Gerrit Adding 'Signed-Off-By' Anonymous Users to Reviewers

77 views
Skip to first unread message

Trevor Bramwell

unread,
Jul 25, 2016, 8:23:34 AM7/25/16
to Repo and Gerrit Discussion
Hi Repo-Discuss,

I'm experiencing an interesting issue with 2.11.3 that I'm not sure how to fix.

Users not registered in Gerrit will be added to Reviewers if they are listed in a 'Signed-off-by' line of a commit.
This results in them getting an email they do not want.
The only option I see available to restrict emails is under capabilities->emailReviewers[2].
There are also sendmail[3] options, but these seem to be restricted to configuring the MSA.
This only seems to limit who can _send_ email, not who can _receive_ email.

If this is a bug, I'm unsure how it would be classified. Is it an issue with adding non-users to 'Reviewers',
a problem with emailing 'Anonymous Users', a feature to restrict outgoing emails, or perhaps an addition
to restrict notifications[4]?

Any feedback or input would be greatly appreciated!

Regards,
Trevor Bramwell

[1] https://gerrit.opnfv.org/gerrit/#/c/17063/
[2] https://gerrit.opnfv.org/gerrit/Documentation/access-control.html#capability_emailReviewers
[3] https://gerrit.opnfv.org/gerrit/Documentation/config-gerrit.html#sendemail
[4] https://gerrit.opnfv.org/gerrit/Documentation/user-notify.html#project

Edwin Kempin

unread,
Jul 26, 2016, 11:12:01 AM7/26/16
to Trevor Bramwell, Repo and Gerrit Discussion
On Fri, Jul 22, 2016 at 5:53 PM, Trevor Bramwell <tbra...@linuxfoundation.org> wrote:
Hi Repo-Discuss,

I'm experiencing an interesting issue with 2.11.3 that I'm not sure how to fix.

Users not registered in Gerrit will be added to Reviewers if they are listed in a 'Signed-off-by' line of a commit.
This results in them getting an email they do not want.
The only option I see available to restrict emails is under capabilities->emailReviewers[2].
There are also sendmail[3] options, but these seem to be restricted to configuring the MSA.
This only seems to limit who can _send_ email, not who can _receive_ email.

If this is a bug, I'm unsure how it would be classified. Is it an issue with adding non-users to 'Reviewers',
a problem with emailing 'Anonymous Users', a feature to restrict outgoing emails, or perhaps an addition
to restrict notifications[4]?

Any feedback or input would be greatly appreciated!
You can use the notify option on push to suppress email notifications for reviewers, see:
 

--
--
To unsubscribe, email repo-discuss...@googlegroups.com
More info at http://groups.google.com/group/repo-discuss?hl=en

---
You received this message because you are subscribed to the Google Groups "Repo and Gerrit Discussion" group.
To unsubscribe from this group and stop receiving emails from it, send an email to repo-discuss...@googlegroups.com.
For more options, visit https://groups.google.com/d/optout.


David Pursehouse

unread,
Jul 26, 2016, 8:54:57 PM7/26/16
to Trevor Bramwell, Repo and Gerrit Discussion
On Mon, Jul 25, 2016 at 9:23 PM Trevor Bramwell <tbra...@linuxfoundation.org> wrote:
Hi Repo-Discuss,

I'm experiencing an interesting issue with 2.11.3 that I'm not sure how to fix.

Users not registered in Gerrit will be added to Reviewers if they are listed in a 'Signed-off-by' line of a commit.
This results in them getting an email they do not want.

I'm not sure if this is intentional.  It sounds like a bug to me.
 
The only option I see available to restrict emails is under capabilities->emailReviewers[2].
There are also sendmail[3] options, but these seem to be restricted to configuring the MSA.
This only seems to limit who can _send_ email, not who can _receive_ email.

The sendemail.allowRcpt option [1] can be used to whitelist email addresses or domains that are allowed to receive mail, although I'm not sure how much it'll help if you're an open source project with committers having email addresses at many different domains.  It's designed more for restricting to a few specific domains.

 

If this is a bug, I'm unsure how it would be classified. Is it an issue with adding non-users to 'Reviewers',
a problem with emailing 'Anonymous Users', a feature to restrict outgoing emails, or perhaps an addition
to restrict notifications[4]?

Any feedback or input would be greatly appreciated!

