Ref protection plugin.

Protects against commits being lost by creating backups of deleted refs (or non-fast-forward commits) under the refs/backups/ namespace.

Branch deletion protection can be disabled by setting plugin.ref-protection.protectDeleted false in gerrit.config. Similarly, non-fast-forward update protection can be disabled with plugin.ref-protection.protectFastForward false.

Branches under refs/heads/ that are deleted or rewritten are backed up as refs/backups/heads/branch-name-YYYYMMDD-HHmmss by default, or as sequentially increasing numbers under refs/backups/heads/branch-name/# by setting plugin.ref-protection.useTimestamp false.

Tags under refs/tags/ that are deleted are backed up (as branches) as refs/backups/tags/tag-name-YYYYMMDD-HHmmss or as sequentially increasing numbers under refs/backups/tags/branch-name/# using the same plugin.ref-protection.useTimestamp setting.

By default, the backups are created as branches. Optionally, they may be created as tags, containing information about the original ref that was changed, as well as the user that performed the change. This can be enabled by setting plugin.ref-protection.createTag true.

Since the refs/backups/* branch is created in the same User scope as the delete, Create Reference and Push permission need to be granted to any user that is allowed to delete or force-push a ref or backups will fail. This is most conveniently achieved by granting the permission to Registered Users (all logged in users).

Furthermore, to avoid the backup refs to be exposed to the users, a block on the Read permission on refs/backups/* is necessary. This will avoid a possible security issue in the following case:

• user A has exclusive access to refs/super-secret-branch
• user A create a change in refs/super-secret-branch
• user A deletes refs/super-secret-branch
• ref-protection creates a backup in refs/backups
• user B can access super-secret-branch backup