Release notes for Gerrit 2.5

This splits all of the replication code out of the core server and moves it into a standard plugin.

Allows plugin developers to declare additional SSH commands.

Site administrators can alias SSH commands from a plugin into the gerrit namespace.

The aliases are configured statically at server startup, but are resolved dynamically at invocation time to the currently loaded version of the plugin. If the plugin is not loaded, or does not define the command, "not found" is returned to the user.

Plugins may contribute to the /plugins/NAME/ URL space.

If a plugin has no modules declared in the manifest, automatically generate the modules for the plugin based on the class files that appear in the plugin and the @Export annotations that appear on these concrete classes.

For any non-abstract command that extends SshCommand, plugins may declare the command with @Export("name") to bind the implementation as that SSH command.

Likewise HTTP servlets can also be bound to URLs.

The static/ and Documentation/ resource directories of a plugin can be served over HTTP for any loaded and running plugin, even if it has no other HTTP handlers. This permits a plugin to supply icons or other graphics for the web UI, or documentation content to help users learn how to use the plugin.

If Gerrit detects that a requested plugin resource does not exist, but instead a file with a .md extension does exist, Gerrit opens the .md file and reformats it as html.

Plugins can implement an AuditListener to be informed about auditable actions:

The plugin must define a plugin module that binds the implementation of the audit listener in the configure() method:

Administrators can see the list of installed plugins in the WebUI under Admin > Plugins. For each plugin the plugin status is shown and it is possible to navigate to the plugin documentation.

Administrators can retrieve plugin information from a REST interface by loading <server-url>/a/plugins/.

The PluginScanner thread runs every 1 minute by default and loads any newly created plugins, unloads any deleted plugins, and reloads any plugins that have been modified.

The check frequency can be configured by setting plugins.checkFrequency in the Gerrit config file. By configuration the scanner can also be disabled.

When a plugin is stopped, schedule a Plugin Cleaner task to run 1 minute later to try and clean out the garbage and release the JAR from $site_path/tmp.

Extensions may need to know when they are starting or stopping. Export the interface that they can use to learn this information.

Plugins can take this value by injection and learn the current server state during their own LifecycleListener. This enables a plugin to determine if it is loading as part of server startup, or because it was dynamically installed or reloaded by an administrator.

This enables plugins to make use of servlet sessions.

Restoring a change is similar to uploading a new change. If a branch gets closed by removing the access rights to upload new changes it shouldn’t be possible to restore changes for this branch.

When initializing a new site a set of default access rights is configured on the All-Projects project. These default access rights include read access on refs/* for Anonymous Users and read access on refs/meta/config for Project Owners. Since the read access on refs/meta/config for Project Owners was not exclusive, Anonymous users were able to access the refs/meta/config branch which by default should only be accessible by the project owners.

There are many search operators and it’s difficult to remember all of them. Now the search operators are suggested as the user types the query.

Writing an expression like "owner:self status:open" will now identify changes that the caller owns and are still open. This self alias is valid in contexts where a user is expected as an argument to a query operator.

The command creates a fresh Prolog environment and loads a Prolog script from stdin. can_submit is then queried and the results are returned to the user.

Site administrators can define aliases for SSH commands in the ssh-alias section of the Gerrit configuration.

Add a command line option to the query SSH command to include submit records in the output.

This facilitates the querying of information relating to the submit status from the command line and by API clients, including information such as whether the change can be submitted as-is, and whether the submission criteria for each review label has been met.

In case if a project has some kind of waterfall automerging a→b→c it is convenient to create all these branches at the project creation time.

e.g. .. gerrit create-project -b master -b foo -b bar …

The verbose mode enabled by the new option makes the ls-groups command output a tab-separated table containing all available information about each group (though not its members).

To submit patches commits can be pushed to https://gerrit.googlesource.com/gerrit

This makes it easier to build for the browser you want to test on, rather than remembering what its GWT name is.

The assertions in the KeyCommandSet class cause exceptions when a KeyCommand is registered several times.

Use an explicit asciidoc attribute to make sure the produced HTML will always contain unix line endings. This will help in producing build results that are better comparable by size.

Eclipse overwrites these files when we import projects using m2e. Eclipse 3 writes a timestamp at the top of these files making the Git working tree dirty. Eclipse 4 (Juno) still overwrites these files but doesn’t write the timestamp. This should help to keep the working tree clean. However, since the timestamp is currently present in these files, Eclipse 4 would still make them dirty by overwriting and effectively removing the timestamp.