Regards,
Trevor Bramwell

[1] https://gerrit.opnfv.org/gerrit/#/c/17063/
[2] https://gerrit.opnfv.org/gerrit/Documentation/access-control.html#capability_emailReviewers
[3] https://gerrit.opnfv.org/gerrit/Documentation/config-gerrit.html#sendemail
[4] https://gerrit.opnfv.org/gerrit/Documentation/user-notify.html#project

--

Edwin Kempin

unread,
Jul 27, 2016, 3:30:02 AM7/27/16
to David Pursehouse, Trevor Bramwell, Repo and Gerrit Discussion
On Wed, Jul 27, 2016 at 2:54 AM, David Pursehouse <david.pu...@gmail.com> wrote:
On Mon, Jul 25, 2016 at 9:23 PM Trevor Bramwell <tbra...@linuxfoundation.org> wrote:
Hi Repo-Discuss,

I'm experiencing an interesting issue with 2.11.3 that I'm not sure how to fix.

Users not registered in Gerrit will be added to Reviewers if they are listed in a 'Signed-off-by' line of a commit.
This results in them getting an email they do not want.

I'm not sure if this is intentional.  It sounds like a bug to me.
I also think that this is a bug :(

Saša Živkov

unread,
Jul 27, 2016, 9:03:10 AM7/27/16
to Edwin Kempin, David Pursehouse, Trevor Bramwell, Repo and Gerrit Discussion
On Wed, Jul 27, 2016 at 9:29 AM, 'Edwin Kempin' via Repo and Gerrit Discussion <repo-d...@googlegroups.com> wrote:


On Wed, Jul 27, 2016 at 2:54 AM, David Pursehouse <david.pu...@gmail.com> wrote:
On Mon, Jul 25, 2016 at 9:23 PM Trevor Bramwell <tbra...@linuxfoundation.org> wrote:
Hi Repo-Discuss,

I'm experiencing an interesting issue with 2.11.3 that I'm not sure how to fix.

Users not registered in Gerrit will be added to Reviewers if they are listed in a 'Signed-off-by' line of a commit.
This results in them getting an email they do not want.

I'm not sure if this is intentional.  It sounds like a bug to me.
I also think that this is a bug :(

Possible off-topic but I had a similar question from one team here last week.
Whenever they cherry-pick a commit, the author of that commit is added as reviewer
and gets email notification. The problem is that the author has left the team and
neither him not the team want that he is added as reviewer.
Looking at the source code this seems to be hardcoded.

Matthew Webber

unread,
Jul 27, 2016, 9:32:56 AM7/27/16
to Repo and Gerrit Discussion, eke...@google.com, david.pu...@gmail.com, tbra...@linuxfoundation.org
Has the person left team, but also stopped using Gerrit? In that case, you can de-activate the account in Gerrit (the account itself remains there, so that all the user's reviews etc. can still be seen). I believe that stops all emails to that person, irrespective of triggering action (if not, it's a bug). You should be de-activating accounts for security reasons anyhow.

However, if the person has left the team, but continues to use Gerrit, that strategy won't work.

Saša Živkov

unread,
Jul 27, 2016, 9:55:15 AM7/27/16
to Matthew Webber, Repo and Gerrit Discussion, Edwin Kempin, David Pursehouse, Trevor Bramwell
On Wed, Jul 27, 2016 at 3:32 PM, Matthew Webber <mat...@unsolvable.org> wrote:
Has the person left team, but also stopped using Gerrit?

No, he is still using Gerrit just working on a different project.

David Pursehouse

unread,
Aug 10, 2016, 2:47:38 AM8/10/16
to Edwin Kempin, Trevor Bramwell, Repo and Gerrit Discussion
On Wed, Jul 27, 2016 at 4:29 PM Edwin Kempin <eke...@google.com> wrote:
On Wed, Jul 27, 2016 at 2:54 AM, David Pursehouse <david.pu...@gmail.com> wrote:
On Mon, Jul 25, 2016 at 9:23 PM Trevor Bramwell <tbra...@linuxfoundation.org> wrote:
Hi Repo-Discuss,

I'm experiencing an interesting issue with 2.11.3 that I'm not sure how to fix.

Users not registered in Gerrit will be added to Reviewers if they are listed in a 'Signed-off-by' line of a commit.
This results in them getting an email they do not want.

I'm not sure if this is intentional.  It sounds like a bug to me.
I also think that this is a bug :(
 

I've tried to reproduce this issue (on master) and was not able to.  It is only adding email addresses to the recipient list if they are resolvable to a Gerrit user account.

I have not explicitly tested on earlier versions, but the code seems to be the same on stable-2.11 as it is on master.

The relevant code is in MailUtil.getRecipientsFromFooters [1] which calls MailUtil.toAccountId [2], which throws NoSuchAccountException when the account was not found.


Reply all
Reply to author
Forward
0 new messages