[MacPorts] #55934: Mirror SourceForge svn repositories

[MacPorts]

#55934: Mirror SourceForge svn repositories
-----------------------------+---------------------
  Reporter:  ryandesign      |      Owner:  admin@…
      Type:  enhancement     |     Status:  new
  Priority:  Normal          |  Milestone:
 Component:  server/hosting  |    Version:
Resolution:                  |   Keywords:
      Port:                  |
-----------------------------+---------------------
Description changed by ryandesign:

Old description:

> SourceForge's uptime has been bad for the past two weeks. They moved to a
> new data center, and have experienced problems and DDoS attacks since
> then. For ports that fetch directly from a code repository hosted on
> SourceForge, such as netpbm, this means the port can't be installed, for
> users who for whatever reason don't receive a binary archive. See #55930,
> #55853, #54918.
>
> There have also been many reports of fetch failures that were the result
> of restrictive user network configurations. We used to fetch from svn
> using the svn protocol, but some networks blocked that port number. See
> #41023. We tried using http, until we found that some proxies interfered
> with that, since svn uses WebDAV's additional HTTP verbs that some
> proxies are unfamiliar with. See #28590. We switched to https, but
> recently SourceForge disabled support for older SSL protocols, making
> fetches fail using the version of svn included on OS X El Capitan and
> earlier. See #55933.
>
> When SourceForge comes back online, I propose that MacPorts provide
> mirrors of the SourceForge svn repositories we use. Currently that's the
> following 10 ports:
>
> * AtomicParsley-devel
> * PsyncX
> * cmuclmtk
> * codeblocks
> * cotvnc
> * despotify
> * flashdot
> * netpbm
> * pymol
> * spim
>
> Such mirrors can be easily created using `svnsync` and kept up to date by
> rerunning `svnsync` periodically. Once a day is probably sufficient. They
> can be hosted on svn.macports.org, where we already host our own archived
> svn repo. Ports that fetch from svn can then either always use the
> MacPorts svn mirror, or it can just be available as something we can
> switch ports to if the original server goes offline.
>
> I know other solutions to the vcs fetch problem have been proposed and
> are partially implemented, such as MacPorts automatically generating a
> tarball. See [log:macports-base at vcs-fetch]. But until such solutions are
> finished and available to users, mirroring the repos could be a quick
> simple solution.
>
> There are also 4 ports fetching from git repositories hosted on
> SourceForge:
>
> * SSHKeychain
> * gcs-java
> * ttk
> * xchm
>
> Offering mirrors of those is something we could discuss separately,
> though since git makes it easy to clone repos, there may already be
> mirrors of them on GitHub or elsewhere that we could use.

New description:

 SourceForge's uptime has been bad for the past two weeks. They moved to a
 new data center, and have experienced downtime and DDoS attacks since
 then. See https://twitter.com/sfnet_ops. For ports that fetch directly
 from a code repository hosted on SourceForge, such as netpbm, this means
 the port can't be installed, for users who for whatever reason don't
 receive a binary archive. See #55930, #55853, #54918.

 There have also been many reports of fetch failures that were the result
 of restrictive user network configurations. We used to fetch from svn
 using the svn protocol, but some networks blocked that port number. See
 #41023. We tried using http, until we found that some proxies interfered
 with that, since svn uses WebDAV's additional HTTP verbs that some proxies
 are unfamiliar with. See #28590. We switched to https, but recently
 SourceForge disabled support for older SSL protocols, making fetches fail
 using the version of svn included on OS X El Capitan and earlier. See
 #55933.

 When SourceForge comes back online, I propose that MacPorts provide
 mirrors of the SourceForge svn repositories we use. Currently that's the
 following 10 ports:

 * AtomicParsley-devel
 * PsyncX
 * cmuclmtk
 * codeblocks
 * cotvnc
 * despotify
 * flashdot
 * netpbm
 * pymol
 * spim

 Such mirrors can be easily created using `svnsync` and kept up to date by
 rerunning `svnsync` periodically. Once a day is probably sufficient. They
 can be hosted on svn.macports.org, where we already host our own archived
 svn repo. Ports that fetch from svn can then either always use the
 MacPorts svn mirror, or it can just be available as something we can
 switch ports to if the original server goes offline.

 I know other solutions to the vcs fetch problem have been proposed and are
 partially implemented, such as MacPorts automatically generating a
 tarball. See [log:macports-base at vcs-fetch]. But until such solutions are
 finished and available to users, mirroring the repos could be a quick
 simple solution.

 There are also 4 ports fetching from git repositories hosted on
 SourceForge:

 * SSHKeychain
 * gcs-java
 * ttk
 * xchm

 Offering mirrors of those is something we could discuss separately, though
 since git makes it easy to clone repos, there may already be mirrors of
 them on GitHub or elsewhere that we could use.

--

--
Ticket URL: <https://trac.macports.org/ticket/55934#comment:1>
MacPorts <https://www.macports.org/>
Ports system for macOS