[Starlingx-discuss] IMPORTANT: Opendev gerrit hacked

[Jeremy Stanley]

On 2020-10-21 11:21:43 -0400 (-0400), Scott Little wrote:
> Here is the latest update from the opendev infrastructure team on
> the gerrit outage.
> 
> http://lists.opendev.org/pipermail/service-announce/2020-October/000011.html
> 
> In short
> 
> - The gerrit service was taken offline for a time, but has since been
> restored.
> 
> - They ask that you review the activity logs
> <https://login.launchpad.net/activity> on your account. Check for
> access times or originating ip addresses that look wrong.
> 
> - They ask that you re-review the diffs for commits submitted
> since October first.  They have collected the diffs at
> https://static.opendev.org/project/opendev.org/gerrit-diffs/ .
> They are organized by repo and branch.  If you have submitted
> code, or you are a core reviewer that has approved a code merge,
> please take the time to re-review the submission.  Do you remember
> approving the submission? Has the submission been tampered with.
> If you are a code submitter and still have access to your local
> working git, perhaps generate your own diffs and compare it to the
> upstream diffs.
> 
> - Users (if any) of the Gerrit HTTP API will find that there old
> passwords have been purged.  You'll need to set a new password to
> regain access.
> 
> I think Bill has volunteered to set up some way to track that all
> the gits have been re-reviewed.

Thanks for starting this process, and please do let me or other folks
on the service-discuss at lists.opendev.org or in the #opendev channel
on Freenode IRC know if you need help with or clarification on
anything. We did at least perform some automated analysis of all
those commits before making the service reachable again, to confirm
that they do all correspond to actual changes in Gerrit. Mainly you
need to be on the lookout for changes you don't remember
reviewing/approving over the past few weeks, especially if they seem
to have been reviewed and/or approved by your account.
-- 
Jeremy Stanley
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 833 bytes
Desc: not available
URL: <http://lists.starlingx.io/pipermail/starlingx-discuss/attachments/20201021/5346737c/attachment.sig>