Insulating the VulkanSceneGraph project and it's users from risks of Geopolitical events

[robertosfield]

Hi All,

I live in Scotland (north part of UK), while no longer in the EU we're still European and for now still part of NATO. Trumps recent rhetoric puts NATO and US/European trade under serious threat. So far the US congress hasn't been able to, is collectively unwilling to reign Trump's worst instincts in, both internally in the US and w.r.t international conduct.

Trump is threatening escalating tariffs and we now have Macron proposing the EU Anti-Coercion Instrument (ACI) is invoked to provide various economic levers that would serious effect US corporations access to the EU market, these go beyond just retaliatory tariffs.

It's pretty alarming to watch this all unfold. As project lead of the VulkanSceneGraph it's my responsibility to guide the project at the code level through to navigating challenges that might happen wholly out of our control or influence. In 25 years of being a open source project lead I have never seen been a period of such high risk transatlantic relations and trade, and feel that we need to start considering how to mitigate against the possible breakdown of systems that we all have relied upon.

Here's some initial thoughts:

1. VulkanSceneGraph is open source, users have rights to keep using and hosting there own git repositories on their machines, companies, regions etc. This can't be revoked so is a significant insurance policy against external events impacting your work.
2. Github is owned by Microsoft so if things get really bad potentially European access to Github could be impacted, which means the following services could be interrupted:
   2.1 VulkanSceneGraph, vsgXchange, vsgImGui, vsgQt, vsgPoints, vsgExamples and many of our dependencies are all hosted on github.
   2.2. vulkanscenegraph.org website is hosted on github.
   2.3. The VulkanSceneGraph forum is hosted on github.

For the overall project having a repository hosted here in Europe as a backup would be sensible. The way git works means that we have the means to create one even if necessary. If crazy stuff did happen we should be able to cobble stuff make into github at a later time when sensible folks get back in charge in the US.

At a personal level I used gmail for my mail client, this might be affected too. Instant messenger/video services like WhatsApp, Zoom etc. could also be impacted. As a European it probably makes sense for me to start looking at hosting email locally and figuring out alternatives for other communication tools.

Would be happy to get thoughts and suggestions on all these topics. Please keep things focused on technical things rather than politics.

Thanks,
Robert.

[robertosfield]

Just came across this european-alternatives. website, I don't know how up to date and extensive it, but might provide a starting place for considering how to create a European mirror of our current github usage etc.

Alternative to github: https://european-alternatives.eu/alternative-to/github
Alternatives for mail: https://european-alternatives.eu/category/email-providers
Alternatives for instant messaging: https://european-alternatives.eu/category/instant-messaging-apps

I don't have familiarity with vast majority of suggested alternatives, the exception is GitLab that I've used a little with client projects. If you have experience with any of these alternatives then let us know.

I the end I'm hoping none of this will be required and we can just continue to work with all the tools we're familiar with, but far better to have done a little scoping out in case we need act quickly to shore things up.

[lufriem]

I'm happy with Proton Mail, as well as other tools from their suite (VPN, drive)

[xarray]

I currently use Gitee (https://gitee.com/xarray) as my main Git repo, as Github is not easy to visit for a long time in my region. :)

[robertosfield]

How do you go about syncing with github repositories?

[xarray]

How do you go about syncing with github repositories?

I use a VPN to update code to GitHub. I only have one VPN account, so I can only push to both remote repositories (with "git add remote ..") simultaneously from my main development machine. Therefore, the update frequency of my GitHub repository will be slightly lower than that of the Gitee repository.

[AnyOldName3]

OpenMW's been on GitLab for years, with GitHub only being a mirror, and as the free CI runners they make available to open source projects are a bit anaemic, we've looked into what's available elsewhere. As far as we've been able to find, no one except GitHub is willing to offer comparable services for free just because a project is open source. Some CI providers do have a free tier, but restrict it to just Linux, and a large part of the reason for having CI is to ensure that changes still build on platforms other than the one the contributor used.

This means that the only practical ways to have a CI system are either to keep things on a US-owned code forge, to pay for a European host (likely expensive as building C++ uses more resources than hosting a code forge), or to host CI runners yourself (which would mean at the minimum keeping a Linux machine, Windows machine and MacOS machine running and connected to the internet at all times, and managing their security well enough that it wouldn't be a problem to let them run code submitted by contributors). None of the options are good.

Some of the problems with using disparate code forges will go away over time, though, as many of the non-GitHub ones are adding federation support via ActivityPub (the protocol behind Mastodon, Lemmy and PieFed), so at some point Soon™ it should be possible to open a pull request on someone's Gitea instance from GitLab using a GitLab account etc..

[xarray]

If it's just for CI/CD, you could also consider Chinese hosting platforms such as Alibaba Cloud or Tencent Cloud.
FYI, an ECS instance with 4 vCPU and 8 GiB RAM costs about 400 RMB per month (around 60 USD?), supporting Ubuntu/CentOS/Debian/Windows systems. Of course, this pricing is for Chinese users (requiring real-name verification), and the international version would probably be more expensive.
Alibaba Cloud International: https://www.alibabacloud.com/
Alibaba Cloud China: https://www.aliyun.com/

[robertosfield]

Thanks for the links.

I think it might be safest to have multiple repos, as the biggest VSG contributors are based in Europe I think it would be sensible to have the main repo hosted in Europe, then the other repos mirrors of this.

First step though is create mirrors in Europe and China that we official link to for each repo in the VulkanSceneGraph/README.md so that folks can find a local repo in case the main ones aren't available.

Then if we need to shift from Github being the main repo we update the links and accompanying info.

[mp3butcher]

I've recently signin on https://codeberg.org and it seems a good github alternative hosted in Germany and it's free:
All required features are there: Code (git), pull requests, CI/CD through Forgejo actions, packets publication, wiki

[AnyOldName3]

It has Forgejo Actions and Woodpecker CI, but you need to provide your own runners except for Linux. MacOS VMs are not cheap, and Windows VMs aren't as cheap as Linux ones are.

[robertosfield]

Do you know if they have support for forum and github pages style websites?

[mp3butcher]

I checked how to do website, documentation says it's not fully reliable but it seems to work:
https://mp3butcher.codeberg.page
Concerning forum, I've found their tickets feature could be used to divide issues from discussion with milestones:
https://codeberg.org/mp3butcher/testinggitatcodeberg/milestones