Consider moving repository out of GitHub

Perhaps, given how large the OpenSSL project is, and how important it is to Microsoft and GitHub, that we can get a commitment statement from their senior management.

I don't see how this addresses the concern. Microsoft's reassurance isn't going to change their response to a request.

As far as we are publicly aware, there have only been a small number of large tech companies that have even contested government requests.

I don't think it's worth moving from GitHub - but definitely worth having several more backup locations.

OpenSSL has a GitHub Enterprise instance that is hosted in Europe (in Germany unless it's changed).

FYI, OpenSSL's github instance is hosted by Google. Anyone can see that with two commands:
- 'host github.openssl.org'
- 'whois {IP address}' (IP address taken from the previous command)

Do note that anyone is free to mirror github.com/openssl/openssl. In terms of resilience, we can set up clones of the repository anywhere, on any forge. It's in the nature of git.

This is not the actual problem.

The problem is redirection of forge specific features, such as handling issues and patches (pull-requests, merge-requests, ...), as well as workflows.

The effort required is something we do need to consider but it shouldn't be the sole (or even primary) concern in the decision. This is a BAC discussion, not a TAC one. We need to ask:

1. Is this a credible threat?

2. What's the likelihood of it happening?

3. What's the damage?

Basic risk analysis. My estimates of these are:

1. yes

2. insufficient information to assess properly

3. potentially catastrophic

@Paul Dale I think evaluating the costs of closing our GH repo(s) properly is the most important part of getting to any well informed decision.

From a very personal standpoint, I'm not convinced that another forge with the same centralizing format (which https://codeberg.org/ currently has, to be a bit crass, but I'm getting back to that). In the end, it's a matter of where things are hosted, and even if Germany (where codeberg is located) is a good enough country, we might find it displeasing some time in the future.

Rince.
Repeat.

With all that in mind, and if we're even considering these things, I would take a closer look at more decentralized models.

There is a model that relies on ActivityPub... it's unfortunately still more theoretical, or at most experimental. I know that Forgejo, which is the forge implementation that Codeberg uses, is working on an implementation, and it seems to be going forward, but development takes its due time, and they aren't there yet.

There is a model that relies on a mix of gossip protocol and essential git protocols for replication, implemented in Radicle. It's still young, so while it has all the basic features (issue and patch handling), it has some rough corners.

There is a model on top of ATproto (the protocol that drives Bluesky, among others), called Tangled, which seems to make some strides forward, but I haven't looked more closely.

I personally find this an interesting field, well worth a look, but can understand if we conclude that "yeah ok, interesting and worth keeping an eye on, but perhaps not quite going there yet".

Just to be clear: all of what I said above are personal reflections, not to be misunderstood as statements in a Foundation capacity.