How to perform security fixes
From Wikitech
(Difference between revisions)
(HEAD^ not HEAD) |
|||
| (7 intermediate revisions by one user not shown) | |||
| Line 5: | Line 5: | ||
== Steps == | == Steps == | ||
=== 1: Commit === | === 1: Commit === | ||
| − | Locally (on your workstation) check out the currently relevant wmf branch(es). Write the fix there and test it. Then commit to your local | + | Locally (on your workstation) check out the currently relevant wmf branch(es). Write the fix there and test it. Then commit to your local topic branch. You also may want to check if this commit applies cleanly to the other active wmf branch (if there is two, there is usually two, e.g. wmf/1.20wmf9 and wmf/1.20wmf10), so you're prepared to handle the merge conflict later on. |
| − | '''Note:''' | + | '''Note:''' Commits (especially security related ones) should, of course, always add release notes! |
<pre> | <pre> | ||
| + | # Create a topic branch | ||
| + | jdoe@laptop:~/Dev/mediawiki/core$ git checkout -b fix-my-bug master | ||
| + | |||
| + | # Fix the security bug | ||
| + | |||
# Add the file (or files) to the staging area | # Add the file (or files) to the staging area | ||
| − | jdoe@laptop:~/Dev/mediawiki/core$ git add path/to/file.php RELEASE-NOTES-1.20 | + | jdoe@laptop:~/Dev/mediawiki/core (fix-my-bug)$ git add path/to/file.php RELEASE-NOTES-1.20 |
# Confirm your stage contains what you want to do commit (no more, no less) | # Confirm your stage contains what you want to do commit (no more, no less) | ||
| − | jdoe@laptop:~/Dev/mediawiki/core$ git status | + | jdoe@laptop:~/Dev/mediawiki/core (fix-my-bug)$ git status |
| − | jdoe@laptop:~/Dev/mediawiki/core$ git commit | + | jdoe@laptop:~/Dev/mediawiki/core (fix-my-bug)$ git commit |
</pre> | </pre> | ||
| Line 22: | Line 27: | ||
<pre> | <pre> | ||
# Convert the commit to a git patch file | # Convert the commit to a git patch file | ||
| − | jdoe@laptop:~/Dev/mediawiki/core$ git format-patch HEAD --stdout > ~/fix-my-bug.patch | + | jdoe@laptop:~/Dev/mediawiki/core (fix-my-bug)$ git format-patch HEAD^ --stdout > ~/fix-my-bug.patch |
# Copy it to your home directory on fenari (scp defaults: protocol=ssh, username=local username, target directory=home directory) | # Copy it to your home directory on fenari (scp defaults: protocol=ssh, username=local username, target directory=home directory) | ||
| − | jdoe@laptop:~/Dev/mediawiki/core$ scp ~/fix-my-bug.patch fenari.wikimedia.org | + | jdoe@laptop:~/Dev/mediawiki/core (fix-my-bug)$ scp ~/fix-my-bug.patch fenari.wikimedia.org |
# Log into fenari and go to the git dir | # Log into fenari and go to the git dir | ||
jdoe@laptop:~/Dev/mediawiki/core$ ssh fenari.wikimedia.org | jdoe@laptop:~/Dev/mediawiki/core$ ssh fenari.wikimedia.org | ||
jdoe@fenari:~$ cd /h/w/common/php-1.20wmf10 | jdoe@fenari:~$ cd /h/w/common/php-1.20wmf10 | ||
| − | jdoe@fenari:/h/w/common/php-1.20wmf10$ git | + | # Sign off uses your .gitconfig (on fenari) to determine name and e-mail address. |
| + | jdoe@fenari:/h/w/common/php-1.20wmf10 (wmf/1.20wmf10)$ git am --signoff < ~/fix-my-bug.patch | ||
| − | |||
</pre> | </pre> | ||