This change removes the timestamp from these files. This helps those using Eclipse 4 and doesn’t make it worse for those still using Eclipse 3.

Building the plugin modules (Plugin API and Plugin Archetype) may take a significant amount of time (since many jars are downloaded). During development it is not needed to build the plugin modules. A new Maven profile was added that skips the build of the plugin modules, so that developers have a faster turnaround. This profile is called no-plugins and it’s active by default. To include the plugin modules into the build activate the all profile:

The script to make release builds has been adapted to activate the all profile so that the plugin modules are always built for release builds.

Add $email.UnifiedDiff as new macro to the NewChange.vm mail template. This macro is expanded to a unified diff of the patch.

Instead of making site administrators hack the email template, allow admins to enable the diff feature by setting a configuration variable in gerrit.config.

If a unified diff included in an email will exceed the limit configured by the system administrator, only the affected file paths are listed in the email instead. This gives interested parties some context on the size and scope of the change, without killing their inbox.

Allow the from email address to be a ParameterizedString that handles the ${userHash} variable. The value of the variable is the md5 hash of the user name. This allows unique generation of email addresses, so GMAIL threads names of users in conversations correctly. For example, the from pattern for gerrit-review defined in the Gerrit configuration looks like this:

Some email clients hide the signature section of an email automatically. If there are no reviewers listed on a new change, such as when a change is pushed over HTTP and a notification is automatically sent out to any subscribed watchers, the URL was hidden inside of the signature and not readily available.

Show the URL right away in the body.

Instead of using Ehcache for in-memory caches, use Guava. The Guava cache code has been more completely tested by Google in high load production environments, and it tends to have fewer bugs. It enables caches to be built at any time, rather than only at server startup.

By creating a Guava cache as soon as it is declared, rather than during the LifecycleListener.start() for the CachePool, we can promise any downstream consumer of the cache that the cache is ready to execute requests the moment it is supplied by Guice. This fixes a startup ordering problem in the GroupCache and the ProjectCache, where code wants to use one of these caches during startup to resolve a group or project by name.

Tracking the Guava backend caches with a DynamicMap makes it possible for plugins to define their own in-memory caches using CacheModule’s cache() function to declare the cache. It allows the core server to make the cache available to administrators over SSH with the gerrit show-caches and gerrit flush-caches commands.

Persistent caches store in a private H2 database per cache, with a simple one-table schema that stores each entry in a table row as a pair of serialized objects (key and value). Database reads are gated by a BloomFilter, to reduce the number of calls made to H2 during cache misses. In theory less than 3% of cache misses will reach H2 and find nothing. Stores happen on a background thread quickly after the put is made to the cache, reducing the risk that a diff or web_session record is lost during an ungraceful shutdown.

Cache databases are capped around 128M worth of stored data by running a prune cycle each day at 1 AM local server time. Records are removed from the database by ordering on the last access time, where last accessed is the last time the record was moved from disk to memory.

Setting OPENID_SSO for auth.type in the gerrit.config will allow the admin to specify an SSO entry point URL so that users clicking on "Sign In" are sent directly to that URL.

Allows the configuration of native Gerrit username/password authentication scheme used for Git over HTTP BasicAuth, as alternative of the default DigestAuth scheme against the random generated password on Gerrit DB.

Example setting for auth.type and auth.gitBasicAuth:

With this configuration Git over HTTP protocol will be authenticated using HTTP-BasicAuth and credentials checked on LDAP.

Group backends are supposed to use unique prefixes to isolate the namespaces. E.g. the group backend for LDAP is using ldap/ as prefix for the group names.

This means that to refer to an LDAP group in the WebUI the group name needs to be prefixed with the ldap/ string. E.g. if there is a group in LDAP which is called "Developers", Gerrit will suggest this group when the user types ldap/De.

Previously, LDAP groups were mirrored in the AccountGroup table and given an Id and UUID the same as internal groups. Update these groups to be backed by only a GroupReference, with a special "ldap:" UUID prefix. Migrate all existing references to the UUID in ownerGroupUUID and any project.config.

This made the LDAP group type obsolete and it was removed.

For patch sets on the ChangeScreen different commands for downloading the patch sets are offered. For some installations not all commands are needed. Allow Gerrit administrators to configure which download commands should be offered.

The notify section allows project owners to include emails to users directly from project.config. This removes the need to create fake user accounts to always BCC a group mailing list.

