9 ms·

GitHub Broken Download URLs

206 points by wyoh 5y ago

sharmin123 5y ago
Learn Ethical Hacking And Save The World: Hacking Benefits: https://www.hackerslist.co/learn-ethical-hacking-and-save-the-world-hacking-benefits/ https://www.hackerslist.co/learn-ethical-hacking-and-save-th...
junon 5y ago
Another gripe; unrelated, but since we're piling on... My username ends in a hyphen. Apparently, that's no longer allowed, though my username appears to be grandfathered in. Trying to give feedback about new experimental features lands me on the GitHub communities site, which is treated as a standalone app and thus requires you to log in via GitHub (it doesn't re-use the existing session token). However, Communities won't let me sign up with my username since it has a hanging hyphen, and I can't change the username in the form. So I effectively can't sign up. Support has not responded for over a month. Feels like things are inching toward getting worse with GitHub.
- belter 5y ago
  I am surprised a Microsoft MVP Certified Professional expert did not pop up yet in the newsgroup, asking you to reboot your machine and review the steps in a certain technote ;-)
  - framecowbird 5y ago
    "Have you tried closing your browser and then opening it again?"
  - Causality1 5y ago
    Hey now, that's libel. There are problems that can be solved by rebooting, and a Microsoft MVP would never post a genuine potential solution. I'm pretty sure you meant to say "an MVP popped up in the newsgroup to copy/paste a paragraph of random intro text and then ask if he's solved your problem".
    - NGRhodes 5y ago
      You are giving them too much credit, it will be copy and pasted from the post/thread/comment/accepted solution that you have already stated you have tried and does not work.
  - 13415 5y ago
    They usually recommend to reinstall the whole operating system, though. Because people have time for this...
- GordonS 5y ago
  I don't mean to "victim blame", but I'm curious why you'd choose a username ending in a hyphen in the first place? (I would have thought this wouldn't work on lots of services)
  - junon 5y ago
    I signed up to GitHub almost 11 years ago, and someone else already registered the username I used for everything. So 11-years-ago-me tacked on a hyphen as I had seen a few other people do it, too.
    - KennyBlanken 5y ago
      > I signed up to GitHub almost 11 years ago, and someone else already registered the username I used for everything. So 11-years-ago-me tacked on a hyphen "I purposefully chose to create a nearly identical username to an existing user" isn't a great defense to someone saying the problem is between the chair and keyboard. At best you didn't think of the possible confusion you'd cause.
      - junon 5y ago
        Both the other account and myself are quite active on GitHub. There has been a mistype maybe 5 times in 11 years. So sorry, but no. Things have been fine. In places where the hyphen is ambiguous, I always make a point to mention it. It's never really been an issue, and the other individual has always been quite nice when the hyphen is omitted, kindly pinging me instead. I'm not trying to defend against anything except poor attempts to paint me as somehow malicious...
      - mmis1000 5y ago
        > "I purposefully chose to create a nearly identical username to an existing user" Is that even surprising? Some names are just so common that people use them all the time and ends up as John, John_ , John-, John1, John11. John100
  - jeroenhd 5y ago
    Hyphens and underscores are often permitted characters in usernames, more so than exclamation marks or other special characters. I don't really see what problem using a hyphen in a username could pose, unless there's some kind of filter being applied that doesn't take into account the previously permitted characters. I'd guess someone applied an [A-z0-9]+ without thinking too much about it because that's what the current username rules are. I'm more surprised that there's a second authorization endpoint, Github could've just used their existing OAuth2 implementation to log users in if they didn't want to reuse the existing login code.
- RedShift1 5y ago
  Have you tried sfc /scannow?
- jrochkind1 5y ago
  Github does let you change your username. I imagine if support got back to you, they'd say "Yes, that was grandfathered in for backwards compatibilty, but that username is no longer allowed and won't always work with new services or functions, as you discovered. We recommend changing your username." However, not getting a response is not encouraging, it's true.
- Eikon 5y ago
  Sounds like a very important and critical issue that should be prioritised.
