You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@solr.apache.org by "Tang, Rebecca" <Re...@ucsf.edu.INVALID> on 2021/12/13 19:53:35 UTC
When will solr 8.11.1 become available?
Thanks,
Rebecca
Log4j remediation in the Docker image
Posted by Andy Lester <an...@petdance.com>.
> On Dec 16, 2021, at 8:26 AM, Carlos Cueto <cc...@gmail.com> wrote:
>
> Any idea when it will be available on Docker Hub? 8.11.1 tag is still not
> added.
I don’t know, but yesterday I went and changed my build process for our Docker image of Solr to delete the JNDI classes from the jar files as a stopgap until a proper 8.11.1 came out. See https://logging.apache.org/log4j/2.x/security.html for details.
This is how I did it.
To be able to delete the class files, one must use zip, so I had to install that in the container. To install zip in the container, I had to make a fake UserAgent file for apt-get to not get refused by the mirrors.
Here is my Dockerfile:
FROM solr:8.11.0
# https://hub.docker.com/_/solr/
# https://github.com/docker-solr/docker-solr#extending-the-image
# https://solr.apache.org/docs/8_11_0/changes/Changes.html
# The SOLR_xxxx vars override defaults. See /etc/default/solr.in.sh in the container for more.
ENV \
TZ=America/Chicago \
SOLR_TIMEZONE=America/Chicago \
SOLR_HEAP=20g
USER root
RUN \
echo 'Installing additional packages' \
&& echo 'Create new agent to get around apt-get bugs per https://lists.debian.org/debian-user/2019/10/msg00629.html' \
&& echo 'Acquire' > /etc/apt/apt.conf.d/99useragent \
&& echo '{' >> /etc/apt/apt.conf.d/99useragent \
&& echo ' http::User-Agent "Mozilla/5.0 (X11; Linux x86_64; rv:60.0) Gecko/20100101 Firefox/60.0";' >> /etc/apt/apt.conf.d/99useragent \
&& echo '};' >> /etc/apt/apt.conf.d/99useragent \
&& echo 'Done populating user agent' \
&& echo 'Installing zip' \
&& apt-get update \
&& apt-get install -y zip \
&& rm -rf /var/lib/apt/lists/* \
&& apt-get clean all \
&& echo 'Done installing additional packages' \
&& echo 'Delete JNDI from the log4j files in both Solr and the exporter' \
&& zip -q -d /opt/solr-8.11.0/contrib/prometheus-exporter/lib/log4j-core-2.14.1.jar org/apache/logging/log4j/core/lookup/JndiLookup.class \
&& zip -q -d /opt/solr-8.11.0/server/lib/ext/log4j-core-2.14.1.jar org/apache/logging/log4j/core/lookup/JndiLookup.class \
&& echo 'Deleted JNDI from jars'
USER solr
I hope this helps someone.
Andy
Re: When will solr 8.11.1 become available?
Posted by David Smiley <ds...@apache.org>.
https://github.com/docker-solr/docker-solr/pull/401
I would guess perhaps in 12 hours from now maybe.
~ David Smiley
Apache Lucene/Solr Search Developer
http://www.linkedin.com/in/davidwsmiley
On Thu, Dec 16, 2021 at 9:26 AM Carlos Cueto <cc...@gmail.com> wrote:
> Any idea when it will be available on Docker Hub? 8.11.1 tag is still not
> added.
>
> On Thu, Dec 16, 2021 at 9:25 AM Ishan Chattopadhyaya <
> ichattopadhyaya@gmail.com> wrote:
>
> > It is available now.
> >
> > On Tue, Dec 14, 2021 at 7:36 AM Shawn Heisey <ap...@elyograg.org>
> wrote:
> >
> > > On 12/13/2021 4:12 PM, Andy Lester wrote:
> > > >> It is impossible to give you an accurate prediction for the release
> > > date of Solr 8.11.1.
> > > >
> > > > It sounds like it’s safe to say that the release will be “on the
> order
> > > of at least a week from now” would be safe, right?
> > > >
> > > > That might be all the accuracy that someone needs.
> > >
> > > If everything goes well and no problems are discovered with the first
> > > release candidate, that would likely be about when the release is
> > > announced.
> > >
> > > Thanks,
> > > Shawn
> > >
> >
>
Re: When will solr 8.11.1 become available?