Update the parsing of project.config to support the contributor agreements.

Add a new schema to move the ContributorAgreement, AccountAgreement, and AccountGroupAgreement information into the All-Projects project.config.

The sameGroupVisiblity is needed to restrict the visibility of accounts when accountVisibility is SAME_GROUP. Namely, this is a way to make sure the autoVerify group in a contributor-agreements section is never suggested.

It was not possible for hook scripts to include topic-specific behavior because the topic name was not included in the arguments.

The --is-draft argument will be passed with either true if the patchset is a draft, or false otherwise.

This can be used by hooks that need to behave differently if the change is a draft.

If for a user signing in into the Gerrit web UI fails, this can have many reasons, e.g. username is wrong, password is wrong, user is marked as inactive, user is locked in the user backend etc. In all cases the user just gets a generic error message Incorrect username or password.. Gerrit administrators had trouble to find the exact reason for the sign in problem because the corresponding AccountException was not logged.

If a user pushes an object which is larger than the configured receive.maxObjectSizeLimit parameter, the push is rejected with an Object too large error. In addition an error log entry with the full stacktrace was written into the error log.

This is not really a server error, but just a user doing something that is not allowed, and thus it should not be logged as error. For a Gerrit administrator it might still be interesting how often the limit is hit. This is why it makes sense to still log this on info level.

For the user pushing a too large object we now do not print the fatal: Unpack error, check server log message anymore, but only the Object too large error message.

Provide information to the user why a certain push was rejected.

In case when Gerrit administrator(s) don’t have a direct access to the file system where the review site is located it gets difficult to perform a schema upgrade (run the init program). For such cases it is convenient if Gerrit performs schema upgrade automatically on its startup.

Since this is a potentially dangerous operation, by default it will not be performed. The configuration parameter site.upgradeSchemaOnStartup is used to switch on automatic schema upgrade.

Some databases can’t deal with column names that are longer than 30 characters. Examples are MaxDB and Oracle.

Gerrit had two column names in the accounts table that exceeded the 30 characters: displayPatchSetsInReverseOrder, displayPersonNameInReviewCategory

These 2 columns were renamed so that their names fit within the 30 character range.

So far tracking ID’s had a maximum length of only 20 characters.

Allows development of hooks parameterized on Gerrit location. This can be useful to allow hooks to load the Gerrit configuration when needed (from $GERRIT_SITE) or even store their additional config files under $GERRIT_SITE/etc and retrieve them at startup.

git-exproll.sh is a git garbage collection script aimed specifically at reducing excessive garbage collection and particularly large packfile churn for Gerrit installations.

Excessive garbage collection on "dormant" repos is wasteful of both CPU and disk IO. Large packfile churn can lead to heavy RAM and FS usage on Gerrit servers when the Gerrit process continues to hold open the old delete packfiles. This situation is most detrimental when jgit is configured with large caching parameters. Aside from these downsides, running git gc often can be very beneficial to performance on servers. This script attempts to implement a git gc policy which avoids the downsides mentioned above so that git gc can be comfortably run very regularly.

git-exproll.sh uses keep files to manage which files will get repacked. It also uses timestamps on the repos to detect dormant repos to avoid repacking them at all. The primary packfile objective is to keep around a series of packfiles with sizes spaced out exponentially from each other, and to roll smaller packfiles into larger ones once the smaller ones have grown. This strategy attempts to balance disk space usage with avoiding rewriting large packfiles most of the time.

The exponential packing objective above does not save a large amount of time or CPU, but it does prevent the packfile churn. Depending on repo usage, however the dormant repo detection and avoidance can result in a very large time savings.

Instead of unpacking a running server into ~/.gerritcodereview/tmp only use that location for commands like init where there is no active site. From gerrit.sh always use $site_path/tmp for the JARs to isolate servers that run on the same host under the same UNIX user account.

Allow CUSTOM_EXTENSION auth type to supply by auth.editFullNameUrl a URL in the web UI that links users to the other account system, where they can edit their name, and then use another reload URL to cycle through the /login/ step and refresh the data cached by Gerrit.

Allow CUSTOM_EXTENSION auth type to supply by auth.httpPasswordUrl a URL in the web UI that allows users to obtain an HTTP password.

Like the rest of the CUSTOM_EXTENSION stuff, this is hack that will eventually go away when there is proper support for authentication plugins.

Loading Admin > Groups on large servers was very slow. The entire group membership database was downloaded to the browser when showing just the list of groups.