- favadi 5y ago
  I still remember the night when logrus's author decided to rename his Github account and broke our production build (https://github.com/sirupsen/logrus/pull/384 https://github.com/sirupsen/logrus/pull/384). Since then, I always vendor third party dependencies.
  - junon 5y ago
    To be fair, this is a side effect of poor module system design in Go. Not really github's fault here.
- floatingatoll 5y ago
  “We” are not piling on; you are. Please don’t shop unrelated concerns to threads that aren’t about that concern. GitHub breaking release URLs worldwide after a multi-hour global outage has no relationship whatsoever to your problem. I sympathize with your frustration, but pet peeve derails pollute HN discussions about every topic under the sun these days. Submit a post instead, and if it doesn’t get traction, so be it.
  - junon 5y ago
    > pet peeve derails pollute HN This isn't a pet peeve derailment. This is commentary on the multitude of issues GitHub has had in recent history, at least from my perspective. A "pet peeve" is something I find annoying. This isn't that - it's a bug. Further, my comment doesn't break the guidelines. I'm not commenting on the layout. I'm not flagrantly dismissing someone's work. If you don't like my comment, either keep scrolling or downvote and move on?
    - floatingatoll 5y ago
      By your logic, any time someone posts about GitHub, it’s appropriate and sensible for each of us to post about whatever GitHub bug upsets us most. This leads to the HN we have today, with hundreds of upvoted comments per day clamoring about each individual’s personal upsets, wholly unrelated to the topics at hand. If you had violated a guideline, I would have contacted the mods rather than reply. The tragedy is that no rule can sufficiently be written that keeps people from concern shopping their personal issues into discussions on the most tenuous of links. “This is a post about a GitHub bug” opens the door for me to post about the hundreds of GitHub bugs I’ve encountered over time, and with thousands of users at HN, if we each do this, there’s so much less room left for discussion about the actual bug this post is about. This affects Show HN, too: when someone posts their cool thing, everyone chimes in with all the other cool things that they like better. It’s incredibly disheartening and sets aside the purpose of the post – “a thing, discuss” – so that people can use that request as a launchpad to discuss other things instead, without making even the slightest effort to tie it back with relative comparisons to the Show HN topic itself. There is no guideline that asks us to set aside our personal needs and desires in these comments and focus on what brings the most value to the original topic, no matter what we feel about other topics that happen to also be about GitHub. But I continue to hope, out loud and with salient arguments, that HN will step up and respect itself more than the guidelines require.
- grepfru_it 5y ago
  I've got you bro, try again in a week
  - junon 5y ago
    For real? :o
the_duke 5y ago
At least now I know why my nix builds are failing... Odd for something like this to slip through and not be rolled back immediately. Unless it was intentional, in which case it would be even more odd to not communicate this widely beforehand.
- tata71 5y ago
  Reproducible builds via IPFS when?
  - hutrdvnj 5y ago
    And then your IPFS pin service has a down time.
    - kevincox 5y ago
      The point of IPFS is that as long as a single online host has the content you will be able to fetch it.
      - hutrdvnj 5y ago
        Sure, but in case of peer-to-peer downloads it's often the case that not so common stuff have zero seeders.
- KennyBlanken 5y ago
  If Github doesn't at least monitor their 404 error rate for large-scale spikes, whoever is in charge of SRE should be fired. With no announcements and no response to a now two day old bug report, I see two possibilities: 1)Their monitoring of their infrastructure and monitoring of issues is shockingly incompetent for a company of their size and importance (the fact that it is a US holiday is irrelevant.) 2)This was 100% intentional and they're purposefully looking "incompetent" to get people to shift to using other services for downloads. My money is on the latter, given others in this discussion are reporting random download link failures starting a month or two ago. A huge number of projects seem to use GitHub as a sort of free file hosting service. I imagine the opex for both storage and bandwidth is a not insignificant amount of money and someone has been told to shoo the freeloaders off the grass. Announcing they're ending free file hosting for unpaid projects would generate a lot of noise and PR. Instead they just make it unreliable, and people go elsewhere. Multiple people in this discussion have described moving downloads of Github in response, which is exactly what Github likely wants.
