Archive release process: Difference between revisions
From MoodleDocs
m (updated for next minor releases) |
m (→See also) |
||
| (9 intermediate revisions by the same user not shown) | |||
| Line 18: | Line 18: | ||
# Determine which security issues will be integrated. | # Determine which security issues will be integrated. | ||
#* Request CVE Identifiers by emailing issue descriptions to [mailto:distros@vs.openwall.org distros@vs.openwall.org] with a message like... <tt> The following security issues have been discovered in Moodle. We request CVE Identifiers for these issues. We will be releasing the security announcements for these on moodle.org on XXX at 12noon AWST which is 04:00 UTC.</tt> The email subject should include the characters '''[vs]'''. The format needs to be plain text or encrypted. When granted CVE Identifiers, our issues should appear in the [http://cve.mitre.org/cve/cve.html CVE list]. More [http://oss-security.openwall.org/wiki/mailing-lists/distros instructions] are available. | #* Request CVE Identifiers by emailing issue descriptions to [mailto:distros@vs.openwall.org distros@vs.openwall.org] with a message like... <tt> The following security issues have been discovered in Moodle. We request CVE Identifiers for these issues. We will be releasing the security announcements for these on moodle.org on XXX at 12noon AWST which is 04:00 UTC.</tt> The email subject should include the characters '''[vs]'''. The format needs to be plain text or encrypted. When granted CVE Identifiers, our issues should appear in the [http://cve.mitre.org/cve/cve.html CVE list]. More [http://oss-security.openwall.org/wiki/mailing-lists/distros instructions] are available. | ||
# Create the next X.Y.Z+1 versions in the Tracker (both MDL and CONTRIB). | |||
===Packaging day=== | ===Packaging day=== | ||
| Line 28: | Line 29: | ||
#* Tag the integration repository with a tag name vX.Y.Z using "MOODLE_XYZ" as a tag message | #* Tag the integration repository with a tag name vX.Y.Z using "MOODLE_XYZ" as a tag message | ||
#* push change to main git repo, github and Gitorious | #* push change to main git repo, github and Gitorious | ||
# | # Wait the automated moodle-package to finish building all the versions. Verify the process has ended ok (email). | ||
# | # Duplicate the download/index.php page and amend it with new release info and links | ||
# Duplicate the download/windows/index.php page and amend it with new release info (always keeping the "+") | |||
# | |||
# Visit releases page on tracker and make the release, bumping all remaining open bugs to the next point release. This must be done both for the [http://tracker.moodle.org/secure/project/ViewProject.jspa?pid=10011 Moodle Project] and the [http://tracker.moodle.org/secure/project/ViewProject.jspa?pid=10033 Non-core contributed modules project]. Archive every released version > 6mo ago. | # Visit releases page on tracker and make the release, bumping all remaining open bugs to the next point release. This must be done both for the [http://tracker.moodle.org/secure/project/ViewProject.jspa?pid=10011 Moodle Project] and the [http://tracker.moodle.org/secure/project/ViewProject.jspa?pid=10033 Non-core contributed modules project]. Archive every released version > 6mo ago. | ||
# Add the release date, build number and link to [[Releases]] | # Add the release date, build number and link to [[Releases]] | ||
# Clone MDL- | # Clone MDL-37491, MDL-37492, MDL-37493 for next minor release X.Y.(Z+1) handling of security issues & security advisories. | ||
# Post | # Post a "git repos updated & tagged" done message on the [http://partners.moodle.com/mod/forum/view.php?id=2 Partner forum] | ||
===Release day=== | ===Release day=== | ||
# Notify all registered sys admins, including security notes with CVE idenifiers. | # Notify all registered sys admins, including security notes with CVE idenifiers. | ||
# Replace the dowload/index.php page with its updated counterpart. | |||
# Replace the dowload/windows/index.php page with its updated counterpart. | |||
# (deprecated) Update the Latest Release block on [http://moodle.org/news/ Moodle.org news] | # (deprecated) Update the Latest Release block on [http://moodle.org/news/ Moodle.org news] | ||
# Post about the release in the [http://moodle.org/news/ moodle.org news] | # Post about the release in the [http://moodle.org/news/ moodle.org news] | ||
| Line 65: | Line 57: | ||
* [[Major release process]] | * [[Major release process]] | ||
* [[Deprecation]] | * [[Deprecation]] | ||
[[Category:Processes|Release process]] | [[Category:Processes|Release process]] | ||
[[Category:Release notes|Release process]] | [[Category:Release notes|Release process]] | ||
Revision as of 03:40, 12 January 2013
This page describes the standard procedures for making Moodle releases.
