Skip to content

Remove sha1 conflicts logging from Maven registry

David Fernandez requested to merge 367356-remove-log-for-tracking into master

🌳 Context

In Maven package registry returning 409 when uploa... (#367356 - closed), an issue was discovered with the Maven Repository: from time to time, a sig file upload would be rejected with conflict!.

In very short words, maven clients will send a file (let's say a .jar) and then, they will send a digest (such as .jar.md5). This second upload is totally ignored by the Maven Repository because we already compute the digest on the first upload. Instead, on this second upload, we compare our computed digest with the digest sent and 💥 if they don't match.

We had reports that sometimes, they would not match for gitlab.com. This issue was very hard to debug and so, we decided to increase logging around these conflict situations in Add logging when there is a maven sha1 conflict (!92532 - merged).

After several investigations, we found out that the culprit was .... 🥁 .... the replica lag. Basically, the second upload would hit the replica but the upload from the first upload would not be there. This situation would messed up the sha1 comparison logic and make it 💥

We fixed the issue with the replica lag in %15.11 and now the logging part can be cleaned up too, which is this MR.

What does this MR do and why?

  • Removes the logging of sha1 conflicts when uploading a file to the Maven Repository
  • Updates the related spec.

I didn't add a CHANGELOG given that the first MR did not have one and I think this change is more of a

Any developer-facing change (such as refactoring, technical debt remediation, or test suite changes) should not have a changelog entry

(https://docs.gitlab.com/ee/development/changelog.html#what-warrants-a-changelog-entry)

📺 Screenshots or screen recordings

n / a

⚙ How to set up and validate locally

See !92532 (merged)

🚥 MR acceptance checklist

This checklist encourages us to confirm any changes have been analyzed to reduce risks in quality, performance, reliability, security, and maintainability.

Edited by David Fernandez

Merge request reports