AshamedCaptain 5y ago
Say what you want about "cloud" reliability, but my little home server in a residential ISP has been up for more time than Github.com in (at least!) the past year.
- arendtio 5y ago
  Well, my home server has about the uptime as WhatsApp had this year. Yet I am still happy that I moved my XMPP server to the Hetzner cloud as it seems to have a better uptime then both ;-)
- elephantum 5y ago
  Did it also handled similar load and feature complexity as well?
  - loloquwowndueo 5y ago
    And does it have an army of highly paid developers and engineers to look after it also? ;)
    - framecowbird 5y ago
      And does it have a cute animal-based mascot?
      - ddtaylor 5y ago
        If TV commercials are anything to go by then picking a good animal mascot for your company/brand is probably the most important thing!
      - Hamuko 5y ago
        Does Github?
  - Nextgrid 5y ago
    Does it need to handle similar load though? It doesn't have to host all the world's open-source projects, it just needs to host the owner's ones.
_zywo 5y ago
Whether this specific problem is intentional or not, these kinds of problems show the issue with using a single centralized service for distribution of third-party dependencies. But it's just so much more darned convenient than hosting your own Git server! It would be super cool if there was a decentralized alternative to GitHub, that used Git under the hood. Perhaps one would upload their repositories to a node, which would then be synchronized with all other nodes, and all you would need to do to use it is to specify any_node.com/author/project. This would keep GitHub's discoverability, while allowing all the benefits of decentralization.
- mfashby 5y ago
  Some software like gitea [1] can mirror github repositories (or vice versa). Some other software like fossil [2] is designed to do not just source code but also issue tracking etc. in a decentralised fashion. It's definitely more work than just throwing it onto GitHub though, something more convenient would be really cool. [1] https://gitea.io/ https://gitea.io/ [2] https://fossil-scm.org/ https://fossil-scm.org/
- adeelk93 5y ago
  Breaking changes aren’t only an issue with centralization. A breaking change with git itself would mess up your decentralized scenario as well.
  - TobTobXX 5y ago
    Maybe for one or two minutes, but if it costs more time, I'd just rollback my git installation. Good Luck rolling back GitHub.
    - adeelk93 5y ago
      But what about rolling back someone else’s installation? What if you’re depending on a different user that has a buggy installation?
- viccuad 5y ago
  I would love to see a Git+Matrix forge, completely decentralised. With the spaces and the upcoming threads, seems like it wouldn't be so difficult to create a client that exposes that. It would be easier to make it closer to Gerrit than Github review process, which would be a step up!
grumple 5y ago
We ran into intermittent failure with Github download urls around a month or two ago that caused our builds to fail (there was no github status, but we replicated the failure easily manually). In response to the failure, we started self-hosting the dependency. The fewer external dependencies you depend on at the actual point of builds/deploys, the better. Since you're using a fixed version of the dependency anyway, you might as well self-host or include it in the ami or container.
sashk 5y ago
Ran into this issue when was updating package. But then, I did not find anywhere mentioned this url documented anywhere. I.e currently broken link to archives https://github.com/USER/REPO/archive/TAG/REPO-TAG.tar.gz https://github.com/USER/REPO/archive/TAG/REPO-TAG.tar.gz vs currently working and documented URL https://github.com/USER/REPO/archive/refs/tags/TAG.tar.gz https://github.com/USER/REPO/archive/refs/tags/TAG.tar.gz Is there a list of pre-defined URLs supported by GitHub?
gudmundur 5y ago
Hi everyone. I'm an engineer at GitHub and I just posted a response to this issue here: https://github.com/github/feedback/discussions/8149#discussioncomment-1712006 https://github.com/github/feedback/discussions/8149#discussi....
- dehrmann 5y ago
  > A change in the handling of URL schemes was deployed a couple of days ago This was deployed Thanksgiving week? I realize Github isn't a consumer company, so it doesn't face the same pressures as Amazon, but I'm surprised there wasn't a code freeze so people can have a quiet holiday weekend.
