Hi Chris,

Christopher Baines <mail@cbaines.net> writes:

> Chris Marusich <cmmarusich@gmail.com> writes:
>
>> [...] Why do you think using Jenkins wouldn't be maintainable? [...]
>
> Sure, I've used Jenkins in different contexts, and indeed currently use
> Jenkins, so I've got some experience here.
>
> I'm obviously ignoring all the good parts here, but one source of data
> is Debian. It used to have a package for Jenkins, and you can see some
> of the work/issues here [1] and the thread about it's removal here [2].
>
> One issue in particular to call out is some potential bootstrapping
> issues [3] that seem to have been encountered.
>
> It seems sensible to me to use Guix when doing things related to the
> Guix project, like automated testing of patches (dogfooding, if you know
> the term). Some of the things I've mentioned here lead me to doubt that
> Jenkins will at some point be available through Guix.
>
> So that's something about the maintainability of a Guix package, but
> there's an operational component to this as well. The attack surface it
> offers is maybe larger than sometimes necessary, if you only need a
> read-only web interface for example.
>
> 1:
> https://bugs.debian.org/cgi-bin/pkgreport.cgi?archive=both;dist=unstable;ordering=normal;repeatmerged=0;src=jenkins
> 2: https://lists.debian.org/debian-java/2016/01/msg00019.html
> 3: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=714596

Wow!  I had no idea Debian had encountered such difficulties with
Jenkins.  And your point about attack surface is also valid - if we can
get by with a read-only web interface, it's much less to worry about.
After reading the links you've provided and hearing your argument, I'm
inclined to agree that avoiding Jenkins is the right call at this time.

Thank you for explaining things!

-- 
Chris