Gitea 1.17.0 is released – includes package registry support

https://blog.gitea.io/2022/07/gitea-1.17.0-is-released/

by belfalas • 4 years ago

230 72 4 years ago

blog.gitea.io

There were many positive changes, but what the fuck happens with all the breakages? Reserving usernames and such.

Also https://github.com/go-gitea/gitea/pull/17688

   "I want to use a regex to filter for valid mail addresses"
   "There is a function for that why not use that?"
   "Invisible unicode characters!"
   "That's not a problem in automatic mail verification"
   *ignore everyone*
   *push*
   *pull*

Meanwhile https://github.com/go-gitea/gitea/issues/19852 is still open

foepys• 4 years ago

I witnessed the split of gogs and gitea and while the maintainer of gogs was indeed rarely active and merged PRs very slowly, they at least examined the code and made a proper review with suggestions.

The gitea guys wanted to move a lot faster and in the process neglected quite a bit of code review and product planning. Apparently this continues to this day as evidenced by the PR you linked.

BlackLotus893• 4 years ago

I used gogs before gitea and when it split I watched for a few months and then switched.

The gogs maontainer was unreachable for many month multiple times and the gitea fork os very active. It implements features I care about and even though they move fast and break configs the problems are documented and I had only a few minor problems over the years, a few of them werent even their fault.

So I'm a happy gitea user even when there are things I dislike.

mvelbaum2• 4 years ago

This, and the many trivial CVEs that were discovered in Gitea made me look for alternatives. I think that right now the best free and OSS solution is https://github.com/theonedev/onedev. It even has CI/CD built-in which is cool!

rambojazz5• 4 years ago

I agree with this too. I witnessed the split too and feel exactly the same. Interestingly, NotABug have not switched to Gitea and is still running Gogs.

KronisLV• 4 years ago

Seems like someone wanted to use the standards compliant functionality for validating e-mails:

  I made a PR here : https://gitea.com/go-chi/binding/pulls/12 which uses the stdlib net/mail (which is rfc5322 compliant) for validation

But it was closed, because Gitea does not want to support with certain Unicode characters:

  Closed as it allows utf-8

Isn't the proper solution there to just add an additional validation afterwards, AFTER using the standard functionality, something like:

  if _, err := otherUtil.DisallowUnicode(fmt.Sprintf("%v", fieldValue)); err != nil {
    ...
  }

Why close the pull request outright instead of just requesting that an additional validation against a set of disallowed characters be implemented?

Of course, I get the feeling that the developers just don't want to support "odd" e-mail addresses, because it doesn't affect them personally. They might be using just firstname.lastname@provider.com, or somenickname@provider.com, instead of using tags (+), slashes or other such symbols. Ergo, they might not care, at least when there are other issues that need to be solved and worked on - this gets de-prioritized.

jeltz2• 4 years ago

Agreed, I really do not get why this PR was merged. It seems pretty obvious to me that the proper solution is to add a check for disallowed Unicode characters.

minimaul4• 4 years ago

I read those links and it just makes me sad.

I don't understand why so many developers do so many stupid things with emails. Sure, there's some trivial validation you can do that makes sense - make sure it matches (.+)@(.+), make sure the domain part exists, etc.

But far too many sites do extra 'validation' using weird restrictive regex, and it prevents you from using valid email addresses - things like restricting chars so I can't use '+', or so I can't use a one char local part, or a one char domain, or a newer TLD that doesn't fit some dodgy regex they copied from a random stack overflow comment...

I really wish that developers would just do really simplistic checks - eg make sure it has an @ in it and something either side, and then just send a validation email as part of their signup flow. If you do it as the first step in the flow, you validate control of the email address and you ensure you don't end up with junk accounts on your system where someone typo'd their email and will never be able to activate it.

edit: the really stupid thing is that it takes considerably more effort to add this restrictive and usually wrong validation than it does to do it right :(

OtomotO6• 4 years ago

The same is true for passwords.

With every restriction, the space of possible passwords becomes smaller.

Just 16 chars, you must use a number, a special character, but not any of these few of course...

Just give it a length of 255 and people can use arbitrary sentences as passwords, which they remember!

Then teach them to add some slight variants to them, like replacing a char by a number, adding commas etc.

Instead we get "passwordless"

rambojazz5• 4 years ago

locked and limited conversation

Kelteseth2• 4 years ago

I find it a bit amusing that Gitea does not use Gitea to develop Gitea. Does anyone have insights on why they chose to use/stay on Github?

orkj• 4 years ago

It's in the FAQ in the readme, which links to this issue: https://github.com/go-gitea/gitea/issues/1029

Basically... They're working on it

3np• 4 years ago

So looks like this is the one outstanding item: https://github.com/go-gitea/gitea/pull/18165

comprev• 4 years ago

Dogfooding is an excellent way to demonstrate a product. I wonder how many OSS (and commercial) projects actually do this?

