#summary Executive summary of the list of major Gerrit topics under review and temporarily blocked

=Overview=

Following a   [https://groups.google.com/forum/#!topic/repo-discuss/qKz7AtZDlC4 discussion on the mailing list] we decided to create a summary page containing the list of outstanding topics that are currently under review and deserve a particular attention because of their nature.

The purpose of this page is to keep track of them and prevent the risk of them being forgotten in the Gerrit changes backlog. The topics listed here are either related to the Gerrit architecture or to some fixes to severe bugs that need particular attention and time for being reviewed and merged.

Currently outstanding topics are:
  # [OutstandingTopics#Intermittent_data_loss_and_corruption intermittent-data-loss-and-corruption]
  # [OutstandingTopics#Pluggable_authentication_backend auth-backends-HttpAuthProtocol]
  # [OutstandingTopics#On-Line_edit inline-2]
  # [OutstandingTopics#Scripting_plugins scripting-reloaded]
  # [OutstandingTopics#Secure_Store secure-store]
  # [OutstandingTopics#Angular_Gerrit angular-gerrit-integration]

-----

=Intermittent data loss and corruption=

This has the *HIGHEST PRIORITY*.

Transaction management in `GWTORM` is only implemented for Google's `Megastore` database (`NoSQL` dialect).

For Jdbc dialects the methods: `beginTransaction()`, `commit()` and `rollback()` are no-ops: `java.sql.Connection` is opened in `autoCommit=true` mode, what effectively means that all executed statements are immediately committed. This obviously cannot work with optimistic database locking strategy that `GWTORM` is using, because it is expected with this approach that some statements can and would fail with stale row manipulation error. But this means a disaster with not proper working transaction management, because `rollback()` is a no-op and all `SQL` statements that were executed after `beginTransaction()` were already committed, leaving the changes in undefined state. Note: all databases used by Gerrit have transaction 
support (with one exception: MySQL's `MyISAM` storage engine, but it is a crap anyway, and both `OpenStack` and `Wikimedia` projects are using `InnoDB` storage engine, obviously). More background information can be found in this [https://groups.google.com/d/topic/repo-discuss/KUUBaI29QO8 thread].

The consequences are all these reported issues [https://code.google.com/p/gerrit/issues/detail?id=2034 1], [https://code.google.com/p/gerrit/issues/detail?id=2246 2], [https://code.google.com/p/gerrit/issues/detail?id=2383 3], [https://code.google.com/p/gerrit/issues/detail?id=2702 4].

 * Gerrit changes: [https://gerrit-review.googlesource.com/#/q/topic:database-corruption changes]
 * Owner: Bruce, DavidO
 * Status: Bruce's change was merged into stable-2.9 but need to be back ported to 2.8. 
 * Issues: back port the changes also to 2.6 and 2.7 and provide patches for older Gerrit releases to prevent data loss and corruption. 

=Pluggable authentication backend=

Replace the current Gerrit authentication infrastructure, mainly based on mega-switch/case with the list of protocols/methods supported, with a new plugin-based authentication back-end. 

These changes would allow Gerrit to be more extensible, avoiding further growth of the mega-switch/case all over the code and support the ability to load user plugins to support other authentication systems in the same way that Gerrit groups have been refactored years ago.

  * Gerrit changes: [https://gerrit-review.googlesource.com/#/q/status:open+project:gerrit+branch:master+topic:auth-backends-HttpAuthProtocol changes]
  * Owner: [https://gerrit-review.googlesource.com/#/q/owner:%22Dariusz+%25C5%2581uksza%22+status:open Dariusz]
  * Status: review started, partially merged
  * Issues: after having merged part of it, the review is now stuck. Needs Shawn attention as the first attempt to merge it broke the Gerrit authentication.

=On-Line edit=

Allows to perform small edits on the files included in an existing Gerrit change in order to submit a new patch-set. Currently it is already possible on the commit message but not on the code.

The overall user-experience is nice and is provides a very quick and easy shortcut for avoiding to go through the check-out / modify / commit --amend / push workflow for small changes. GitHub provides already this feature and is really nice!

  * Gerrit changes: [https://gerrit-review.googlesource.com/#/q/status:open+project:gerrit+branch:master+topic:inline-2 changes]
  * Owner: [https://gerrit-review.googlesource.com/#/q/owner:%22David+Ostrovsky+%253CDavid.Ostrovsky%2540gmx.de%253E%22+status:open DavidO]
  * Status: second version of the on-line edit. Demoed at the last Gerrit User Summit 2014 @Google. Review should be finalized
  * Issues: The major parts of the series were reviewed and tested by Björn Pedersen, David P., Shawn and Martin. All comments were addressed. Particularly after Shawn comment the series was substantially redesigned: `RevisionEdits` were evacuated out from `GET /changes<id>/detail` request and put into its own request.

=Scripting plugins=

Introduce the ability to load scripts written in languages different than Java (e.g. Groovy, Scala and potentially any other language that can run on the JVM) and use them as Gerrit plugins for extending Gerrit functionalities.

Currently the plugin-type is an hardcoded Enum that allows only "plugin", "extension" and "javascript" types. Once the changes will be reviewed and merged, Gerrit would potentially support any type of plugin that declares to support a specific file or directory w/ extension.

For an overview on Gerrit Scripting Plugins, see the [http://www.slideshare.net/lucamilanesio/gerrit-code-review-how-to-script-a-plugin-with-scala-and-groovy SlideShare] slide-deck presented at the Gerrit User Summit 2014 @Google.

  * Gerrit changes: [https://gerrit-review.googlesource.com/#/q/status:open+topic:scripting-reloaded changes]
  * Owner: [https://gerrit-review.googlesource.com/#/q/owner:%22Luca+Milanesio+%253Cluca.milanesio%2540gmail.com%253E%22 Luca]
  * Status: review started, partially merged
  * Issues: after having merged part of it, the review is now stuck. Needs Shawn attention as we are coming to the part of refactoring the current Jar Scanner in order to scan things that are not Jars.

=Secure Store=

Makes the Gerrit secure.config more secure by encrypting its values. This change aims to make the security system applied to the secure.config more generic and pluggable. Potentially the key-value pairs could be stored in an external security vault and not even persisted in the filesystem.

The challenges are actually on where the secure.config is used: all over the place in Gerrit whenever a @GerritServerConfig annotation is present. Additionally when the config gets created the plugin infrastructure and loader are not available: the pluggability then needs to use another discovery system.

  * Gerrit changes: [https://gerrit-review.googlesource.com/#/q/status:open+topic:secure-store changes]
  * Owner: [https://gerrit-review.googlesource.com/#/q/owner:%22Dariusz+%25C5%2581uksza%22+status:open Dariusz]
  * Status: review started
  * Issues: positive and negative feedbacks on the change. Needs rethinking / reworking possibly to a much simpler approach.

=Angular Gerrit=

Dariusz presented at the Gerrit User a prototype for leveraging the REST-API through an AngularJS UX. It has been published to GitHub at https://github.com/dluksza/angular-gerrit.

In order to use the Gerrit-Angular integration a set of changes in the Plugin infrastructure are needed and have been uploaded for review.

  * Gerrit changes: [https://gerrit-review.googlesource.com/#/q/status:open+topic:angular-gerrit-integration changes]
  * Owner: [https://gerrit-review.googlesource.com/#/q/owner:%22Dariusz+%25C5%2581uksza%22+status:open Dariusz]
  * Status: changes submitted, topic created.
  * Issues: None at the moment.