Archive release process

This page describes the standard procedures for making Moodle releases.

For a stable release on an existing branch XY with point value Z (eg. X.Y.Z)

One week before

Notify Moodle developers and Moodle Partners about the upcoming release
Identify security issues that need to be integrated.
- Integrate from provided patches into supported branches (including branches supported only for security issues).
- Ensure security issues are given priority in weekly integration and testing.
Freeze stable development and post in the General developer forum to inform everyone of the freeze
Review and complete the release notes of the upcoming version using the template
- Ensure all issues labelled with "ui_change" or "api_change" are listed as functional or API changes respectively in the release notes.
Begin preparing the security advisories to be sent on release day.
Test / QA etc.

During the week prior release

Normal integration / testing / upstream / weekly cycle. It will constitute, somehow, the "release candidate" to be packaged and released.
Determine which security issues will be integrated.
- Request CVE Identifiers by emailing issue descriptions to distros@vs.openwall.org with a message like... The following security issues have been discovered in Moodle. We request CVE Identifiers for these issues. We will be releasing the security announcements for these on moodle.org on XXX at 12noon AWST which is 04:00 UTC. The email subject should include the characters [vs]. The format needs to be plain text or encrypted. When granted CVE Identifiers, our issues should appear in the CVE list. More instructions are available.

Packaging day

This should happen immediately before the next integration cycle begins on Monday (i.e., some days after last weekly, 2 days prior to official release).

Make sure there are not real blockers introduced by last weekly (install / upgrade ...)
Make sure all the Unit tests pass!
Run the mdlrelease process, that will do, for a release:
- Edit version.php, update release and version to new point release and commit in the integration repository
- Tag the integration repository with a tag name vX.Y.Z using "MOODLE_XYZ" as a tag message
- push change to main git repo, github and Gitorious
- sync CVS mirror (copy the version.php file and update githash.php to point to the release commit)
- cvs tag -FR MOODLE_XYZ to tag everything in the release
- cvs tag -FR MOODLE_XY_WEEKLY to make the weekly version match the release
cvs -q update -dP all code on download server
Run moodle-makenightlystableXY
Go to download/stableXY
Copy current daily as release package:
- cp moodle-latest-XY.zip moodle-X.Y.Z.zip
- cp moodle-latest-XY.tgz moodle-X.Y.Z.tgz
Edit download index.php page with new release info and links
Run moodle-makewindowspackages so all the windows packages will be rebuilt
Edit download windows/index.php page with new release info (always keeping the "+")
Run SF's mirror script
Visit releases page on tracker and make the release, bumping all remaining open bugs to the next point release. This must be done both for the Moodle Project and the Non-core contributed modules project. Archive every released version > 6mo ago.
Add the release date, build number and link to Releases
Clone MDL-36495, MDL-36496, MDL-36497 for next minor release X.Y.(Z+1) handling of security issues & security advisories.
Post an "advanced release" message on the Partner forum

Release day

Verify packaging has happened.
Notify all registered sys admins, including security notes with CVE idenifiers.
(deprecated) Update the Latest Release block on Moodle.org news
Post about the release in the moodle.org news

One week after release day

Update the version.php in git to be X.Y.Z+ during the next weekly integration process
Add all security advisories to Security news and release notes with links to security advisories
- (@todo: integrate the advisories under the CVE advisories standard).
Create a new release notes page for the next version X.Y.(Z+1) (here you can find one template for that)
Send a plain text email to the following email list: oss-security@lists.openwall.com An appropriate message when sending the issues is... The following security notifications have now been made public. Thanks to OSS members for their cooperation. ...followed by the security notes.

Documentation