The title suggests a that this is a feature request, but maybe it's more of a documentation item stemming from me not understanding something...
I've been looking into setting up an Athens proxy for both public and private repos, but I was a little confused about the proper use of ATHENS_GONOSUM_PATTERNS and GONOSUMDB in your documentation on proxying checksum requests.
After reading through that documentation, here are the main questions I have:
- Is there a need for checksums on public repos that I have control over?
- Is there a need for checksums on private repos?
a. What are the dangers of not checksumming the public repos under my control?
b. When is there a need for checksums on a private repo?
c. Are there any problems that could stem from a two parties using the same tag but having different checksums because one had turn off checksums?
- When I have a mix of public and private repos under the same name space (i.e.
github.com/company/*), is there a good way to (1) allow checksums in public repos and (2) disallow checksums for the private repos without managing a list of private/public repos?
a. I don't want to have to (1) manage that list across Athens and developers machines, (2) update Athens every time I add a new private repo (because I'll forget), (3) field questions from individuals why they are getting 410 errors when they want to get the new private repo.
- Would it make sense to use Athens as a private checksum database for my own private repos?
a. Are there consequences with not being in sync with the global checksum db if I accidentally configure it to also checksum public repos?
Action items
I see this becoming either a feature request to add checksum database functionality to Athens for private repos and all the problems that may come with that OR updating documentation to explain the "ideal" way to handle checksums with public/private stuff, explaining the trade-offs of various configurations, etc. Maybe have something explaining how to manage the list of private repos in an efficient/scaleable manner.
The title suggests a that this is a feature request, but maybe it's more of a documentation item stemming from me not understanding something...
I've been looking into setting up an Athens proxy for both public and private repos, but I was a little confused about the proper use of
ATHENS_GONOSUM_PATTERNSandGONOSUMDBin your documentation on proxying checksum requests.After reading through that documentation, here are the main questions I have:
a. What are the dangers of not checksumming the public repos under my control?
b. When is there a need for checksums on a private repo?
c. Are there any problems that could stem from a two parties using the same tag but having different checksums because one had turn off checksums?
github.com/company/*), is there a good way to (1) allow checksums in public repos and (2) disallow checksums for the private repos without managing a list of private/public repos?a. I don't want to have to (1) manage that list across Athens and developers machines, (2) update Athens every time I add a new private repo (because I'll forget), (3) field questions from individuals why they are getting
410errors when they want to get the new private repo.a. Are there consequences with not being in sync with the global checksum db if I accidentally configure it to also checksum public repos?
Action items
I see this becoming either a feature request to add checksum database functionality to Athens for private repos and all the problems that may come with that OR updating documentation to explain the "ideal" way to handle checksums with public/private stuff, explaining the trade-offs of various configurations, etc. Maybe have something explaining how to manage the list of private repos in an efficient/scaleable manner.