In the wake of yesterday's Gerrit 3.4 upgrade maintenance, we've
observed a regression in behavior where signed Git tags are being
misidentified as unsigned[*]. Since our ACLs normally disallow
pushing of unsigned (annotated) tags, the result is tag pushes being
rejected with a permissions error.
As an emergency measure, and in an attempt to not roll back our
Gerrit upgrade while working with their developers on a proper patch
so solve this, we have updated the ACLs for all projects with a
workaround so that they will be able to continue pushing tags.
Unfortunately, this workaround means that projects will temporarily
be able to push unsigned tags as well as signed ones, so we ask
anyone manually tagging their projects be extra careful to remember
to pass the -s option to git's tag subcommand.
Once we have a proper fix in place, the temporary addition of
unsigned tag permissions will be rolled back, and a follow-up
announcement sent to this mailing list.
[*] https://bugs.chromium.org/p/gerrit/issues/detail?id=15616
--
Jeremy Stanley
Hello,
The OpenDev team will be taking the early year quiet as an opportunity to rename a few projects in Gerrit and upgrade Gerrit to 3.4 starting January 24, 2022 at 22:00 UTC. We expect to be done by 00:00 UTC January 25, 2022.
If you would like to rename a project now is the time to get that preparation done. Please link any rename proposals in our list here: https://wiki.openstack.org/wiki/Meetings/InfraTeamMeeting#Upcoming_Project_…
The Gerrit 3.4 release notes can be found at https://www.gerritcodereview.com/3.4.html. This upgrade does not require offline reindexing which means it should happen quickly. We are also automatically testing the 3.3 to 3.4 upgrade in our CI system. Additionally there is a downgrade process that we can use to fall back to 3.3 if necessary.
Let us know if you have any questions or concerns,
Clark