ssh: Add git tag push to upgrade instructions

[emaste]

Summary

Tags are not pushed by default.

[lwhsu]

From https://docs.freebsd.org/en/articles/committers-guide/#git-primer 5.4.4 , I think we can use git push --follow-tags freebsd vendor/openssh

[emaste]

In D33605#759409, @lwhsu wrote:

I think we can use git push --follow-tags freebsd vendor/openssh

Interesting, that seems like it would push a bunch of extraneous tags:

$ git push --dry-run --follow-tags freebsd vendor/openssh
To ssh://gitrepo.freebsd.org/src.git
 * [new tag]                   freebsd-main-20201127 -> freebsd-main-20201127
 * [new tag]                   freebsd-main-20201201 -> freebsd-main-20201201
 * [new tag]                   freebsd-main-20201204 -> freebsd-main-20201204
 * [new tag]                   freebsd-main-20201211 -> freebsd-main-20201211
 * [new tag]                   freebsd-main-20201218 -> freebsd-main-20201218
 * [new tag]                   freebsd-main-20201225 -> freebsd-main-20201225
 * [new tag]                   freebsd-main-20210101 -> freebsd-main-20210101
 * [new tag]                   freebsd-main-20210108 -> freebsd-main-20210108
 * [new tag]                   freebsd-main-20210115 -> freebsd-main-20210115
 * [new tag]                   freebsd-main-20210122 -> freebsd-main-20210122
 * [new tag]                   freebsd-main-20210129 -> freebsd-main-20210129
 * [new tag]                   freebsd-main-20210205 -> freebsd-main-20210205
 * [new tag]                   freebsd-main-20210212 -> freebsd-main-20210212
 * [new tag]                   freebsd-main-20210219 -> freebsd-main-20210219
 * [new tag]                   freebsd-main-20210226 -> freebsd-main-20210226
 * [new tag]                   freebsd-main-20210305 -> freebsd-main-20210305
 * [new tag]                   freebsd-main-20210312 -> freebsd-main-20210312
 * [new tag]                   freebsd-main-20210319 -> freebsd-main-20210319
 * [new tag]                   freebsd-main-20210326 -> freebsd-main-20210326
 * [new tag]                   freebsd-main-20210402 -> freebsd-main-20210402
 * [new tag]                   freebsd-main-20210409 -> freebsd-main-20210409
 * [new tag]                   freebsd-main-20210416 -> freebsd-main-20210416
 * [new tag]                   freebsd-main-20210423 -> freebsd-main-20210423
 * [new tag]                   freebsd-main-20210430 -> freebsd-main-20210430
 * [new tag]                   upstream/8.1.0 -> upstream/8.1.0
 * [new tag]                   vendor/libcbor/0.8.0 -> vendor/libcbor/0.8.0
 * [new tag]                   vendor/libfido2/1.8.0 -> vendor/libfido2/1.8.0

This includes tags that are not anywhere on the vendor/openssh branch. The final two tags should be in the upstream repo (as part of the libfido2/libcobr vendor imports). I'm not sure about the upstream/8.1.0 tag. I believe the freebsd-main-20xxxxxx tags came via CHERI.

It is possible that these are somehow an artifact of --dry-run, which does not connect to the server and is entirely client side, but it is surprising to me that tags outside of the given branch would be found.

[emaste]

commit 9adee7d03f2e4c91e6330410f88fb5addaf2a24a (tag: upstream/8.1.0, tag: release/8.1.0)
Author: Ken Smith <[e-mail]>
Date:   Sat Jul 17 04:36:40 2010 +0000

    Ready for 8.1-RELEASE builds.
    
    Approved by:    re (implicit)

Notes:
    svn path=/releng/8.1/; revision=210187
    svn path=/release/8.1.0/; revision=210188; tag=release/8.1.0

[emaste]

@lwhsu @imp any comment on git push --follow-tags seemingly pushing undesired tags?
(We may want to update the git primer if this is indeed an issue that needs to be worked around.)

[imp]

@lwhsu @imp any comment on git push --follow-tags seemingly pushing undesired tags?

It doesn't push undesirable tags. It only pushes annotated (including signed) tags. I have dozens of tags in my tree that it won't push when I do a vendor update when I follow the instructions to push the tag like this. I'm unsure why --dry-run is tagging them.

[emaste]

The freebsd-main-XXXXXXXX tags in my --dry-run are annotated tags

[emaste]

e.g.

tag freebsd-main-20201127
Tagger: Brooks Davis <[e-mail]>
Date:   Fri Oct 1 18:28:03 2021 +0100

FreeBSD main November 27, 2020

commit a36179937e7e768d1840896ac1ea13ba6f118a09 (tag: freebsd-main-20201127)
Author: Ed Maste <[e-mail]>
Date:   Fri Nov 27 21:38:03 2020 +0000

    addr2line: add label checks when DW_AT_range and DW_AT_low_pc cannot be used
    
    Check label's ranges for address we want to translate if a CU doesn't
    have usable DW_AT_range or DW_AT_low_pc.
    
    Use more appropriate names: "struct CU" -> "struct range"
    
    Developed as part of upstream ELF Tool Chain bug report
    https://sourceforge.net/p/elftoolchain/tickets/552/ although this does
    not address the specific case reported there.
    
    Submitted by:   Tiger Gao <[e-mail]>
    MFC after:      1 month
    Sponsored by:   The FreeBSD Foundation
    Differential Revision:  https://reviews.freebsd.org/D23782

Notes:
    svn path=/head/; revision=368114

from git docs:

--follow-tags

Push all the refs that would be pushed without this option, and also push annotated tags in refs/tags that are missing from the remote but are pointing at commit-ish that are reachable from the refs being pushed.

So I think this does include undesired annotated tags that exist in the local repo.

[emaste]

In D33605#762436, @emaste wrote:

So I think this does include undesired annotated tags that exist in the local repo.

Oh, wait - I don't think any of those should be reachable from "the refs being pushed" which should be only ones in vendor/openssh.

@imp could you try --dry-run and see if additional tags are listed?