5 ms·

Yes, which is why git is a pain in the butt to install and you have to rely on your OS packages (which includes all the kitchen sink stuff) or a GUI installer w

Yes, which is why git is a pain in the butt to install and you have to rely on your OS packages (which includes all the kitchen sink stuff) or a GUI installer with all the necessary dependencies vs. Fossil which is just download executable and done.

westurner 3y ago
Securing the software supply chain for software updaters and VCS systems means PKI and/or key distribution, cryptographic hashes and signatures, file manifests with per-archive-file checksums, and DAC extended filesystem attributes for installed files; Ironically, there's more to it than just `curl`'ing a binary into place and not remembering to update it. And that is why package managers.
- westurner 3y ago
  And sigstore; for centralized software artifact (package,) hashes: https://sigstore.dev/ https://sigstore.dev/
backendanon 3y ago
git...is difficult to install? What's difficult about apt-get install git?
- mrighele 3y ago
  > you have to rely on your OS packages (which includes all the kitchen sink stuff)
- avikalp 3y ago
  These is exactly what my first thought was! Installing open-ssh and git is kind of my first activity on a new computer. But I believe they are talking about setting up a git server. The thing that we rely on GitHub/GitLab/Bitbucket for. Richard counts them as an added dependency. (I mean, he is not wrong in being worried about that. You are basically giving your all your code to a company. Which does not matter for open-source projects like SQLite, but it does for many private projects with code as their primary IP)
  - School-Cotton 3y ago
    What is a “git server”? There’s no distinction between client and server in git; you can “git pull” from any machine with the normal “git” program installed that you have SSH access to.
    - pwdisswordfishc 3y ago
      Behold: https://git-scm.com/docs/git-daemon https://git-scm.com/docs/git-daemon
      - yencabulator 3y ago
        Who uses git-daemon these days? When's the last time you saw git:// in a README? Practically all use of git is either the "smart HTTP" protocol over HTTPS, or over SSH. git-daemon is plaintext, you wouldn't want to push over that, and for public use HTTPS has won. I believe grandparent means what is these days called "forges", a web frontend with user accounts and such, with an extra heaping pile of features.
  - tayo42 3y ago
    Git server is just setting up ssh keys and a directory. The code base viewer runs with apache which is also pretty simple to get all set up
  - politelemon 3y ago
    Even simpler in some cases, git and openssh were already installed.
- madsmith 3y ago
  I’ve been trying to install git on the hypervisor of my smartOS install intermittently for a year. I run into system package conflicts or key signing errors and then I give up and switch to a zone that isn’t so borked with package issues. Then I go lament in the corner that I really should be serious about migrating this to 200TB home lab to anything else and then realize that the 200TB is not something easily backed up in the case FreeBSD or TrueNAS doesn’t understand my Zpool versions and all of those zones I created will need to be rebuilt as jails… And my lamentations turn to tears. All because I wanted to just checkout some random project.
- kaba0 3y ago
  For what it’s worth, on windows without wsl you literally have to bring half of a whole unix with you to run git.
  - alophawen 3y ago
    Not really. https://gitforwindows.org/ https://gitforwindows.org/
    - mkl 3y ago
      From that page: "Git for Windows provides a BASH emulation used to run Git from the command line. *NIX users should feel right at home, as the BASH emulation behaves just like the "git" command in LINUX and UNIX environments."
      - backendanon 3y ago
        That's correct, it works automatically and is great to fix windows (when I have to work on windows) so it has some functionality but even if all I used out of that was git, it's easy. Is it all one exe? No. Does it need to be? No.
    - _Algernon_ 3y ago
      Git BASH (from that page) is what they referred to when they said "you literally have to bring half of a whole unix with you to run git".
      - lolive 3y ago
        GitBash, AutoHotkey, Notepad++, 7zip and PowerToys are the basic installs I do on any Windows I am given. Any dev opening a CMD is suspect, to me.
        pjmlp 3y ago
        Not for me, as Windows developers don't need to depend on UNIX culture. The only thing that is debatable is using command prompt instead of powershell, unless for legacy scripts.
9dev 3y ago
Come on, isn’t that kind of an argument from the 90ies, when disk space was scarce, and internet connections slow? I mean like, I have space for millions of kitchen sinks now. Considering that, I kind of refuse to accept that out of all things, bundle size is a valid distinction criterion for VCS‘es.

