You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@roller.apache.org by sn...@apache.org on 2026/09/24 22:21:07 UTC
(roller-website) branch asf-site updated: Roller 6.1.6 is best available; add project security page
This is an automated email from the ASF dual-hosted git repository.
asf-gitbox-commits pushed a commit to branch asf-site
in repository https://gitbox.apache.org/repos/asf/roller-website.git
The following commit(s) were added to refs/heads/asf-site by this push:
new 1fb7994 Roller 6.1.6 is best available; add project security page
1fb7994 is described below
commit 1fb7994f7919bcfb31d4c11597e061b9ec32d911
Author: David M. Johnson <sn...@users.noreply.github.com>
AuthorDate: Thu Sep 24 18:14:53 2026 -0400
Roller 6.1.6 is best available; add project security page
---
content/downloads/downloads.html | 11 ++++---
content/getinvolved/edit_website.html | 3 +-
content/index.html | 1 +
content/project/whoweare.html | 3 +-
.../{downloads/downloads.html => security.html} | 36 +++++++++-------------
.../src/main/jbake/content/downloads/downloads.md | 8 ++---
sources/src/main/jbake/content/security.md | 28 +++++++++++++++++
sources/src/main/jbake/templates/header.ftl | 1 +
8 files changed, 58 insertions(+), 33 deletions(-)
diff --git a/content/downloads/downloads.html b/content/downloads/downloads.html
index 661cecd..dd32d93 100644
--- a/content/downloads/downloads.html
+++ b/content/downloads/downloads.html
@@ -52,6 +52,7 @@
</ul>
</li>
<li class="nav-item"><a class="nav-link" href="/downloads/downloads.html">Download</a></li>
+ <li class="nav-item"><a class="nav-link" href="/security.html">Security</a></li>
<li class="nav-item dropdown">
<a href="#" class="nav-link dropdown-toggle" data-bs-toggle="dropdown">ASF</a>
<ul class="dropdown-menu">
@@ -75,14 +76,14 @@
<div class="container">
<h1>Downloads</h1>
- <p><h2>Apache Roller Releases</h2>
+ <p><h2>Apache Roller Releases</h2>
<p>Releases of the Apache Roller blog server are made available to the general public at no charge, under the <a href="http://apache.org/licenses/">Apache License,</a> in both binary and source distributions.</p>
<h3>General Availability (GA) Releases</strong> - <em>Ready for Prime Time!</em></h3>
-<p><strong><a href="http://www.apache.org/dyn/closer.cgi/roller/roller-6.1/v6.1.5">Roller 6.1.5</a> ("best available")</strong></p>
+<p><strong><a href="https://www.apache.org/dyn/closer.cgi/roller/roller-6.1/v6.1.6">Roller 6.1.6</a> ("best available")</strong></p>
<p>Previous source and binary distributions, including documentation, are available in the <a class="external" href="http://archive.apache.org/dist/roller/">Apache archives</a>.</p>
<p>Project releases are approved by vote of the Apache Roller Project Management Committee (PMC). Support for a release is provided by project volunteers on the project <a href="https://cwiki.apache.org/confluence/display/ROLLER/How+to+ask+for+help">mailing lists</a>. Bugs found in a release may be discussed on the list and reported through the <a href="https://issues.apache.org/jira/browse/ROL">issue tracker</a>. The user mailing list and issue tracker are the <strong>only</strong> supp [...]
