Now that we have a fix in place for Gerrit's tag signature detection
regression, remove the unsafe permission for pushing unsigned tags
to return everything to the state we had prior to the 3.4 upgrade.
Change-Id: Ia9afb5fb4be311cca59d3e1cf3b7bc611184fe15
Upon upgrading from Gerrit 3.3 to 3.4, a regression was observed in
which jgit no longer returns signatures in its tag messages, causing
Gerrit to misidentify signed tags as unsigned (annotated) tags.
Because our ACLs only allow signed tags to be pushed, this
regression prevents Gerrit from accepting them now.
Temporarily grant permission to push unsigned tags to anyone who
has permission to push signed ones. We will revert that as soon as a
fixed Gerrit is in place, but in the meantime users will be warned
to take care when pushing tags so that they don't accidentally push
actually unsigned tags to Gerrit.
Also, the pushSignedTag keyword was deprecated in favor of the new
createSignedTag name, so go ahead and update to that while we're
doing this so that we can limit the amount of churn across all these
ACLs. Documentation will be corrected to recommend the new format in
a separate change, but update the ACL linter now to prevent the old
syntax from being used in new projects.
This workaround was already tested on opendev/bindep in the parent
Iad8c1f83e247c9a8bcf5b4f530f7b83663e1f793 change, and confirmed to
function as intended.
Change-Id: Ia426ea36b4e6877fdce5725ff1e00ae02c62e3f4
When x/tap-as-a-service was renamed to openstack/tap-as-a-service in
Iaa6fc7b0a9dca20ea77637a3890c603837ac7014 its ACL moved into the
openstack namespace along with it. However, because these move
changes are currently untestable, we did not spot that the ACL was
also shared by the x/tap-as-a-service-dashboard and
x/tap-as-a-service-tempest-plugin projects which were not included
in the rename work.
For now, add back the old x/tap-as-a-service Gerrit ACL as it
appeared prior to the move, so that our consistency checks will stop
failing unrelated changes. Separately, we can discuss the fate of
these other two projects with their stakeholders, and see what can
be done to clean this up a bit.
Change-Id: Iee2e37f47fee9ee1fb0016f87069d7cf90a30f5d
Neutron team accepted to include tap-as-a-service as a stadium project
on last PTG (see [0] ~l212), for this tap-as-a-service (taas) must be
under openstack/ namespace.
The renaming includes only x/tap-as-a-service.
* x/tap-as-a-service-tempest-plugin: the tests should be merged to
neutron-tempest-plugin.
* x/tap-as-a-service-dashboard: unmaintained, and Neutron doesn't govern
Horizon plugins
[0] https://etherpad.opendev.org/p/neutron-xena-ptg
Change-Id: Iaa6fc7b0a9dca20ea77637a3890c603837ac7014
