Some Eclipse Foundation services are deprecated, or will be soon. Please ensure you've read this important communication.

Bug 441911

Summary: Enable Gerrit for Henshin Incubation Project
Product: Community Reporter: Christian Krause <henshin.ck>
Component: GerritAssignee: Eclipse Webmaster <webmaster>
Status: RESOLVED FIXED QA Contact:
Severity: normal    
Priority: P3 CC: denis.roy, thanh.ha
Version: unspecified   
Target Milestone: ---   
Hardware: PC   
OS: Windows 7   
Whiteboard:

Description Christian Krause CLA 2014-08-16 18:13:29 EDT
Hi,
could you please enable Gerrit for the Henshin project? The git repository path is:

/gitroot/henshin/org.eclipse.emft.henshin.git

Cheers,
Christian
Comment 1 Eclipse Webmaster CLA 2014-08-18 11:07:09 EDT
Done.  You'll need to update your URLs to:

ssh://committer_id@git.eclipse.org:29418/henshin/org.eclipse.emft.henshin

or

https://committer_id@git.eclipse.org/r/henshin/org.eclipse.emft.henshin

Keep in mid you'll need to login to Gerrit and generate an HTTP password(settings->HTTP password) to be able to commit via HTTPS.

-M.
Comment 2 Christian Krause CLA 2014-08-20 14:06:22 EDT
Thanks a lot.

Is it possible to forbid pushing directly to the Git remote (thereby bypassing Gerrit)?

Cheers,
Christian
Comment 3 Eclipse Webmaster CLA 2014-08-20 14:17:34 EDT
I've removed the push permission which should do the trick.

-M.
Comment 4 Christian Krause CLA 2014-08-20 14:24:55 EDT
Hm, now it seems like I also cannot push to Gerrit anymore (refs/for/master)
Comment 5 Christian Krause CLA 2014-08-20 14:43:06 EDT
The error is message is:

Repository ssh://<committer_id>@git.eclipse.org:29418/henshin/org.eclipse.emft.henshin

A Contributor License Agreement is required.
Processing changes: refs: 1
Processing changes: refs: 1, done    
----------
Reviewing commit: 3332865a
Authored by: Christian Krause <xxx@xxx.com>

The author is not a committer on the project.
error: The author does not have a current Contributor License Agreement (CLA) on file.

error: The author has not "signed-off" on the contribution.
Please see http://wiki.eclipse.org/CLA
Comment 6 Thanh Ha CLA 2014-08-20 14:47:12 EDT
(In reply to Christian Krause from comment #5)
> The error is message is:
> 
> Repository
> ssh://<committer_id>@git.eclipse.org:29418/henshin/org.eclipse.emft.henshin
> 
> A Contributor License Agreement is required.
> Processing changes: refs: 1
> Processing changes: refs: 1, done    
> ----------
> Reviewing commit: 3332865a
> Authored by: Christian Krause <xxx@xxx.com>
> 
> The author is not a committer on the project.
> error: The author does not have a current Contributor License Agreement
> (CLA) on file.
> 
> error: The author has not "signed-off" on the contribution.
> Please see http://wiki.eclipse.org/CLA

This is expected. The way the CLA plugin figures out if you are a committer on a project or not is by checking if you have "Push" permission. So now that you no longer have push permission you need to have a CLA signed and sign-off on the commit unfortunately.

We have bug 437166 open tracking to improve the CLA plugin to be a bit smarter.
Comment 7 Christian Krause CLA 2014-08-20 14:50:58 EDT
So how can I get my push rights back again (for Gerrit)?
Comment 8 Thanh Ha CLA 2014-08-20 14:56:13 EDT
(In reply to Christian Krause from comment #7)
> So how can I get my push rights back again (for Gerrit)?

Sorry I think there is a misunderstanding here. Removing "Push" permissions for refs/heads/* prevents you from "pushing" directly to the repo branch. You should still be able to "Push" to refs/for/* which is the refspec for reviews but because the CLA checker plugin is currently very simple and checks if you have "Push" rights to refs/heads/* as a way of determining whether you are a committer or not.

The current workaround if you do not want committers to be able to bypass code review is to ensure you sign your CLA and push with a sign-off for your commit.
Comment 9 Denis Roy CLA 2014-08-20 14:57:15 EDT
> This is expected. The way the CLA plugin figures out if you are a committer
> on a project or not is by checking if you have "Push" permission.

Just out of curiosity, in the Gerrit permissions can we not create a set of permissions for refs/for/* and grant push to the committer LDAP group?
Comment 10 Thanh Ha CLA 2014-08-20 14:59:48 EDT
(In reply to Denis Roy from comment #9)
> > This is expected. The way the CLA plugin figures out if you are a committer
> > on a project or not is by checking if you have "Push" permission.
> 
> Just out of curiosity, in the Gerrit permissions can we not create a set of
> permissions for refs/for/* and grant push to the committer LDAP group?

No because the CLA plugin code specifically checks for refs/heads/*. We would have to change the plugin code.

https://github.com/eclipse/gerrit-cla-plugin/blob/master/eclipse-cla/src/main/java/org/eclipse/foundation/gerrit/validation/EclipseCommitValidationListener.java#L262
Comment 11 Christian Krause CLA 2014-08-20 15:22:40 EDT
Works for me. Thanks.