  - bengale 5y ago
    Is everyone at GitHub based in America?
    - novok 5y ago
      If a good chunk of them are, it's still good to do a code freeze. If %30-90 of your company is on holiday, not a good time to do major things.
    - mdoms 5y ago
      No, they are not. I know at least one Kiwi who worked remotely for Github from New Zealand.
    - jsnell 5y ago
      No. But this appears to now be the most important online shopping week of the year in all of Europe as well. Shops are abnormally sensitive to outages. You'd expect all kinds of service providers to be extremely conservative with code and config pushes this week due to that. Maybe GitHub is far enough removed from the actual consumers that they don't feel the pressure, but it does seem surprising.
- kzrdude 5y ago
  Thanks for fixing! Sorry for being curious.. does Github have an office in Copenhagen? That would be cool.
Karellen 5y ago
> Arch Linux as well for every package downloading tarballs from GitHub. Packages checking out the git source tree are not affected, but they are a minority. It feels like people are using git wrong.
- anjbe 5y ago
  When building distro packages from source, the full revision history of a Git repo is unnecessary. Downloading just the source code of a specific commit or tag with curl is simpler, faster, has fewer dependencies, and is less prone to breakage (well, unless your URLs change under you, as happened here).
  - jeroenhd 5y ago
    Git allows checking out only a limited set of changes with the --depth flag: git clone --branch v1.0 --depth 1 https://github.com/example/example.git The parameter is called --branch but it also takes tags. It's not as fast as fetching a ZIP file, but it gets pretty close. From my count, this method only requires one dependency (git) whereas the curl + unzip method requires, well, both curl and unzip. The zip download method (download, decompress, build, compress into package, decompress onto system) is already silly enough, the first decompression part can easily be dropped.
    - anjbe 5y ago
      > It's not as fast as fetching a ZIP file, but it gets pretty close. In the context of distro packages (the bug report mentioned OpenBSD and Fedora) you might be building tens of thousands of packages of which thousands are likely to come from GitHub. A small difference becomes greatly magnified. > From my count, this method only requires one dependency (git) whereas the curl + unzip method requires, well, both curl and unzip. You’re forgetting that git itself depends on curl.
  - Karellen 5y ago
    The first time, sure. But the second time, a `git pull` should normally be significantly quicker. Heck, you could check if the tag you want already exists in the repo you have and skip the `git pull` a lot of the time.
intunderflow 5y ago
Combined with the outage yesterday this hasn't been a good weekend for GitHub SRE's I'm surprised something like this happened on a weekend though since I wouldn't expect anyone to be changing anything in the codebase (then again it could be some infra has just ran out of storage or etc)
- yardstick 5y ago
  Perhaps there’s a lack of attention due to the holiday weekend in the US? Seems like major incidents in infrastructure and services tend to happen over holidays (general observation, not GitHub specific).
  - deleted 5y ago
    [deleted]
mfashby 5y ago
This has also broken a bunch of packages in the arch user repository, for example https://aur.archlinux.org/packages/dendrite/ https://aur.archlinux.org/packages/dendrite/ :(
- Semaphor 5y ago
  Yeah, I thought the package I tried to install had an issue, but didn’t have the time to investigate. This explains it.
- viccuad 5y ago
  This sounds for the better. Not having code mirrors (as other distribution channels) sounds not just insecure, but borderly malicious.
  - themusicgod1 5y ago
    Using github, period, is not just insecure, but actively malicious. Stop using NSA/Microsoft.
  - turminal 5y ago
    I suspect you have no idea what AUR is and how it works and furthermore, you have no experience with software packaging. If a project is using github to publish releases, where else are consumers of that software going to get them from? Having all sources of everything that is packaged backed up is a must for the official repository of a competent distro, but even in that case there is no reason not to use github in normal operation.
  - mfashby 5y ago
    Depends what you mean by better. It's kind of annoying for me when trying to install some software I want to actually use, and I just can't.

