Hi, fine with me -- start of a month is always a good time to make changes like that so they don't risk breaking the release.

ttyl bero

On 25 June 2015 at 13:24, Paul Sokolovsky paul.sokolovsky@linaro.org wrote:

Hello Android Team,

For this past weekend, there was scheduled an LDAP authentication upgrade for review.android.git.linaro.org - sorry, it wasn't announced to the list, because it should be pretty transparent change, so I just got an ack from Vishal on IRC.

However, the migration was postponed last-minute because new auth setup requires having SSL on review.android.git.linaro.org, and we lack it there. It's not enabled because it has pretty deep 5-level domain name, we never had such a wildcard certificate, and apparently never ordered a dedicated certificate for it. During last year or so we actually gave up many 4-level domain names, by switching to use dashes as separators instead of dots. That's more cost-effective and much easier to maintain and avoid situation with expired certificates, etc.

So, what we'd like to do is migrate Android services to contemporary Linaro naming convention either. It would be:

review.android.git.linaro.org -> android-review.linaro.org android.git.linaro.org -> android-git.linaro.org

Note that older names will remain active and will be supported indefinitely. How it will look like, is that if you access review.android.git.linaro.org via web browser, you will be automatically redirected to android-review.linaro.org. Access via gerrit, git, ssh will work as before.

Overall, the upgrade should be seamless, but as there will be several moving parts, there may be risk of something breaking for short periods of time. So, we would like to make sure that there're no concerns and that e.g. end of next week is good time to proceed.

Thanks, Paul

Linaro.org | Open source software for ARM SoCs Follow Linaro: http://www.facebook.com/pages/Linaro http://twitter.com/#%21/linaroorg - http://www.linaro.org/linaro-blog _______________________________________________ linaro-android mailing list linaro-android@lists.linaro.org https://lists.linaro.org/mailman/listinfo/linaro-android

As long as previous releases work with the above redirection, I am happy :) .

On 25 June 2015 at 17:46, Fathi Boudra fathi.boudra@linaro.org wrote:

On 25 June 2015 at 14:24, Paul Sokolovsky paul.sokolovsky@linaro.org wrote:

...

Hello Android Team,

For this past weekend, there was scheduled an LDAP authentication upgrade for review.android.git.linaro.org - sorry, it wasn't announced to the list, because it should be pretty transparent change, so I just got an ack from Vishal on IRC.

However, the migration was postponed last-minute because new auth setup requires having SSL on review.android.git.linaro.org, and we lack it there. It's not enabled because it has pretty deep 5-level domain name, we never had such a wildcard certificate, and apparently never ordered a dedicated certificate for it. During last year or so we actually gave up many 4-level domain names, by switching to use dashes as separators instead of dots. That's more cost-effective and much easier to maintain and avoid situation with expired certificates, etc.

So, what we'd like to do is migrate Android services to contemporary Linaro naming convention either. It would be:

review.android.git.linaro.org -> android-review.linaro.org android.git.linaro.org -> android-git.linaro.org

Note that older names will remain active and will be supported indefinitely. How it will look like, is that if you access review.android.git.linaro.org via web browser, you will be automatically redirected to android-review.linaro.org. Access via gerrit, git, ssh will work as before.

...

Overall, the upgrade should be seamless, but as there will be several moving parts, there may be risk of something breaking for short periods of time. So, we would like to make sure that there're no concerns and that e.g. end of next week is good time to proceed.

Thanks, Paul

fwiw, looks good to me.

Cheers, Fathi

Hello,

On Wed, 1 Jul 2015 18:57:08 +0300 Paul Sokolovsky Paul.Sokolovsky@linaro.org wrote:

[]

...

As long as previous releases work with the above redirection, I am happy :) .

Thanks for all the positive feedback regarding migration. We however made a more detailed check-list, and with Git-HA set up we now have, we also need to migrate regional server, android-ap. That area is experimental and overseen by Ben Copeland of ITS, who is currently on vacation. So, we decided to postpone the migration till he's back (in 2 weeks) and can confirm HA config changes. We'll check with all stakeholders regarding new migration date then.

ITS and Systems restarted work on this last week, in background, "cautious" mode. Well, even despite good planning and cautious pace, there were couple of breaking issues - but they were addressed promptly, so hopefully didn't cause too much alarm and wasted time. We appreciate your patience during the migration - it was too easy to say "let's postpone to the next month", but then next month is vacation time, and we end up with summer backlog to resolve till New Year, like happened before ;-).

So, good news is that it's now finished. If you go by one of the older URLs, you'll be transparently redirected to:

https://android-gerrit.linaro.org (Gerrit) https://android-git.linaro.org (Gitweb)

SSL is enabled and mandatory on both (like on the majority of other Linaro sites).

Gerrit login now happens not via OpenID authentication (with redirect to Crowd server), but via Gerrit own login form (just like https://review.linaro.org)

Repository access via SSH or HTTP keeps working for old names, that was an invariant of this migration. Older Gerrit reviews/Gitweb links also work. So, you don't need to update anything, but for sharing new information, we welcome you to use URLs with new server names.

Let us know if you spot any issues - we're around to resolve them quickly.

And as a sneak peek, one of the reasons we didn't want to postpone this migration for longer than needed is because we're readying next exciting migration - upgrade of Gerrit to a fresh version ;-). Please expect RFC for that yet this week.

Thanks, Paul

Thanks for understanding, Paul

...

...

On 25 June 2015 at 17:46, Fathi Boudra fathi.boudra@linaro.org wrote:

...

On 25 June 2015 at 14:24, Paul Sokolovsky paul.sokolovsky@linaro.org wrote:

...

Hello Android Team,

For this past weekend, there was scheduled an LDAP authentication upgrade for review.android.git.linaro.org - sorry, it wasn't announced to the list, because it should be pretty transparent change, so I just got an ack from Vishal on IRC.

However, the migration was postponed last-minute because new auth setup requires having SSL on review.android.git.linaro.org, and we lack it there. It's not enabled because it has pretty deep 5-level domain name, we never had such a wildcard certificate, and apparently never ordered a dedicated certificate for it. During last year or so we actually gave up many 4-level domain names, by switching to use dashes as separators instead of dots. That's more cost-effective and much easier to maintain and avoid situation with expired certificates, etc.

So, what we'd like to do is migrate Android services to contemporary Linaro naming convention either. It would be:

review.android.git.linaro.org -> android-review.linaro.org android.git.linaro.org -> android-git.linaro.org

Note that older names will remain active and will be supported indefinitely. How it will look like, is that if you access review.android.git.linaro.org via web browser, you will be automatically redirected to android-review.linaro.org. Access via gerrit, git, ssh will work as before.

...

Overall, the upgrade should be seamless, but as there will be several moving parts, there may be risk of something breaking for short periods of time. So, we would like to make sure that there're no concerns and that e.g. end of next week is good time to proceed.

Thanks, Paul

fwiw, looks good to me.

Cheers, Fathi