From b44c03eb7af81f29712592f8c58b7f2d5fb1f1c9 Mon Sep 17 00:00:00 2001 From: Justin Mclean Date: Fri, 16 Oct 2026 20:34:26 +1100 Subject: [PATCH] Fix trailing spaces and blank lines in pages Turns MD009, MD012, MD022, MD031 and MD032 back on and fixes the pages that broke them. Whitespace only, apart from one blog paragraph that now splits where the author left a blank line. --- .markdownlint-cli2.yaml | 5 - content/blog/2022_Infra_Survey_Results.md | 5 +- content/blog/2023 Infra Survey Results.md | 2 +- content/blog/Blogs has a new home.md | 1 - content/blog/Danny_Angus_Infra_VP.md | 18 ++- content/blog/README.md | 4 +- content/blog/add_wisdom.md | 4 +- content/blog/another-oar-in-the-water.md | 6 +- content/blog/apache-and-github-a-friendly.md | 14 +- content/blog/apache_cms_and_external_build.md | 6 +- content/blog/apache_cms_latest_new_feature.md | 10 +- content/blog/apache_cms_new_features_for.md | 8 +- content/blog/apache_org_04_09_2010.md | 85 ++++++------ .../blog/apache_org_incident_report_for.md | 26 ++-- content/blog/apache_services_and_sha_1.md | 34 ++--- content/blog/appveyor_ci_now_available_for.md | 18 +-- content/blog/asf_buildbot_svn_setup.md | 4 +- content/blog/asf_comments_system_live.md | 4 +- content/blog/blogs-a-o-moved-upgraded.md | 20 +-- content/blog/bob_thomson_joins_infra.md | 2 +- content/blog/brand-new-selfserve-page.md | 3 +- .../blog/bringing-gitpubsub-to-the-apache.md | 20 +-- .../buildbot_master_currently_off_line.md | 76 +++++------ content/blog/changes_to_email_service_for.md | 1 - .../code_signing_service_now_available.md | 10 +- .../blog/committer_shell_access_to_people.md | 10 +- content/blog/committers_mail_relay_service.md | 14 +- content/blog/continued_outages_for_the_asf.md | 6 +- content/blog/dmarc_filtering_on_lists_that.md | 6 +- .../blog/email_from_apache_org_committer.md | 6 +- content/blog/end_of_home.md | 2 +- .../blog/github_pull_request_builds_now.md | 30 ++--- content/blog/gradle_at_the_ASF.md | 9 +- content/blog/heartbleed_fallout_for_apache.md | 32 ++--- content/blog/https_id_apache_org_new.md | 4 +- ...improved_integration_between_apache_and.md | 18 +-- .../infrastructure_team_adopting_an_on.md | 18 +-- content/blog/introducing_jira_service_desk.md | 8 +- content/blog/ldap_and_password_policy.md | 4 +- content/blog/mail_outage.md | 24 ++-- content/blog/mail_outage_post_mortem.md | 24 ++-- .../blog/mail_service_architecture_changes.md | 36 ++--- content/blog/mirroring_to_github_issues.md | 20 +-- .../blog/new-jenkins-nodes-running-windows.md | 2 +- content/blog/new_infra_team_members.md | 12 +- .../blog/new_monitoring_system_nagios_is.md | 26 ++-- content/blog/new_status_page_for_the.md | 6 +- content/blog/newsletter_01_24.md | 6 +- content/blog/newsletter_01_25.md | 7 +- content/blog/newsletter_01_26.md | 3 +- content/blog/newsletter_02_24.md | 2 +- content/blog/newsletter_02_25.md | 5 +- content/blog/newsletter_02_26.md | 13 +- content/blog/newsletter_03_24.md | 2 - content/blog/newsletter_03_25.md | 2 +- content/blog/newsletter_04_24.md | 4 +- content/blog/newsletter_04_25.md | 5 +- content/blog/newsletter_04_26.md | 2 +- content/blog/newsletter_05_24.md | 4 +- content/blog/newsletter_05_26.md | 6 +- content/blog/newsletter_06_24.md | 10 +- content/blog/newsletter_06_25.md | 3 +- content/blog/newsletter_06_26.md | 4 +- content/blog/newsletter_07_24.md | 1 + content/blog/newsletter_07_26.md | 2 +- content/blog/newsletter_08_25.md | 3 +- content/blog/newsletter_08_26.md | 1 - content/blog/newsletter_09_24.md | 5 - content/blog/newsletter_09_25.md | 5 +- content/blog/newsletter_09_26.md | 3 +- content/blog/newsletter_10_24.md | 3 +- content/blog/newsletter_10_25.md | 4 +- content/blog/newsletter_11_24.md | 2 +- content/blog/newsletter_11_25.md | 2 - content/blog/newsletter_12_24.md | 3 +- content/blog/newsletter_12_25.md | 2 - .../blog/on_demand_workers_from_rackspace.md | 16 +-- content/blog/parallelputissue.md | 2 +- content/blog/paste_apache_org_sees_the.md | 26 ++-- .../blog/pear_package_hosting_available1.md | 2 +- content/blog/planned_downtime_for_jira1.md | 2 +- .../blog/planned_downtime_for_reviewboard.md | 16 +-- ...le-infrastructure-systems-administrator.md | 2 +- ...le_infrastructure_systems_administrator.md | 32 ++--- content/blog/promoting-podlings.md | 2 +- .../blog/rate-limiting-on-apache-services.md | 30 ++--- .../relocation-of-apache-git-repositories.md | 28 ++-- content/blog/responding_to_2024_survey.md | 2 +- content/blog/roller-updated-to-5-2.md | 6 +- content/blog/roller_installed_for_use_by.md | 1 - content/blog/s_apache_org_uri_shortening.md | 6 +- content/blog/scaling_down_the_cms_to.md | 6 +- content/blog/subversion-to-git-service-git.md | 26 ++-- ...master_undergoing_emergency_maintenance.md | 50 +++---- content/blog/svn_service_outage_postmortem.md | 126 +++++++++--------- content/blog/the_joy_of_feedback.md | 15 +-- content/blog/the_value_of_taint_checks.md | 24 ++-- .../blog/towards_a_redeployable_future_or.md | 8 +- content/blog/trivy_security_incident.md | 4 + content/blog/welcome_new_members_of_the.md | 24 ++-- content/pages/account-mgmt.md | 10 +- content/pages/apache-github.md | 6 +- content/pages/app-upgrade-policy.md | 6 +- content/pages/apple-dev-program.md | 3 +- content/pages/asf-pelican-branches.md | 2 +- content/pages/asf-pelican-build.md | 5 +- content/pages/asf-pelican-config.md | 2 +- content/pages/asf-pelican-data.md | 6 +- content/pages/asf-pelican-gettingstarted.md | 3 +- content/pages/asf-pelican-local.md | 3 +- content/pages/asf-pelican-plugins.md | 5 +- content/pages/asf-pelican-theme.md | 5 +- content/pages/asfbot.md | 9 +- content/pages/asfquart.md | 2 +- content/pages/asfyaml-mkdocs.md | 2 +- content/pages/backup-policy.md | 4 + content/pages/bug-writing-guide.md | 3 +- content/pages/build-supported-services.md | 28 +++- content/pages/code-signing-use.md | 8 +- content/pages/committer-email.md | 11 +- content/pages/committer-outreach.md | 2 +- content/pages/committers.md | 1 - content/pages/contact.md | 13 +- content/pages/content-moderation.md | 15 ++- content/pages/contributors.md | 5 +- content/pages/crypto.md | 2 +- content/pages/csp.md | 4 +- content/pages/cwiki.md | 8 +- content/pages/digicert-use.md | 6 +- content/pages/doc.md | 5 +- content/pages/docker-hub-policy.md | 3 +- content/pages/email_lists.md | 6 +- content/pages/gfm.md | 4 +- content/pages/git-primer.md | 7 +- content/pages/git.md | 3 +- content/pages/github-actions-policy.md | 8 +- content/pages/github-actions-secrets.md | 4 +- content/pages/github-pages.md | 2 +- content/pages/github-roles.md | 5 +- content/pages/glossary.md | 1 - content/pages/gradle.md | 6 +- content/pages/hosting-external-agent.md | 7 +- content/pages/how-to-mirror.md | 8 +- content/pages/infra-contact.md | 22 ++- content/pages/infra-incubator.md | 4 +- content/pages/infra-mail.md | 3 +- content/pages/infra-news.md | 2 +- content/pages/infra-reports.md | 4 +- content/pages/infra-volunteer.md | 2 - .../pages/jira-account-retention-policy.md | 2 +- content/pages/jira-approve-account.md | 3 + content/pages/jira-for-infra.md | 3 +- content/pages/jira-guidelines.md | 14 +- content/pages/key-transition.md | 2 +- content/pages/licensing-howto.md | 1 + content/pages/localization.md | 4 +- content/pages/mail-migration-faq.md | 32 ++--- content/pages/mail-rejection.md | 4 +- content/pages/mailing-list-moderation.md | 12 +- content/pages/managing-committers.md | 2 +- content/pages/matomo.md | 3 - content/pages/mfa-reset.md | 4 +- content/pages/mfa.md | 1 + content/pages/new-committers-guide.md | 2 + content/pages/nexus101.md | 2 - content/pages/nightlies.md | 5 + content/pages/open-access-svn.md | 4 +- content/pages/openpgp.md | 33 +++-- content/pages/os-upgrade-policy.md | 6 +- content/pages/password-policy.md | 37 ++--- content/pages/patch.md | 1 - content/pages/pelican-buildbot.md | 7 +- content/pages/phishing.md | 2 +- content/pages/policies.md | 1 + content/pages/project-blogs.md | 4 +- content/pages/project-repo-policy.md | 1 - content/pages/project-site-policy.md | 2 +- content/pages/project-site.md | 25 ++-- content/pages/publishing-maven-artifacts.md | 14 +- content/pages/pypubsub.md | 22 ++- content/pages/qbot.md | 8 +- content/pages/reference/committer/index.md | 2 +- content/pages/reference/committer/start.md | 3 - content/pages/release-distribution.md | 2 +- content/pages/release-download-pages.md | 7 +- content/pages/release-integrity-primer.md | 11 +- content/pages/release-publishing.md | 21 ++- content/pages/release-signing.md | 25 ++-- content/pages/repository-faq.md | 2 +- content/pages/request-bug-tracker.md | 3 +- content/pages/responsetime.md | 7 +- content/pages/retired.md | 1 - content/pages/roundtable.md | 4 +- content/pages/sensitive_info.md | 2 +- content/pages/services.md | 7 +- content/pages/slack-policy.md | 3 + content/pages/slack.md | 12 +- content/pages/stats.md | 2 +- content/pages/svn-basics.md | 2 +- content/pages/svn-to-git-migration.md | 4 +- content/pages/svngit2jira.md | 4 +- content/pages/team.md | 6 +- content/pages/tools/csp.md | 14 +- content/pages/tools/index.md | 2 - content/pages/user-ssh.md | 4 +- content/pages/version-control.md | 12 +- content/pages/vm-for-project.md | 2 - content/pages/vm-management.md | 2 + content/pages/website-guidelines.md | 3 +- 209 files changed, 1011 insertions(+), 979 deletions(-) diff --git a/.markdownlint-cli2.yaml b/.markdownlint-cli2.yaml index da6830ea0..8c0b508f4 100644 --- a/.markdownlint-cli2.yaml +++ b/.markdownlint-cli2.yaml @@ -18,19 +18,14 @@ config: MD004: false MD005: false MD007: false - MD009: false MD010: false - MD012: false MD014: false MD018: false - MD022: false MD024: false MD025: false MD026: false MD029: false MD030: false - MD031: false - MD032: false MD034: false MD036: false MD038: false diff --git a/content/blog/2022_Infra_Survey_Results.md b/content/blog/2022_Infra_Survey_Results.md index 8bee93e9b..2b04a0f49 100644 --- a/content/blog/2022_Infra_Survey_Results.md +++ b/content/blog/2022_Infra_Survey_Results.md @@ -4,9 +4,11 @@ permalink: 2022_infra_survey_results layout: post ### Intro + I'd like to thank everyone who took time to take the survey. This is the first time that I know of that we've tried something like this, and feedback is very important. I'd also like to take a second to clarify my tone for this article. I'm presenting as Chris T. the Infra person, not as an ASF Member or committer. So when I say "we" or "us", I'm referring to the other Infra folks, not specifically the Foundation as a whole or any Members. I am not posting the full results, but a summary of the data, as we had some responses that used enough information to identify the person being discussed. Those responses are 100% valid and I don't want to post an incomplete dataset with them removed. ### Summary of Results + We sent the survey to 4109 people (and anyone who went to the blog post would also have been able to complete the survey) and received 80 responses. While that isn't a huge number of results, it's a very manageable dataset to parse through. I also presume that some people submitting responses were conveying information gathered from other participants in their project. There weren't many surprises in responses, as we all know a lot of the pain points. However, it's vital for the Infra team to have data to back up our work and the resources we offer. Here are the top subjects that were referred to: @@ -20,7 +22,6 @@ Here are the top subjects that were referred to: * Platforms (Jenkins, Buildbot, GHA, etc.) 1. Release process is a problem - The charts reflect the data above: @@ -28,6 +29,6 @@ The charts reflect the data above: - ### Next Steps + The easy