Gitolite migration personas (team#40472)

[[_TOC_]]

Summary: Gitolite and gitweb will be fully retired in 9 to 12

Summary: Gitolite and GitWeb will be fully retired in 9 to 12

months. Start migrating your repositories now, following the

[migration procedure][].

# Personas

TODO: personas

## Arthur, the user

Examples:

Arthur, the average Tor user, will likely not notice any change from

this migration. Arthur rarely interacts with our git servers; if at

all, it might be through some link to a specification hidden deep

inside one of our applications or website documentation. Redirections

will ensure those will keep working at least partially.

 * ...

If Arthur ever becomes really motivated, they will become Barbara,

drive-by contributor.

Counter examples:

## Barbara, the drive-by contributor

 * ...

Barbara is a drive-by contributor, which finds and reports bugs in our

software or our documentation. Previously, Barbara was lost when she

would previously find git repositories because it was not clear where

or how to contribute.

Now, if Barbara finds the old git repositories, she will be redirected

to GitLab where she can make awesome contributions.

## Charlie, the old-timer

Charlie has been around the Tor project since before it was called

Tor. He knows by heart proposal numbers and magic redirections like

<https://spec.torproject.org/>.

Charlie will be slightly disappointed because some deep links to line

numbers in GitWeb will break. Charlie is concerned about the attack

surface in GitLab, but will look at the [mitigation strategies][].

Otherwise Charlie should be generally unaffected by the change.

[mitigation strategies]: https://gitlab.torproject.org/tpo/tpa/team/-/wikis/howto/gitlab#git-repository-integrity-solutions

# Alternatives considered

 * TODO: consider other forges?

Those are other alternatives to this proposal that were discussed but

rejected in the process.

## Keeping gitolite and cgit

## Keeping gitolite only for problem repositories

TODO: respond to intrigeri's suggestion in https://gitlab.torproject.org/tpo/tpa/team/-/issues/40472#note_2756340

One [suggestion](https://gitlab.torproject.org/tpo/tpa/team/-/issues/40472#note_2756340) that was made was to keep gitolite for problematic

repositories and keep a mirror to avoid having to migrate those to

GitLab.

After some research, it seems like only TPA is affected by those

problems. In effect, we have already implemented part of that

suggestion by keeping gitolite around for so long. Now, we're actually

going to find solutions to migrate those hooks into GitLab reliably.

## Concerns about GitLab's security

> > assuming that the timeframe is long enough.

> 

> For now, the result of that discussion is a [summary of git repository

> integrity solutions](howto/gitlab#git-repository-integrity-solutions), which is therefore delegated to teams.

> integrity solutions][mitigation strategies], which is therefore delegated to teams.

## git:// protocol redirections

infrastructure might provide a little slack that could be used for

that purpose.

## Other forges

There are many other forges around. We have used Trac in the past (see

[our Trac documentation](howto/trac)) and projects like [Gitea][] or

[Sourcehut][] are around as well.

Other than Trac, no serious evaluation of alternative Git forges was

performed before we migrated to GitLab in 2020. Now, we feel it's too

late to put that put that into question.

Migrating to other forges is therefore considered out of scope as far

as gitolite's retirement is concerned, but TPA doesn't permanently

exclude evaluating other solutions than GitLab in the future if

requirements are not being fulfilled correctly.

[Gitea]: https://gitea.io/

[Sourcehut]: https://sr.ht/

# Costs

Staff.