206 points by wyoh 5y ago

Learn Ethical Hacking And Save The World: Hacking Benefits: https://www.hackerslist.co/learn-ethical-hacking-and-save-the-world-hacking-benefits/ https://www.hackerslist.co/learn-ethical-hacking-and-save-th...

junon 5y ago

Another gripe; unrelated, but since we're piling on... My username ends in a hyphen. Apparently, that's no longer allowed, though my username appears to be grandfathered in. Trying to give feedback about new experimental features lands me on the GitHub communities site, which is treated as a standalone app and thus requires you to log in via GitHub (it doesn't re-use the existing session token). However, Communities won't let me sign up with my username since it has a hanging hyphen, and I can't change the username in the form. So I effectively can't sign up. Support has not responded for over a month. Feels like things are inching toward getting worse with GitHub.

belter 5y ago
I am surprised a Microsoft MVP Certified Professional expert did not pop up yet in the newsgroup, asking you to reboot your machine and review the steps in a certain technote ;-)
- framecowbird 5y ago
  "Have you tried closing your browser and then opening it again?"
- Causality1 5y ago
  Hey now, that's libel. There are problems that can be solved by rebooting, and a Microsoft MVP would never post a genuine potential solution. I'm pretty sure you meant to say "an MVP popped up in the newsgroup to copy/paste a paragraph of random intro text and then ask if he's solved your problem".
  - NGRhodes 5y ago
    You are giving them too much credit, it will be copy and pasted from the post/thread/comment/accepted solution that you have already stated you have tried and does not work.
- 13415 5y ago
  They usually recommend to reinstall the whole operating system, though. Because people have time for this...
GordonS 5y ago
I don't mean to "victim blame", but I'm curious why you'd choose a username ending in a hyphen in the first place? (I would have thought this wouldn't work on lots of services)
- junon 5y ago
  I signed up to GitHub almost 11 years ago, and someone else already registered the username I used for everything. So 11-years-ago-me tacked on a hyphen as I had seen a few other people do it, too.
  - KennyBlanken 5y ago
    > I signed up to GitHub almost 11 years ago, and someone else already registered the username I used for everything. So 11-years-ago-me tacked on a hyphen "I purposefully chose to create a nearly identical username to an existing user" isn't a great defense to someone saying the problem is between the chair and keyboard. At best you didn't think of the possible confusion you'd cause.
    - junon 5y ago
      Both the other account and myself are quite active on GitHub. There has been a mistype maybe 5 times in 11 years. So sorry, but no. Things have been fine. In places where the hyphen is ambiguous, I always make a point to mention it. It's never really been an issue, and the other individual has always been quite nice when the hyphen is omitted, kindly pinging me instead. I'm not trying to defend against anything except poor attempts to paint me as somehow malicious...
    - mmis1000 5y ago
      > "I purposefully chose to create a nearly identical username to an existing user" Is that even surprising? Some names are just so common that people use them all the time and ends up as John, John_ , John-, John1, John11. John100
- jeroenhd 5y ago
  Hyphens and underscores are often permitted characters in usernames, more so than exclamation marks or other special characters. I don't really see what problem using a hyphen in a username could pose, unless there's some kind of filter being applied that doesn't take into account the previously permitted characters. I'd guess someone applied an [A-z0-9]+ without thinking too much about it because that's what the current username rules are. I'm more surprised that there's a second authorization endpoint, Github could've just used their existing OAuth2 implementation to log users in if they didn't want to reuse the existing login code.
RedShift1 5y ago
Have you tried sfc /scannow?
jrochkind1 5y ago
Github does let you change your username. I imagine if support got back to you, they'd say "Yes, that was grandfathered in for backwards compatibilty, but that username is no longer allowed and won't always work with new services or functions, as you discovered. We recommend changing your username." However, not getting a response is not encouraging, it's true.
Eikon 5y ago
Sounds like a very important and critical issue that should be prioritised.
favadi 5y ago
I still remember the night when logrus's author decided to rename his Github account and broke our production build (https://github.com/sirupsen/logrus/pull/384 https://github.com/sirupsen/logrus/pull/384). Since then, I always vendor third party dependencies.
- junon 5y ago
  To be fair, this is a side effect of poor module system design in Go. Not really github's fault here.
floatingatoll 5y ago
“We” are not piling on; you are. Please don’t shop unrelated concerns to threads that aren’t about that concern. GitHub breaking release URLs worldwide after a multi-hour global outage has no relationship whatsoever to your problem. I sympathize with your frustration, but pet peeve derails pollute HN discussions about every topic under the sun these days. Submit a post instead, and if it doesn’t get traction, so be it.
- junon 5y ago
  > pet peeve derails pollute HN This isn't a pet peeve derailment. This is commentary on the multitude of issues GitHub has had in recent history, at least from my perspective. A "pet peeve" is something I find annoying. This isn't that - it's a bug. Further, my comment doesn't break the guidelines. I'm not commenting on the layout. I'm not flagrantly dismissing someone's work. If you don't like my comment, either keep scrolling or downvote and move on?
  - floatingatoll 5y ago
    By your logic, any time someone posts about GitHub, it’s appropriate and sensible for each of us to post about whatever GitHub bug upsets us most. This leads to the HN we have today, with hundreds of upvoted comments per day clamoring about each individual’s personal upsets, wholly unrelated to the topics at hand. If you had violated a guideline, I would have contacted the mods rather than reply. The tragedy is that no rule can sufficiently be written that keeps people from concern shopping their personal issues into discussions on the most tenuous of links. “This is a post about a GitHub bug” opens the door for me to post about the hundreds of GitHub bugs I’ve encountered over time, and with thousands of users at HN, if we each do this, there’s so much less room left for discussion about the actual bug this post is about. This affects Show HN, too: when someone posts their cool thing, everyone chimes in with all the other cool things that they like better. It’s incredibly disheartening and sets aside the purpose of the post – “a thing, discuss” – so that people can use that request as a launchpad to discuss other things instead, without making even the slightest effort to tie it back with relative comparisons to the Show HN topic itself. There is no guideline that asks us to set aside our personal needs and desires in these comments and focus on what brings the most value to the original topic, no matter what we feel about other topics that happen to also be about GitHub. But I continue to hope, out loud and with salient arguments, that HN will step up and respect itself more than the guidelines require.
grepfru_it 5y ago
I've got you bro, try again in a week
- junon 5y ago
  For real? :o

