27ef42eb0b
Group refs are only visible to group owners that have read permissions on the ref. To be a group owner the user must either be member of the owner group or have the 'Administrate Server' capability. Read permissions don't allow non-group-owners to see the group refs. To see group refs as non-group-owner the 'Access Database' capability is required. With 'Access Database' read permissions are not needed. This is consistent with the handling of user branches. To see a user ref the user must be the owning user and have read permissions. To see user branches of other users the 'Access Database' capability is needed. By default All-Projects grants read access on 'refs/*' to 'Anonymous Users'. Hence by inheritance all users have read access on the group branches in All-Users, but these read permissions are only effective for group owners and users that have the 'Access Database' capability. A follow-up change may make the read access more explicit by granting read permissions to 'Registered Users' on 'refs/groups/*' in All-Users by default (for existing sites this may be done by a schema migration). To check whether the calling user owns a group ref we need to know the owner group and check if the user is a member of this owner group. Fortunately all data that we need for this is available via caches. IdentifiedUser caches the effective groups of the calling user and the owner group can be retrieved via the group cache. This means to decide which group refs should be advertised we need to access all groups via the group cache. This only performs well if the group cache is large enough to hold entries for all groups. Change Ieef38b9dda made the group cache unlimited by default and documented that the group cache should be large enough to hold entries for all groups. Also ls-remote calls to All-Users are relatively rare and hence performance of the group ref advertisement is not that critical. Change-Id: I864c66970d48473d33694f4c33d3d6695123be88 Signed-off-by: Edwin Kempin <ekempin@google.com>
Gerrit Code Review
Gerrit is a code review and project management tool for Git based projects.
Objective
Gerrit makes reviews easier by showing changes in a side-by-side display, and allowing inline comments to be added by any reviewer.
Gerrit simplifies Git based project maintainership by permitting any authorized user to submit changes to the master Git repository, rather than requiring all approved changes to be merged in by hand by the project maintainer.
Documentation
For information about how to install and use Gerrit, refer to the documentation.
Source
Our canonical Git repository is located on googlesource.com. There is a mirror of the repository on Github.
Reporting bugs
Please report bugs on the issue tracker.
Contribute
Gerrit is the work of hundreds of contributors. We appreciate your help!
Please read the contribution guidelines.
Note that we do not accept Pull Requests via the Github mirror.
Getting in contact
The IRC channel on freenode is #gerrit. An archive is available at: echelog.com.
The Developer Mailing list is repo-discuss on Google Groups.
License
Gerrit is provided under the Apache License 2.0.
Build
Install Bazel and run the following:
git clone --recursive https://gerrit.googlesource.com/gerrit
cd gerrit && bazel build release
Install binary packages (Deb/Rpm)
The instruction how to configure GerritForge/BinTray repositories is here
On Debian/Ubuntu run:
apt-get update & apt-get install gerrit=<version>-<release>
NOTE: release is a counter that starts with 1 and indicates the number of packages that have been released with the same version of the software.
On CentOS/RedHat run:
yum clean all && yum install gerrit-<version>[-<release>]
On Fedora run:
dnf clean all && dnf install gerrit-<version>[-<release>]
Use pre-built Gerrit images on Docker
Docker images of Gerrit are available on DockerHub
To run a CentOS 7 based Gerrit image:
docker run -p 8080:8080 gerritforge/gerrit-centos7[:version]
To run a Ubuntu 15.04 based Gerrit image:
docker run -p 8080:8080 gerritforge/gerrit-ubuntu15.04[:version]
NOTE: release is optional. Last released package of the version is installed if the release number is omitted.