OpenSSL Communities
Tue 27 May 2025 12:02AM

Consider moving repository out of GitHub

PD Paul Dale Public Seen by 11

Should we move the public code repository away from GitHub?

GitHub is owned by Microsoft and it's servers are in the USA. The political environment in the USA is rather volatile at present and an edict that cripples the project's public repository is well within the realms of possibility.

When raised on the Corporation BAC call earlier today, two committee members pointed out that the instability is already having an impact on them:

  1. Randall noted that he's had to cancel a trip to the USA (from Canada) because travel insurance wasn't possible; and

  2. James noted that they are moving their code to https://codeberg.org/ because they cannot risk having hosting issues.

It was also mentioned that:

  • OpenSSL has a GitHub Enterprise instance that is hosted in Europe (in Germany unless it's changed).

  • There are free options available that are not USA based.

  • Tim said that Cryptsoft's customers hadn't raised this as a concern.

  • This is unlikely to be a concern for USA based companies or institutions.

  • Cryptography has been restricted in the past and having restrictions re-introduced is very plausible.

  • An open source project isn't really a thing if it's not on GitHub. Slightly overstated but …

Even if migration away from GitHub doesn't happen, having a contingency in place would be prudent.

Thoughts folks?

Note: this is not about "Microsoft is evil, we can't trust them". All large businesses are evil and none can be trusted. It's highly unlikely Microsoft would decide to cripple GitHub on a whim. They would, however, comply with any edict.

I'll post this in the other BAC as a discussion since the overlap isn't 100%.

PD

Paul Dale Tue 27 May 2025 10:35PM

Exploring other options apart from Codeberg is prudent, that was just an example not a commitment. Something more distributed would be good. Nonetheless, this is premature IMO.

For now, we need to figure out if we want to start looking into such a transition. Then we can figure out the specifics and the level of pain (i.e. cost) we're willing to endure to enact it.