1) 389-ds-console 1.2.7 has no tarball though it was tagged for release
in Sep'12

You can download the tar ball from here now.
http://port389.org/sources/389-ds-console-1.2.7.tar.bz2

Cool, thanks. It's a broken tarball though, you forgot '/' after the
version..

tar tvjf 389-ds-console-1.2.7.tar.bz2
drwxrwxr-x root/root         0 2012-09-17 13:03 389-ds-console-1.2.7/
-rw-rw-r-- root/root        35 2012-09-17 13:03 389-ds-console-1.2.7/.gitignore
-rw-rw-r-- root/root      4628 2012-09-17 13:03 389-ds-console-1.2.7/389-ds-console.spec
-rw-rw-r-- root/root     12279 2012-09-17 13:03 389-ds-console-1.2.7/LICENSE
-rwxrwxr-x root/root      1002 2012-09-17 13:03 389-ds-console-1.2.7/build.properties

Also, you still need some way to fix the process of how these links get
to the webpage too :)

2) 389-adminutil 1.1.20 is not tagged in git

Looks like it is, according to
https://git.fedorahosted.org/cgit/389/adminutil.git/

Rich, I cannot see the tag, either...  *puzzled*

    $ git pull
    Already up-to-date.
    $ git tag -l | egrep 389-adminutil
    389-adminutil-1.1.10
    389-adminutil-1.1.11
    389-adminutil-1.1.12
    389-adminutil-1.1.13
    389-adminutil-1.1.14
    389-adminutil-1.1.15
    389-adminutil-1.1.16
    389-adminutil-1.1.17
    389-adminutil-1.1.18
    389-adminutil-1.1.19
    389-adminutil-1.1.8
    389-adminutil-1.1.9

although indeed this page
https://git.fedorahosted.org/cgit/389/adminutil.git/ shows it is... 
Timo, you could download the zip file/tar ball that has the tag from
here.  So, you have no problem to continue your task?

I've used the release tarball and packaging is on 9b3cfced24ffe6e6e from
master, so I'm good.. just wondered why the tag wasn't there but it was.

3) 389-ds-base repo seems to be in limbo, since 1.3.2 branch doesn't
have the latest release, which itself was just 1.3.2.13+ one patch, so
doesn't contain changes from .14 and .15. So which one am I supposed to
push to the distro?

389-ds-base-1.3.2.16 is a security fix only release.  It's branched from
the stable build (1.3.2.13) and it has only the fix.  The tag
389-ds-base-1.3.2.16 tag is on the 389-ds-base-1.3.2-CVE-2014-0132
branch.  Once we finish more testing, we are going back to the normal
branch 389-ds-base-1.3.2.  Sorry about this confusion.

ahh ok, I'll just rebase on .16 then.

Now I see that you have a separate 389-announce list where only the
stable releases get announced.. maybe send those to 389-users too?