3 ms·

FYI: this breaks homebrew

by bin_bash 4y ago

giancarlostoro 4y ago
Does it break all of Homebrew or just some packages? I never knew homebrew started using GitHub Packages.
- mfer 4y ago
  Homebrew uses it to store bottles (the built assets).
  - 0xbadcafebee 4y ago
    Fun fact: Linux distributions (and some older open source programming language package managers) use hundreds of mirrors distributed around the world to distribute their assets. If any mirror goes down, you just pick a different one. Even when they could just use SourceForge as a mirror (formerly the largest repository for open source software), they still used hundreds more mirrors. Distribution was made easy with rsync, and mirrors could choose what files they mirrored (just the latest release, or all releases, or just binaries and not source code)
    - naikrovek 4y ago
      GitHub uses pools of mirrors, too, they're just transparent. twice this year I've had to spend an hour or more with a user because a mirror was down. that's one more time than I've had to deal with a GitHub packages outage this year. the latest was yesterday. they chose another pool of mirrors and the mirror continually chosen from that pool was down as well. finally I manually checked a mirror, made sure it was up and that signatures matched, then gave them that specific hostname. the Linux package distribution system is not better. it's just different.
  - jacobsenscott 4y ago
    So this is why hb started asking for access to my keychain all the time? (macos) Does it need to log in to gh to install open source software now?
    - naikrovek 4y ago
      you don't have to, but hb will ask you to if you have a saved credential because your quota on GitHub for downloading packages is much higher if you are logged in. anonymous stuff on GitHub is usually limited to 60 requests per hour per ip address. if you're authenticated, it's several hundred if not several thousand.
      - cozzyd 4y ago
        That sounds... problematic for people on big NATs? (e.g. universities?)
        oasisbob 4y ago
        NATs are problematic already. Every office I've ever worked at has that one guy who is really good at tickling Google with scripts until it puts you all behind a CAPTCHA.
        deleted 4y ago
        [deleted]
- bin_bash 4y ago
  anything you don't install via `--build-from-source`
ducktective 4y ago
Nix too I presume
- lom 4y ago
  Only if you pull from master
- mananaysiempre 4y ago
  You presume incorrectly. GitHub Packages, the package registry and binary hosting service, does not even support Nix. As for GitHub in general— The binary hosting at https://cache.nixos.org/ https://cache.nixos.org/ is independent of GitHub, and so are the old-style channels at https://channels.nixos.org/ https://channels.nixos.org/. The new-style flake registry used to be fetched from GitHub but has now been moved to https://channels.nixos.org/flake-registry.json https://channels.nixos.org/flake-registry.json. Admittedly in a new-style situation you’re likely to be using unlocked flake references that refer to GitHub (e.g. Nixpkgs), but it’s on you to lock them and pull them into your Nix store in that case. Of course, you also get GitHub references for upstreams that host their code there, but that applies to almost any distro(’s build system) except the oldest of the old-timers which host the source for the whole distro on their own infrastructure, like Debian. (I happen think the old-timers are right here, but that’s beside the point.)
- pxc 4y ago
  Nope. This is actually the second (maybe third; I didn't even know about GitHub's outage a week and a half ago so idk how Nix was or was not affected) time in three months or less that a partial GitHub outage or GitHub change has taken down Homebrew while leaving Nix unaffected.
orwellg1984 4y ago
affirmative
VWWHFSfQ 4y ago
I think it will break any of the open source package managers that rely on GitHub's proprietary hosting and distribution. Cargo, etc.
- kreco 4y ago
  I did not know package managers relied on Github, this is the most unwise thing to do from a package manager perspective. Anyone could just change username/organization and break thousands/millions of build.
  - chisquared 4y ago
    > Anyone could just change username/organization and break thousands/millions of build. GitHub redirects you to the new name in the event of a rename and you look up the old one.
    - JamesonNetworks 4y ago
      For now, hopefully
      - naikrovek 4y ago
        yeah. if GitHub is even real.
        JamesonNetworks 4y ago
        Well, we know GitHub is real. But we should also remember that they can change their API at anytime and basing a package manager on their priorities is not the best situation for the long term success of that package manager, unless they are owned by Microsoft
    - adders 4y ago
      until someone claims the old name as a new org/repo
  - 4y ago
josephd79 4y ago
how so? It's working for me.
taywrobel 4y ago
Man, this disappoints me. I was a tech lead on the packages project about 3 years ago, specifically on the redesign for OCI container support and making anonymous downloads of public packages as reliable as possible was a top priority. If that flow was broken there’s only a handful of things it could be; specifically azure blob store or azure MySQL, but both of those should have layers of redundancy. Public anonymous download bypasses most everything else; no auth services, rails monolith, or metered billing. It does emit some events to the message bus for metrics, but that’d effect much more than packages if there was an issue with it. As far as I’m aware this is the first time anonymous public package download broke since I left a few years back.
hummus_bae 4y ago
[dead]

