Merge branch 'stable'

* stable:
  Release notes for 2.1.2.4
  Update JGit to 0.7.1.34-gf36df5d to fix empty tree bug
  Add 'checkout' download command to patch sets
  documentation: Document Read Access +2 aka Upload Access
  documentation: Elaborate on branch level Owner
  Fallback to ISO-8859-1 if charset isn't supported

Documentation/access-control.txt

@@ -216,13 +216,21 @@ through the web UI, but not through SSH.  To get SSH branch access
 project owners must grant an access right to a group they are a
 member of, just like for any other user.
 
+Ownership over a particular branch subspace may be delegated by
+entering a branch pattern.  To delegate control over all branches
+that begin with `qa/` to the QA group, add `Owner` category
+for reference `refs/heads/qa/\*`.  Members of the QA group can
+further refine access, but only for references that begin with
+`refs/heads/qa/`.
+
 [[category_READ]]
 Read Access
 ~~~~~~~~~~~
 
 The `Read Access` category controls visibility to the project's
-changes, comments, code diffs, and Git access over SSH.  A user must
-have `Read Access +1` in order to see a project or any of its data.
+changes, comments, code diffs, and Git access over SSH or HTTP.
+A user must have `Read Access +1` in order to see a project, its
+changes, or any of its data.
 
 This category has a special behavior, where the per-project ACL is
 evaluated before the global all projects ACL.  If the per-project
@@ -232,12 +240,12 @@ is ignored.  This behavior is useful to hide a handful of projects
 on an otherwise public server.
 
 For an open source, public Gerrit installation it is common to grant
-`Read Access +1` to `Anonymous Users` in the `\-- All Projects \--`
-ACL, enabling casual browsing of any project's changes, as well as
-fetching any project's repository over SSH.  New projects can be
-temporarily hidden from public view by granting `Read Access -1`
-to `Anonymous Users` and granting `Read Access +1` to the project
-owner's group within the per-project ACL.
+`Read Access +1` to `Anonymous Users` in the `\-- All Projects
+\--` ACL, enabling casual browsing of any project's changes,
+as well as fetching any project's repository over SSH or HTTP.
+New projects can be temporarily hidden from public view by granting
+`Read Access -1` to `Anonymous Users` and granting `Read Access +1`
+to the project owner's group within the per-project ACL.
 
 For a private Gerrit installation using a trusted HTTP authentication
 source, granting `Read Access +1` to `Registered Users` may be more
@@ -246,6 +254,26 @@ able to authenticate through the HTTP access controls.  This may
 be suitable in a corporate deployment if the HTTP access control
 is already restricted to the correct set of users.
 
+[[category_READ_2]]
+Upload Access
+~~~~~~~~~~~~~
+
+The `Read Access +2` permits the user to upload a commit to the
+project's `refs/for/BRANCH` namespace, creating a new change for
+code review.
+
+Rather than place this permission in its own category, its chained
+into the Read Access category as a higher level of access.  A user
+must be able to clone or fetch the project in order to create a new
+commit on their local system, so in practice they must also have
+Read Access +1 to even develop a change.  Therefore upload access
+implies read access by simply being a higher level of it.
+
+For an open source, public Gerrit installation, it is common to
+grant `Read Access +1..+2` to `Registered Users` in the `\-- All
+Projects \--` ACL.  For more private installations, its common to
+simply grant `Read Access +1..+2` to all users of a project.
+
 [[category_pTAG]]
 Push Tag
 ~~~~~~~~

