Tag cleanup and protection

[ppkarwasz]

Hi all,

In PR #4095 I will also be introducing protection on our tags.

Our tags are currently unprotected. The GitHub feature previously used for this (Protected Tags) was sunset in 2024, and we now need to use Rulesets instead.

Before doing that, I'd like to clean up the tags so our users only see the relevant ones: specifically, remove all log4j-* tags and keep
only the rel/* tags. Since our release process no longer relies on tags to mark release candidates (they are now referenced by SHA-1), we could also go ahead and protect all tags.

Before the cleanup, however, I'd like to fix a few inconsistencies that have crept in over the years:

1. The earliest pre-releases, 2.0-alpha1 through 2.0-beta9, have no rel/* tag. These predate the convention.

2. The following releases have lightweight tags instead of annotated ones: 2.22.1, 2.23.0, all 2.24.x releases, 3.0.0-beta2 and 3.0.0-beta3. These appear to all be releases I cut, though not all of them.

3. The following releases have unsigned tags: all 2.21.x and 2.25.x releases.

I'd like to address all three before enabling tag protection.

What do you think?

Piotr

[garydgregory]

How does this work in gitbox?

[ppkarwasz]

This is a good question: I can test with one tag (e.g. an unsigned one) and check if the update will synchronize with GitBox.

[jvz]

GitBox already has built in support for marking rel/* branches as immutable. We might want to check with Infra about write-protected branches, but given that it's in the .asf.yml file, I imagine they do support it.

[vy]

I liked the idea.

The following releases have unsigned tags: all 2.21.x and 2.25.x releases.

Per this dev@logging lazy consensus, I don't think signatures is a requirement anymore.

[ppkarwasz]

Signatures on commits and tags are a little bit different topic:

• We don't require signatures in PRs, because we have no way to verify GPG keys for contributors,
• However we know the keys of release managers and our users can easily verify that a release commit is signed by one of us.

To create a tag all it takes now is to steal a PAT with write permission on contents. However, you won't be able to sign it with a release manager's GPG key.

[jvz]

I thought we wanted to sign tags in the first place due to using CI for tagging releases? Anyways, signing individual commits, while helpful, isn't required (simply signing commits isn't enough for proper security here; you also need to manage the valid lists of signing keys for a domain, and that brings things back to the equivalent of managing a KEYS file but with more types of supported keys).