Page MenuHomePhabricator

Last MW Core Security Release tags haven't pushed through to github
Open, MediumPublic

Description

1.34.1/1.33.3/1.31.7 seem to be missing from GitHub

And Phabricator is missing all tags https://phabricator.wikimedia.org/source/mediawiki/tags/master/

Related Objects

Event Timeline

Reedy created this task.Mar 30 2020, 11:04 AM
Restricted Application added a subscriber: Aklapper. · View Herald TranscriptMar 30 2020, 11:04 AM
Reedy updated the task description. (Show Details)

I would have expected this to be listed on https://www.mediawiki.org/wiki/Release_checklist however that page now says it is outdated. :-(

They exist on gerrit, as per T240398: Tag 1.31.7/1.33.3/1.34.1... But something seemingly wrong with the replication through to github

$ ssh -p 29418 gerrit.wikimedia.org replication start --wait mediawiki/core
Replicate mediawiki/core ref ..all.. to gerrit2001.wikimedia.org, Succeeded! (OK)
Replicate mediawiki/core ref ..all.. to github.com, Succeeded! (OK)
Replication of mediawiki/core ref ..all.. completed to 2 nodes, 
----------------------------------------------
Replication completed successfully!

Do we want to keep this open to find out why it didn't work before?

https://github.com/wikimedia/mediawiki/releases/tag/1.31.7
https://github.com/wikimedia/mediawiki/releases/tag/1.33.3
https://github.com/wikimedia/mediawiki/releases/tag/1.34.1

bootc added a subscriber: bootc.Mar 30 2020, 11:54 AM
hashar added a subscriber: hashar.Mar 30 2020, 3:24 PM

Gerrit replication config for github does mention pushing tags:

replication.config
[remote "github"]
...
  push = +refs/heads/*:refs/heads/*
  push = +refs/tags/*:refs/tags/*
...

Then in the Gerrit replication logs, I can only find a tag I have pushed a few days ago:

$ zgrep --color=always mediawiki/core.*refs/tags replication_log.2020-03-2*
replication_log.2020-03-26.gz:[2020-03-26 18:05:47,667] [] scheduling replication mediawiki/core:refs/tags/test-hashar-for-ci => git@github.com:wikimedia/mediawiki-core
replication_log.2020-03-26.gz:[2020-03-26 18:05:47,774] [] scheduled mediawiki/core:refs/tags/test-hashar-for-ci => [f11a4b34] push git@github.com:wikimedia/mediawiki-core to run after 15s
replication_log.2020-03-26.gz:[2020-03-26 18:05:47,774] [] scheduling replication mediawiki/core:refs/tags/test-hashar-for-ci => gerrit2@gerrit2001.wikimedia.org:/srv/gerrit/git/mediawiki/core.git
replication_log.2020-03-26.gz:[2020-03-26 18:05:47,774] [] scheduled mediawiki/core:refs/tags/test-hashar-for-ci => [712e5b60] push gerrit2@gerrit2001.wikimedia.org:/srv/gerrit/git/mediawiki/core.git to run after 5s
replication_log.2020-03-26.gz:[2020-03-26 18:05:52,781] [712e5b60] Push to gerrit2@gerrit2001.wikimedia.org:/srv/gerrit/git/mediawiki/core.git references: [RemoteRefUpdate[remoteName=refs/tags/test-hashar-for-ci, NOT_ATTEMPTED, (null)...0000000000000000000000000000000000000000, srcRef=null, forceUpdate, message=null]]

Which was an unsigned / unannotated tag. Maybe the replication fails on signed tags?

Reedy added a comment.Mar 30 2020, 3:25 PM

Which was an unsigned / unannotated tag. Maybe the replication fails on signed tags?

It certainly worked before...

hashar added a comment.Apr 9 2020, 9:59 AM

It certainly worked before...

I do not dismiss that it worked before. I guess the first thing to do is to reproduce? I could not find any specific change on the Gerrit side that would explain why tags are not replicated. Maybe I missed a permission change in Gerrit with regard to replication or something has changed on Github side that would prevent it.

A way to test might be to generate a dummy tag and a signed tag and check whether those are replicated. At least the deletion of an unsigned tag (test-hashar-for-ci) worked on March 26th.

hashar triaged this task as Medium priority.Apr 9 2020, 10:00 AM
Reedy added a comment.Apr 9 2020, 6:07 PM

Yeah, they've been there since

$ ssh -p 29418 gerrit.wikimedia.org replication start --wait mediawiki/core
Replicate mediawiki/core ref ..all.. to gerrit2001.wikimedia.org, Succeeded! (OK)
Replicate mediawiki/core ref ..all.. to github.com, Succeeded! (OK)
Replication of mediawiki/core ref ..all.. completed to 2 nodes, 
----------------------------------------------
Replication completed successfully!

Do we want to keep this open to find out why it didn't work before?

https://github.com/wikimedia/mediawiki/releases/tag/1.31.7
https://github.com/wikimedia/mediawiki/releases/tag/1.33.3
https://github.com/wikimedia/mediawiki/releases/tag/1.34.1

;)

Oh, sorry i didn't read the whole task :(