thing would be to say, “Let’s fix all the things!” To be honest, there is on-going work with all the above issues, but most of them are not subject to a quick fix or a short answer. Now that we have data and a baseline, we’ll evaluate and discuss how we’re going to address your concerns. Since that I’ve never done one of these surveys before, I do not have the next steps laid out, so we’ll have to take them together. diff --git a/content/blog/2023 Infra Survey Results.md b/content/blog/2023 Infra Survey Results.md index a45cea74e..a7e042e47 100644 --- a/content/blog/2023 Infra Survey Results.md +++ b/content/blog/2023 Infra Survey Results.md @@ -69,7 +69,7 @@ We asked which existing services need improvement. These areas got the most vote - Issue Tracking (Jira, GitHubIssues, Bugzilla) – 31% - Documentation / Wiki pages – 31% - Source control (GitHub/GitBox, SVN) – 19% - - Messaging (Slack, mailing lists) – 19% + - Messaging (Slack, mailing lists) – 19% Comments: diff --git a/content/blog/Blogs has a new home.md b/content/blog/Blogs has a new home.md index 4dfe21333..0452bbeba 100644 --- a/content/blog/Blogs has a new home.md +++ b/content/blog/Blogs has a new home.md @@ -3,4 +3,3 @@ date: '2022-10-24T12:54:00+00:00' permalink: blogs-has-a-new-home Just moved posts over from blogs.apache.org/infra. New posts all go through the infrastructure-website repo and it should be as easy as posting some markdown. - diff --git a/content/blog/Danny_Angus_Infra_VP.md b/content/blog/Danny_Angus_Infra_VP.md index 36610b6ae..5a6bf8e24 100644 --- a/content/blog/Danny_Angus_Infra_VP.md +++ b/content/blog/Danny_Angus_Infra_VP.md @@ -5,37 +5,45 @@ permalink: danny_angus_infra_vp layout: post _Danny Angus became VP-Infra in 2025, succeeding Myrle Krantz_ ## What is your technical background? + I have no relevant qualification. I'm basically self taught; From books initially, then the internet. Participating in ASF projects has been a very important part of my learning, and that continues today. I have been a tinkerer since i was at school. I had a physics teacher when I was about 17 who retrieved a large computer from a scrap yard (it took three trips) in the early 80s, welded it back together and then we learned how to program it using punched cards and teletype. Imagine our joy when he upgraded it to punched tape. -So when the dot com thing happened I wanted to be part of that, and with a good friend we found our way to interviews. I won the toss and went for a developer role with Perl skills. The interview was a week away, so I bought **Learn Perl in Seven Days**. I got the job. +So when the dot com thing happened I wanted to be part of that, and with a good friend we found our way to interviews. I won the toss and went for a developer role with Perl skills. The interview was a week away, so I bought **Learn Perl in Seven Days**. I got the job. I have kept on learning and doing, getting to Principal Engineer and moving to engineering manager. Learning and following my curiosity. ## When you are not doing ASF stuff, what do you do? -I enjoy baking (and eating baked goods. I learned how to bake so I can eat the things I love.), the outdoors, cycling, hiking, boats, cars, and I am a tinkerer. I'm always tinkering with something, or learning new skills. I've reached the point where I choose to buy old and poorly maintained things instead of new ones, because that gives me more to learn about and tinker with. On the electronics front, I have found a rich seam of tinkering in hand-rolled home automation. Right now my lights have a habit of coming on unexpectedly when the connection is lost to the EC2 instance that I have set up to run it all. (and you thought I wasn't eccentric!) + +I enjoy baking (and eating baked goods. I learned how to bake so I can eat the things I love.), the outdoors, cycling, hiking, boats, cars, and I am a tinkerer. I'm always tinkering with something, or learning new skills. I've reached the point where I choose to buy old and poorly maintained things instead of new ones, because that gives me more to learn about and tinker with. On the electronics front, I have found a rich seam of tinkering in hand-rolled home automation. Right now my lights have a habit of coming on unexpectedly when the connection is lost to the EC2 instance that I have set up to run it all. (and you thought I wasn't eccentric!) ## How did you find your way into open source, and then to The Apache Software Foundation? + It was 24 years ago, and I worked for a startup that wanted to do stuff with natural language processing and email. We needed a mail processor that could use a database for storage and I found Apache James. Of course, the database layer didn't work well enough, so I fixed it, learned a lot, made friends, stuck around. ## What attracted you to working with the Infrastructure team? + I recently came off my bike and had concussion. I think I may have been unconscious when the handover plan was pressed into my hand. No, actually, I have a load of relevant experience from work that I can bring to this: experience like managing jira instances, email processing, cloud products, security, CI/CD all help me understand the work we do and the needs of our user. Skills like people management and budget responsibility are what I can give back. In short, it seemed like I was a good fit, and as workaholic I couldn't resist! ## What are the biggest challenges Infra faces at the moment? + The same challenges the Foundation has always faced: How do we keep our core services up to date? How do we meet the expectations of new generations of builders and innovators? How can we pay for it all? Plus one trending new one: How do we embrace the rise of gen AI? ## Have there been any surprises once you became VP-Infra? -Only good ones, I have been surprised by how nice everyone is, how well everything is run, and best of all how positive and supportive our 'users' were when we met them in real life at Community Over Code. That encouraged me a lot. There is always a risk that Infra, because we have a bunch of paid roles, could be seen as a separate entity paid to serve the volunteer community. + +Only good ones, I have been surprised by how nice everyone is, how well everything is run, and best of all how positive and supportive our 'users' were when we met them in real life at Community Over Code. That encouraged me a lot. There is always a risk that Infra, because we have a bunch of paid roles, could be seen as a separate entity paid to serve the volunteer community. The ASF I joined was a place where eveything was figured out and done by volunteers, often with no better qualifications than curiosity and enthusiasm. I'm keen we continue to encourage volunteers to come and help us do cool things. ## With the Tooling team taking on many of the tasks that had fallen to Infra in the past, what do you see the team focussing on in 2025 and 2026? -It makes a lot of sense to me that we would separate these things. I think Infra, particularly the part that costs money, has to be laser-focused on operations. The challenging and interesting work comes about because our users are innovators whose expectations change with time, while the needs of the Foundation remain somewhat stable, and as a non profit we need to operate on donations of various kinds. -Our archive of historic activity needs to be durable and accessible, we have to support new ways of building software, we are not here to pick winners, and we aspire to give our users the flexibility to truly innovate, not only in the software they invent and build, but also in the way they choose to organize, build and distribute it. +It makes a lot of sense to me that we would separate these things. I think Infra, particularly the part that costs money, has to be laser-focused on operations. The challenging and interesting work comes about because our users are innovators whose expectations change with time, while the needs of the Foundation remain somewhat stable, and as a non profit we need to operate on donations of various kinds. + +Our archive of historic activity needs to be durable and accessible, we have to support new ways of building software, we are not here to pick winners, and we aspire to give our users the flexibility to truly innovate, not only in the software they invent and build, but also in the way they choose to organize, build and distribute it. The tooling team are building some of the tools builders need, but Infra are the ones who will scale and operate it. We all want ASF Infra to be a tailwind to world class innovation. ## Has the team assigned you an emoji yet? + NO! OMG is that an option? diff --git a/content/blog/README.md b/content/blog/README.md index 7fdaa8612..12243074a 100644 --- a/content/blog/README.md +++ b/content/blog/README.md @@ -34,7 +34,8 @@ Pelican supports these tags, which the Infra blog does not use: - template: template to use to generate content - translation (true or false) -The first line of the file should have this metadata, at a minimum: +The first line of the file should have this metadata, at a minimum: + ``` layout: post title: THE ENTRY'S TITLE date: 2010-01-01 permalink: KEY WORDS FROM THE TITLE category CATEGORY ``` @@ -54,6 +55,7 @@ category CATEGORY ### Creating a blog entry To create an entry, create an .md file in this folder. The file's name should probably be like the permalink for the entry. + - give the file a meaningful title that does not duplicate one we have used already. - Starting at the first line of the file, add metadata for the entry, as described above. diff --git a/content/blog/add_wisdom.md b/content/blog/add_wisdom.md index 7ac1f01ed..2b2d4c455 100644 --- a/content/blog/add_wisdom.md +++ b/content/blog/add_wisdom.md @@ -13,21 +13,19 @@ If you join the `users@infra.apache.org` email list, you can help answer the man The issues range in complexity. Any committer or ASF Member is well-positioned to answer all but the most gnarly ones. - **Join the Roundtables** Infra holds regular roundtable discussions on important topics in the World of Infrastructure. These are not lectures, where an Infra member holds forth and everybody is supposed to sit in respectful silence. Rather, the Infra team is hoping to gain insights and guidance from members of the ASF community that will improve how the team works or a tool it is developing. The roundtables usually take place on the **first Wednesday of each month**, on the `#roundtable` channel in the `the-ASF` workspace on Slack. They are available to anyone who can access the ASF workspace on Slack: basically, committers and Members. + - Here are details about the Roundtables, including information on joining the `#roundtable` channel. - We don't record the sessions, but we do take copious notes. - **Build better builds** A group meets regularly (usually the second Thursday of the month) in the `#builds` channel in the `the-ASF` workspace on Slack to explore issues related to builds of ASF projects' products. You are welcome whether you have a puzzle you need help solving, or some insights that may help others. - **Re-vision distribution** Infra is starting to develop the **Artifacts Distribution Platform** (ADP). The idea is to consolidate `dist.apache.org`, `downloads.apache.org`, `rsync.apache.org` and `archive.apache.org` into one service that will free up resources and: diff --git a/content/blog/another-oar-in-the-water.md b/content/blog/another-oar-in-the-water.md index d5032bf0c..2948361f9 100644 --- a/content/blog/another-oar-in-the-water.md +++ b/content/blog/another-oar-in-the-water.md @@ -4,7 +4,7 @@ permalink: another-oar-in-the-water layout: post