Posted by Carlos Cueto <cc...@gmail.com>.
Any idea when it will be available on Docker Hub? 8.11.1 tag is still not
added.
On Thu, Dec 16, 2021 at 9:25 AM Ishan Chattopadhyaya <
ichattopadhyaya@gmail.com> wrote:
> It is available now.
>
> On Tue, Dec 14, 2021 at 7:36 AM Shawn Heisey <ap...@elyograg.org> wrote:
>
> > On 12/13/2021 4:12 PM, Andy Lester wrote:
> > >> It is impossible to give you an accurate prediction for the release
> > date of Solr 8.11.1.
> > >
> > > It sounds like it’s safe to say that the release will be “on the order
> > of at least a week from now” would be safe, right?
> > >
> > > That might be all the accuracy that someone needs.
> >
> > If everything goes well and no problems are discovered with the first
> > release candidate, that would likely be about when the release is
> > announced.
> >
> > Thanks,
> > Shawn
> >
>
Re: When will solr 8.11.1 become available?
Posted by Ishan Chattopadhyaya <ic...@gmail.com>.
It is available now.
On Tue, Dec 14, 2021 at 7:36 AM Shawn Heisey <ap...@elyograg.org> wrote:
> On 12/13/2021 4:12 PM, Andy Lester wrote:
> >> It is impossible to give you an accurate prediction for the release
> date of Solr 8.11.1.
> >
> > It sounds like it’s safe to say that the release will be “on the order
> of at least a week from now” would be safe, right?
> >
> > That might be all the accuracy that someone needs.
>
> If everything goes well and no problems are discovered with the first
> release candidate, that would likely be about when the release is
> announced.
>
> Thanks,
> Shawn
>
Re: When will solr 8.11.1 become available?
Posted by Shawn Heisey <ap...@elyograg.org>.
On 12/13/2021 4:12 PM, Andy Lester wrote:
>> It is impossible to give you an accurate prediction for the release date of Solr 8.11.1.
>
> It sounds like it’s safe to say that the release will be “on the order of at least a week from now” would be safe, right?
>
> That might be all the accuracy that someone needs.
If everything goes well and no problems are discovered with the first
release candidate, that would likely be about when the release is announced.
Thanks,
Shawn
Re: When will solr 8.11.1 become available?
Posted by Andy Lester <an...@petdance.com>.
> It is impossible to give you an accurate prediction for the release date of Solr 8.11.1.
It sounds like it’s safe to say that the release will be “on the order of at least a week from now” would be safe, right?
That might be all the accuracy that someone needs.
Re: When will solr 8.11.1 become available?
Posted by Shawn Heisey <ap...@elyograg.org>.
On 12/13/21 12:53 PM, Tang, Rebecca wrote:
> Thanks,
> Rebecca
It is impossible to give you an accurate prediction for the release date
of Solr 8.11.1.
Yesterday, the developer who designated themselves the release manager
for 8.11.1 said on the Solr dev list that they would be creating the
first release candidate soon. I would expect it before the end of the
week, but cannot guarantee that.
Once a release candidate is available, it will then go to a vote about
whether or not that candidate should be released. Project rules dictate
that the vote will run for 72 hours. Assuming the vote passes, the
process of making the official release available on the Apache mirror
system will begin once the vote concludes. At that point it can be
downloaded from the official archive. It usually takes a day or two
before enough mirrors have the release that the project feels
comfortable announcing it.
If the vote doesn't pass, then whatever problem was found must be fixed
and a new release candidate created, and then a brand new 72-hour vote
will commence.
I believe that votes for 8.x releases will happen on the Lucene dev
list, because for 8.x Solr is still part of the lucene-solr codebase.
When Solr 9.0 reaches the point where it can be released, it will be
released from a codebase that only includes Solr, and so the vote should
move to the Solr dev list.
Thanks,
Shawn
Re: When will solr 8.11.1 become available?
Posted by Jan Høydahl <ja...@cominvent.com>.
You can follow the release on the dev@ mailing list, see https://lists.apache.org/list.html?dev@solr.apache.org
There will be a first release candidate soon-ish, and depending on voting outcome there may be more RCs during the week and then finally an official release.
Jan
> 13. des. 2021 kl. 20:53 skrev Tang, Rebecca <Re...@ucsf.edu.INVALID>:
>
> Thanks,
> Rebecca