In the wake of yesterday's Gerrit 3.4 upgrade maintenance, we've observed a regression in behavior where signed Git tags are being misidentified as unsigned[*]. Since our ACLs normally disallow pushing of unsigned (annotated) tags, the result is tag pushes being rejected with a permissions error.
As an emergency measure, and in an attempt to not roll back our Gerrit upgrade while working with their developers on a proper patch so solve this, we have updated the ACLs for all projects with a workaround so that they will be able to continue pushing tags. Unfortunately, this workaround means that projects will temporarily be able to push unsigned tags as well as signed ones, so we ask anyone manually tagging their projects be extra careful to remember to pass the -s option to git's tag subcommand.
Once we have a proper fix in place, the temporary addition of unsigned tag permissions will be rolled back, and a follow-up announcement sent to this mailing list.
[*] https://bugs.chromium.org/p/gerrit/issues/detail?id=15616