Comment 6 for bug 1044695

That would be:

  $> git push gerrit :refs/tags/0.1.2
  $> git tag -d 0.1.2
  $> git tag -s 0.1.2 dec8f77
  $> git push gerrit tag 0.1.2

i.e. signed tag, not annotated