From Mageia wiki
Jump to: navigation, search
(Adding old advisories)
Line 107: Line 107:
  
 
* set the ''ID'' manually
 
* set the ''ID'' manually
* set the ''no_mail'' option
+
* set the ''no_mail'' option so that an email is not sent for this already published advisory
 
* set ''pubtime'' to the publication time of the update, as epoch value
 
* set ''pubtime'' to the publication time of the update, as epoch value
  
Line 117: Line 117:
 
</pre>
 
</pre>
  
To know the epoch value of some date, you can use the following command (in this example for 2012-06-10) :
+
To know the epoch value of a date, you can use the following command (in this example for 2012-06-10) :
 
<pre>
 
<pre>
 
$ perl -MDateTime -e 'my @a = split(/-/,$ARGV[0]); print DateTime->new(year => $a[0], month => $a[1], day => $a[2], hour => 12)->epoch, "\n"' 2012-06-10
 
$ perl -MDateTime -e 'my @a = split(/-/,$ARGV[0]); print DateTime->new(year => $a[0], month => $a[1], day => $a[2], hour => 12)->epoch, "\n"' 2012-06-10
 
</pre>
 
</pre>

Revision as of 15:26, 17 June 2013

Updates advisories are managed using mgaadv. This page explains how to create an update advisory.

SVN access

To be able to add or edit advisories, you need to have commit access to the svn server. So you must be in the packagers or QA ldap group. You also need to setup your ssh key to be able to access the svn (see Packagers_ssh for details). The following command should work :

$ svn ls svn+ssh://svn.mageia.org/svn/advisories/

Installation

The first step to create advisories is to install the package mga-advisories :

# urpmi mga-advisories

The package is available in cauldron, and in updates_testing for Mageia 2 and Mageia 3.

Configuration

Configuration of mgaadv can be done using the command initqaconf :

$ mgaadv initqaconf

This should open a text editor with something like this :

---
advisories_dir: /home/boklm/mageia-advisories/advisories
mode: qa
out_dir: /home/boklm/mageia-advisories/html
status_dir: /home/boklm/mageia-advisories/status

By default it will save advisories in the directory mageia-advisories under your home directory. You can change this if you you want :

  • advisories_dir: the directory where advisories infos are (a checkout of the advisories svn repository)
  • out_dir: the directory where html pages will be saved
  • status_dir: directory where status of the advisories is saved

After saving the file and closing the text editor it should checkout the advisories svn in the advisories_dir directory.

If you want to edit the configuration later, the file is .mga-advisories/mga-advisories.conf in your home directory.

Creating a new advisory

Creating a new advisory is done with the command new :

$ mgaadv new [type] [bugnum]

Replace [type] with the type of advisory (security or bugfix). Replace [bugnum] with the bugzilla number of the bug used to track the update.

It should open a text editor with something like this :

type: bugfix
subject: Updated [package] package fixes [something]
src:
  2:
   core:
     - something-1.0-1.mga2
  3:
   core:
     - something-1.0-1.mga3
description: |
  Advisory text to describe the update.
  Wrap lines at ~75 chars.
references:
 - https://bugs.mageia.org/show_bug.cgi?id=123456

The format of the file is YAML (see the wikipedia page for basic syntax).

You should edit the following infos :

  • subject: a one line summary of the advisory
  • description: a longer description of the update. Text should be wrapped at ~75 chars.
  • src: the list of source packages, in a tree including the mageia release and media
  • references: a list of URLs

When you finished editing the advisory, you need to commit the file on svn. The name of the file is [bugnum].adv in the advisories directory.

Add the new file to svn :

$ svn add 123456.adv

Review changes before you commit :

$ svn diff

Commit :

$ svn ci -m 'Add advisory for bug 123456'

Testing the advisory

You can use mgaadv and the mksite command to generate the advisories web site to check that your new advisory is displayed correctly :

$ mgaadv mksite

Then open a web browser to view the out_dir directory (defined in mgaadv configuration).

You can also use the list and show commands to display a text version of the advisory.

Publishing advisory

Publishing is done by assigning an ID to an advisory. In the future, it is planned that mga-advisories moves the updated packages to the updates repository automatically, but it is not ready yet. For now, this part still needs to be done by the sysadmin team. When an advisory file is ready to be published, don't publish it, but mention in the bug report that the advisory is ready, so that a sysadmin push the updated packages and publish the advisory.

Adding old advisories

If someone has a lot of time, it's possible to add old advisories from https://wiki.mageia.org/en/Support/Advisories/.

To add already published advisories, the process is the same, with the following differences in the advisory file :

  • set the ID manually
  • set the no_mail option so that an email is not sent for this already published advisory
  • set pubtime to the publication time of the update, as epoch value

Example :

no_mail: 1
pubtime: 1339329600
ID: MGASA-2012-0112

To know the epoch value of a date, you can use the following command (in this example for 2012-06-10) :

$ perl -MDateTime -e 'my @a = split(/-/,$ARGV[0]); print DateTime->new(year => $a[0], month => $a[1], day => $a[2], hour => 12)->epoch, "\n"' 2012-06-10