastodon, enabling comments between them.

frio 8y ago

This seems extremely sparse, and perhaps not ready to share? The latest draft appears to be here: https://github.com/git-federation/gitpub/blob/draft-0.1/SPECIFICATION.md https://github.com/git-federation/gitpub/blob/draft-0.1/SPEC...

AsyncAwait 8y ago
The reason for sharing this is to get more people involved.

fiatjaf 8y ago

Who's using ActivityPub? For what?

Foxboron 8y ago
Mastodon uses ActivityPub. https://en.wikipedia.org/wiki/Mastodon_(software) https://en.wikipedia.org/wiki/Mastodon_(software)
buovjaga 8y ago
Quoting from https://medium.com/we-distribute/faces-of-the-federation-christopher-allan-webber-on-mediagoblin-and-activitypub-24bbe212867e https://medium.com/we-distribute/faces-of-the-federation-chr... > Aardwolf, Bridgy Fed, distbin.com, dokieli, Funkwhale, Hubzilla, Kroeg, Mastodon, Nextcloud, Numaverse, PeerTube, places.pub, Pubstrate, Smilodon, tags.pub, Pleroma, Pump.io, and Rustodon are all either implementors of or are currently implementing ActivityPub. In addition to those, https://pixelfed.org/ https://pixelfed.org/ is in the process of implementing federation with AP.

smcameron 8y ago

Seems like a lot of work to paper over with a dubious web front end what essentially amounts to emailing a patch. I'm old... I'll go back to my pasture.

Sir_Cmpwn 8y ago

I like the idea of closing the gap where GitHub might fail, and I love ActivityPub-based services and the federated web, but I think this isn't the best solution. Git is already decentralized to the extent necessary to be useful for projects. An open source project will generally have one and only one canonical upstream location. If that location needs to move, git is accomodating. The better strategy is to work on encoding ticket tracking and such into git objects, in my opinion.

mike-cardwell 8y ago

I would be surprised if Github implements this. Especially with the Microsoft purchase. Microsoft is known for building walled gardens, not knocking them down. Why would they expend effort to make life easier for competitors?