-The Infrastructure team (Infra) works behind the scenes to make it possible for Apache's galaxy of committers to do the cool stuff they do, and for the open-source world to get, use, and rely on applications Apache projects produce. Infra supports additions to code repositories, a constant stream of conversation among project committers and contributors, and about 100 terabytes a month of software downloads.

-

Infra provides not just services, but knowledge. Infra's team and project committers rely on clear and accurate documentation about everything from how to update personal information to how to keep the Apache servers online, secure, and speedy.

-

Over 20 years of work, however, Infra has built up a substantial quantity of documentation that may be hard for its intended audience to find, out of date, or no longer relevant. So, in December, 2019, the ASF hired Andrew Wetmore as a part-time Technical Writer-Editor. His job is to curate the existing documentation and, in coordination with the rest of the Infra team and the wider ASF community, extend and improve it.

+The Infrastructure team (Infra) works behind the scenes to make it possible for Apache's galaxy of committers to do the cool stuff they do, and for the open-source world to get, use, and rely on applications Apache projects produce. Infra supports additions to code repositories, a constant stream of conversation among project committers and contributors, and about 100 terabytes a month of software downloads.

+

Infra provides not just services, but knowledge. Infra's team and project committers rely on clear and accurate documentation about everything from how to update personal information to how to keep the Apache servers online, secure, and speedy.

+

Over 20 years of work, however, Infra has built up a substantial quantity of documentation that may be hard for its intended audience to find, out of date, or no longer relevant. So, in December, 2019, the ASF hired Andrew Wetmore as a part-time Technical Writer-Editor. His job is to curate the existing documentation and, in coordination with the rest of the Infra team and the wider ASF community, extend and improve it.

Andrew is a member of the PMC of Apache Royale, and spent fifteen years leading QA and documentation teams for software projects ranging from kitchen-table startups to major corporations. He lives in rural Nova Scotia, on the east coast of Canada, where he is the editor of a small publishing house.

diff --git a/content/blog/apache-and-github-a-friendly.md b/content/blog/apache-and-github-a-friendly.md index 9c0dbc552..68f19d799 100644 --- a/content/blog/apache-and-github-a-friendly.md +++ b/content/blog/apache-and-github-a-friendly.md @@ -3,11 +3,11 @@ date: '2019-04-30T01:08:58+00:00' permalink: apache-and-github-a-friendly layout: post -

With the news of the Apache Software Foundation teaming up more closely with GitHub, we feel it natural to elaborate a bit on what has been going on and what this means for you as a committer and/or user of Apache software.

-

A little bit of history

The Apache Software Foundation started experimenting with git as a source code repository system in 2008, and ventured into GitHub in 2010, where we were graciously offered whatever resources we needed.

At first, this was merely a mirror of our existing git and subversion repositories, but as time went on, and projects expressed an interest in utilizing the many user-friendly features of GitHub, we started work on enabling projects to make proper use of GitHub some three years ago in the middle of 2016. This project, aptly named `gitbox`, ensured that committers could make full use of the GitHub features, while we kept a place within our own infrastructure for people inclined to continue using our infrastructure for their work. As git is decentralized by its very nature, we were able to use GitHub to augment rather than replace our git workflow, bringing our software development to the millions of users on GitHub in addition to the existing Apache community and committers, on a case-by-case basis.

In 2018, we made the decision to combine the two different git service offerings we had into one service, allowing all Apache projects to use GitHub if they so desired. Before then, we had two distinct git services: gitbox and git-wip-us, the initial git service that had been available since 2010. We coordinated the move from git-wip to gitbox with the various Apache projects, and in early 2019 we had migrated all projects to the new service, enabling GitHub features for all git-based Apache projects.

With Microsoft's acquisition of GitHub in 2018, and their commitment to help strengthen open source development, we have received additional resources to help lower the bar for contributions, and we'd like to thank GitHub for their support of the Apache Software Foundation through all nine years of using their platform.

-

What this means for you as a committer


As stated above, our GitHub integration is an augmentation of our existing service. It is available to all committers on git-based projects to make use of, should they so wish. All new git repositories will automatically be available on both GitHub and Gitbox.

For those wishing to take full advantage of GitHub's features, one can link their GitHub and Apache accounts through https://gitbox.apache.org/setup/ which will grant their GitHub account write access to the repositories you'd traditionally have access to at Apache.

People that wish to continue using their Apache committer accounts to commit code may continue doing so on gitbox.apache.org with their Apache credentials. Nothing has changed in that respect.

As Apache is a very email-centered organization, all GitHub activity is naturally linked to our mailing lists to ensure the same level of openness in the development of our software.

-

What this means for you as a user of Apache software

-


For many projects, the move to GitHub means a lower bar to both contributing as well as troubleshooting and submitting issues to the projects, through the GitHub issue and pull request features.

