Warning |
---|
This version is outdated! Work-in-progress! |
Content
Table of Contents | ||||||
---|---|---|---|---|---|---|
|
Building Steps (Struts)
Getting ready
- Prepare new Security Bulletin - use just brief description about the security vulnerability, no examples, no proof-of-concept, anything that could be used against users, secure the page to allow access only member of struts-committers group in Confluence
- Create a new Version Notes page in Confluence, link from Migration Guide, and link to prior release page and JIRA DONE filters of the version to release, secure the page to allow access only member of struts-committers group in Confluence
When a serious security issue arises, we should try to create a
STRUTS#STRUTS_#_#_#_X
branch from the last GA release (from tag - check it out and usemvn release:branch
as below).No Format svn co https://svn.apache.org/repos/asf/struts/struts2/tags/STRUTS_#_#_# cd STRUTS_#_#_# mvn release:branch -DbranchName=STRUTS_#_#_#_X -DupdateBranchVersions=true -DupdateWorkingCopyVersions=false -DautoVersionSubmodules=true
Read the maven release:branch docs for further details or alternatively
- Apply ), and apply to that branch only the security patch
- Commit the security patchfix. No reference should be make to the commit being related to a security vulnerability.
- If the patch first applies to some other dependency, implore the other group to do the same, to avoid side-effects from other changes.
- Release the upcoming version in JIRA (under Administration/Manage Releases) and tag the release date
- Create DONE and TODO filters for the new version, share with all, and remove obsolete TODO filter
- Create a new Version Notes page in Confluence, link from Migration Guide, and link to prior release page and JIRA DONE filters of the version to release
Note |
---|
Before starting release process make sure that the Docs were exported to https://cwiki.apache.org/WW/! Check the Version Notes page! |
Obtain a fresh checkout.
Code Block |
---|
svn co https://svn.apache.org/repos/asf/struts/struts2/branches/STRUTS_#_#_#_X STRUTS_#_#_X
|
Change site target
Edit the top pom.xml file and replace 2.x the url below with version number that's going to be released
...
<distributionManagement>
<site>
<id>apache-site</id>
<url>scp://people.apache.org/www/struts.apache.org/2.x/</url>
</site>
</distributionManagement>
Info | ||
---|---|---|
| ||
If needed, you can use Versions Maven Plugin to set -SNAPSHOT version in all poms, like below:
|
Update version of archetypes
Edit src/site/resources/archetype-catalog.xml
and change version of archetypes to current $VERSION, save and commit.
Apply security patch
Apply and commit security patch.commit the change
Prepare release
Tag the release by using the "{{release:prepare" goal }} goal of Maven:
Code Block |
---|
mvn release:prepare -Dusername=yourSvnUsername -Dpassword=yourSvnPassword -DautoVersionSubmodules=true |
For a dry run, add '-DdryRun=true'. If you do a dry run, use 'mvn release:clean' to clean up after you have looked at the output.unmigrated-wiki-markup
When prompted for the SCM tag name, follow this pattern: {{ STRUTS_2_3_\[PATCH_VERSION\]}}
Note |
---|
For some reason, when using svn client 1.5, the release plugin might fail to tag the release, if it fails, run: |
This step will (more information):
...
Perform the release
Code Block |
---|
mvn release:perform -Dusername=yourSvnUsername
|
...
- Checkout from an SCM URL with optional tag
- Run the predefined Maven goals to release the project (by default, deploy site-deploy)
Info |
---|
N.B.: this step takes a long time (about 2 hours with a broadband connection) |
After this step the artifacts will be hosted by Nexus
If you need to run perform again, (or in a different box), do:
Code Block |
---|
svngit coclone httphttps://svngit-wip-us.apache.org/repos/asf/struts/struts2/tags/.git git checkout $VERSION cd $VERSION mvn deploy site-deploy --no-plugin-updates -DperformRelease=true |
...
After closing repository in Nexus, you must obtain the url where the assemblies are stored, it looks like check if the version is available from staging repository as below:
Code Block |
---|
https://repository.apache.org/content/repositoriesgroups/orgapachestruts-300staging/org/apache/struts/struts2-assembly/$VERSION/ |
extract $REPOID, in the above example it's orgapachestruts-300.
In order to move the assemblies login to people.apache.org and execute the following code:
Code Block | ||||
---|---|---|---|---|
| ||||
#!/bin/sh # create the destination directory mkdir $VERSION cd $VERSION # get the distro wget -erobots=off -nv -l 1 --accept=zip,md5,sha1,asc -r --no-check-certificate -nd -nH https://repository.apache.org/content/repositoriesgroups/$REPOIDstaging/org/apache/struts/struts2-assembly/$VERSION # rename files for f in *2-assembly*.zip* do mv $f `echo $f | sed s/2-assembly//g` done # remove unneeded files for f in struts2-assembly-*.pom* do rm $f done # remove unneeded hashes rm *.asc.md5 rm *.asc.sha1 |
After that move the assemblies directory to the builds destination with
Code Block |
---|
mv $VERSION /www/people.apache.org/builds/struts/
|
...
Post a release/quality vote to the dev list (and only the dev list). The example mail is on Sample Announcements page.
...
announcements page. Include the term "fast-track"
...
in
...
the
...
subject,
...
as: [VOTE
...
]
...
Struts
...
2.0.9.1
...
quality
...
(fast
...
track)
...
.
