{"action":"closed","issue":{"url":"https://api.github.com/repos/steemit/steem/issues/833","repository_url":"https://api.github.com/repos/steemit/steem","labels_url":"https://api.github.com/repos/steemit/steem/issues/833/labels{/name}","comments_url":"https://api.github.com/repos/steemit/steem/issues/833/comments","events_url":"https://api.github.com/repos/steemit/steem/issues/833/events","html_url":"https://github.com/steemit/steem/issues/833","id":203713520,"node_id":"MDU6SXNzdWUyMDM3MTM1MjA=","number":833,"title":"use of submodules causes code review difficulty","user":{"login":"sneak","id":408977,"node_id":"MDQ6VXNlcjQwODk3Nw==","avatar_url":"https://avatars3.githubusercontent.com/u/408977?v=4","gravatar_id":"","url":"https://api.github.com/users/sneak","html_url":"https://github.com/sneak","followers_url":"https://api.github.com/users/sneak/followers","following_url":"https://api.github.com/users/sneak/following{/other_user}","gists_url":"https://api.github.com/users/sneak/gists{/gist_id}","starred_url":"https://api.github.com/users/sneak/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/sneak/subscriptions","organizations_url":"https://api.github.com/users/sneak/orgs","repos_url":"https://api.github.com/users/sneak/repos","events_url":"https://api.github.com/users/sneak/events{/privacy}","received_events_url":"https://api.github.com/users/sneak/received_events","type":"User","site_admin":false},"labels":[{"id":527269392,"node_id":"MDU6TGFiZWw1MjcyNjkzOTI=","url":"https://api.github.com/repos/steemit/steem/labels/Security","name":"Security","color":"b60205","default":false},{"id":431069346,"node_id":"MDU6TGFiZWw0MzEwNjkzNDY=","url":"https://api.github.com/repos/steemit/steem/labels/priority/high","name":"priority/high","color":"b60205","default":false}],"state":"closed","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":4,"created_at":"2017-01-27T19:02:17Z","updated_at":"2018-07-27T01:11:35Z","closed_at":"2018-07-27T01:11:35Z","author_association":"CONTRIBUTOR","body":"Right now because fc and chainbase don't have their own independent test suites and branch protection, bumping the submodules in this repo causes potentially unreviewed code to end up in steemd.  This is unacceptable for obvious reasons.\r\n\r\nWe need to standardize on one of two policies:\r\n\r\n1) fc and chainbase get moved into this repo, causing all changes to them to undergo the exact same code review procedures as everything else in steemd, or,\r\n\r\n2) fc and chainbase get their own independent test suites and branch protection, each repository undergoing the exact same change control as the `steemit/steem` repo.  This is a bit suboptimal though because the submodule ref points to a commit ID and it still could point to a non-reviewed commit in the other repo.  People approving PRs in `steem` would need to *manually verify* that the commit ID for a submodule update matches the tip of `master` on the other repo, each and every PR that updates them.  This is error-prone and would allow a compromised github account to sneak code into the production release of steemd (via a commit on an unprotected branch of chainbase or fc).\r\n\r\nI personally think that `fc` and `chainbase` should be subdirectories inside this repository, as they are not consumed by other active projects and should be subject to identical code review as the rest of the code used to build `steemd`.  (Boost notably excepted, as it has its own extensive review/test pipeline due to its widespread use and existing team of maintainers.)\r\n\r\nPlease advise.   cc @bytemaster @theoreticalbts @mvandeberg "}}
{"actor":{"display_login":"mvandeberg"}}