Our commitment to provenance, quality and open governance remains the same, and with our tight integration with GitHub through our linked account service, we are able to bring what made Apache a mark of quality to the many users and contributors on GitHub.

-


-

+

With the news of the Apache Software Foundation teaming up more closely with GitHub, we feel it natural to elaborate a bit on what has been going on and what this means for you as a committer and/or user of Apache software.

+

A little bit of history

The Apache Software Foundation started experimenting with git as a source code repository system in 2008, and ventured into GitHub in 2010, where we were graciously offered whatever resources we needed.

At first, this was merely a mirror of our existing git and subversion repositories, but as time went on, and projects expressed an interest in utilizing the many user-friendly features of GitHub, we started work on enabling projects to make proper use of GitHub some three years ago in the middle of 2016. This project, aptly named `gitbox`, ensured that committers could make full use of the GitHub features, while we kept a place within our own infrastructure for people inclined to continue using our infrastructure for their work. As git is decentralized by its very nature, we were able to use GitHub to augment rather than replace our git workflow, bringing our software development to the millions of users on GitHub in addition to the existing Apache community and committers, on a case-by-case basis.

In 2018, we made the decision to combine the two different git service offerings we had into one service, allowing all Apache projects to use GitHub if they so desired. Before then, we had two distinct git services: gitbox and git-wip-us, the initial git service that had been available since 2010. We coordinated the move from git-wip to gitbox with the various Apache projects, and in early 2019 we had migrated all projects to the new service, enabling GitHub features for all git-based Apache projects.

With Microsoft's acquisition of GitHub in 2018, and their commitment to help strengthen open source development, we have received additional resources to help lower the bar for contributions, and we'd like to thank GitHub for their support of the Apache Software Foundation through all nine years of using their platform.

+

What this means for you as a committer


As stated above, our GitHub integration is an augmentation of our existing service. It is available to all committers on git-based projects to make use of, should they so wish. All new git repositories will automatically be available on both GitHub and Gitbox.

For those wishing to take full advantage of GitHub's features, one can link their GitHub and Apache accounts through https://gitbox.apache.org/setup/ which will grant their GitHub account write access to the repositories you'd traditionally have access to at Apache.

People that wish to continue using their Apache committer accounts to commit code may continue doing so on gitbox.apache.org with their Apache credentials. Nothing has changed in that respect.

As Apache is a very email-centered organization, all GitHub activity is naturally linked to our mailing lists to ensure the same level of openness in the development of our software.

+

What this means for you as a user of Apache software

+


For many projects, the move to GitHub means a lower bar to both contributing as well as troubleshooting and submitting issues to the projects, through the GitHub issue and pull request features.

Our commitment to provenance, quality and open governance remains the same, and with our tight integration with GitHub through our linked account service, we are able to bring what made Apache a mark of quality to the many users and contributors on GitHub.

+


+

As always, if you have any questions, comments, remarks or feedback about this, we welcome you to reach out to the Apache Infrastructure Team at: users@infra.apache.org

diff --git a/content/blog/apache_cms_and_external_build.md b/content/blog/apache_cms_and_external_build.md index b7d67e7e8..52bfdacfb 100644 --- a/content/blog/apache_cms_and_external_build.md +++ b/content/blog/apache_cms_and_external_build.md @@ -9,7 +9,7 @@ layout: post Links to suggestions for setting up a project website, and website guidelines, are available under "PMC resources" in the general Infrastructure documentation page.
-

Recently we've been working with the maven team to facilitate migration of maven.apache.org to the Apache CMS, using maven as the core build system instead of the standard perl build scripts.  A mockup has been created at maventest.apache.org  to see how this will work.   Once the site is completed, there will be roughly 5GB of data to service, spanning dozens of maven components.  Each component will be self-contained and managed externally from the CMS site using a local maven svnpubsub plugin written mainly by Benson Margulies.  The CMS will glue all the components together into a single common site using the extpaths.txt file to configure the paths.

-

The doxia subproject requires special treatment as an independent CMS subproject which is also using maven as it's core build system.  Special logic was introduced into the CMS to properly redirect subproject links based on maven source tree layouts, and the system has worked seamlessly so far.

-

Other recent news includes the migration of the main incubator.apache.org site to the CMS.  There the CMS relies on Ant/Anakia to produce site builds instead of the standard perl build scripts, providing an easy migration path for folks accustomed to the old way of building the site.

+

Recently we've been working with the maven team to facilitate migration of maven.apache.org to the Apache CMS, using maven as the core build system instead of the standard perl build scripts.  A mockup has been created at maventest.apache.org  to see how this will work.   Once the site is completed, there will be roughly 5GB of data to service, spanning dozens of maven components.  Each component will be self-contained and managed externally from the CMS site using a local maven svnpubsub plugin written mainly by Benson Margulies.  The CMS will glue all the components together into a single common site using the extpaths.txt file to configure the paths.

+

The doxia subproject requires special treatment as an independent CMS subproject which is also using maven as it's core build system.  Special logic was introduced into the CMS to properly redirect subproject links based on maven source tree layouts, and the system has worked seamlessly so far.

+

Other recent news includes the migration of the main incubator.apache.org site to the CMS.  There the CMS relies on Ant/Anakia to produce site builds instead of the standard perl build scripts, providing an easy migration path for folks accustomed to the old way of building the site.

Essentially we've made good on the promise that the CMS is simply CI for websites with an easy way of editing pages within your browser.  Support for forrest builds is planned but hasn't been fleshed out with any live examples to date.  That would round out the major java site-building technologies currently deployed by Apache projects- volunteers welcome!

diff --git a/content/blog/apache_cms_latest_new_feature.md b/content/blog/apache_cms_latest_new_feature.md index 82b20c1cc..edd96c57a 100644 --- a/content/blog/apache_cms_latest_new_feature.md +++ b/content/blog/apache_cms_latest_new_feature.md @@ -8,9 +8,9 @@ layout: post Links to suggestions for setting up a project website, and website guidelines, are available under "PMC resources" in the general Infrastructure documentation page.
-

Over the past few months the Apache CMS has seen lots of new improvements, all under the general theme of making the system more performant.  Supporting very large sites like the Apache OpenOffice User Site with almost 10 GB of content has presented new challenges, met largely with the introduction of zfs clones for generating per-user server-side working copies, changing what was an O(N) rsync job to an O(1) operation.  We've also moved the update processing out-of-band to further cut down on the time it takes for the bookmarklet to produce a page, eliminating all O(N) algorithms from the process.

-

 More recent work focuses on the merge-based publication process, which for large changesets took a considerable amount of time to process.  That too has been recoded based on svnmucc and is now another O(1) operation- essentially a perfect copy of staging with a few adjustments for "external" paths.

-

Combine that with the activity around parallelizing the build system and you have a completely different performance profile compared to the way the system worked in 2011.  In short, if you haven't tried the CMS lately, and were a bit offput by the page rendering times or build speeds, have another look!

-

-

Next up: describing the work done around external build support, focusing first on maven based sites.

+

Over the past few months the Apache CMS has seen lots of new improvements, all under the general theme of making the system more performant.  Supporting very large sites like the Apache OpenOffice User Site with almost 10 GB of content has presented new challenges, met largely with the introduction of zfs clones for generating per-user server-side working copies, changing what was an O(N) rsync job to an O(1) operation.  We've also moved the update processing out-of-band to further cut down on the time it takes for the bookmarklet to produce a page, eliminating all O(N) algorithms from the process.

+

 More recent work focuses on the merge-based publication process, which for large changesets took a considerable amount of time to process.  That too has been recoded based on svnmucc and is now another O(1) operation- essentially a perfect copy of staging with a few adjustments for "external" paths.

+

Combine that with the activity around parallelizing the build system and you have a completely different performance profile compared to the way the system worked in 2011.  In short, if you haven't tried the CMS lately, and were a bit offput by the page rendering times or build speeds, have another look!

+

+

Next up: describing the work done around external build support, focusing first on maven based sites.


diff --git a/content/blog/apache_cms_new_features_for.md b/content/blog/apache_cms_new_features_for.md index 8edd6918a..73e9ce772 100644 --- a/content/blog/apache_cms_new_features_for.md +++ b/content/blog/apache_cms_new_features_for.md @@ -9,8 +9,8 @@ layout: post Links to suggestions for setting up a project website, and website guidelines, are available under "PMC resources" in the general Infrastructure documentation page.
-

Two new features have recently been added to the CMS, courtesy of David Blevins.  These features are geared towards streamlining the user experience for anonymous users.  The first feature is "Quick Mail", which is the analog of "Quick Commit" but for anonymous users who cannot otherwise commit their changes directly.  Quick Mail, which is enabled by default, will take the immediate submission of an anonymous Edit session and post it directly to the project's dev list, saving several steps that might be hard for a new user to walk through.

-

The second feature is a natural result of that known as anonymous clones.  In the subsequent mailout from "Quick Mail", there will be an URL for committers to use to effectively clone the working copy of the anonymous user who generated the patch.  This makes review and subsequent commit operations much more convenient than directly applying the emailed patch to a local working copy.  In fact it is possible for users to clone a non-anonymous user's working copy, so anyone experiencing chronic problems with their working copy on the CMS can get help from other committers by simply using the "Mail Diff" feature to contact either the dev list or another apache committer with details of their problem.

-

We have added these features in the hopes this will considerably lower the bar for anonymous users in particular to take advantage of the CMS.  Please let your community know about them!