Copy files
After the vote, if the distribution is being mirrored (there was a favourable release vote) copy the Sources and Binaries:
Code Block |
---|
ssh people.apache.org
cd /www/people.apache.org/builds/struts/$VERSION
cp struts-$VERSION-src.* /www/www.apache.org/dist/struts/source
cp struts-$VERSION-docs.* /www/www.apache.org/dist/struts/documentation
cp struts-$VERSION-lib.* /www/www.apache.org/dist/struts/library
cp struts-$VERSION-apps.* /www/www.apache.org/dist/struts/examples
cp struts-$VERSION-all.* /www/www.apache.org/dist/struts/binaries
|
If a new DTD was defined, copy it to /www/struts.apache.org/dtds/ and change permission to struts group (chwon chown :struts *.dtd) and write rights (chmod g+w *.dtd).
...
Remove the old files from under /www/www.apache.org/dist/struts/ to synchronize only the latest version with peers. All the files from /www/www.apache.org/dist/ are always mirrored to http://archive.apache.org/dist/struts/
Wait for rsync
...
If the release will fix a - hopefully yet undisclosed - security issue, it's now time to update the Security Bulletins page and add a new announcement. For a template, just check former announcements
Update site (Struts 2 site)
Code Block |
---|
ssh people.apache.org
export VERSION=2.#.#
unzip /www/people.apache.org/builds/struts/$VERSION/struts-$VERSION-docs.zip -d ~/docs
#now the docs are under ~/docs/struts-$VERSION/docs
mkdir -p /www/struts.apache.org/$VERSION
mv ~/docs/struts-$VERSION/docs/* /www/struts.apache.org/$VERSION
chmod -R g+w /www/struts.apache.org/$VERSION
|
Edit /www/struts.apache.org/$VERSION/archetype-catalog.xml and update the version of artifacts
Update site (Struts top level site)
Check out site src code
Code Block svn co https://svn.apache.org/repos/asf/struts/site/ struts-site
- Update xml files
- struts-site/src/site/xdoc/announce.xml (if applicable, refer also to corresponding security bulletin)
- struts-site/src/site/xdoc/downloads.xml (remove previous version)
- struts-site/src/site/xdoc/download.xml (remove previous version)
- struts-site/src/site/xdoc/index.xml
- struts-site/src/site/site.xml
- Commit the changes
- Generate the site
mvn site:siteCode Block - struts-site/
- src/site/resources/
- Deploy site
It takes a few hours for the site changes to go liveCode Block mvn site-deploy
Rollback site target
Revert back the site target to 2.x and commit the change
Permissions
After updating the site, be sure that the permissions are set to group writeable ($ chmod -R g+w .
)
Post announcements
We leave this as the last step, once the artifacts have had time to sync up on the mirrors. Target it to: user@struts.a.o and announcements@struts.a.o, samples are available at Sample announcements page
Fast-Tracking an Important Security Release
- In the vote message, specify voting terms like:
- archetype-catalog.xml
- Commit the changes
- Got to Struts Staging and review the changes
- If everything is ok, push changes to Production via Apache CMS web interface
Update site (Struts 2 site)
Use below script to perform update
Code Block |
---|
#!/bin/sh
# script used to update struts2-subsite after release
VERSION=2.3.15
BRANCH=2.3.x
TAG=STRUTS_2_3_15
svn co https://svn.apache.org/repos/infra/websites/production/struts/content/ struts-site
svn co https://svn.apache.org/repos/asf/struts/struts2/tags/$TAG/ $TAG
wget -erobots=off |
No Format |
The Struts #.#.#.# test build is now available. Release notes: * [http://struts.apache.org/2.x/docs/release-notes-####.html] Distribution: * [http://people.apache.org/builds/struts/#.#.#.#/] Maven 2 staging repository: * [http://people.apache.org/builds/struts/#.#.#.#/m2-staging-repository/] Once you have had a chance to review the test build, please respond with a vote on its quality: [ ] Leave at test build [ ] Alpha [ ] Beta [ ] General Availability (GA) Everyone who has tested the build is invited to vote. Votes by PMC members are considered binding. A vote passes if there are at least three binding +1s and more +1s than -1s. This is a "fast-track" release vote. If we have a positive vote after 24 hours (at least three binding +1s and more +1s than -1s), the release may be submitted for mirroring and announced to the usual channels. The website download link will include the mirroring timestamp parameter [1], which limits the selection of mirrors to those that have been refreshed since the indicated time and date. (After 24 hours, we \*must\* remove the timestamp parameter from the website link, to avoid unnecessary server load.) In the case of a fast-track release, the email announcement will not link directly to <download.cgi>, but to <downloads.html>, so that we can control use of the timestamp parameter. [1] <[http://apache.org/dev/mirrors.html#use|http://apache.org/dev/mirrors.html#use]> $VERSION/struts-$VERSION-docs.zip unzip struts-$VERSION-docs.zip -d docs rm -r struts-site/release/$BRANCH/docs rm -r struts-site/release/$BRANCH/struts2-core rm -r struts-site/release/$BRANCH/struts2-plugins rm -r struts-site/release/$BRANCH/xwork-core mv -f docs/struts-$VERSION/docs/* struts-site/release/$BRANCH cd $TAG mvn site:site site:stage -DstagingDirectory=../struts-site/release/$BRANCH cd ../struts-site svn add --force ./ # Delete removed files svn st | grep '^!' | awk '{print $2}' | xargs svn delete --force svn commit -m "Updates Struts2 subsite after release process" cd .. rm -r struts-site rm -r $TAG rm -r docs rm struts-$VERSION-docs.zip |
Post announcements
We leave this as the last step, once the artifacts have had time to sync up on the mirrors.
Announce the release and the vulnerability. Typically this will be sent to the reporter, the project's users list (user@struts.a.o), the project's dev list (dev@struts.a.o), the project's announce list (announcements@struts.a.o), security@apache.org, full-disclosure@lists.grok.org.uk and bugtraq@securityfocus.com.
Samples are available at Sample announcements pagePlease be sure to update Security Bulletins accordingly as described above.