FYI: this breaks homebrew

giancarlostoro 4y ago

Does it break all of Homebrew or just some packages? I never knew homebrew started using GitHub Packages.

mfer 4y ago
Homebrew uses it to store bottles (the built assets).
- 0xbadcafebee 4y ago
  Fun fact: Linux distributions (and some older open source programming language package managers) use hundreds of mirrors distributed around the world to distribute their assets. If any mirror goes down, you just pick a different one. Even when they could just use SourceForge as a mirror (formerly the largest repository for open source software), they still used hundreds more mirrors. Distribution was made easy with rsync, and mirrors could choose what files they mirrored (just the latest release, or all releases, or just binaries and not source code)
  - naikrovek 4y ago
    GitHub uses pools of mirrors, too, they're just transparent. twice this year I've had to spend an hour or more with a user because a mirror was down. that's one more time than I've had to deal with a GitHub packages outage this year. the latest was yesterday. they chose another pool of mirrors and the mirror continually chosen from that pool was down as well. finally I manually checked a mirror, made sure it was up and that signatures matched, then gave them that specific hostname. the Linux package distribution system is not better. it's just different.
- jacobsenscott 4y ago
  So this is why hb started asking for access to my keychain all the time? (macos) Does it need to log in to gh to install open source software now?
  - naikrovek 4y ago
    you don't have to, but hb will ask you to if you have a saved credential because your quota on GitHub for downloading packages is much higher if you are logged in. anonymous stuff on GitHub is usually limited to 60 requests per hour per ip address. if you're authenticated, it's several hundred if not several thousand.
    - cozzyd 4y ago
      That sounds... problematic for people on big NATs? (e.g. universities?)
      - oasisbob 4y ago
        NATs are problematic already. Every office I've ever worked at has that one guy who is really good at tickling Google with scripts until it puts you all behind a CAPTCHA.
      - deleted 4y ago
        [deleted]
bin_bash 4y ago
anything you don't install via `--build-from-source`

ducktective 4y ago

Nix too I presume

lom 4y ago
Only if you pull from master
mananaysiempre 4y ago
You presume incorrectly. GitHub Packages, the package registry and binary hosting service, does not even support Nix. As for GitHub in general— The binary hosting at https://cache.nixos.org/ https://cache.nixos.org/ is independent of GitHub, and so are the old-style channels at https://channels.nixos.org/ https://channels.nixos.org/. The new-style flake registry used to be fetched from GitHub but has now been moved to https://channels.nixos.org/flake-registry.json https://channels.nixos.org/flake-registry.json. Admittedly in a new-style situation you’re likely to be using unlocked flake references that refer to GitHub (e.g. Nixpkgs), but it’s on you to lock them and pull them into your Nix store in that case. Of course, you also get GitHub references for upstreams that host their code there, but that applies to almost any distro(’s build system) except the oldest of the old-timers which host the source for the whole distro on their own infrastructure, like Debian. (I happen think the old-timers are right here, but that’s beside the point.)
pxc 4y ago
Nope. This is actually the second (maybe third; I didn't even know about GitHub's outage a week and a half ago so idk how Nix was or was not affected) time in three months or less that a partial GitHub outage or GitHub change has taken down Homebrew while leaving Nix unaffected.

orwellg1984 4y ago

affirmative

VWWHFSfQ 4y ago

I think it will break any of the open source package managers that rely on GitHub's proprietary hosting and distribution. Cargo, etc.

kreco 4y ago
I did not know package managers relied on Github, this is the most unwise thing to do from a package manager perspective. Anyone could just change username/organization and break thousands/millions of build.
- chisquared 4y ago
  > Anyone could just change username/organization and break thousands/millions of build. GitHub redirects you to the new name in the event of a rename and you look up the old one.
  - JamesonNetworks 4y ago
    For now, hopefully
    - naikrovek 4y ago
      yeah. if GitHub is even real.
      - JamesonNetworks 4y ago
        Well, we know GitHub is real. But we should also remember that they can change their API at anytime and basing a package manager on their priorities is not the best situation for the long term success of that package manager, unless they are owned by Microsoft
  - adders 4y ago
    until someone claims the old name as a new org/repo
- 4y ago

josephd79 4y ago

how so? It's working for me.

taywrobel 4y ago

Man, this disappoints me. I was a tech lead on the packages project about 3 years ago, specifically on the redesign for OCI container support and making anonymous downloads of public packages as reliable as possible was a top priority. If that flow was broken there’s only a handful of things it could be; specifically azure blob store or azure MySQL, but both of those should have layers of redundancy. Public anonymous download bypasses most everything else; no auth services, rails monolith, or metered billing. It does emit some events to the message bus for metrics, but that’d effect much more than packages if there was an issue with it. As far as I’m aware this is the first time anonymous public package download broke since I left a few years back.

hummus_bae 4y ago

[dead]