-


+

Two new features have recently been added to the CMS, courtesy of David Blevins.  These features are geared towards streamlining the user experience for anonymous users.  The first feature is "Quick Mail", which is the analog of "Quick Commit" but for anonymous users who cannot otherwise commit their changes directly.  Quick Mail, which is enabled by default, will take the immediate submission of an anonymous Edit session and post it directly to the project's dev list, saving several steps that might be hard for a new user to walk through.

+

The second feature is a natural result of that known as anonymous clones.  In the subsequent mailout from "Quick Mail", there will be an URL for committers to use to effectively clone the working copy of the anonymous user who generated the patch.  This makes review and subsequent commit operations much more convenient than directly applying the emailed patch to a local working copy.  In fact it is possible for users to clone a non-anonymous user's working copy, so anyone experiencing chronic problems with their working copy on the CMS can get help from other committers by simply using the "Mail Diff" feature to contact either the dev list or another apache committer with details of their problem.

+

We have added these features in the hopes this will considerably lower the bar for anonymous users in particular to take advantage of the CMS.  Please let your community know about them!

+



diff --git a/content/blog/apache_org_04_09_2010.md b/content/blog/apache_org_04_09_2010.md index 93ffb01c8..2355597d8 100644 --- a/content/blog/apache_org_04_09_2010.md +++ b/content/blog/apache_org_04_09_2010.md @@ -3,51 +3,50 @@ date: '2010-04-13T05:04:50+00:00' permalink: apache_org_04_09_2010 layout: post -

Apache.org services recently suffered a direct, targeted attack against our infrastructure, specifically the server hosting our issue-tracking software.

-

The Apache Software Foundation uses a donated instance of Atlassian JIRA as an issue tracker for our projects. Among other projects, the ASF Infrastructure Team uses it to track issues and requests. Our JIRA instance was hosted on brutus.apache.org, a machine running Ubuntu Linux 8.04 LTS.

-

Password Security

-

If you are a user of the Apache hosted JIRA, Bugzilla, or Confluence, a hashed copy of your password has been compromised.

-

JIRA and Confluence both use a SHA-512 hash, but without a random salt. We believe the risk to simple passwords based on dictionary words is quite high, and most users should rotate their passwords.

-

Bugzilla uses a SHA-256, including a random salt. The risk for most users is low to moderate, since pre-built password dictionaries are not effective, but we recommend users should still remove these passwords from use.

-

In addition, if you logged into the Apache JIRA instance between April 6th and April 9th, you should consider the password as compromised, because the attackers changed the login form to log them.

-

What Happened?

-

On April 5th, the attackers via a compromised Slicehost server opened a new issue, INFRA-2591. This issue contained the following text:

+

Apache.org services recently suffered a direct, targeted attack against our infrastructure, specifically the server hosting our issue-tracking software.

+

The Apache Software Foundation uses a donated instance of Atlassian JIRA as an issue tracker for our projects. Among other projects, the ASF Infrastructure Team uses it to track issues and requests. Our JIRA instance was hosted on brutus.apache.org, a machine running Ubuntu Linux 8.04 LTS.

+

Password Security

+

If you are a user of the Apache hosted JIRA, Bugzilla, or Confluence, a hashed copy of your password has been compromised.

+

JIRA and Confluence both use a SHA-512 hash, but without a random salt. We believe the risk to simple passwords based on dictionary words is quite high, and most users should rotate their passwords.

+

Bugzilla uses a SHA-256, including a random salt. The risk for most users is low to moderate, since pre-built password dictionaries are not effective, but we recommend users should still remove these passwords from use.

+

In addition, if you logged into the Apache JIRA instance between April 6th and April 9th, you should consider the password as compromised, because the attackers changed the login form to log them.

+

What Happened?

+

On April 5th, the attackers via a compromised Slicehost server opened a new issue, INFRA-2591. This issue contained the following text:

ive got this error while browsing some projects in jira http://tinyurl.com/XXXXXXXXX [obscured] -
-

Tinyurl is a URL redirection and shortening tool. This specific URL redirected back to the Apache instance of JIRA, at a special URL containing a cross site scripting (XSS) attack. The attack was crafted to steal the session cookie from the user logged-in to JIRA. When this issue was opened against the Infrastructure team, several of our administrators clicked on the link. This compromised their sessions, including their JIRA administrator rights.

-

At the same time as the XSS attack, the attackers started a brute force attack against the JIRA login.jsp, attempting hundreds of thousands of password combinations.

-

On April 6th, one of these methods was successful. Having gained administrator privileges on a JIRA account, the attackers used this account to disable notifications for a project, and to change the path used to upload attachments. The path they chose was configured to run JSP files, and was writable by the JIRA user. They then created several new issues and uploaded attachments to them. One of these attachments was a JSP file that was used to browse and copy the filesystem. The attackers used this access to create copies of many users' home directories and various files. They also uploaded other JSP files that gave them backdoor access to the system using the account that JIRA runs under.

-

By the morning of April 9th, the attackers had installed a JAR file that would collect all passwords on login and save them. They then sent password reset mails from JIRA to members of the Apache Infrastructure team. These team members, thinking that JIRA had encountered an innocent bug, logged in using the temporary password sent in the mail, then changed the passwords on their accounts back to their usual passwords.

-

One of these passwords happened to be the same as the password to a local user account on brutus.apache.org, and this local user account had full sudo access. The attackers were thereby able to login to brutus.apache.org, and gain full root access to the machine. This machine hosted the Apache installs of JIRA, Confluence, and Bugzilla.

-

Once they had root on brutus.apache.org, the attackers found that several users had cached Subversion authentication credentials, and used these passwords to log in to minotaur.apache.org (aka people.apache.org), our main shell server. On minotaur, they were unable to escalate privileges with the compromised accounts.

-

About 6 hours after they started resetting passwords, we noticed the attackers and began shutting down services. We notified Atlassian of the previously unreported XSS attack in JIRA and contacted SliceHost. Atlassian was responsive. Unfortunately, SliceHost did nothing and 2 days later, the very same virtual host (slice) attacked Atlassian directly.

-

We started moving services to a different machine, thor.apache.org. The attackers had root access on brutus.apache.org for several hours, and we could no longer trust the operating system on the original machine.

-

By April 10th, JIRA and Bugzilla were back online.

-

On April 13th, Atlassian provided a patch for JIRA to prevent the XSS attack. See + +

Tinyurl is a URL redirection and shortening tool. This specific URL redirected back to the Apache instance of JIRA, at a special URL containing a cross site scripting (XSS) attack. The attack was crafted to steal the session cookie from the user logged-in to JIRA. When this issue was opened against the Infrastructure team, several of our administrators clicked on the link. This compromised their sessions, including their JIRA administrator rights.

+

At the same time as the XSS attack, the attackers started a brute force attack against the JIRA login.jsp, attempting hundreds of thousands of password combinations.

+

On April 6th, one of these methods was successful. Having gained administrator privileges on a JIRA account, the attackers used this account to disable notifications for a project, and to change the path used to upload attachments. The path they chose was configured to run JSP files, and was writable by the JIRA user. They then created several new issues and uploaded attachments to them. One of these attachments was a JSP file that was used to browse and copy the filesystem. The attackers used this access to create copies of many users' home directories and various files. They also uploaded other JSP files that gave them backdoor access to the system using the account that JIRA runs under.

+

By the morning of April 9th, the attackers had installed a JAR file that would collect all passwords on login and save them. They then sent password reset mails from JIRA to members of the Apache Infrastructure team. These team members, thinking that JIRA had encountered an innocent bug, logged in using the temporary password sent in the mail, then changed the passwords on their accounts back to their usual passwords.

+

One of these passwords happened to be the same as the password to a local user account on brutus.apache.org, and this local user account had full sudo access. The attackers were thereby able to login to brutus.apache.org, and gain full root access to the machine. This machine hosted the Apache installs of JIRA, Confluence, and Bugzilla.

+

Once they had root on brutus.apache.org, the attackers found that several users had cached Subversion authentication credentials, and used these passwords to log in to minotaur.apache.org (aka people.apache.org), our main shell server. On minotaur, they were unable to escalate privileges with the compromised accounts.

+

About 6 hours after they started resetting passwords, we noticed the attackers and began shutting down services. We notified Atlassian of the previously unreported XSS attack in JIRA and contacted SliceHost. Atlassian was responsive. Unfortunately, SliceHost did nothing and 2 days later, the very same virtual host (slice) attacked Atlassian directly.

+

We started moving services to a different machine, thor.apache.org. The attackers had root access on brutus.apache.org for several hours, and we could no longer trust the operating system on the original machine.

+

By April 10th, JIRA and Bugzilla were back online.

+

On April 13th, Atlassian provided a patch for JIRA to prevent the XSS attack. See JRA-20994 and JRA-20995 for details. -

-

Our Confluence wiki remains offline at this time. We are working to restore it.

-

What worked?

- -

What didn't work?

- -

What are we changing?

-

We hope our disclosure has been as open as possible and true to the ASF spirit. Hopefully others can learn from our mistakes.

diff --git a/content/blog/apache_org_incident_report_for.md b/content/blog/apache_org_incident_report_for.md index 2166def82..d32bf4858 100644 --- a/content/blog/apache_org_incident_report_for.md +++ b/content/blog/apache_org_incident_report_for.md @@ -3,20 +3,20 @@ date: '2012-05-29T16:59:09+00:00' permalink: apache_org_incident_report_for layout: post -

Last week, internal audit activity discovered that the access logs of some committer-only Apache services contained passwords but had been available to every Apache committer.