-<p>Note: When downloading from a mirror, be sure to verify that checksums and/or signatures are correct. To do so, use the checksum and signature files from the main Apache site at <a class="external" href="http://www.apache.org/dist/roller/"><a href="http://www.apache.org/dist/roller/">http://www.apache.org/dist/roller/</a></a>.</p>
-<p>The PGP signatures can be verified using PGP or GPG. First download the <a href="http://www.apache.org/dist/roller/KEYS">KEYS</a> as well as the <code>asc</code> signature file for the particular distribution. Make sure you get these files from the <a href="http://www.apache.org/dist/roller/">main distribution directory,</a> rather than from a mirror. Then verify the signatures using <code>pgpk</code> as follows:</p>
+<p>Note: When downloading from a mirror, be sure to verify that checksums and/or signatures are correct. To do so, use the checksum and signature files from the main Apache distribution site at <a class="external" href="https://downloads.apache.org/roller/">downloads.apache.org/roller</a>.</p>
+<p>The PGP signatures can be verified using PGP or GPG. First download the <a href="https://downloads.apache.org/roller/KEYS">KEYS</a> as well as the <code>asc</code> signature file for the particular distribution. Make sure you get these files from the <a href="https://downloads.apache.org/roller/">main distribution directory,</a> rather than from a mirror. Then verify the signatures using <code>pgpk</code> as follows:</p>
<pre><code>% pgpk -a KEYS
% pgpv ${filename}.tar.gz.asc
</code></pre>
@@ -94,7 +95,7 @@
<pre><code>% gpg --import KEYS
% gpg --verify ${filename}.tar.gz.asc
</code></pre>
-<p>Alternatively you can also verify the SHA256 checksum for each file. Apache Open Office provides a nice guide to verifying checksum here <a href="https://www.openoffice.org/download/checksums.html">How to verify the integrity of the downloaded file?</a></p>
+<p>Alternatively you can also verify the SHA-256 or SHA-512 checksum for each file (Roller 6.1.6 ships both, as <code>.sha256</code> and <code>.sha512</code> files). Apache Open Office provides a nice guide to verifying checksum here <a href="https://www.openoffice.org/download/checksums.html">How to verify the integrity of the downloaded file?</a></p>
<p>If you want to build directly from the sources, please check the <a href="https://cwiki.apache.org/confluence/display/ROLLER/How+to+build+Roller">Project Wiki</a>.</p>
</p>
</div>
diff --git a/content/getinvolved/edit_website.html b/content/getinvolved/edit_website.html
index a3a75a1..442fed0 100644
--- a/content/getinvolved/edit_website.html
+++ b/content/getinvolved/edit_website.html
@@ -52,6 +52,7 @@
</ul>
</li>
<li class="nav-item"><a class="nav-link" href="/downloads/downloads.html">Download</a></li>
+ <li class="nav-item"><a class="nav-link" href="/security.html">Security</a></li>
<li class="nav-item dropdown">
<a href="#" class="nav-link dropdown-toggle" data-bs-toggle="dropdown">ASF</a>
<ul class="dropdown-menu">
@@ -75,7 +76,7 @@
<div class="container">
<h1>Edit Website</h1>
- <p><p>The Roller website is generated using <a href="http://jbake.org">JBake</a> and Maven. Content is written in <a href="http://daringfireball.net/projects/markdown/syntax">Markdown</a>. Page layouts are written in HTML within <a href="http://freemarker.org">FreeMarker</a> template files. The HTML uses the Bootstrap framework. The website is stored in a Git repository and when you push your changes to the asf_site branch, after a short delay, the changes will go live on the web [...]
+ <p><p>The Roller website is generated using <a href="http://jbake.org">JBake</a> and Maven. Content is written in <a href="http://daringfireball.net/projects/markdown/syntax">Markdown</a>. Page layouts are written in HTML within <a href="http://freemarker.org">FreeMarker</a> template files. The HTML uses the Bootstrap framework. The website is stored in a Git repository and when you push your changes to the asf_site branch, after a short delay, the changes will go live on the website.</p>
<h2>Prerequisites</h2>
<p>This page is not a tutorial. To update the website you will have to understand how JBake, Markdown and possibly HTML and Bootstrap work. Refer to the links above for documentation on those topics. You'll also need this software installed on your machine to update the website:</p>
<ul>
diff --git a/content/index.html b/content/index.html
index 048eaf2..1ad72f5 100644
--- a/content/index.html
+++ b/content/index.html
@@ -52,6 +52,7 @@
</ul>
</li>
<li class="nav-item"><a class="nav-link" href="/downloads/downloads.html">Download</a></li>
