Codeberg experiment invitation

[Ian Young]

Dear colleagues,

As you may be aware, the Shibboleth project was recently subjected to what appeared to be a Denial of Service attack on its infrastructure; specifically its GitWeb service. We have felt for some time that it would be better all round if we were able to have the Shibboleth source code hosted by one of the public services, where economies of scale can help defend against this kind of attack: obviously, the DoS brought this into focus again.

When we have looked at this before, the principal problem has been that public, commercial, Git hosting sites all require repository owners to indemnify the hosting provider against potential legal fees, at their discretion and without a limit to that liability. As the Shibboleth consortium isn’t a legal entity, this potentially unlimited financial burden would fall on the developers individually.

More recently we’ve come across Codeberg (https://codeberg.org), a not-for-profit Git hosting service for Free and Open Source Software projects which does not require us to indemnify them. Codeberg has come into the spotlight recently as an alternative to GitHub given the latter's move into Microsoft’s CoreAI division.

We have started to experiment with Codeberg as a possible host for the Shibboleth source code in the medium to long term. The current state of the experiment is described in [1]. To summarise:

- All of the Shibboleth Project’s public repositories are now mirrored to Codeberg, [2]
- These mirrors are read-only for now; issues and wiki features are disabled,
- Nothing is being removed from its current location for now.

If you work with the Shibboleth source code in any way, we’d like to invite you to participate in the experiment by making use of the Codeberg mirror when possible. For example, either re-cloning from the Codeberg version of the repository or changing your “origin” remote to point there. For example:

git remote set-url origin \
	https://codeberg.org/Shibboleth/java-parent-project.git \
	https://git.shibboleth.net/git/java-parent-project.git

Even if you do not have a local clone of the codebase, the browser experience at Codeberg when viewing commits and branches is in many ways more polished than the GitWeb service we have been providing (and which was the subject of the recent DoS attack).

Although this is an experiment for now, and as such we’re not committing to a change in our services, this is a direction that we believe is worth moving in if it is possible for us to do so. If you can, please help us in figuring out what is in fact possible.

   — Ian, for the Shibboleth Project



[1] https://shibboleth.atlassian.net/wiki/spaces/DEV/pages/4629659652/Codeberg+experiment

[2] https://codeberg.org/Shibboleth


-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/pkcs7-signature
Size: 4151 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/dev/attachments/20250925/d5f2199c/attachment.p7s>