Re: Google Code shutting down

[Trevor Daniels]

Trevor Daniels wrote Saturday, May 16, 2015 12:27 PM
> 
> David Kastrup wrote Saturday, May 16, 2015 11:11 AM
> 
>>> Trevor Daniels wrote Tuesday, May 12, 2015 9:15 PM
>>>
>>>> I'm sure we'll find some undesirable features of Allura when we get
>>> down to the details, but that's what the next few weeks will tell us.
>>>
>>> I've pretty well completed my assessment of Allura at SourceForge, and
>>> find the facilities available pretty well match our needs, in fact
>>> they are surprisingly similar to those at GoogleCode.  There are some
>>> differences but none which we can't live with.  So far so good.
>>>
>>> However, there is a show-stopper concerning the integrity of the
>>> Issues discussions recorded in the tracker.  Each item in the
>>> discussion has an owner, and this is set to Anonymous during the
>>> import, since the original owner is not recognised as a SourceForge
>>> account-holder.  This in itself is not a serious problem, as the
>>> correct owner is recorded in the text of the message.  However, owners
>>> of discussion messages are always permitted to edit them, irrespective
>>> of the permission settings, and I can find no way of preventing this.
>>> That means Anonymous, which is any not-logged-in user, i.e. anyone,
>>> will be able to edit, accidently or maliciously, any and all
>>> discussion entries in our Issues DB.
>>>
>>> I've reported this to the SourceForge maintainers:
>>> https://sourceforge.net/p/forge/site-support/10317/
>> 
>> So one probably will want to have some fallback owner here.  
> 
> Yes, I've suggested using a dummy user, like Importer, in the report
> I submitted.  Or even the project owner.
> 
>> The issue
>> would be somewhat softened if we can convince Savannah to offer Allura,
>> but not all current issue owners are in the LilyPond project member set
>> on Savannah either.
> 
> I don't think the importer is part of Allura.  I suspect it is an
> add-on developed by or for SourceForge, although I have no evidence to 
> back that up, only that the documentation for it is separate from the
> Allura documentation.  I'll dig a bit.

An update: my suspicion was wrong: the importer _is_ part of Allura.

I simply cloned the Allura git repository and browsed, finding
Allura/ForgeImporters/forgeimporters/google/tracker.py
which from the messages clearly is the code used in my import test.

As an aside, the repository seems pretty active.  The last release
was 1.2.1 (Feb 2015), and there are c.170 commits since then.

Trevor