the_duke 5y ago

At least now I know why my nix builds are failing... Odd for something like this to slip through and not be rolled back immediately. Unless it was intentional, in which case it would be even more odd to not communicate this widely beforehand.

tata71 5y ago
Reproducible builds via IPFS when?
- hutrdvnj 5y ago
  And then your IPFS pin service has a down time.
  - kevincox 5y ago
    The point of IPFS is that as long as a single online host has the content you will be able to fetch it.
    - hutrdvnj 5y ago
      Sure, but in case of peer-to-peer downloads it's often the case that not so common stuff have zero seeders.
KennyBlanken 5y ago
If Github doesn't at least monitor their 404 error rate for large-scale spikes, whoever is in charge of SRE should be fired. With no announcements and no response to a now two day old bug report, I see two possibilities: 1)Their monitoring of their infrastructure and monitoring of issues is shockingly incompetent for a company of their size and importance (the fact that it is a US holiday is irrelevant.) 2)This was 100% intentional and they're purposefully looking "incompetent" to get people to shift to using other services for downloads. My money is on the latter, given others in this discussion are reporting random download link failures starting a month or two ago. A huge number of projects seem to use GitHub as a sort of free file hosting service. I imagine the opex for both storage and bandwidth is a not insignificant amount of money and someone has been told to shoo the freeloaders off the grass. Announcing they're ending free file hosting for unpaid projects would generate a lot of noise and PR. Instead they just make it unreliable, and people go elsewhere. Multiple people in this discussion have described moving downloads of Github in response, which is exactly what Github likely wants.

