Just running through publishing dev-images with @jeena, discovered that previous updater of /srv/dev-images on contint1002 winds up owning some files in .git with insufficient group-level access to update things.
We should fix this, since we'd like to extend publishing permissions to several folks outside of RelEng.
| Subject | Repo | Branch | Lines +/- | |
|---|---|---|---|---|
| contint: build dev-images with a system user | operations/puppet | production | +18 -11 |
| Title | Reference | Author | Source Branch | Dest Branch | |
|---|---|---|---|---|---|
| fab: build images with user dockerpkg-builder | repos/releng/dev-images!39 | hashar | fab-shared-user | main |
| Status | Subtype | Assigned | Task | ||
|---|---|---|---|---|---|
| Resolved | thcipriani | T274303 dev-images +2 rights and Docker registry credentials for FR-Tech | |||
| Resolved | hashar | T277604 Permissions / ownership interfere with publishing dev-images |
The way this works on the deployment servers (IIRC) is the /etc/profile assigns a umask of 002 -- maybe that could work here too
Eventually that is addressed by https://gerrit.wikimedia.org/r/c/operations/puppet/+/927975 which switch the repo and deploy script to use a shared system user dockerpkg-builder.
Change 927975 had a related patch set uploaded (by Hashar; author: Hashar):
[operations/puppet@production] contint: build dev-images with a system user
Change 927975 merged by Clément Goubert:
[operations/puppet@production] contint: build dev-images with a system user
The fab build script for dev-images is fixed by https://gitlab.wikimedia.org/repos/releng/dev-images/-/merge_requests/39