Now the amount of data that needs to be downloaded to the browser is reduced by using the more lightweight AccountGroup type instead of the GroupDetail type when showing the groups in a list format. As a consequence the Owners column that showed the name of the owner group had been dropped.

A new cache named "ldap_groups_byinclude" is introduced to help lessen the number of queries needed to resolve nested LDAP-groups.

This improves the performance of loading the dashboards.

If a user can forge author, committer and gerrit server identity, and can upload merges, don’t bother checking the commit history of what is being uploaded. This can save time on servers that are trying to accept a large project import using the push permission.

JGit RevWalk does not perform well when a large number of objects are added to the start set by markStart or markUninteresting. Avoid putting existing refs/changes/ or refs/tags/ into the RevWalk and instead use only the refs/heads namespace and the name of the branch used in the refs/for/ push line.

Catch existing changes by looking for their exact commit SHA-1, rather than complete ancestry. This should have roughly the same outcome for anyone pushing a new commit on top of an existing open change, but with lower computational cost at the server.

If the database has high query latency, the loop that locates existing changes on the destination branch given Change-Id can be slow. Start all of the queries as commits are discovered, but don’t block on results until all queries were started.

If the database can build the ResultSet in the background, this may hide some of the query latency by allowing the queries to overlap when more than one lookup must be performed for a push.

When multiple changes need to be created or updated for a single push operation they are now inserted into the database by parallel threads, up to the maximum allowed thread count. The current thread is used when the thread pool is already fully in use, falling back to the prior behavior where each concurrent push operation can do its own concurrent database update. The thread pool exists to reduce latency so long as there are sufficient threads available.

This helps push times on databases that are high latency, such as database servers that are running on a different machine from the Gerrit server itself, e.g. gerrit.googlesource.com.

The new thread pool is disabled by default, limiting the overhead to servers that have good latency with their database, such as using in-process H2 database, or a MySQL or PostgreSQL on the same host.

Some storage backends for JGit are able to update multiple references in a single pass efficiently. Take advantage of this by pushing any normal reference updates (such as direct push or branch create) into a single BatchRefUpdate object.

To reduce end-user latency when displaying changes in a search result or user dashboard, assume the labels are accurate in the database at display time and don’t recompute the access privileges of a reviewer.

The tag cache was updated in-place, which prevented the H2 based storage from writing out the updated tag information. This meant servers almost never had the right data stored on disk and had to recompute it at startup.

Anytime the value is now modified in place, put it back into the cache so it can be saved for use on the next startup.

VisibleRefFilter requires a lot of server CPU to accurately provide the correct listing to clients when they cannot read refs/*.

Since the default configuration is now to hide refs/meta/config, use a special case in VisibleRefFilter that permits showing every reference except refs/meta/config if a user can read every other reference in the repository.

By using the new /changes/ REST endpoint the web UI client now obtains the label information during the query and avoids a second round trip to lookup the current approvals for each displayed change. For most users this should improve the way the page renders. The verified and code review columns will be populated before the table is made visible, preventing the layout from "jumping" the way the old UI did when the 2nd RPC finally finished and supplied the label data.

ResultSet is a future-like interface, the database system is free to execute each result set asynchronously in the background if it supports that. gwtorm’s default SQL backend always runs queries immediately and then returns a ListResultSet, so for most installs this has no real impact in ordering.

For the system that runs gerrit-review, each query has a high cost in network latency, the system treats ResultSet as a future promise to supply the matching rows. Getting all of the necessary ResultSets up front allows the database to send all requests to the backend as early as possible, allowing the network latency to overlap.

Only Gerrit server administrators (members of the groups that have the administrateServer capability) should be able to edit the global capabilities because being able to edit the global capabilities means being able to assign the administrateServer capability.

Because of this on the All-Projects project it is disallowed to assign

When LDAP is used for authentication, clicking on the Sign In link opens a user/password dialog. In this dialog the "Session cookie not available." message was always shown as warning. This warning was pretty useless since the user was about to sign in because he had no current session.

This problem was discussed on the Gerrit mailing list.

If a branch got deleted and there was an open change for this branch, it was still possible to submit this open change. As result the destination branch was implicitly recreated, even if the user submitting the change had no privileges to create branches.

The commit message file is special, it doesn’t actually exist and cannot be downloaded. Don’t offer the download link in the side by side viewer.

Older patchsets are now iterated for descendants, so that the dependency chain does not break on new upstream patchsets.