+ <li class="nav-item"><a class="nav-link" href="/security.html">Security</a></li>
<li class="nav-item dropdown">
<a href="#" class="nav-link dropdown-toggle" data-bs-toggle="dropdown">ASF</a>
<ul class="dropdown-menu">
diff --git a/content/project/whoweare.html b/content/project/whoweare.html
index b8c52c1..928ec06 100644
--- a/content/project/whoweare.html
+++ b/content/project/whoweare.html
@@ -52,6 +52,7 @@
</ul>
</li>
<li class="nav-item"><a class="nav-link" href="/downloads/downloads.html">Download</a></li>
+ <li class="nav-item"><a class="nav-link" href="/security.html">Security</a></li>
<li class="nav-item dropdown">
<a href="#" class="nav-link dropdown-toggle" data-bs-toggle="dropdown">ASF</a>
<ul class="dropdown-menu">
@@ -75,7 +76,7 @@
<div class="container">
<h1>Who we are</h1>
- <p><h2>Roller Committers</h2>
+ <p><h2>Roller Committers</h2>
<p>The current Roller committer list (* = PMC member):</p>
<ul>
<li>Aditya Sharma</li>
diff --git a/content/downloads/downloads.html b/content/security.html
similarity index 66%
copy from content/downloads/downloads.html
copy to content/security.html
index 661cecd..a57b414 100644
--- a/content/downloads/downloads.html
+++ b/content/security.html
@@ -52,6 +52,7 @@
</ul>
</li>
<li class="nav-item"><a class="nav-link" href="/downloads/downloads.html">Download</a></li>
+ <li class="nav-item"><a class="nav-link" href="/security.html">Security</a></li>
<li class="nav-item dropdown">
<a href="#" class="nav-link dropdown-toggle" data-bs-toggle="dropdown">ASF</a>
<ul class="dropdown-menu">
@@ -74,28 +75,19 @@
<div class="container">
- <h1>Downloads</h1>
- <p><h2>Apache Roller Releases</h2>
-<p>Releases of the Apache Roller blog server are made available to the general public at no charge, under the <a href="http://apache.org/licenses/">Apache License,</a> in both binary and source distributions.</p>
-<h3>General Availability (GA) Releases</strong> - <em>Ready for Prime Time!</em></h3>
-<p><strong><a href="http://www.apache.org/dyn/closer.cgi/roller/roller-6.1/v6.1.5">Roller 6.1.5</a> ("best available")</strong></p>
-<p>Previous source and binary distributions, including documentation, are available in the <a class="external" href="http://archive.apache.org/dist/roller/">Apache archives</a>.</p>
-<p>Project releases are approved by vote of the Apache Roller Project Management Committee (PMC). Support for a release is provided by project volunteers on the project <a href="https://cwiki.apache.org/confluence/display/ROLLER/How+to+ask+for+help">mailing lists</a>. Bugs found in a release may be discussed on the list and reported through the <a href="https://issues.apache.org/jira/browse/ROL">issue tracker</a>. The user mailing list and issue tracker are the <strong>only</strong> supp [...]
-<p>Note: When downloading from a mirror, be sure to verify that checksums and/or signatures are correct. To do so, use the checksum and signature files from the main Apache site at <a class="external" href="http://www.apache.org/dist/roller/"><a href="http://www.apache.org/dist/roller/">http://www.apache.org/dist/roller/</a></a>.</p>
-<p>The PGP signatures can be verified using PGP or GPG. First download the <a href="http://www.apache.org/dist/roller/KEYS">KEYS</a> as well as the <code>asc</code> signature file for the particular distribution. Make sure you get these files from the <a href="http://www.apache.org/dist/roller/">main distribution directory,</a> rather than from a mirror. Then verify the signatures using <code>pgpk</code> as follows:</p>
-<pre><code>% pgpk -a KEYS
-% pgpv ${filename}.tar.gz.asc
-</code></pre>
-<p>or</p>
-<pre><code>% pgp -ka KEYS
-% pgp ${filename}.tar.gz.asc
-</code></pre>
-<p>or</p>
-<pre><code>% gpg --import KEYS
-% gpg --verify ${filename}.tar.gz.asc
-</code></pre>
-<p>Alternatively you can also verify the SHA256 checksum for each file. Apache Open Office provides a nice guide to verifying checksum here <a href="https://www.openoffice.org/download/checksums.html">How to verify the integrity of the downloaded file?</a></p>
-<p>If you want to build directly from the sources, please check the <a href="https://cwiki.apache.org/confluence/display/ROLLER/How+to+build+Roller">Project Wiki</a>.</p>
+ <h1>Security</h1>
+ <p><h2>Apache Roller Security</h2>
+<h3>Reporting a vulnerability</h3>
+<p>Report suspected security vulnerabilities in Apache Roller privately to the Apache Security Team at <a href="mailto:security@apache.org"><a href="mailto:security@apache.org">security@apache.org</a></a>. Please <strong>do not</strong> report them in the public issue tracker, in GitHub issues or pull requests [...]
