Page MenuHomePhabricator

deploy_security.py should check if user.name and user.email git configs are set
Closed, ResolvedPublic

Description

I just used deploy_security.py to deploy a security patch (T333569). It turns out that I’d never deployed security patches from deploy2002 (codfw) before, and so my user.name and user.email configs weren’t set yet. There was a warning message from Git about this when the security patch was committed to /srv/patches, but by the time the deploy was finished and I could fix my config, one of the /srv/patches commits had already been synced to deploy1002 (eqiad), and at that point I didn’t want to risk fixing the history – so those commits might use my wrong email address forever now.

Event Timeline

Suggested behavior: make this an error during dry-run, to make sure the user notices it; but skip the check on --run, when getting the security fix deployed is more important than having correct Git metadata.

lucaswerkmeister-wmde opened https://gitlab.wikimedia.org/repos/releng/release/-/merge_requests/17

deploy_security: Check user.name and user.email are set

Lucas_Werkmeister_WMDE claimed this task.
Lucas_Werkmeister_WMDE added a subscriber: dancy.

Done. (Note: @dancy requested that it should happen on --run too.)

Note to anyone updating their local copy: make sure to download it from the main branch, not master :) I just updated the wikitech page that still had the old branch name (the branch still exists but is outdated).

sbassett added a project: SecTeam-Processed.
sbassett subscribed.

Thanks for addressing this.