Re: github.com/NetBSD/src 5 days old?

[maya%NetBSD.org@localhost]

On Sun, Apr 26, 2020 at 11:26:38PM +0000, Thomas Mueller wrote:
> On Sun, Apr 26, 2020 at 02:30:48PM +1000, Paul Ripke wrote:
> > I switched away from cvsup a while back, but I now see that github
> > NetBSD/src mirror is now 5 days old. Known issue?
> 
> maya%netbsd.org@localhost responded:
> 
> > Yes, I believe joerg and spz are changing the conversion from
> > cvs->??->git to hg->git, to match what will be done once we stop using CVS.
> 
> Then what will be the primary way to track NetBSD src and pkgsrc trees?
> 
> Now it's CVS, mirrored to git.  What will replace CVS, will it be git, hg, or something else, and will it be in the base system, or will it have to be built or pkg_add'ed from pkgsrc?
> 
> Is it a matter of CVS being less secure?  I see that OpenBSD, the great security-minded OS, still uses CVS, mirrored on Github.

Hi Thomas,

The main motivation to move away from CVS is that it's lacking in
features. The plan so far is to move to Mercurial, and not have it in
base. "Bootstrapping" is still possible using tarballs.

While I would hesitate to connect to a malicious CVS server, I don't see
a reason to suspect CVS is significantly worse than Git-over-SSH, for
example. A lot of the security in CVS relies on the SSH implementation.