+<p>A useful report says which Roller version you tested, how the site is configured in any way that matters to the issue, and what steps reproduce the behaviour. If you are not sure whether what you found is a vulnerability, report it privately anyway and we will work it out with you.</p>
+<p>The Apache Security Team forwards the report to the Roller PMC, and coordination continues on a private list. See the <a class="external" href="https://www.apache.org/security/">ASF security page</a> for the foundation-wide policy that governs this process.</p>
+<h3>What happens next</h3>
+<p>We acknowledge the report, investigate it, and tell you whether we accept it. Accepted reports get a CVE identifier, a fix, and a release. We ask reporters to keep the details private until the fix is released, and we credit reporters in the advisory unless they prefer otherwise.</p>
+<p>Advisories are published when the fixed release is publicly available for download. They go to <a class="external" href="https://lists.apache.org/list.html?announce@apache.org"><a href="mailto:announce@apache.org">announce@apache.org</a></a>, the Roller <a class="external" href="https:// [...]
+<h3>Supported versions</h3>
+<p>Security fixes are made on the current release line and shipped in a new release. Older releases are not patched in place. If you are running an older version, the fix is to upgrade to the <a href="/downloads/downloads.html">current release</a>.</p>
+<h3>Published advisories</h3>
+<p>Advisories for Apache Roller are announced on the lists above and archived at <a class="external" href="https://lists.apache.org/list.html?announce@apache.org">lists.apache.org</a>.</p>
</p>
</div>
diff --git a/sources/src/main/jbake/content/downloads/downloads.md b/sources/src/main/jbake/content/downloads/downloads.md
index bb72d42..510036a 100644
--- a/sources/src/main/jbake/content/downloads/downloads.md
+++ b/sources/src/main/jbake/content/downloads/downloads.md
@@ -8,15 +8,15 @@ type=page
Releases of the Apache Roller blog server are made available to the general public at no charge, under the <a href="http://apache.org/licenses/">Apache License,</a> in both binary and source distributions.
### General Availability (GA) Releases</strong> - <em>Ready for Prime Time!</em>
-__<a href="http://www.apache.org/dyn/closer.cgi/roller/roller-6.1/v6.1.5">Roller 6.1.5</a> ("best available")__
+__<a href="https://www.apache.org/dyn/closer.cgi/roller/roller-6.1/v6.1.6">Roller 6.1.6</a> ("best available")__
Previous source and binary distributions, including documentation, are available in the <a class="external" href="http://archive.apache.org/dist/roller/">Apache archives</a>.
Project releases are approved by vote of the Apache Roller Project Management Committee (PMC). Support for a release is provided by project volunteers on the project <a href="https://cwiki.apache.org/confluence/display/ROLLER/How+to+ask+for+help">mailing lists</a>. Bugs found in a release may be discussed on the list and reported through the <a href="https://issues.apache.org/jira/browse/ROL">issue tracker</a>. The user mailing list and issue tracker are the <strong>only</strong> support [...]
-Note: When downloading from a mirror, be sure to verify that checksums and/or signatures are correct. To do so, use the checksum and signature files from the main Apache site at <a class="external" href="http://www.apache.org/dist/roller/">http://www.apache.org/dist/roller/</a>.
+Note: When downloading from a mirror, be sure to verify that checksums and/or signatures are correct. To do so, use the checksum and signature files from the main Apache distribution site at <a class="external" href="https://downloads.apache.org/roller/">downloads.apache.org/roller</a>.