For a stable release on an existing branch XY with point value Z (eg. X.Y.Z)
One week before
- Notify Moodle developers and Moodle Partners about the upcoming release
- Identify security issues that need to be integrated.
- Integrate from provided patches into supported branches (including branches supported only for security issues).
- Ensure security issues are given priority in weekly integration and testing.
- Freeze stable development and post in the General developer forum to inform everyone of the freeze
- Review and complete the release notes of the upcoming version using the template
- Ensure all issues labelled with "ui_change" or "api_change" are listed as functional or API changes respectively in the release notes.
- Begin preparing the security advisories to be sent on release day.
- Test / QA etc.
During the week prior release
- Normal integration / testing / upstream / weekly cycle. It will constitute, somehow, the "release candidate" to be packaged and released.
- Determine which security issues will be integrated.
- Request CVE Identifiers by emailing issue descriptions to distros@vs.openwall.org with a message like... The following security issues have been discovered in Moodle. We request CVE Identifiers for these issues. We will be releasing the security announcements for these on moodle.org on XXX at 12noon AWST which is 04:00 UTC. The email subject should include the characters [vs]. The format needs to be plain text or encrypted. When granted CVE Identifiers, our issues should appear in the CVE list. More instructions are available.
- Create the next X.Y.Z+1 versions in the Tracker (both MDL and CONTRIB).
Packaging day
This should happen immediately before the next integration cycle begins on Monday (i.e., some days after last weekly, 2 days prior to official release).
- Make sure there are not real blockers introduced by last weekly (install / upgrade ...)
- Make sure all the Unit tests pass!
- Run the mdlrelease process, that will do, for a release:
- Edit version.php, update release and version to new point release and commit in the integration repository
- Tag the integration repository with a tag name vX.Y.Z using "MOODLE_XYZ" as a tag message
- push change to main git repo, github and Gitorious
- Wait the automated moodle-package to finish building all the versions. Verify the process has ended ok (email).
- Duplicate the download/index.php page and amend it with new release info and links
- Duplicate the download/windows/index.php page and amend it with new release info (always keeping the "+")
- Visit releases page on tracker and make the release, bumping all remaining open bugs to the next point release. This must be done both for the Moodle Project and the Non-core contributed modules project. Archive every released version > 6mo ago.
- Add the release date, build number and link to Releases
- Clone MDL-37491, MDL-37492, MDL-37493 for next minor release X.Y.(Z+1) handling of security issues & security advisories.
- Post a "git repos updated & tagged" done message on the Partner forum
Release day
- Notify all registered sys admins, including security notes with CVE idenifiers.
- Replace the dowload/index.php page with its updated counterpart.
- Replace the dowload/windows/index.php page with its updated counterpart.
- (deprecated) Update the Latest Release block on Moodle.org news
- Post about the release in the moodle.org news
One week after release day
- Update the version.php in git to be X.Y.Z+ during the next weekly integration process
- Add all security advisories to Security news and release notes with links to security advisories
- (@todo: integrate the advisories under the CVE advisories standard).
- Create a new release notes page for the next version X.Y.(Z+1) (here you can find one template for that)
- Send a plain text email to the following email list: oss-security@lists.openwall.com An appropriate message when sending the issues is... The following security notifications have now been made public. Thanks to OSS members for their cooperation. ...followed by the security notes.