In the change screen, the dependencies panel was showing draft changes in the "Depends On" and "Needed By" lists for all users, and when there was no user logged in.

Rebasing a draft patch set created a non-draft patch set. It was unexpected that rebasing a draft patch set published the modifications done in the draft patch set.

Clicking on the download command for a patch set in Firefox made the download command disappear.

If a collapsed patch set panel was expanded and re-closed it’s patch list wasn’t updated anymore when the selection for Old Version History was changed.

When changing the diff base in the Old Version History on the change screen and then entering the Side-By-Side view for a file, clicking on the back button in the browser (reentering the change screen) was causing the files to be wrongly compared with Base again.

Broken changes may have the current patch set field incorrectly specified, causing currentPatchSet to be unable to locate the correct data and return it. When this happens don’t NPE, just claim the change is not reviewed.

Displaying any file diff for a patch set failed if the change had any gaps in its patch set history. Patch sets can be missing, if they have been drafts and were deleted.

Published and draft comments that are posted on deleted files were not loaded and displayed.

An ArrayIndexOutOfBoundsException could occur when navigating from one patch to the next/previous patch if the next/previous patch was a newly added binary file. The exception occurred if the user was not signed in or if the user was signed in and had Syntax Coloring in the preferences enabled.

If a change is merged or abandoned, do not consider the reviewed property for the calling user, so that the change is not highlighted as unreviewed on the user’s dashboard.

This patch fixes an issue with the "file list" table displayed by clicking on the "Files" sub-menu when viewing a diff.

Originally when navigating between patch screens the highlighted row (pointer) of the file list table would not change when not directly interacting with the table e.g. by clicking on the previous or next file link.

This patch updates the file list table whenever a new patch screen is loaded so that the pointer corresponds to the current patch being displayed.

When an external group (such as LDAP) is used in a permission rule, don’t attempt to link to the group in the internal account system UI. The group won’t load successfully. Instead just display the name and put the UUID into a tooltip to show the full DN.

On Watched Projects screen, the Browse button displays a popup window. If the user moves it and then resizes the screen, it won’t snap back to the original position.

If the search returned no results, the search button would not be enabled and the status panel was not shown. Fixed the panel and button to always be enabled.

Requesting just /p/ caused a NullPointerException as the redirection logic had no project name to form a URL from. Detect requests for /p/ and redirect to Admin > Projects to show the projects the caller has access to.

Prefer the full name for the display text of the link.

Make sure the signature delimiter is "-- " (two dashes and a space).

According to RFC 2847 section 5.2, SMTP server won’t send the banner message again after STARTTLS negotiation. The original code will hang until SMTP server kicks it off due to timeout and can’t send email with STARTTLS enabled, aka. sendemail.smtpEncryption = tls.

The example mail templates RebasedPatchSet.vm, Restored.vm and Reverted.vm were not extracted during the initialization of a new site.

If a user is not allowed to bypass code review, but tries to push a commit directly, Gerrit rejected this push with the error message "can not update the reference as a fast forward". This message was confusing to the user since the push only failed due to missing access rights. Go back to the old message that says "prohibited by Gerrit".

Pushing a tag that has somebody else as tagger requires the Forge Committer access right. If this access right was missing Gerrit was rejecting the push with "can not create new references". This error message was misleading because the user may have thought that the Create Reference access right was missing which was actually assigned.

The same reject message was also returned on push of an annotated tag if the Push Annotated Tag access right was missing. Also in this case the error message was not ideal.

Go back to the old more generic message which says prohibited by Gerrit.

When a change is uploaded as a draft, a patchset-created event is sent to the event stream, but since drafts are private to the owner, the event is not publicly visible. When the draft is later published, no publicly visible event was sent. As result of this external tools that rely on the event stream to detect new changes didn’t receive events for any changes that were first uploaded as draft.

There is now a new event, draft-published, which is sent to the event stream when a draft change is published. The content of this event is the same as patchset-created.

When using cherry-pick as merge strategy, the wrong ref was set in the change-merged stream-event.

The issue stems from Gerrit would not acknowledge the resulting new pachset (the actual cherry-pick).

Running the query SSH command with the options --comments and --format=JSON failed with a NullPointerException if a change had a message without author. Change messages have no author if they were created by Gerrit. For such messages now the Gerrit Server identity is returned as author.

The export-review-notes command was broken because of the CachePool class being bound twice. The startup of the command failed because of that.

