4 ms·
Vouch is forge-agnostic. See the 2nd paragraph in the README: > The implementation is generic and can be used by any project on any code forge, but we provide
by mitchellh 8mo ago
Vouch is forge-agnostic. See the 2nd paragraph in the README:
> The implementation is generic and can be used by any project on any code forge, but we provide GitHub integration out of the box via GitHub actions and the CLI.
And then see the trust format which allows for a platform tag. There isn't even a default-GitHub approach, just the GitHub actions default to GitHub via `--default-platform` flag (which makes sense cause they're being invoked ON GITHUB).
- yencabulator 8mo agoDefine "platform". So I can choose from github, gitlab or maybe codeberg? What about self-hosters, with project-specific forges? What about the fact that I have an account on multiple forges, that are all me? This seems to be overly biased toward centralized services, which means it's just serving to further re-enforce Microsoft's dominance.
- mitchellh 8mo agoIt's a text string, platform can be anything you want, then use the vouch CLI (or parse it yourself) to do whatever you want. We don't do identity mapping, because cross-forge projects are rare and maintaining that would centralize the system and its not what we're trying to do. The whole thing is explicitly decentralized with tiny, community specific networks that you build up.
- potsandpans 8mo agoI would rather stop contributing to open source rather than interact with your gatekeeping social experiment.
- mitchellh 8mo agoThat’s fine and doesn’t bother me one bit.
- potsandpans 8mo agoTracks. You don't care about the open source community.
- mitchellh 8mo agoNo, that’s quite a jump. I just respect whatever your preferences are.