jxself.org

Goodbye, Gitorious

I've been self-hosted since 1999, and always push that option when talking to people. I didn't always follow my own advice though and made an exception for public source code repos I put on Gitorious. The announcement of Gitorious's demise motivated me to change that policy so that the rug can't be pulled out from under me again. I spent some time reviewing options and wanted to share my own decisions and rationale.

• GitLab.com - The canonical upgrade path provided by GitLab B.V. is moving people from Gitorious to the hosted GitLab.com. I do not like the idea of moving to GitLab.com since that runs their Enterprise Edition which is not free software. Proprietary sofware is never a solution so this option is automatically disqualified.
• GitLab Community Edition - From a purely technical perspective this seems to have some nice features. GitLab B.V. only makes money when people buy the proprietary version though so they're clearly betting on people doing that. They also have a CLA, which I don't like. The lax pushover license used for the GitLab software already allows them to make proprietary versions though. I suspect it's only there so that they can be sure there are no issues with them proprietarizing people's contributions because it seems very big on making sure that they can sublicense the contributions under whatever terms they want. This is backed up by history: The CLA appeared in October 2013 and the license change for the Enterprise Edition was announced in February 2014 (it used to be free software), so the work on the CLA could be seen as preparing for the later license change. I'd like to be able to make contributions to a project without having to agree to such a thing. As a result, while it's free software, using the Community Edition seems like propping up GitLab B.V.'s proprietary software business which I find distasteful. Disqualified.
• Gitorious - It appears that GitLab B.V. will discontinue this so I'd be using abandoned software. That's not appealing to me. Also disqualified.
• Phabricator - Like GitLab B.V.'s Community Edition, this seems to have some nice technical features. It also comes with a CLA, which I don't like. Also disqualified.
• GNU Savannah - I can see that some may complain about the web interface not being HTML5-ified, responsive, or whatever other terms the kids are using these days. On the other hand, Savannah supports multiple version control systems, has issue, patch, and other trackers, mailing lists, website hosting, and more. Also, the GNU Project and FSF are unlikely to be going anywhere anytime soon.
• Kallithea - This seems rather appealing. It's community-developed, doesn't have a CLA, but it's missing some features some may want such as issue tracking. From reading about their future plans in the documentation this is and more is planned though. Seems like it could be a good candidate.
• Fossil - This seems like another good candidate. It has a bug tracker and a wiki in addition to source code hosting.
• Gogs - This seems like a good candidate. There's no CLA and it seems to have all of the features I'd want (namely, an issue tracker.) I've talked to some of the developers on IRC and they seem very responsive and accepting of feedback. Based on my suggestion they now plan to add an option to the web interace for people to export their issues and such so that they can take them with them if they decide to move to another instance.
• GitWeb - Basic, but would do what I need. My repositories are small, don't have lots of contributors (it's really just me) so I don't need bug trackers. I don't even get pull requests, really, having received exactly one. People can send their stuff to me via email, if they have any.

In the end, I've decided to go with GitWeb and letting people do anonymous cloning over HTTP. Someone with different needs (like an issue tracker) might do well with their own Gogs or Fossil instance though. I know of hosted Gogs instances at gogs.io and notabug.org and a hosted Fossil instance at chiselapp.com. Snowdrift.coop has a list of some other options too but whatever it is you should really run your own instance of it. The demise of Gitorious has shown just how easy it is to have the rug pulled out from under you. Do you really want to be in a position where it can happen again? I don't.