5 ms·

OpenBao’s development seems heavily reliant on a single person, compared to multiple frequent long-term commiters to Vault. Not sure if I’d feel comfortable swi

by sevg 1y ago

OpenBao’s development seems heavily reliant on a single person, compared to multiple frequent long-term commiters to Vault. Not sure if I’d feel comfortable switching from Vault to OpenBao! I tried linking directly to contributors for last 12 months, but you still have to select the time range manually from the dropdown :( OpenBao: https://github.com/openbao/openbao/graphs/contributors?from=25%2F05%2F2024 https://github.com/openbao/openbao/graphs/contributors?from=... Vault: https://github.com/hashicorp/vault/graphs/contributors?from=25%2F05%2F2024 https://github.com/hashicorp/vault/graphs/contributors?from=...

JanMa 1y ago
It is true that most of the commits in the last 12 months were made by cipherboy, but I can assure you that the project is not a one man show. Building a community and getting traction on a project is hard work and takes time. Have a look at the contributions for our latest beta release and you'll see that the amount of people involved in the project is growing: https://github.com/openbao/openbao/releases/tag/v2.3.0-beta20250528 https://github.com/openbao/openbao/releases/tag/v2.3.0-beta2...
- sevg 1y ago
  Note to clarify: I wasn’t intending to disparage the project with my original comment! I appreciate that these things take time and a lot of hard work. Just wanted to share an observation, in the knowledge that it may not hold true indefinitely :)
- cipherboy 1y ago
  Yes, a big thank you to you, Jan, in particular! The organization has been slowly building trust in more committers and maintainers and so he's had to personally review many a pull request of mine in the interim. :-D
cipherboy 1y ago
GitHub's charts are inaccurate and a quick glance at the commit list would tell you that: https://github.com/openbao/openbao/commits/main/ https://github.com/openbao/openbao/commits/main/ -- you have to cross some threshhold number of commits across all time in the repository to even appear in that dashboard. https://insights.linuxfoundation.org/project/openbao-2/repository/openbao-openbao/contributors https://insights.linuxfoundation.org/project/openbao-2/repos... is a more accurate view. Yes, I contribute a lot, but in the last three months, we've seen substantial interest from other groups (thank you SAP, Reply, Adfinis, and G-Research OSS to name a few!) and have recently promoted a fresh group of committers. Having worked at HashiCorp, I'm rather proud of what the community has built and proud of our ability to promote external maintainers. Open governance isn't easy for corporate contributions, but it is possible and I thank my employer for letting me try. :-) Just look at the (narrowing) feature gap and critical improvements we've landed--transactions to name one--to see why I'm optimistic.
- sevg 1y ago
  Thanks for the response and calm rebuttal :) I realise GitHub’s graph isn’t necessarily fully representative, but one personal concern is that I don’t know yet how long-term many of these new contributors will be. That said, I also do applaud the efforts to build a community-driven fork in a similar vein to OpenTofu (which does seem to have critical mass now), and from the sounds of what you’re saying OpenBao is heading in the right direction too.
- burnt-resistor 1y ago
  What's annoying is the one man band projects get popular and then suddenly deciding to throw it away by archiving it on github without giving the chance of others to step in.
  - cipherboy 1y ago
    Definitely. It's why I've been pushing for open governance and slowly building community's trust in additional maintainers to avoid burnout and ensure continuity. You can see maintainer process here: https://github.com/openbao/openbao/blob/main/MAINTAINERS.md https://github.com/openbao/openbao/blob/main/MAINTAINERS.md And TSC processes here: https://github.com/openbao/openbao/blob/main/GOVERNANCE.md https://github.com/openbao/openbao/blob/main/GOVERNANCE.md Earlier this month, we moved from LF Edge to OpenSSF to better align with our umbrella foundation and hopefully reach more people.
  - RainyDayTmrw 1y ago
    It's the safe thing to do. If you endorse a fork, and the new maintainer goes rogue, it's on you. Or, let a prevailing fork naturally emerge, and hopefully that vets them a bit in the process.
phoronixrly 1y ago
So, the first reflex is to check whether this project offers free support/maintenance and development, a.k.a. free labour? It goes to show how perverted our current understanding of open source is.
- sevg 1y ago
  If I understand your comment correctly, I think you’ve read my comment uncharitably. I’m not making an entitled demand for free labor. I’m talking about business decisions. My business uses many FOSS projects. We want to pick projects that are likely to be long-term solutions to reduce churn. (We also can’t pay for all of them or become committers on all of them. Equally, we don’t demand free support. This is just a risk-based decision making process.)
  - 0xbadcafebee 1y ago
    Couple of things to consider for your business: 1) If Vault's license format prevents managed hosted solutions, you might want to switch to OpenBao. 2) Vault has enterprise solutions you have to pay for; OpenBao is making those free. 3) In general, if you plan to pay for support, use Vault. If you don't plan to pay for support, use either of them, because they require the same amount of maintenance and have the same features. Since OpenBao is a fork, you can just review the ChangeLogs when you upgrade to see how far it has diverged from upstream. Once it's diverged more than you're comfortable with, you can just switch back to Vault [before you adopt diverged features] and it will be a very small change. You can also avoid using any OpenBao features which aren't compatible upstream. It's worth considering that your business can lend legitimacy to OpenBao, which will increase its contributor share. You can simultaneously make a small, low-risk engineering decision, while helping grow an open source project [which helps your business].
    - inhumantsar 1y ago
      alternatively, donate to openbao the amount you'd pay for Vault support. you'll help ensure the project doesn't fall into disrepair and get more influence over fix/feature prioritization than you could with Vault.