Kelteseth2• 4 years ago

We had this conversation at a startup for a feedback tool I worked for. We often had conversation with early adopters on how to improve the site. An external designer then stated the obvious to us, that we simply use _our_ tool to get feedback.

npteljes• 4 years ago

Onedev ("Self-hosted Git Server with Kanban and CI/CD") specifically states that they're doing this: https://github.com/theonedev/onedev

corrral• 4 years ago

If you want anyone to find your project, you're gonna need to at least mirror on GH regardless.

rambojazz5• 4 years ago

Once upon a time... search engines!

schipplock• 4 years ago

I'm grateful for Gitea. It performs well even on slow computers (fitlet2 equipped with an Atom x7-E3950 and 16GB of Ram in my case). Gitlab, on the other hand, doesn't, which is a shame, because I love Gitlab (using it at work) :).

krn• 4 years ago

That's why any new open-source project designed to be run in different environments should prefer Go over Ruby:

https://news.ycombinator.com/item?id=31686536

Kovah• 4 years ago

I think the issue with Gitlab resource usage isn't the application itself, but the sheer complexity of Gitlab and the amount of services needed to run the whole thing. It even starts Prometheus and Grafana and stuff like that. https://docs.gitlab.com/ee/development/architecture.html

jeltz2• 4 years ago

Nah, the issue with the resource usage of Gitlab is not caused by Ruby. It is the architecture they chose. You could build the same resource hog in Go if you wanted to.

nine_k• 4 years ago

I'd say that an open-source project has a (much) longer horizon than a typical for-profit startup. The startup needs to iterate incredibly quickly, to adapt to the market and capture it, before the money runs out. Then it is usually acquired, and the code base becomes someone else's headache. It can even be rewritten wholesale, how it happened to Twitter.

A typical open-source project is written by its users; if you want a feature, contribute, don't demand. The project can (but not always does!) choose tools that are best in long term and fit the problem domain better, even if they require time to get started / involved, and longer to get an MVP out the door.

Go checks both boxes: it lets move fast, but also is a reasonable long-term choice. I used to shy away from Go-based projects, but after 1.18 I have to admit that Go becomes acceptably pleasant to use!

Wronnay2• 4 years ago

Yay! Finally I can ditch Verdaccio and just use Gitea for Packages

hardwaresofton2• 4 years ago

Did you have bad experiences with Verdaccio? I've always thought verdaccio looked like an undervalued project/pretty amazing for how much people usually pay NPM for private packages.

TheChaplain2• 4 years ago

Probably just a matter of maintenance and time, I use Verdaccio and DevPi but if Gitea fulfills the task then there is no reason to keep them.

Wronnay2• 4 years ago

Yeah - actually it had some crashes on my device... However, I never found the time to debug the problem...

Could also be because I used a low powered OrangePi...

hericium• 4 years ago

Does it allow hiding admin's username from public users list without disabling this list entirely?

bioemerl3• 4 years ago

Remember that this thing is developed by people under the domain of the chinese government. They host their source on Chinese servers, and are firmly in the control of a nearly-enemy-state.

I would avoid using it if at all possible. You do not want your source code on a platform opened by those notorious for stealing intellectual property.

paraph1n• 4 years ago

Citation needed. They host their source on GitHub [1].

[1] https://github.com/go-gitea/gitea

nimbius• 4 years ago

https://en.wikipedia.org/wiki/Gitea

you are mistaking gitea for "gitee."

https://en.wikipedia.org/wiki/Gitee

bioemerl3• 4 years ago

Nope, go look at the developers on the repo for gitea

xnyan• 4 years ago

Gitea is a fork of Gogs and is 100% open source.

bioemerl3• 4 years ago

Open source isn't important, the primary developers are. The source can be open, but if everyone who works on it is compromised the source is compromised unless you go and read all of yourself.

jonnycomputer2• 4 years ago

Anyone know if this would work for R packages? (sorry naive question here)

galleywest200• 4 years ago

Does not seem like it. But it does support "Generic" and I am sure you can rig something up. https://docs.gitea.io/en-us/packages/overview/

jonnycomputer2• 4 years ago

Yeah, that's sort of what I thought. Thanks for addressing my question!

Gitea 1.17.0 is released – includes package registry support

Related Stories