westurner 3y ago

Securing the software supply chain for software updaters and VCS systems means PKI and/or key distribution, cryptographic hashes and signatures, file manifests with per-archive-file checksums, and DAC extended filesystem attributes for installed files; Ironically, there's more to it than just `curl`'ing a binary into place and not remembering to update it. And that is why package managers.

westurner 3y ago
And sigstore; for centralized software artifact (package,) hashes: https://sigstore.dev/ https://sigstore.dev/

backendanon 3y ago

git...is difficult to install? What's difficult about apt-get install git?

mrighele 3y ago
> you have to rely on your OS packages (which includes all the kitchen sink stuff)
avikalp 3y ago
These is exactly what my first thought was! Installing open-ssh and git is kind of my first activity on a new computer. But I believe they are talking about setting up a git server. The thing that we rely on GitHub/GitLab/Bitbucket for. Richard counts them as an added dependency. (I mean, he is not wrong in being worried about that. You are basically giving your all your code to a company. Which does not matter for open-source projects like SQLite, but it does for many private projects with code as their primary IP)
- School-Cotton 3y ago
  What is a “git server”? There’s no distinction between client and server in git; you can “git pull” from any machine with the normal “git” program installed that you have SSH access to.
  - pwdisswordfishc 3y ago
    Behold: https://git-scm.com/docs/git-daemon https://git-scm.com/docs/git-daemon
    - yencabulator 3y ago
      Who uses git-daemon these days? When's the last time you saw git:// in a README? Practically all use of git is either the "smart HTTP" protocol over HTTPS, or over SSH. git-daemon is plaintext, you wouldn't want to push over that, and for public use HTTPS has won. I believe grandparent means what is these days called "forges", a web frontend with user accounts and such, with an extra heaping pile of features.
- tayo42 3y ago
  Git server is just setting up ssh keys and a directory. The code base viewer runs with apache which is also pretty simple to get all set up
- politelemon 3y ago
  Even simpler in some cases, git and openssh were already installed.
madsmith 3y ago
I’ve been trying to install git on the hypervisor of my smartOS install intermittently for a year. I run into system package conflicts or key signing errors and then I give up and switch to a zone that isn’t so borked with package issues. Then I go lament in the corner that I really should be serious about migrating this to 200TB home lab to anything else and then realize that the 200TB is not something easily backed up in the case FreeBSD or TrueNAS doesn’t understand my Zpool versions and all of those zones I created will need to be rebuilt as jails… And my lamentations turn to tears. All because I wanted to just checkout some random project.
kaba0 3y ago
For what it’s worth, on windows without wsl you literally have to bring half of a whole unix with you to run git.
- alophawen 3y ago
  Not really. https://gitforwindows.org/ https://gitforwindows.org/
  - mkl 3y ago
    From that page: "Git for Windows provides a BASH emulation used to run Git from the command line. *NIX users should feel right at home, as the BASH emulation behaves just like the "git" command in LINUX and UNIX environments."
    - backendanon 3y ago
      That's correct, it works automatically and is great to fix windows (when I have to work on windows) so it has some functionality but even if all I used out of that was git, it's easy. Is it all one exe? No. Does it need to be? No.
  - _Algernon_ 3y ago
    Git BASH (from that page) is what they referred to when they said "you literally have to bring half of a whole unix with you to run git".
    - lolive 3y ago
      GitBash, AutoHotkey, Notepad++, 7zip and PowerToys are the basic installs I do on any Windows I am given. Any dev opening a CMD is suspect, to me.
      - pjmlp 3y ago
        Not for me, as Windows developers don't need to depend on UNIX culture. The only thing that is debatable is using command prompt instead of powershell, unless for legacy scripts.

9dev 3y ago

Come on, isn’t that kind of an argument from the 90ies, when disk space was scarce, and internet connections slow? I mean like, I have space for millions of kitchen sinks now. Considering that, I kind of refuse to accept that out of all things, bundle size is a valid distinction criterion for VCS‘es.