On Thu, Mar 21, 2024 at 02:07:02PM +0100, Max Gautier wrote: > On Thu, Mar 21, 2024 at 01:37:30PM +0100, Patrick Steinhardt wrote: > > On Mon, Mar 18, 2024 at 04:31:15PM +0100, Max Gautier wrote: > > > > It would be great to document _why_ we want to package the systemd units > > alongside with Git. > > > > Hum, I wrote that in the cover, but you're right, it should be in the > commit itself. > Ack. > > > > ... > > > diff --git a/systemd/user/git-maintenance@.service b/systemd/user/git-maintenance@.service > > > new file mode 100644 > > > index 0000000000..87ac0c86e6 > > > --- /dev/null > > > +++ b/systemd/user/git-maintenance@.service > > > @@ -0,0 +1,16 @@ > > > +[Unit] > > > +Description=Optimize Git repositories data > > > + > > > +[Service] > > > +Type=oneshot > > > +ExecStart=git for-each-repo --config=maintenance.repo \ > > > + maintenance run --schedule=%i > > > +LockPersonality=yes > > > +MemoryDenyWriteExecute=yes > > > +NoNewPrivileges=yes > > > +RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6 AF_VSOCK > > > +RestrictNamespaces=yes > > > +RestrictRealtime=yes > > > +RestrictSUIDSGID=yes > > > +SystemCallArchitectures=native > > > +SystemCallFilter=@system-service > > > > Curious, but how did you arrive at these particular restrictions for the > > unit? Might be something to explain in the commit message, as well. > > > > Patrick > > I copied the unit file which is defined in strings in builtin/gc.c, > which I delete in patch 3. > Should the moving be inside one commit, in order to explicit the fact > that it's only moving things around ? I don't really think it's necessary. But pointing that out in the commit message would go a long way to explain where exactly these definitions come from. Patrick
Attachment:
signature.asc
Description: PGP signature