-

-

The problem

-

The httpd logs of several ASF services are aggregated and archived on minotaur.apache.org.  Minotaur is also people.apache.org, the shell host for committers, and committers were encouraged to analyse the logs and produce aggregated data.

However, for two services, the archived logs included forensic logs, which are extra-verbose logs that include all HTTP request headers.  (The logs are never encrypted, even if the HTTP connection was wrapped by SSL encryption.)  Both of these services http://s.apache.org and http://svn.apache.org allow anyone to use them in a read-only manner anonymously, and allow further operations (such as creating shortlinks) to LDAP-authenticated committers.  Authentication is usually done by embedding the username and password, encoded in base64, in the "Authorization:" HTTP header, under SSL encryption.

Base64 is a reversible transform.  (It is an encoding, not a cipher.)

Consequently, any Apache committer could learn the passwords of any other committer by reading the log files and reversing the base64 encoding.

-

Shutting the barn door

-

The logs archive directory was made readable by the root user only.  Forensic logging was disabled, and past forensic logs deleted.  ZFS snapshots containing those logs were destroyed, too.

-

Finding the horse

-

We know that several committers had on one occasion or another copied the logs in order to analyse them, so we operated on the assumption that copies of the sensitive forensic logs were circulating on hardware we do not control.  We therefore opted to have all passwords changed, or reset.

Several Apache committers whose passwords grant very high access were advised privately to change their passwords.  The root@ team ensured the follow-through and, before announcing the vulnerability any further, changed the passwords of those whom had not done so themselves.  The root@ team also changed the passwords of all non-human (role) accounts on those services.

The vulnerability was then announced to all Apache committers with the same instructions: 'Your passwords may be compromised; change them "now"; we will explain the problem later.'.  This notice was authenticated via a PGP signature and via acknowledging it in a root-owned file on people.apache.org.

Finally, passwords that have not been changed after forensic logs had been disabled and, therefore, were presumed to be contained in compromised forensic logs were changed by the root@ team to random strings.

-

Implications

-

Were some committer to have compromised another Apache account using this vulnerability prior to these steps being taken, note that root access to all apache.org hosts is only available using one-time-passwords (otp) for certain privileged sudo users.  Such account holders have been instructed not to use the same password for otp as for LDAP, so this would not have resulted in an attacker gaining root privileges without our knowledge.  All of our commit activity is peer-reviewed and logged to various commit lists, and no reports of unusual commit activity have been received during the time frame in which this exposure was effective.  In fact no unusual activity has ever been reported regarding any of our LDAP-based services, so there is no reason for us to suspect malicious activity has occurred as a result of this vulnerability.

-

Preventing recurrence

+

Last week, internal audit activity discovered that the access logs of some committer-only Apache services contained passwords but had been available to every Apache committer.

+

+

The problem

+

The httpd logs of several ASF services are aggregated and archived on minotaur.apache.org.  Minotaur is also people.apache.org, the shell host for committers, and committers were encouraged to analyse the logs and produce aggregated data.

However, for two services, the archived logs included forensic logs, which are extra-verbose logs that include all HTTP request headers.  (The logs are never encrypted, even if the HTTP connection was wrapped by SSL encryption.)  Both of these services http://s.apache.org and http://svn.apache.org allow anyone to use them in a read-only manner anonymously, and allow further operations (such as creating shortlinks) to LDAP-authenticated committers.  Authentication is usually done by embedding the username and password, encoded in base64, in the "Authorization:" HTTP header, under SSL encryption.

Base64 is a reversible transform.  (It is an encoding, not a cipher.)

Consequently, any Apache committer could learn the passwords of any other committer by reading the log files and reversing the base64 encoding.

+

Shutting the barn door

+

The logs archive directory was made readable by the root user only.  Forensic logging was disabled, and past forensic logs deleted.  ZFS snapshots containing those logs were destroyed, too.

+

Finding the horse

+

We know that several committers had on one occasion or another copied the logs in order to analyse them, so we operated on the assumption that copies of the sensitive forensic logs were circulating on hardware we do not control.  We therefore opted to have all passwords changed, or reset.

Several Apache committers whose passwords grant very high access were advised privately to change their passwords.  The root@ team ensured the follow-through and, before announcing the vulnerability any further, changed the passwords of those whom had not done so themselves.  The root@ team also changed the passwords of all non-human (role) accounts on those services.

The vulnerability was then announced to all Apache committers with the same instructions: 'Your passwords may be compromised; change them "now"; we will explain the problem later.'.  This notice was authenticated via a PGP signature and via acknowledging it in a root-owned file on people.apache.org.

Finally, passwords that have not been changed after forensic logs had been disabled and, therefore, were presumed to be contained in compromised forensic logs were changed by the root@ team to random strings.

+

Implications

+

Were some committer to have compromised another Apache account using this vulnerability prior to these steps being taken, note that root access to all apache.org hosts is only available using one-time-passwords (otp) for certain privileged sudo users.  Such account holders have been instructed not to use the same password for otp as for LDAP, so this would not have resulted in an attacker gaining root privileges without our knowledge.  All of our commit activity is peer-reviewed and logged to various commit lists, and no reports of unusual commit activity have been received during the time frame in which this exposure was effective.  In fact no unusual activity has ever been reported regarding any of our LDAP-based services, so there is no reason for us to suspect malicious activity has occurred as a result of this vulnerability.

+

Preventing recurrence

No code changes were needed to the software that s.apache.org and svn.apache.org run; the software was behaving correctly according to its configuration, but the configuration itself and the in-house -log archiving scripts were incorrect.

A member of the infrastructure team will be approaching the Apache HTTPD PMC with a documentation patch for mod_log_forensic.

-

Epilogue

+log archiving scripts were incorrect.

A member of the infrastructure team will be approaching the Apache HTTPD PMC with a documentation patch for mod_log_forensic.

+

Epilogue

There were no malicious parties involved here (to our knowledge); we just made a configuration error.  The nature of the error meant we had to assume all passwords were compromised, and that was costly to fix.

We hope our disclosure has been as open as possible and true to the ASF spirit.  Hopefully others can learn from our mistakes.  See our prior incident reports from the Apache Infrastructure Team.

Committers please address questions to root@apache.org only.

Queries from the press should be sent to press@apache.org.

Happy hacking!

diff --git a/content/blog/apache_services_and_sha_1.md b/content/blog/apache_services_and_sha_1.md index b7c749b42..40155f6a3 100644 --- a/content/blog/apache_services_and_sha_1.md +++ b/content/blog/apache_services_and_sha_1.md @@ -4,22 +4,22 @@ permalink: apache_services_and_sha_1 layout: post

-As some of you may have already encountered, certain services within Apache appear to have broken SSL support. While the cert is still valid, there is a part of the cert that both Microsoft and Google have stopped accepting as valid. We are working on fixing this and will use this blogpost to track what services will be updated and when (as well as emails).

-

-

-

Services:

- -

Schedule:

- -

General

What is Community Over Code?

