Codeberg experiment invitation

[Wessel, Keith]

All, for what it's worth, and considering I might be the only one who this impacts, the web interface for Codebook is much less cluttered and easier to interact with using a screen reader than the existing hosted Git web interface. With that said, I had no problem browsing commits, branches, and tags and even searching for a file. But the one feature I couldn't do with a screen reader in a few minutes of exploration was to browse the file tree of a branch. That's a fairly basic and essential task, and while I usually just check out the repo so I can browse, search and tinker from a much more comfortable command line interface, I have been known to use the file browser in Git web. For Codebook, even though I was on the code tab, I couldn't find a list of files or a tree to traverse. I'm hoping I'm just missing something obvious rather than it being there but totally invisible to the screen reader.

Anyway, just wanted to provide my $0.02 on the ground floor of this experiment.

Keith


-----Original Message-----
From: dev <dev-bounces at shibboleth.net> On Behalf Of Ian Young
Sent: Thursday, September 25, 2025 11:02 AM
To: dev at shibboleth.net
Subject: Codeberg experiment invitation

Dear colleagues,

As you may be aware, the Shibboleth project was recently subjected to what appeared to be a Denial of Service attack on its infrastructure; specifically its GitWeb service. We have felt for some time that it would be better all round if we were able to have the Shibboleth source code hosted by one of the public services, where economies of scale can help defend against this kind of attack: obviously, the DoS brought this into focus again.

When we have looked at this before, the principal problem has been that public, commercial, Git hosting sites all require repository owners to indemnify the hosting provider against potential legal fees, at their discretion and without a limit to that liability. As the Shibboleth consortium isn’t a legal entity, this potentially unlimited financial burden would fall on the developers individually.

More recently we’ve come across Codeberg (https://codeberg.org), a not-for-profit Git hosting service for Free and Open Source Software projects which does not require us to indemnify them. Codeberg has come into the spotlight recently as an alternative to GitHub given the latter's move into Microsoft’s CoreAI division.

We have started to experiment with Codeberg as a possible host for the Shibboleth source code in the medium to long term. The current state of the experiment is described in [1]. To summarise:

- All of the Shibboleth Project’s public repositories are now mirrored to Codeberg, [2]
- These mirrors are read-only for now; issues and wiki features are disabled,
- Nothing is being removed from its current location for now.

If you work with the Shibboleth source code in any way, we’d like to invite you to participate in the experiment by making use of the Codeberg mirror when possible. For example, either re-cloning from the Codeberg version of the repository or changing your “origin” remote to point there. For example:

git remote set-url origin \
	https://codeberg.org/Shibboleth/java-parent-project.git \
	https://git.shibboleth.net/git/java-parent-project.git

Even if you do not have a local clone of the codebase, the browser experience at Codeberg when viewing commits and branches is in many ways more polished than the GitWeb service we have been providing (and which was the subject of the recent DoS attack).

Although this is an experiment for now, and as such we’re not committing to a change in our services, this is a direction that we believe is worth moving in if it is possible for us to do so. If you can, please help us in figuring out what is in fact possible.

   — Ian, for the Shibboleth Project



[1] https://shibboleth.atlassian.net/wiki/spaces/DEV/pages/4629659652/Codeberg+experiment

[2] https://codeberg.org/Shibboleth