by sevg 1y ago

JanMa 1y ago

It is true that most of the commits in the last 12 months were made by cipherboy, but I can assure you that the project is not a one man show. Building a community and getting traction on a project is hard work and takes time. Have a look at the contributions for our latest beta release and you'll see that the amount of people involved in the project is growing: https://github.com/openbao/openbao/releases/tag/v2.3.0-beta20250528 https://github.com/openbao/openbao/releases/tag/v2.3.0-beta2...

sevg 1y ago
Note to clarify: I wasn’t intending to disparage the project with my original comment! I appreciate that these things take time and a lot of hard work. Just wanted to share an observation, in the knowledge that it may not hold true indefinitely :)
cipherboy 1y ago
Yes, a big thank you to you, Jan, in particular! The organization has been slowly building trust in more committers and maintainers and so he's had to personally review many a pull request of mine in the interim. :-D

cipherboy 1y ago

GitHub's charts are inaccurate and a quick glance at the commit list would tell you that: https://github.com/openbao/openbao/commits/main/ https://github.com/openbao/openbao/commits/main/ -- you have to cross some threshhold number of commits across all time in the repository to even appear in that dashboard. https://insights.linuxfoundation.org/project/openbao-2/repository/openbao-openbao/contributors https://insights.linuxfoundation.org/project/openbao-2/repos... is a more accurate view. Yes, I contribute a lot, but in the last three months, we've seen substantial interest from other groups (thank you SAP, Reply, Adfinis, and G-Research OSS to name a few!) and have recently promoted a fresh group of committers. Having worked at HashiCorp, I'm rather proud of what the community has built and proud of our ability to promote external maintainers. Open governance isn't easy for corporate contributions, but it is possible and I thank my employer for letting me try. :-) Just look at the (narrowing) feature gap and critical improvements we've landed--transactions to name one--to see why I'm optimistic.

sevg 1y ago
Thanks for the response and calm rebuttal :) I realise GitHub’s graph isn’t necessarily fully representative, but one personal concern is that I don’t know yet how long-term many of these new contributors will be. That said, I also do applaud the efforts to build a community-driven fork in a similar vein to OpenTofu (which does seem to have critical mass now), and from the sounds of what you’re saying OpenBao is heading in the right direction too.
burnt-resistor 1y ago
What's annoying is the one man band projects get popular and then suddenly deciding to throw it away by archiving it on github without giving the chance of others to step in.
- cipherboy 1y ago
  Definitely. It's why I've been pushing for open governance and slowly building community's trust in additional maintainers to avoid burnout and ensure continuity. You can see maintainer process here: https://github.com/openbao/openbao/blob/main/MAINTAINERS.md https://github.com/openbao/openbao/blob/main/MAINTAINERS.md And TSC processes here: https://github.com/openbao/openbao/blob/main/GOVERNANCE.md https://github.com/openbao/openbao/blob/main/GOVERNANCE.md Earlier this month, we moved from LF Edge to OpenSSF to better align with our umbrella foundation and hopefully reach more people.
- RainyDayTmrw 1y ago
  It's the safe thing to do. If you endorse a fork, and the new maintainer goes rogue, it's on you. Or, let a prevailing fork naturally emerge, and hopefully that vets them a bit in the process.

phoronixrly 1y ago

So, the first reflex is to check whether this project offers free support/maintenance and development, a.k.a. free labour? It goes to show how perverted our current understanding of open source is.

sevg 1y ago
If I understand your comment correctly, I think you’ve read my comment uncharitably. I’m not making an entitled demand for free labor. I’m talking about business decisions. My business uses many FOSS projects. We want to pick projects that are likely to be long-term solutions to reduce churn. (We also can’t pay for all of them or become committers on all of them. Equally, we don’t demand free support. This is just a risk-based decision making process.)
- 0xbadcafebee 1y ago
  Couple of things to consider for your business: 1) If Vault's license format prevents managed hosted solutions, you might want to switch to OpenBao. 2) Vault has enterprise solutions you have to pay for; OpenBao is making those free. 3) In general, if you plan to pay for support, use Vault. If you don't plan to pay for support, use either of them, because they require the same amount of maintenance and have the same features. Since OpenBao is a fork, you can just review the ChangeLogs when you upgrade to see how far it has diverged from upstream. Once it's diverged more than you're comfortable with, you can just switch back to Vault [before you adopt diverged features] and it will be a very small change. You can also avoid using any OpenBao features which aren't compatible upstream. It's worth considering that your business can lend legitimacy to OpenBao, which will increase its contributor share. You can simultaneously make a small, low-risk engineering decision, while helping grow an open source project [which helps your business].
  - inhumantsar 1y ago
    alternatively, donate to openbao the amount you'd pay for Vault support. you'll help ensure the project doesn't fall into disrepair and get more influence over fix/feature prioritization than you could with Vault.