| − | You may want to verify at this point that the bug is fixed on [[test.wikipedia.org]]. | + | * If there are other active branches, apply the patch there as well (see [[mw:MediaWiki_1.20/Roadmap#Timeline|roadmap]]). |
| + | * You may want to verify at this point that the bug is fixed on [[test.wikipedia.org]]. | ||
=== 3: Deploy === | === 3: Deploy === | ||
: See also [[How to deploy code]] | : See also [[How to deploy code]] | ||
<pre> | <pre> | ||
| − | jdoe@fenari:/h/w/common$ sync-file php-1.20wmf10/path/to/file.php ' | + | jdoe@fenari:/h/w/common$ sync-file php-1.20wmf10/path/to/file.php 'Deploy security fix' |
</pre> | </pre> | ||
| Line 50: | Line 56: | ||
# Commit to the wmf branch in gerrit. Especially important because the clone on fenari is | # Commit to the wmf branch in gerrit. Especially important because the clone on fenari is | ||
# now 1 commit ahead of the gerrit repository | # now 1 commit ahead of the gerrit repository | ||
| − | jdoe@laptop:~/Dev/mediawiki/core$ git push gerrit HEAD:refs/for/wmf/1.20wmf10 | + | jdoe@laptop:~/Dev/mediawiki/core (fix-my-bug)$ git push gerrit HEAD:refs/for/wmf/1.20wmf10 |
# Creates new gerrit change, self-merge this one through the web interface | # Creates new gerrit change, self-merge this one through the web interface | ||
# Okay, since it is already deployed anyway. | # Okay, since it is already deployed anyway. | ||
# Now for the release. First to master. | # Now for the release. First to master. | ||
| − | jdoe@laptop:~/Dev/mediawiki/core ( | + | jdoe@laptop:~/Dev/mediawiki/core (fix-my-bug)$ git push gerrit HEAD:refs/for/master |
| − | jdoe@laptop:~/Dev/mediawiki/core ( | + | |
| − | + | # Make note of the git commit hash | |
| − | + | jdoe@laptop:~/Dev/mediawiki/core (fix-my-bug)$ git show HEAD --stat | |
# Then to the other release branch(es). | # Then to the other release branch(es). | ||
| − | jdoe@laptop:~/Dev/mediawiki/core ( | + | jdoe@laptop:~/Dev/mediawiki/core (fix-my-bug)$ git checkout -b fix-my-bug/REL1_19 gerrit/REL1_19 |
| − | jdoe@laptop:~/Dev/mediawiki/core (REL1_19)$ git cherry-pick 9023aa2d830029da5745e92212f03ddbc71da4c2 | + | jdoe@laptop:~/Dev/mediawiki/core (fix-my-bug/REL1_19)$ git cherry-pick 9023aa2d830029da5745e92212f03ddbc71da4c2 |
# Make sure to update the release notes properly (probably causes a conflict, either way update the right file) | # Make sure to update the release notes properly (probably causes a conflict, either way update the right file) | ||
| − | jdoe@laptop:~/Dev/mediawiki/core (REL1_19)$ git add RELEASE-NOTES-1.19 | + | jdoe@laptop:~/Dev/mediawiki/core (fix-my-bug/REL1_19)$ git add RELEASE-NOTES-1.19 |
| − | jdoe@laptop:~/Dev/mediawiki/core (REL1_19)$ git commit --amend | + | jdoe@laptop:~/Dev/mediawiki/core (fix-my-bug/REL1_19)$ git commit --amend |
| − | jdoe@laptop:~/Dev/mediawiki/core (REL1_19)$ git push gerrit HEAD:refs/for/REL1_19 | + | jdoe@laptop:~/Dev/mediawiki/core (fix-my-bug/REL1_19)$ git push gerrit HEAD:refs/for/REL1_19 |
# Creates a new gerrit change for each push. Merge as appropiate. | # Creates a new gerrit change for each push. Merge as appropiate. | ||
Latest revision as of 00:28, 6 September 2012
Contents |
This is a brief guide on how to perform security fixes. From commit draft to minor release.
