Some Eclipse Foundation services are deprecated, or will be soon. Please ensure you've read this important communication.

Bug 539666

Summary: Github ip-validation fails with clear-text name but requests Github userid
Product: Community Reporter: Markus Karg <markus>
Component: GitHubAssignee: Eclipse Webmaster <webmaster>
Status: RESOLVED FIXED QA Contact:
Severity: major    
Priority: P3 CC: wayne.beaton
Version: unspecified   
Target Milestone: ---   
Hardware: PC   
OS: Windows NT   
Whiteboard:

Description Markus Karg CLA 2018-10-01 01:41:07 EDT 
As https://git.eclipse.org/r/Documentation/user-signedoffby.html says, a sign-off MUST be "using your real name (sorry, no pseudonyms or anonymous contributions.)".

Just recently I noticed a failing ip-validation in Github with the reason told that the name MUST NOT be the clear-text name but MUST match "andymc12" which is the Github userid! I then changed the lined from from "Andy Mc Cright" to "andymc12" and the ip-validation succeeded.

Hence, either the above documentation is wrong, or the ip-validation script has a bug.
Comment 1 Wayne Beaton CLA 2018-10-04 10:50:50 EDT 
That link points to standard Gerrit documentation. This has nothing to do with the hook we've implemented. Besides, since they use different technology and have different APIs, we have different implementations of the hooks on Gerrit and GitHub.

Anyway...

AFAICT, it looks like the method (evaluateSignature) that checks the signature considers the signature valid when:

* the email address matches the *committer* email address; or
* the name matches the *author* GitHub id.

The first condition should, I think, be checking the *author* email address. I don't recall matching the GitHub author Id being valid criteria in the requirements, so I'll have to think a bit harder about that.

It looks like the implementation also has the flaw that it only checks the first "Signed-off-by". There could, theoretically, be more than one.

I'll take a run at a patch.

Markus, I can't find a commit in the state you describe in either the git log or any open pull request on jaxrs-api; can verify whether or not the commits in question have different values in the committer and author fields?
Comment 2 Eclipse Webmaster CLA 2019-07-24 15:38:47 EDT 
The ip-validation hook on Github was updated a few months ago.  As such I'll close this as resolved, but please reopen if it's still a problem.

-M.