AshamedCaptain 5y ago

Say what you want about "cloud" reliability, but my little home server in a residential ISP has been up for more time than Github.com in (at least!) the past year.

arendtio 5y ago
Well, my home server has about the uptime as WhatsApp had this year. Yet I am still happy that I moved my XMPP server to the Hetzner cloud as it seems to have a better uptime then both ;-)
elephantum 5y ago
Did it also handled similar load and feature complexity as well?
- loloquwowndueo 5y ago
  And does it have an army of highly paid developers and engineers to look after it also? ;)
  - framecowbird 5y ago
    And does it have a cute animal-based mascot?
    - ddtaylor 5y ago
      If TV commercials are anything to go by then picking a good animal mascot for your company/brand is probably the most important thing!
    - Hamuko 5y ago
      Does Github?
- Nextgrid 5y ago
  Does it need to handle similar load though? It doesn't have to host all the world's open-source projects, it just needs to host the owner's ones.

_zywo 5y ago

Whether this specific problem is intentional or not, these kinds of problems show the issue with using a single centralized service for distribution of third-party dependencies. But it's just so much more darned convenient than hosting your own Git server! It would be super cool if there was a decentralized alternative to GitHub, that used Git under the hood. Perhaps one would upload their repositories to a node, which would then be synchronized with all other nodes, and all you would need to do to use it is to specify any_node.com/author/project. This would keep GitHub's discoverability, while allowing all the benefits of decentralization.

mfashby 5y ago
Some software like gitea [1] can mirror github repositories (or vice versa). Some other software like fossil [2] is designed to do not just source code but also issue tracking etc. in a decentralised fashion. It's definitely more work than just throwing it onto GitHub though, something more convenient would be really cool. [1] https://gitea.io/ https://gitea.io/ [2] https://fossil-scm.org/ https://fossil-scm.org/
adeelk93 5y ago
Breaking changes aren’t only an issue with centralization. A breaking change with git itself would mess up your decentralized scenario as well.
- TobTobXX 5y ago
  Maybe for one or two minutes, but if it costs more time, I'd just rollback my git installation. Good Luck rolling back GitHub.
  - adeelk93 5y ago
    But what about rolling back someone else’s installation? What if you’re depending on a different user that has a buggy installation?
viccuad 5y ago
I would love to see a Git+Matrix forge, completely decentralised. With the spaces and the upcoming threads, seems like it wouldn't be so difficult to create a client that exposes that. It would be easier to make it closer to Gerrit than Github review process, which would be a step up!

grumple 5y ago

We ran into intermittent failure with Github download urls around a month or two ago that caused our builds to fail (there was no github status, but we replicated the failure easily manually). In response to the failure, we started self-hosting the dependency. The fewer external dependencies you depend on at the actual point of builds/deploys, the better. Since you're using a fixed version of the dependency anyway, you might as well self-host or include it in the ami or container.

sashk 5y ago

Ran into this issue when was updating package. But then, I did not find anywhere mentioned this url documented anywhere. I.e currently broken link to archives https://github.com/USER/REPO/archive/TAG/REPO-TAG.tar.gz https://github.com/USER/REPO/archive/TAG/REPO-TAG.tar.gz vs currently working and documented URL https://github.com/USER/REPO/archive/refs/tags/TAG.tar.gz https://github.com/USER/REPO/archive/refs/tags/TAG.tar.gz Is there a list of pre-defined URLs supported by GitHub?

gudmundur 5y ago

Hi everyone. I'm an engineer at GitHub and I just posted a response to this issue here: https://github.com/github/feedback/discussions/8149#discussioncomment-1712006 https://github.com/github/feedback/discussions/8149#discussi....

