25d4e6f4c9
This replaces the previous Echosign+Launchpad+Wiki+approver-based
asynchronous contributor license agreement signing process with a
fully-automated one contained entirely within Gerrit itself.
Note that the CLA features in Gerrit's WebUI depend on a modified
gerrit.war with an earlier patch reverted:
https://review.openstack.org/12716
* manifests/site.pp(review-dev.openstack.org): Fill contactstore_appsec
and contactstore_pubkey private material from hiera, for use by Gerrit's
contact store feature. Similar entries should be added for
review.openstack.org before going into production.
* modules/gerrit/manifests/init.pp(gerrit): Add contactstore,
contactstore_appsec and contactstore_url variables needed by the
gerrit.config.erb template, and contactstore_pubkey needed by the
contact_information.pub.erb template. Add a conditional block so that if
contactstore is enabled it installs the libbcpg-java package which
Bouncy Castle needs for OpenPGP operations, links the bcpg.jar into
Gerrit's lib directory, and builds contact_information.pub from the
contact_information.pub.erb template.
* modules/gerrit/templates/contact_information.pub.erb: New template
which is effectively an empty file waiting to be filled with the
contents of the contactstore_pubkey variable. The
gerrit_contact_information.pub file built from it gets used to encrypt
contact information filed by users in such a way that it can only be
decrypted by the private key held by the Foundation.
* modules/gerrit/templates/gerrit.config.erb(contactstore): New section,
implemented conditionally for safety. Once enabled, if the
contactstore_appsec and contactstore_url are unset then Gerrit will
refuse to start. If the system referred to by contactstore_url is
unresponsive or contactstore_appsec does not contain the shared secret
it's expecting, contributors will be unable to file initial or updated
contact information through Gerrit's WebUI.
* modules/openstack_project/files/gerrit/cla.html: A stripped-down HTML
copy of http://wiki.openstack.org/CLA retaining all the original
wording. This will probably need updating by OpenStack Foundation staff.
* modules/openstack_project/manifests/gerrit.pp
(openstack_project::gerrit): Add contactstore, contactstore_appsec,
contactstore_pubkey and contactstore_url variables to pass back into the
gerrit module. Also define the cla_description, cla_file, cla_id and
cla_name variables which get used in the gerrit_set_agreements.sh.erb
template. Add an entry to install the cla.html file.
* modules/openstack_project/manifests/review_dev.pp
(openstack_project::review_dev): Add the contactstore_appsec and
contactstore_pubkey variables so they can be filled in by hiera.
Override the war to pull in the g69c8fa6 test build which has the
aforementioned CLA bits restored. Turn on contactstore and set
contactstore_url to point to an existing test CGI on the Internet until
the Foundation has theirs ready. Pass contactstore_appsec and
contactstore_pubkey through up into gerrit.pp. Add an entry for the
set_agreements.sh script built from the gerrit_set_agreements.sh.erb
template and then execute it to add the new CLA to Gerrit's DB and mark
the old one expired. Similar changes should be made in review.pp before
going into production.
* modules/openstack_project/templates/gerrit_set_agreements.sh.erb: New
template used to build a set_agreements.sh script which checks Gerrit's
database and, if necessary, expires the old Echosign CLA and adds the
new local CLA. These conditions are checked and associated operations
performed independently, so subsequent runs become a no-op.
Post-migration, this can probably be neutered further and kept around
for pushing future CLA modifications into the database when needed.
Change-Id: Ib7136fef23dbd5602955649b33a57bc8d7106026
Reviewed-on: https://review.openstack.org/13058
Reviewed-by: Monty Taylor <mordred@inaugust.com>
Reviewed-by: Clark Boylan <clark.boylan@gmail.com>
Reviewed-by: James E. Blair <corvus@inaugust.com>
Approved: Monty Taylor <mordred@inaugust.com>
Tested-by: Jenkins
49 lines
1.9 KiB
Plaintext
49 lines
1.9 KiB
Plaintext
#!/bin/sh
|
|
|
|
# The point of this script is to update the list of contributor license
|
|
# agreements Gerrit knows about. More specifically, in its current form,
|
|
# it's being used by Puppet to perform database-specific parts of a
|
|
# migration for OpenStack's development and production Gerrit servers
|
|
# from Echosign to a Gerrit-managed CLA. As such, a lot of this code can
|
|
# be ripped out once that migration is complete (though it doesn't
|
|
# necessarily need to be, and can be left in place more or less
|
|
# indefinitely without impact).
|
|
|
|
# This function takes a contributor agreement ID and returns 0 if Y
|
|
# (active), 1 if N (inactive) or anything else (including if the CLA
|
|
# does not exist). It would be nice to implement this by short name
|
|
# instead, but Gerrit does not create the id column with auto_increment
|
|
# so we have to know what ID integers we want when creating anyway.
|
|
is_active () {
|
|
ACTIVE=$(
|
|
mysql --defaults-file=/etc/mysql/debian.cnf --batch \
|
|
--skip-column-names --execute '
|
|
SELECT active FROM contributor_agreements WHERE id='$1';
|
|
' reviewdb
|
|
)
|
|
if test "$ACTIVE" = "Y" ; then
|
|
return 0
|
|
else
|
|
return 1
|
|
fi
|
|
}
|
|
|
|
# The old Echosign CLA needs to be invalidated, so if it's active then
|
|
# update it to an inactive state.
|
|
is_active 1 \
|
|
&& mysql --defaults-file=/etc/mysql/debian.cnf --execute '
|
|
UPDATE contributor_agreements SET active="N" WHERE id=1;
|
|
' reviewdb
|
|
|
|
# The new Gerrit-managed CLA should be created if it does not yet exist.
|
|
# It's added as ID 2 to accomodate the existence of the old Echosign CLA
|
|
# occupying ID 1.
|
|
is_active 2 \
|
|
|| mysql --defaults-file=/etc/mysql/debian.cnf --execute '
|
|
INSERT INTO contributor_agreements VALUES (
|
|
"Y", "Y", "Y", "<%= cla_name %>",
|
|
"<%= cla_description %>",
|
|
"<%= cla_file %>", <%= cla_id %>
|
|
);
|
|
' reviewdb
|