ReleaseNotes/ReleaseNotes-2.1.2.4.txt

@@ -0,0 +1,46 @@
+Release notes for Gerrit 2.1.2.4
+================================
+
+Gerrit 2.1.2.4 is now available in the usual location:
+
+link:http://code.google.com/p/gerrit/downloads/list[http://code.google.com/p/gerrit/downloads/list]
+
+New Features
+------------
+
+* Add 'checkout' download command to patch sets
++
+The Download area of a patch set now offers a command line to fetch
+and checkout the patch set on a detached HEAD.  This is more suitable
+for building and testing the change locally.
+
+Bug Fixes
+---------
+
+* issue 545 Fallback to ISO-8859-1 if charset isn't supported
++
+Some input files are misrecognized by the jchardet library that is
+used to automatically guess a character set.  A guessed charset
+might not even be supported by the local JRE.  In such cases the
+ISO-8859-1 character set is used as a fallback, so the file content
+is still visible.
+
+* Update JGit to 0.7.1.34-gf36df5d to fix empty tree bug
++
+Repositories which contained an empty tree object (very uncommon, its
+technically a bug to produce a repository like this) wouldn't clone
+properly from the embedded Gerrit SSH or HTTP daemon.  Fixed upstream
+in JGit 0.7.0, but we never picked up the bug fix release.
+
+Documentation Corrections
+~~~~~~~~~~~~~~~~~~~~~~~~~
+
+* documentation: Elaborate on branch level Owner
++
+Documentation didn't describe that the Owner permission within a
+project can be used to delegate control over a branch namespace to
+another group.
+
+* documentation: Document Read Access +2 aka Upload Access
++
+The documentation didn't describe what Read +2 means.

ReleaseNotes/index.txt

@@ -4,6 +4,7 @@ Gerrit Code Review - Release Notes
 [[2_1]]
 Version 2.1.x
 -------------
+* link:ReleaseNotes-2.1.2.4.html[2.1.2.4]
 * link:ReleaseNotes-2.1.2.3.html[2.1.2.3]
 * link:ReleaseNotes-2.1.2.2.html[2.1.2.2]
 * link:ReleaseNotes-2.1.2.1.html[2.1.2.1]

gerrit-gwtui/src/main/java/com/google/gerrit/client/changes/PatchSetPanel.java

@@ -225,6 +225,14 @@ class PatchSetPanel extends Composite implements OpenHandler<DisclosurePanel> {
     }
 
     if (!urls.isEmpty()) {
+      commands.add(new DownloadCommandLink(DownloadCommand.CHECKOUT, "checkout") {
+        @Override
+        void setCurrentUrl(DownloadUrlLink link) {
+          urls.setVisible(true);
+          copyLabel.setText("git fetch " + link.urlData
+              + " && git checkout FETCH_HEAD");
+        }
+      });
       commands.add(new DownloadCommandLink(DownloadCommand.PULL, "pull") {
         @Override
         void setCurrentUrl(DownloadUrlLink link) {

gerrit-reviewdb/src/main/java/com/google/gerrit/reviewdb/AccountGeneralPreferences.java

@@ -41,7 +41,7 @@ public final class AccountGeneralPreferences {
 
   /** Preferred method to download a change. */
   public static enum DownloadCommand {
-    REPO_DOWNLOAD, PULL, CHERRY_PICK, FORMAT_PATCH;
+    REPO_DOWNLOAD, PULL, CHECKOUT, CHERRY_PICK, FORMAT_PATCH;
   }
 
   /** Default number of lines of context when viewing a patch. */

gerrit-server/src/main/java/com/google/gerrit/server/patch/Text.java

@@ -17,10 +17,17 @@ package com.google.gerrit.server.patch;
 import org.eclipse.jgit.diff.RawText;
 import org.eclipse.jgit.util.RawParseUtils;
 import org.mozilla.universalchardet.UniversalDetector;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
 
 import java.nio.charset.Charset;
+import java.nio.charset.IllegalCharsetNameException;
+import java.nio.charset.UnsupportedCharsetException;
 
 public class Text extends RawText {
+  private static final Logger log = LoggerFactory.getLogger(Text.class);
+  private static final Charset ISO_8859_1 = Charset.forName("ISO-8859-1");
+
   public static final byte[] NO_BYTES = {};
   public static final Text EMPTY = new Text(NO_BYTES);
 
@@ -36,9 +43,19 @@ public class Text extends RawText {
       encoding = d.getDetectedCharset();
     }
     if (encoding == null) {
-      encoding = "ISO-8859-1";
+      return ISO_8859_1;
+    }
+    try {
+      return Charset.forName(encoding);
+
+    } catch (IllegalCharsetNameException err) {
+      log.error("Invalid detected charset name '" + encoding + "': " + err);
+      return ISO_8859_1;
+
+    } catch (UnsupportedCharsetException err) {
+      log.error("Detected charset '" + encoding + "' not supported: " + err);
+      return ISO_8859_1;
     }
-    return Charset.forName(encoding);
   }
 
   private Charset charset;