Re: Wrong backports listing on website

2019-07-31 Thread Daniel Shahaf
Julian Foad wrote on Wed, 31 Jul 2019 20:23 +00:00: > Daniel Shahaf wrote: > > Julian Foad wrote on Wed, Jul 31, 2019 at 10:53:17 +0100: > >> [...] Document a step for updating the 'upcoming > >> changes' branch for a new minor release. > > > > How do you feel about automating that? We could make

Security release procedures

2019-07-31 Thread Julian Foad
I handled two security fixes in the recent set of patch releases. It was the first time I had done it and the procedures were rather less than push-of-a-button simple to follow. 1. We should move as much as possible of the scripts and documentation that exists in a private repo, into a public

Re: Wrong backports listing on website

2019-07-31 Thread Julian Foad
Daniel Shahaf wrote: Julian Foad wrote on Wed, Jul 31, 2019 at 10:53:17 +0100: [...] Document a step for updating the 'upcoming changes' branch for a new minor release. How do you feel about automating that? We could make the script figure out the latest stable version easily enough: I feel

Re: Wrong backports listing on website

2019-07-31 Thread Daniel Shahaf
Julian Foad wrote on Wed, Jul 31, 2019 at 10:53:17 +0100: > Daniel Shahaf wrote: > > - In the Puppet manifest, [1], for the actual commands to use. > > I sent a merge request to change it from 'cd ~/src/svn/1.11.x' to 'cd > ~/src/svn/latest' and made a symlink 'latest -> 1.12.x' locally on svn-qav

[CVE-2018-11782, CVE-2019-0203] Apache Subversion svnserve vulnerabilities

2019-07-31 Thread Julian Foad
The recent releases of Apache Subversion 1.12.2, 1.10.6, 1.9.12, contain fixes for two security issues, CVE-2018-11782 and CVE-2019-0203. These issues affect Subversion 'svnserve' servers. We encourage server operators to upgrade to the latest appropriate version as soon as reasonable. Please se

Re: Wrong backports listing on website

2019-07-31 Thread Julian Foad
Daniel Shahaf wrote: https://subversion.apache.org/docs/release-notes/#upcoming-patch-release still shows 1.11.x changes rather than 1.12.x. The "11" is hardcoded in two places: - In the HTML source of site/publish/docs/release-notes/index.html (for the prose). http://svn.apache.org/r18640