[edit] Steps
[edit] 1: Commit
Locally (on your workstation) check out the currently relevant wmf branch(es). Write the fix there and test it. Then commit to your local topic branch. You also may want to check if this commit applies cleanly to the other active wmf branch (if there is two, there is usually two, e.g. wmf/1.20wmf9 and wmf/1.20wmf10), so you're prepared to handle the merge conflict later on.
Note: Commits (especially security related ones) should, of course, always add release notes!
# Create a topic branch jdoe@laptop:~/Dev/mediawiki/core$ git checkout -b fix-my-bug master # Fix the security bug # Add the file (or files) to the staging area jdoe@laptop:~/Dev/mediawiki/core (fix-my-bug)$ git add path/to/file.php RELEASE-NOTES-1.20 # Confirm your stage contains what you want to do commit (no more, no less) jdoe@laptop:~/Dev/mediawiki/core (fix-my-bug)$ git status jdoe@laptop:~/Dev/mediawiki/core (fix-my-bug)$ git commit
[edit] 2: Apply on fenari
# Convert the commit to a git patch file jdoe@laptop:~/Dev/mediawiki/core (fix-my-bug)$ git format-patch HEAD^ --stdout > ~/fix-my-bug.patch # Copy it to your home directory on fenari (scp defaults: protocol=ssh, username=local username, target directory=home directory) jdoe@laptop:~/Dev/mediawiki/core (fix-my-bug)$ scp ~/fix-my-bug.patch fenari.wikimedia.org # Log into fenari and go to the git dir jdoe@laptop:~/Dev/mediawiki/core$ ssh fenari.wikimedia.org jdoe@fenari:~$ cd /h/w/common/php-1.20wmf10 # Sign off uses your .gitconfig (on fenari) to determine name and e-mail address. jdoe@fenari:/h/w/common/php-1.20wmf10 (wmf/1.20wmf10)$ git am --signoff < ~/fix-my-bug.patch
- If there are other active branches, apply the patch there as well (see roadmap).
- You may want to verify at this point that the bug is fixed on test.wikipedia.org.
[edit] 3: Deploy
- See also How to deploy code
jdoe@fenari:/h/w/common$ sync-file php-1.20wmf10/path/to/file.php 'Deploy security fix'
[edit] 4: Push to gerrit & make release
- Todo: These could be moved to a generic "Backport and do a minor release" how-to page, then put a link here.
[edit] Push to gerrit
# Commit to the wmf branch in gerrit. Especially important because the clone on fenari is # now 1 commit ahead of the gerrit repository jdoe@laptop:~/Dev/mediawiki/core (fix-my-bug)$ git push gerrit HEAD:refs/for/wmf/1.20wmf10 # Creates new gerrit change, self-merge this one through the web interface # Okay, since it is already deployed anyway. # Now for the release. First to master. jdoe@laptop:~/Dev/mediawiki/core (fix-my-bug)$ git push gerrit HEAD:refs/for/master # Make note of the git commit hash jdoe@laptop:~/Dev/mediawiki/core (fix-my-bug)$ git show HEAD --stat # Then to the other release branch(es). jdoe@laptop:~/Dev/mediawiki/core (fix-my-bug)$ git checkout -b fix-my-bug/REL1_19 gerrit/REL1_19 jdoe@laptop:~/Dev/mediawiki/core (fix-my-bug/REL1_19)$ git cherry-pick 9023aa2d830029da5745e92212f03ddbc71da4c2 # Make sure to update the release notes properly (probably causes a conflict, either way update the right file) jdoe@laptop:~/Dev/mediawiki/core (fix-my-bug/REL1_19)$ git add RELEASE-NOTES-1.19 jdoe@laptop:~/Dev/mediawiki/core (fix-my-bug/REL1_19)$ git commit --amend jdoe@laptop:~/Dev/mediawiki/core (fix-my-bug/REL1_19)$ git push gerrit HEAD:refs/for/REL1_19 # Creates a new gerrit change for each push. Merge as appropiate.
[edit] Make release
- TODO: Something with
make-releasefrom mediawiki/tools/release.git