diff --git a/content/pages/contact.md b/content/pages/contact.md index 1a7ec74cd..1fe6285c4 100644 --- a/content/pages/contact.md +++ b/content/pages/contact.md @@ -1,15 +1,18 @@ Title: Contact the Infrastructure Team license: https://www.apache.org/licenses/LICENSE-2.0 - ### Request a change to the main ASF website + The Marketing and Publicity (M&P) committee is responsible for the main ASF website. The source for the website is at github.com/apache/www-site. You can create an Issue there to state what you think should change, and what you propose the change to be. ### Request a change to the Infrastructure website + The source for this website is at github.com/apache/infrastructure-website. You can create an Issue there to state what you think should change, and what you propose the change to be. ### Email lists + Infra monitors and participates in these email addresses: + - `users@infra.apache.org` is for general infrastructure discussions and suggestions, and for questions related to ASF infrastructure and the Infra team that do **not** rise to the level of a Jira ticket; so if your question requires guidance or action by Infra, please open a Jira ticket. See the `security@infra` note below if your problem relates to your ASF account in a way that prevents you from opening a Jira ticket. Only committers and ASF members can subscribe to the list. - `private@infra.apache.org` is for communications that may involve PII, personnel issues, or other information that should not be widely shared. Only ASF Members and Board Members can subscribe to the list. - Use `security@infra.apache.org` to report **infrastructure-related** security issues (you cannot subscribe to this list) or if your problem prevents you from opening a Jira ticket. See the third entry on Contacting Infra if you are reporting a security issue specific to an ASF project or a project's product. @@ -18,16 +21,21 @@ Infra monitors and participates in these email addresses: In the past there was the `infrastructure@apache.org` mailing list. This address is no longer in use. ### You think your IP address has been blocked + If you cannot access one or more ASF repositories or services, your IP address may have been blocked. Before contacting Infra, review Abuse and Connectivity Issues at the ASF (ABC). The page lists the common overuse (or abuse) issues that affect our site's work and cause an automatic IP address block, and recommends steps to get such a block removed. ABC also provides a channel to contact Infra if you need more information than the page provides. + ### Chat + Join us on [Slack](https://the-asf.slack.com/) in the #asfinfra channel for direct messaging! ### Request resources/tasks/projects -Please create a [Jira](https://issues.apache.org/jira/) ticket for your request. + +Please create a [Jira](https://issues.apache.org/jira/) ticket for your request. Review the [guidelines for creating a Jira ticket](jira-guidelines). ### Suggest a service, or an enhancement to an existing service + Visit the Infra suggestion box. ### What we need to know ### @@ -37,6 +45,7 @@ Here's a [guide to what to tell us](infra-contact.html) so we can respond to you ### In case of emergency ### If there is an absolutely urgent problem that must be handled **at once**, such as a malicious hacker having an active root through shell on `archive.apache.org`, members of the ASF community can follow this escalation path: + 1. (anyone) Send an email to `security@infra` describing the issue. If you get no response within fifteen minutes... 2. (anyone who has a presence on ASF Slack) Create a message on the `#asfinfra` channel in the Slack Apache space (link is at the top of the page). If you get no response within ten minutes... 3. (anyone with an ASF Jira account) Open a Jira ticket (link is higher in the page) for INFRA, with a priority of **blocker**. diff --git a/content/pages/content-moderation.md b/content/pages/content-moderation.md index 2687ca902..0722d8393 100644 --- a/content/pages/content-moderation.md +++ b/content/pages/content-moderation.md @@ -1,7 +1,7 @@ Title: Content Moderation Policies license: https://www.apache.org/licenses/LICENSE-2.0 -This page lists the most common questions and answers surrounding content moderation +This page lists the most common questions and answers surrounding content moderation policies at ASF Infrastructure, including, but not limited to: - Data Privacy (GDPR, CCPA, CPPA/PIPEDA, etc.) @@ -13,23 +13,24 @@ The content the Infrastructure team can moderate includes text on ASF web pages, See also the guidelines for mailing list moderation. ## Personal Data Privacy Requests -Requests regarding exposure of PII (Personal Identifiable Information) **MUST** be sent to our -Data Privacy Officer at `privacy@apache.org`. For more information on personal data privacy, + +Requests regarding exposure of PII (Personal Identifiable Information) **MUST** be sent to our +Data Privacy Officer at `privacy@apache.org`. For more information on personal data privacy, see https://privacy.apache.org/. ## Accidental exposure of credentials or company-sensitive data -**TL;DR:** If you or your company experience accidental exposure of sensitive data or credentials in one of the types of content listed above, +**TL;DR:** If you or your company experience accidental exposure of sensitive data or credentials in one of the types of content listed above, you should always assume that the data is now public, and immediately invalidate those credentials. -Depending on the context and circumstances of your request, we _may_ be able to remove the +Depending on the context and circumstances of your request, we _may_ be able to remove the following items: - Specific emails from our mailing list archives* - Public comments on PRs/issues* - Web pages or packages with compromised data -`*`Removing emails from public archives is not likely to be approved, as propagation of email to multiple hosts and locations makes it +`*`Removing emails from public archives is not likely to be approved, as propagation of email to multiple hosts and locations makes it virtually impossible to enact. We are **not** able to, and will not spend time with the following: @@ -43,7 +44,7 @@ If you are a **mailing list moderator**, see this this guidance on possible spam. + - Review this guidance on possible spam. - If you still have an issue, report it to `users@infra.apache.org`. If you seem to be receiving spam from an ASF email account, report the issue to `abuse@infra.apache.org`. diff --git a/content/pages/contributors.md b/content/pages/contributors.md index bd9e1a3d2..324dc1aa8 100644 --- a/content/pages/contributors.md +++ b/content/pages/contributors.md @@ -15,7 +15,6 @@ More information is available in the [guide](new-committers-guide.html) and [FAQ - Source code repositories - Providing feedback to Apache projects

-

Community Development is here to help!

Apache values "Community over code", and is full of volunteers who want to help you. Guideposts and helpful information and mentors for newcomers to Apache can be found at Community Development. @@ -53,7 +52,7 @@ projects have different preferences about how you should submit feedback. Check A vital part of the ASF projects are the project mailing lists. Most projects have a users' list named `users@${project}.apache.org` or `user@${project}.apache.org`. Subscribe to it by sending an e-mail to `users-subscribe@${project}.apache.org`, then follow the instructions. We have many tips on asking questions in a way that gets answers. -Tell the developer and user community about your use of the software product, your experiences in setting it up, issues you encountered, and any general feedback you may have. Don't forget to include any positive observations that will show you appreciate the effort the team is making. Your story will likely be very welcome if you write it clearly, in a friendly tone, and Read The Manual before asking for answers that you could find there. You'll probably receive enthusiastic responses from some of the developers and other users (although responses may not appear right away: everybody is busy). +Tell the developer and user community about your use of the software product, your experiences in setting it up, issues you encountered, and any general feedback you may have. Don't forget to include any positive observations that will show you appreciate the effort the team is making. Your story will likely be very welcome if you write it clearly, in a friendly tone, and Read The Manual before asking for answers that you could find there. You'll probably receive enthusiastic responses from some of the developers and other users (although responses may not appear right away: everybody is busy). If you found specific issues or have an idea about how things should work, the project may ask you to submit a detailed bug report or patch to improve things. @@ -74,7 +73,7 @@ A patch is a computer-generated file that describes differences between differen See [How to submit a patch for project code](patch.html) for further details.

How to suggest changes to project websites

-

One of the simplest ways to contribute to Apache projects is by suggesting improvements to the project's website or product documentation. If something doesn't make +

One of the simplest ways to contribute to Apache projects is by suggesting improvements to the project's website or product documentation. If something doesn't make sense to you, or if you have a better way to explain something, send the project a patch! Projects use many different content management systems for their websites. Some systems have a web-based editor that makes it relatively simple to provide improvements, once you have access rights. Ask the PMC for such rights, explaining how you would like to help, or simply provide your suggestions in an email. diff --git a/content/pages/crypto.md b/content/pages/crypto.md index 6f3b482c4..3147c289b 100644 --- a/content/pages/crypto.md +++ b/content/pages/crypto.md @@ -5,7 +5,7 @@ This page provides PMC members with the information they need to ensure U.S. exp **This page is not intended for users of Apache products**. Users should consult the export control status of our products. -**Note**: The regulations covering US export control laws for encryption are continuously changing, and the latest modification of this page, to describe the current state of regulations, was May 24, 2019. +**Note**: The regulations covering US export control laws for encryption are continuously changing, and the latest modification of this page, to describe the current state of regulations, was May 24, 2019. This page describes the process which should be continued until the Apache VP Legal Affairs approves an updated version. diff --git a/content/pages/csp.md b/content/pages/csp.md index 200de8f76..2e4e43280 100644 --- a/content/pages/csp.md +++ b/content/pages/csp.md @@ -1,7 +1,7 @@ Title: Content Security Policy for project websites license: https://www.apache.org/licenses/LICENSE-2.0 -This policy became effective **March 1, 2025**. +This policy became effective **March 1, 2025**. For your project's website: @@ -9,7 +9,7 @@ For your project's website: - External resources, such as videos or PDFs, from providers with which we do not have a Data Processing Agreement (DPA) are **not allowed** to be embedded in the project's website. If you have a DPA request or inquiry, contact `privacy@apache.org`. They can also tell you if a provider whose content you want to embed in your website has already signed a DPA. - Links that lead to downloadable external resources **are allowed** if the site visitor must give explicit consent in order to see or use the content (such as by clicking a button or a link). This consent cannot be opt-out, and there must be a clear way for the visitor to retract consent at a later time. -This policy brings project websites into alignment with the security and privacy parameters defined by the VP, Data Privacy and as requested by The ASF Security Committee. We ask that projects do not circumvent them without express permission from our VP, Data Privacy. +This policy brings project websites into alignment with the security and privacy parameters defined by the VP, Data Privacy and as requested by The ASF Security Committee. We ask that projects do not circumvent them without express permission from our VP, Data Privacy. The instructions on this page can help you update the CSP policy for your project's website. diff --git a/content/pages/cwiki.md b/content/pages/cwiki.md index 50e735ce7..69b0b20a0 100644 --- a/content/pages/cwiki.md +++ b/content/pages/cwiki.md @@ -31,19 +31,19 @@ When Infra creates the space, it sets up a $project-committer group (or equivale - You can create user groups in addition to the standard groups:

