You are viewing a plain text version of this content. The canonical link for it is here.
Posted to cvs@httpd.apache.org by co...@apache.org on 2026/05/08 13:15:48 UTC
svn commit: r1933940 - httpd/dev-tools/trunk/release
Author: covener
Date: Fri May 8 13:15:48 2026
New Revision: 1933940
Log:
update CVE.json earlier for the website sake
Modified:
httpd/dev-tools/trunk/release/README.md
httpd/dev-tools/trunk/release/r4-stage-release.sh
Modified: httpd/dev-tools/trunk/release/README.md
==============================================================================
--- httpd/dev-tools/trunk/release/README.md Fri May 8 12:52:46 2026 (r1933939)
+++ httpd/dev-tools/trunk/release/README.md Fri May 8 13:15:48 2026 (r1933940)
@@ -60,7 +60,6 @@
#### On vote success
-
1. Push the release tarballs
`$DEV_TOOLS/release/r3-push-release-tars.sh`
@@ -76,17 +75,24 @@
can manually access the current release by manipulating the filenames you see from
the previous release then move on (within 15 more minutes?)
-3. Stage the other release artifacts:
+3. Stage the other release artifacts:
+
+ 1. Add the 2.4.x backport revisions to the CVE JSON files, so they will be
+ in the copies incorporated onto the website.
+
+ This can currently be done with:
+ cveprocess_update.py CVE-xxxx/CVE.json --backport r1xxxx
+ cveprocess_put.py CVE-xxxx/CVE.json
+
+ 2.Run: `$DEV_TOOLS/release/r4-stage-release.sh`
- `$DEV_TOOLS/release/r4-stage-release.sh`
-
ALL CHANGES HERE ARE LOCAL ONLY
- folds in CVE related information for CHANGES files
- moves CVEs to pmc/resolved
- update ./CHANGES ./STATUS ./include/ap_release.h
- checks out and modifies project website
-
+
To verify, just `svn diff` with a focus on e.g. CHANGES for CVE handling.
It is likely you will want to cleanup the SECURITYT changes folded into STATUS
because they often have unusual formatting and some redundant info.
@@ -97,6 +103,7 @@
5. Commit additional staged release artifacts:
+
`$DEV_TOOLS/release/r5-commit-staged-release.sh`
This commits all locally staged changes to repositories and website.
@@ -123,15 +130,7 @@
The released moved the included CVEs into the ../resolved/ directory and you also
hopefully have a list of them from the notes taken while backporting.
- 1. `tools/update_cve_for_release.py` adds the reference tag and 2.4.x revision to the CVE
- and sends it back to cveprocess.a.o. This can be done manually instead:
-
- - In <https://cveprocess.apache.org>
- - Fill in a 'reference' tag 'vendor-advisory' with:
- `https://httpd.apache.org/security/vulnerabilities_24.html`
- - add a timeline entry to the CVE
- > fixed by r... in 2.4.x
- 2. In <https://cveprocess.apache.org>
+ 1. In <https://cveprocess.apache.org>
- set CVE to READY on the cveprocess site
- save the CVE entry
- Use the 'OSS/ASF Emails' tab for the emails you should send to oss-security
@@ -139,12 +138,16 @@
- ASF Security will be notified and will submit to the CVE
project and then set state to 'PUBLIC'.
- 3. `tools/update_svn_logs_with_cve.py` generates a shell script that updates
- the 2.4.x SVN commits to includ the CVE names. This can be done manually:
-
- - In SVN:
- - Edit the CVE info (from CHANGES) into the revisions that fixed
- them in the backport, e.g. `svn propedit --revprop -r... svn:log`
+ 2. `tools/update_svn_logs_with_cve.py` generates a shell script that updates
+ the 2.4.x SVN commits to includ the CVE names.
+
+ The input is a text file with stanzas like this:
+ ```
+ CVE-2026-33857-oob_reads_in_ajp_get_functions
+ trunk: 1933340
+ 2.4.x: 1933341
+ ```
+ This can be done manually with `svn propedit --revprop -r... svn:log`
9. Clean up prior release artifacts
- https://dist.apache.org/repos/dist/release/httpd (incl CHANGES_2.4.xx)
Modified: httpd/dev-tools/trunk/release/r4-stage-release.sh
==============================================================================
--- httpd/dev-tools/trunk/release/r4-stage-release.sh Fri May 8 12:52:46 2026 (r1933939)
+++ httpd/dev-tools/trunk/release/r4-stage-release.sh Fri May 8 13:15:48 2026 (r1933940)
@@ -155,6 +155,17 @@ fi
if test -n "${CVE_DIRS}"; then
echo "adding timeline entry to CVEs and copy to site"
TIMELINE_ENTRY='{"lang":"eng","time":"'"${timeline_timestamp}"'","value":"'"${VERSION}"' released"}'
+
+ # Validation pass
+ for CVE in $CVE_DIRS; do
+ CVE_JSON="${DIST_DIR}/pmc/SECURITY/${CVE}/CVE.json"
+ test -f "$CVE_JSON" || fail "not found: ${CVE_JSON}"
+ CVE_ID=`jq -r .cveMetadata.cveId "${CVE_JSON}"`
+ if ! jq -e 'any(.containers.cna.timeline[]?; .value | contains("fixed in 2.4.x"))' < $CVE_JSON; then
+ fail "${CVE_JSON} doesn't have any 'fixed in 2.4.x' timeline when staging content, so it will not be on the website"
+ fi
+ done
+
for CVE in $CVE_DIRS; do
CVE_JSON="${DIST_DIR}/pmc/SECURITY/${CVE}/CVE.json"
test -f "$CVE_JSON" || fail "not found: ${CVE_JSON}"