This came up last week for beta, filing a task for production. There is at least one server that scap deploys to in production that is still on Trusty (silver), there may be more; however, it would be nice to use new git features like --jobs and --reference inside scap's guts.
Both Jessie and Stretch machines are using git version 2.11. Would be ideal for all production machines to standardize on this version.
Adding @MoritzMuehlenhoff explicitly since IIRC he did the work to add git 2.11 to jessie-backports.
silver will be replaced by the new labweb* hosts using stretch soon, so that should be resolved soon. Is that the only one deployment relevant?
From that paste and https://phabricator.wikimedia.org/source/operations-puppet/browse/production/hieradata/common/scap/dsh.yaml
pretty sure that's it
Those hosts have only Zotero on them, and they will never move off of trusty (because reasons). One of two things will happen here: (a) we manage to get rid of Zotero (T93579); or (b) we move it to k8s once the infra is ready. I would put my money on (b).
More to the point of the problem, perhaps a viable alternative here would be for Scap to detect the target's git version is then act accordingly (with regards to using --jobs and friends).
Building a git 2.11 for trusty is probably just a matter of 1-2 hours work, but it's something we would need to repeat for every git security update. I'd totally prefer Mukunda's approach since it feels wrong to invest time into something we're actively working to get rid of.