-The PGP signatures can be verified using PGP or GPG. First download the <a href="http://www.apache.org/dist/roller/KEYS">KEYS</a> as well as the ``asc`` signature file for the particular distribution. Make sure you get these files from the <a href="http://www.apache.org/dist/roller/">main distribution directory,</a> rather than from a mirror. Then verify the signatures using ``pgpk`` as follows:
+The PGP signatures can be verified using PGP or GPG. First download the <a href="https://downloads.apache.org/roller/KEYS">KEYS</a> as well as the ``asc`` signature file for the particular distribution. Make sure you get these files from the <a href="https://downloads.apache.org/roller/">main distribution directory,</a> rather than from a mirror. Then verify the signatures using ``pgpk`` as follows:
% pgpk -a KEYS
% pgpv ${filename}.tar.gz.asc
@@ -31,7 +31,7 @@ or
% gpg --import KEYS
% gpg --verify ${filename}.tar.gz.asc
-Alternatively you can also verify the SHA256 checksum for each file. Apache Open Office provides a nice guide to verifying checksum here <a href="https://www.openoffice.org/download/checksums.html">How to verify the integrity of the downloaded file?</a>
+Alternatively you can also verify the SHA-256 or SHA-512 checksum for each file (Roller 6.1.6 ships both, as ``.sha256`` and ``.sha512`` files). Apache Open Office provides a nice guide to verifying checksum here <a href="https://www.openoffice.org/download/checksums.html">How to verify the integrity of the downloaded file?</a>
If you want to build directly from the sources, please check the <a href="https://cwiki.apache.org/confluence/display/ROLLER/How+to+build+Roller">Project Wiki</a>.
diff --git a/sources/src/main/jbake/content/security.md b/sources/src/main/jbake/content/security.md
new file mode 100644
index 0000000..17632eb
--- /dev/null
+++ b/sources/src/main/jbake/content/security.md
@@ -0,0 +1,28 @@
+title=Security
+status=published
+type=page
+~~~~~~
+
+## Apache Roller Security
+
+### Reporting a vulnerability
+
+Report suspected security vulnerabilities in Apache Roller privately to the Apache Security Team at <a href="mailto:security@apache.org">security@apache.org</a>. Please **do not** report them in the public issue tracker, in GitHub issues or pull requests, or on the public mailing lists.
+
+A useful report says which Roller version you tested, how the site is configured in any way that matters to the issue, and what steps reproduce the behaviour. If you are not sure whether what you found is a vulnerability, report it privately anyway and we will work it out with you.
+
+The Apache Security Team forwards the report to the Roller PMC, and coordination continues on a private list. See the <a class="external" href="https://www.apache.org/security/">ASF security page</a> for the foundation-wide policy that governs this process.
+
+### What happens next
+
+We acknowledge the report, investigate it, and tell you whether we accept it. Accepted reports get a CVE identifier, a fix, and a release. We ask reporters to keep the details private until the fix is released, and we credit reporters in the advisory unless they prefer otherwise.
+
+Advisories are published when the fixed release is publicly available for download. They go to <a class="external" href="https://lists.apache.org/list.html?announce@apache.org">announce@apache.org</a>, the Roller <a class="external" href="https://lists.apache.org/list.html?dev@roller.apache.org">dev</a> and <a class="external" href="https://lists.apache.org/list.html?user@roller.apache.org">user</a> lists, and <a class="external" href="https://www.openwall.com/lists/oss-security/">oss-se [...]
+
+### Supported versions
+
+Security fixes are made on the current release line and shipped in a new release. Older releases are not patched in place. If you are running an older version, the fix is to upgrade to the <a href="/downloads/downloads.html">current release</a>.
+
+### Published advisories
+
+Advisories for Apache Roller are announced on the lists above and archived at <a class="external" href="https://lists.apache.org/list.html?announce@apache.org">lists.apache.org</a>.
diff --git a/sources/src/main/jbake/templates/header.ftl b/sources/src/main/jbake/templates/header.ftl
index f235639..c12e3c7 100644
--- a/sources/src/main/jbake/templates/header.ftl
+++ b/sources/src/main/jbake/templates/header.ftl
@@ -52,6 +52,7 @@
</ul>
</li>
<li class="nav-item"><a class="nav-link" href="/downloads/downloads.html">Download</a></li>
+ <li class="nav-item"><a class="nav-link" href="/security.html">Security</a></li>
<li class="nav-item dropdown">
<a href="#" class="nav-link dropdown-toggle" data-bs-toggle="dropdown">ASF</a>
<ul class="dropdown-menu">