looks like whitelisting bots is as easy as filing http://b/78627303 and waiting

Don: can you enumerate the bot accts ?  i know we have chrome-bot@chromium.org, but that's just the git config settings, not the actual service acct.

 Issue 851094  has been merged into this issue.

GCE builders:
  3su6n15k.default@developer.gserviceaccount.com

Golo builders (I think, defined in the .netrc file):
  chromeos-commit-bot@chromium.org

Also, see http://b/111220495

There was some discussion there about new service accounts for GCE in the future.

missed the update from Don

based on b/111220495, it looks like we've got the right accounts whitelisted now in SignCLA.  and going by crbug.com/860584, our chrome bot should be whitelisted for forge access.

i'll try turning on SignCLA in a few repos where we submit in the precq (like docs/) and see how it goes.  that way if it blows up, it should only affect that repo/precq.

i've turned it on for all chromiumos/ repos.  need some config changes before we can turn it on for all chromeos/ repos.

Many SOC partners and ODM partners who had account worked before all failed today. Is there a guide for what they should do?

I'm raising the priority since it's blocking multiple projects for going forward.

And I've get few questions from SOC/ODM partners:

1. Can partner developers keep using their non-PD accounts (which already registered on gerrit before, and works better than PD)?

2. Does the CLA thing need to go through legal process?

3. Do we want partner company to sign just one and then apply for all their developers, or they have to do the process one by one (for individual engineers)?

the default was turned off last nite

everyone has to go through the CLA, no exceptions

For some partners that we know agreements are in place, is there anyway we can white list them?
Thanks.

The CLA should be covered by our existing agreements by my understanding, all the partners we are talking about here should be under an even more inclusive Co-Development agreement.

As such we need a way to mark partner domains that have done so, this is causing a lot of disruption to partners all over.

Raising priority, as this has effectively stopped development for all on going partner projects, we need specific guidance on how to get partners 'CLA-ed' from the source tree's point of view, or we need to turn this back off. 

IMHO, this is probably a bit too late -- may be we could have a PSA upfront so all partners can prepare for it to avoid the disruption?
Thanks.

you need to provide concrete examples of things being blocked.  as i noted earlier, the default enforcement has already been turned off days ago which means no partners are blocked.

#17: There was a PSA sent to chromium-os-dev@ on Sep 18: https://groups.google.com/a/chromium.org/d/topic/chromium-os-dev/-4EMVnqkhVk/discussion

Does that exclude people that should have received it?

I think the problem with that PSA was it was not clear what the impact would be, all of our partners have effectively signed CLAs or we would not be accepting code from them, when I read the PSA it does not suggest that action needs to be taken by partners or by us, since they already have signed CLAs.

So I think it was presumed that all existing partners that have CLAs would be added to the mechanism here before this would be turned on. Since that appears to not be the case, we need to set up the white listing for all active partners. 

If we cannot just white list we need to explain to the partners what else they need to sign, give them a time line to sign it, and tell them what they need to do to be on the list. The partner engineering team can help here as a partner interface but I am not sure what exactly they need to do.

Is there any extra action needed to bind corp. CLA with Legal stuff (https://www.chromium.org/developers/contributing-code#TOC-Legal-stuff)?

Partner is still asked to "Signed a new agreement" even they already have corp. CLA signed.

Since CLA is mandatory per comment 10, when we plan to enable it back? Besides, we would like to know what actions need to be taken to not impact the CrOS repo. commit after CLA check is on.

yes, it will be turned back on for all repos for everyone with no exceptions.  i'm writing a doc, but i'm not going to post it here to the public bug.