Commands were displaying in random order, sort commands before output.

If the user provided an invalid combination of command options or an non existing project name this was logged in the error.log but printing the error out to the user is sufficient.

Servers that are connected to LDAP but have non-LDAP user accounts created by gerrit create-account (e.g. batch role accounts for build systems) were crashing with a NullPointerException when the LdapRealm tried to discover which LDAP groups the non-LDAP user was a member of in the directory.

Per RFC 2617 the domain field is optional. If it is not present, the digest token is valid on any URL on the server. When set it must be a path prefix describing the URLs that the password would be valid against.

When a canonical URL is known, supply that as the only domain that is valid. When the URL is missing (e.g. because the provider is still broken) rely on the context path of the application instead.

In replication.config, if authGroup is set to be used together with mirror = true, refs blocked through the authGroup are deleted from the slave/mirror. The same correctly applies if the authGroup is used to block refs/meta/config.

However, if replicatePermission was set to false, Gerrit was refusing to clean up refs/meta/config on the slave/mirror.

The groupCache was being used before it was set in the class. Fix the ordering of the assignment.

The approval category functions NoBlock and NoOp have not worked since the integration of Prolog.

MAY was introduced as a new submit record status to complement OK, REJECT, NEED, and IMPOSSIBLE. This allows the expression of approval categories (labels) that are optional, i.e. could either be set or unset without ever influencing whether the change could be submitted. Previously there was no way to express this property in the submit record.

This enables the NoBlock and NoOp approval category functions to work as they now emit may() terms from the Prolog rules. Previously they returned ok() terms lacking a nested user term, leading to exceptions in code that expected a user context if the label was OK.

Categories without blocking or approval scores will result in the blocking/approved image appearing in the category column after changes are merged should the score by the reviewer match the minimum or maximum value respectively.

A check to ignore "No Score" values of 0 was added.

If an approval category name contained a dash, it was removed by Gerrit. On the other side a space in an approval category name is converted to a dash. This was confusing for writing Prolog submit rules. If, for example, one defined a new category named X-Y, then in the Prolog code the proper name for that category would have been XY which was unintuitive.

If a change query uses reviewer information and loads the approvals map, but there are no approvals for a given patch set available, the collection came out null, which cannot be iterated. Make it always be an empty list.

If a new project is created in Gerrit the replication creates the repository for this new project directly in the filesystem of the slave server. The slave server was not discovering this new repository and as result any attempt to clone the corresponding project from the slave server failed.

If Cherry Pick is chosen as submit type, on submit a new commit is created by the cherry-pick. For this commit a new patch set is created which is added to the change. Using any of the download commands to fetch this new patch set failed with Couldn’t find remote ref because no ref for the new patch set was created.

The transfer timeout was only set when pushing via SSH.

The limit for the maximum object size was only set when pushing via SSH.

The default unit here is minutes, but Jetty wants to get milliseconds from the maxWait field. Convert the minutes returned by getTimeUnit to be milliseconds, matching what Jetty expects.

This should resolve a large number of 503 errors for Git over HTTP.

Pushing a commit directly into the central repository with bypassing code review wrongly resulted in a "change … closed" message if the commit was already pushed for review and if a Change-Id was included in the commit message. Despite of the error message the push succeeded and the corresponding change got closed. Now the message is not printed anymore.

Note that the --show-stack-trace option is needed to print the stack trace when a program stops with a Die exception.

The body of the commit object may have been discarded earlier to save memory, so ensure it exists before asking for the author.

The commit_delta predicate was matching the entire file name against the given regular expression while other predicates (commit_edits, commit_message_matches) performed substring matching. It was inconsistent that for commit_delta it was needed to write something like:

to match all *.java files, while for commit_edits it was:

to match the same set of (Java) files.

The cmd field is populated by validate(boolean). If this method fails, results on some ReplaceRequests may not be set. Guard the attempt to access the field with a null check.

If the current patch set cannot be loaded from ChangeData, assume no label information. This works around an NullPointerException inside of ChangeControl where the PatchSet is otherwise required.

Ensure the commit used by a new change or replacement patch set always exists in the Git repository by writing the reference first as part of the overall BatchRefUpdate, then inserting the database records if all of the references stored successfully.

Update the Git reference before writing to the database. This way the repository cannot be corrupted if the server goes down between the two actions.

Set the GroupDetail.ownerGroup to the AccountGroup.ownerGroupUUID instead of the groupUUID.