dehrmann 5y ago
> A change in the handling of URL schemes was deployed a couple of days ago This was deployed Thanksgiving week? I realize Github isn't a consumer company, so it doesn't face the same pressures as Amazon, but I'm surprised there wasn't a code freeze so people can have a quiet holiday weekend.
- bengale 5y ago
  Is everyone at GitHub based in America?
  - novok 5y ago
    If a good chunk of them are, it's still good to do a code freeze. If %30-90 of your company is on holiday, not a good time to do major things.
  - mdoms 5y ago
    No, they are not. I know at least one Kiwi who worked remotely for Github from New Zealand.
  - jsnell 5y ago
    No. But this appears to now be the most important online shopping week of the year in all of Europe as well. Shops are abnormally sensitive to outages. You'd expect all kinds of service providers to be extremely conservative with code and config pushes this week due to that. Maybe GitHub is far enough removed from the actual consumers that they don't feel the pressure, but it does seem surprising.
kzrdude 5y ago
Thanks for fixing! Sorry for being curious.. does Github have an office in Copenhagen? That would be cool.

Karellen 5y ago

> Arch Linux as well for every package downloading tarballs from GitHub. Packages checking out the git source tree are not affected, but they are a minority. It feels like people are using git wrong.

anjbe 5y ago
When building distro packages from source, the full revision history of a Git repo is unnecessary. Downloading just the source code of a specific commit or tag with curl is simpler, faster, has fewer dependencies, and is less prone to breakage (well, unless your URLs change under you, as happened here).
- jeroenhd 5y ago
  Git allows checking out only a limited set of changes with the --depth flag: git clone --branch v1.0 --depth 1 https://github.com/example/example.git The parameter is called --branch but it also takes tags. It's not as fast as fetching a ZIP file, but it gets pretty close. From my count, this method only requires one dependency (git) whereas the curl + unzip method requires, well, both curl and unzip. The zip download method (download, decompress, build, compress into package, decompress onto system) is already silly enough, the first decompression part can easily be dropped.
  - anjbe 5y ago
    > It's not as fast as fetching a ZIP file, but it gets pretty close. In the context of distro packages (the bug report mentioned OpenBSD and Fedora) you might be building tens of thousands of packages of which thousands are likely to come from GitHub. A small difference becomes greatly magnified. > From my count, this method only requires one dependency (git) whereas the curl + unzip method requires, well, both curl and unzip. You’re forgetting that git itself depends on curl.
- Karellen 5y ago
  The first time, sure. But the second time, a `git pull` should normally be significantly quicker. Heck, you could check if the tag you want already exists in the repo you have and skip the `git pull` a lot of the time.

intunderflow 5y ago

Combined with the outage yesterday this hasn't been a good weekend for GitHub SRE's I'm surprised something like this happened on a weekend though since I wouldn't expect anyone to be changing anything in the codebase (then again it could be some infra has just ran out of storage or etc)

yardstick 5y ago
Perhaps there’s a lack of attention due to the holiday weekend in the US? Seems like major incidents in infrastructure and services tend to happen over holidays (general observation, not GitHub specific).
- deleted 5y ago
  [deleted]

mfashby 5y ago

This has also broken a bunch of packages in the arch user repository, for example https://aur.archlinux.org/packages/dendrite/ https://aur.archlinux.org/packages/dendrite/ :(

Semaphor 5y ago
Yeah, I thought the package I tried to install had an issue, but didn’t have the time to investigate. This explains it.
viccuad 5y ago
This sounds for the better. Not having code mirrors (as other distribution channels) sounds not just insecure, but borderly malicious.
- themusicgod1 5y ago
  Using github, period, is not just insecure, but actively malicious. Stop using NSA/Microsoft.
- turminal 5y ago
  I suspect you have no idea what AUR is and how it works and furthermore, you have no experience with software packaging. If a project is using github to publish releases, where else are consumers of that software going to get them from? Having all sources of everything that is packaged backed up is a must for the official repository of a competent distro, but even in that case there is no reason not to use github in normal operation.
- mfashby 5y ago
  Depends what you mean by better. It's kind of annoying for me when trying to install some software I want to actually use, and I just can't.