Watching a cwiki page

-Cwiki users, including those not involved in a project, can 'watch' pages in a project's space to receive update notices when information on that page changes. +Cwiki users, including those not involved in a project, can 'watch' pages in a project's space to receive update notices when information on that page changes. -To watch a page: +To watch a page: - Log in in to the ASF cwiki. - Locate the page you want to watch. - - Click **Watch** on the top menu bar. + - Click **Watch** on the top menu bar. To stop watching a page: - Log in in to the ASF cwiki. - Click your profile icon at the top right of the wiki page. - - From the dropdown menu that appears, select **Watches**. + - From the dropdown menu that appears, select **Watches**. - The list of pages you are watching appears, and you can remove those you no longer want to watch. Infra can help you set up a role account that can watch for any changes in your space and send notices about them to an email list. This can lead to a large amount of traffic, so you can choose a digest option that provides a daily summary of changes. diff --git a/content/pages/digicert-use.md b/content/pages/digicert-use.md index d3afc8763..97cec737d 100644 --- a/content/pages/digicert-use.md +++ b/content/pages/digicert-use.md @@ -2,11 +2,13 @@ Title: Using the Digicert code signing service license: https://www.apache.org/licenses/LICENSE-2.0 ## Transition to DigiCert + The ASF used Symantec's Secure App Service to provide Windows and JAR code signing functionality from 2014 to 2019. In 2019 the ASF moved from the Symantec service to DigiCert ONE. All new signing must be via the DigiCert service. If you require assistance migrating to the DigiCert service, please open an INFRA Jira ticket and select code signing as the component. ## DigiCert Secure Software + DigiCert Secure Software supports a range of signing tools and formats. For the full list see the [client user guide](https://digicert.github.io/snowbird-doc/#/administration-guides/secure-software-manager/index). Whichever signing option you choose, you will need to complete four steps: 1. Obtain a DigiCert ONE account @@ -20,7 +22,7 @@ DigiCert Secure Software supports a range of signing tools and formats. For the Adding a new PMC or a new user to an existing PMC needs to be performed by the infrastructure team. Please open an INFRA Jira ticket and select code signing as the component. -When the infrastructure team creates your account you will receive a password reset email. The link in that email is only valid for 12 hours. If you are unable to complete the creation of your account in that time you can request a new password reset email by going to DigiCert ONE and clicking the password reset link. Your username is your ASF email address. You should then receive a new password reset email you can use to set your password. +When the infrastructure team creates your account you will receive a password reset email. The link in that email is only valid for 12 hours. If you are unable to complete the creation of your account in that time you can request a new password reset email by going to DigiCert ONE and clicking the password reset link. Your username is your ASF email address. You should then receive a new password reset email you can use to set your password. You also need to configure your OTP token. Officially, only Google authenticator is supported but any similar tool should also work. @@ -66,7 +68,6 @@ If you use JSign 4.0, you can skip this step. The DigiCert ONE client tools are not available for MacOS. Use JSign 4.0 so you can skip this step. - ### Step 4: Configure your chosen signing tool #### Signing Windows binaries on Windows using signtool.exe @@ -87,7 +88,6 @@ To sign a file with SHA-256 rather than SHA-512 use `... /fd sha256...` rather t alias="" tsaurl="http://timestamp.digicert.com" - #### Signing Windows binaries on Linux with JSign 4.0+ 1. Download jsign `wget https://github.com/ebourg/jsign/releases/download/4.0/jsign_4.0_all.deb`. diff --git a/content/pages/doc.md b/content/pages/doc.md index 17de6657a..72ea953ad 100644 --- a/content/pages/doc.md +++ b/content/pages/doc.md @@ -19,6 +19,7 @@ Infra provides a library of resources that is constantly evolving to reflect the ### PMC resources ### #### Source code #### + - [Project source code repositories](version-control.html) - [Repositories for Maven releases and snapshots](repository-faq.html) - .asf.yaml features for Git repositories @@ -28,6 +29,7 @@ Infra provides a library of resources that is constantly evolving to reflect the - [Dependabot for dependency management](dependabot.html) #### Build and release #### + - [Release creation process](release-publishing.html) - Creating optional [Maven releases](publishing-maven-artifacts.html) - [Signing releases](release-signing.html) @@ -40,6 +42,7 @@ Infra provides a library of resources that is constantly evolving to reflect the - [Deploying a self-hosted runner](self-hosted-runners.html) #### Website, blog and wiki #### + - [Project website guidelines](website-guidelines.html). **Note**: No new projects can use the Apache CMS, which has reached end-of-life. Any projects still using the CMS must migrate to another resource to maintain their websites. Projects that have not migrated their site may find that they are no longer able to update it. - Here is how one project did the migration. - A [project site template](asf-pelican.html) written in Pelican is available to smooth migration away from the CMS, and to support creation of new project sites. @@ -48,11 +51,11 @@ Infra provides a library of resources that is constantly evolving to reflect the - Managing permissions on your project's Confluence space. #### Other #### + - [Managing project committers](managing-committers.html) - [Virtual machine for your project](vm-policy.html) - [Mailing list moderation](mailing-list-moderation.html) - ### Committer resources ### - [New committer's guide](new-committers-guide.html) diff --git a/content/pages/docker-hub-policy.md b/content/pages/docker-hub-policy.md index fb234944d..83b6dac91 100644 --- a/content/pages/docker-hub-policy.md +++ b/content/pages/docker-hub-policy.md @@ -1,8 +1,7 @@ Title: Docker Hub use policy license: https://www.apache.org/licenses/LICENSE-2.0 - -**Docker** is an open source containerization platform. Developers can package applications in **containers**, components combining application source code with the operating system (OS) libraries and dependencies required to run that code in any environment. +**Docker** is an open source containerization platform. Developers can package applications in **containers**, components combining application source code with the operating system (OS) libraries and dependencies required to run that code in any environment. Docker Hub is the world's largest public registry for hosting Docker images. It is the default download source when you are working with Docker. diff --git a/content/pages/email_lists.md b/content/pages/email_lists.md index 165c2fc66..1bdec22a5 100644 --- a/content/pages/email_lists.md +++ b/content/pages/email_lists.md @@ -7,7 +7,7 @@ In `lists.apache.org` you can browse, search for, and read emails on mailing lis - If you have logged in: - if you are an ASF Member, you can access all ASF mailing lists. - if you are not an ASF Member but are on the PMC of a project, you can access, in addition to the public lists, the private lists of that project. - + If you have logged in, and depending on your status as noted above, you can respond to email threads and create new messages in the email list you are currently viewing. The user interface does not have controls for these actions; instead, there are shortcut keys: - `H`: Display the help window. @@ -20,6 +20,7 @@ If you have logged in, and depending on your status as noted above, you can resp - `left arrow`: Move up the current list to display the next-newer bunch of emails. ## Searching + To display your search options, click the down-arrow at the right of the `search` field. - Opt to search in @@ -34,7 +35,8 @@ To display your search options, click the down-arrow at the right of the `search - a keyword within the body of the email ## If the email you sent does not appear -The email system does not use what is in the `From` field; instead it looks at the envelope `sender`, so it is important to make sure you are using an account that appears in your LDAP record when you compose email intended for an ASF list. + +The email system does not use what is in the `From` field; instead it looks at the envelope `sender`, so it is important to make sure you are using an account that appears in your LDAP record when you compose email intended for an ASF list. You can review and update your LDAP record at selfserve.apache.org/identity.html. diff --git a/content/pages/gfm.md b/content/pages/gfm.md index c61e6dd25..aa2450c13 100644 --- a/content/pages/gfm.md +++ b/content/pages/gfm.md @@ -25,7 +25,7 @@ Sites built with the ASF-Pelican template use a version of [cmark-gfm][1] by [Gi - [email][11] - [Disallowed html][12] the tagfilter extension disables certain HTML tags. The asfgenid plugin reenables `script`, `style`, and `iframe` HTML tags. - + - [Examples][13] - ID and Class annotations @@ -64,7 +64,6 @@ If you are moving a project site of the Apache CMS and will be using the ASF-Pel - Only one {#id} or {.class} annotation is allowed on a tag. - {.class} annotations are seldom used. - [1]: https://github.com/github/cmark-gfm [2]: https://github.blog/2017-03-14-a-formal-spec-for-github-markdown/ [3]: https://guides.github.com/features/mastering-markdown/ @@ -78,4 +77,3 @@ If you are moving a project site of the Apache CMS and will be using the ASF-Pel [11]: https://github.github.com/gfm/#extended-email-autolink [12]: https://github.github.com/gfm/#disallowed-raw-html-extension- [13]: https://sindresorhus.com/github-markdown-css/ - diff --git a/content/pages/git-primer.md b/content/pages/git-primer.md index c9ce240ab..e122ee560 100644 --- a/content/pages/git-primer.md +++ b/content/pages/git-primer.md @@ -26,7 +26,7 @@ This document is chiefly about the read/write repositories.

Public and private repositories

-Projects can set up as many **public repositories** as their development work requires, using SelfServe. +Projects can set up as many **public repositories** as their development work requires, using SelfServe. Each project can also have a **private repository** space for working on sensitive issues such as: @@ -40,7 +40,7 @@ In particular, the resources available to run **GitHub Actions** against private See the [Project Code Repository Policy](project-repo-policy.html) for further details. -Open a Jira ticket for Infra to request a private repository. +Open a Jira ticket for Infra to request a private repository.

Repository checkout

@@ -55,7 +55,6 @@ https://gitbox.apache.org/repos/asf/reponame.git - **Committers**: `$ git clone https://gitbox.apache.org/repos/asf/reponame.git` - **Non-Committers**: `$ git clone http://gitbox.apache.org/repos/asf/reponame.git` -

Using .asf.yaml

`.asf.yaml` is a branch-specific YAML configuration file that a project may create (using a text editor of your choice) and put in the root of a Git repository to control features such as @@ -125,7 +124,7 @@ Instead of setting up a `~/.netrc` file you need to: In general, you should normalize line endings in the Git repository and set them to be platform specific on checkout. - - The `msysgit` installer on **Windows** will prompt you to set the `core.autocrlf` setting to `true` by default. + - The `msysgit` installer on **Windows** will prompt you to set the `core.autocrlf` setting to `true` by default. - On **Mac OS X or Linux**, use this setting: `$ git config --global core.autocrlf input` Further details and attributes for handling line endings differently per file type are available at Configuring Git to handle line endings. diff --git a/content/pages/git.md b/content/pages/git.md index f56cf4a90..147041e60 100644 --- a/content/pages/git.md +++ b/content/pages/git.md @@ -3,7 +3,6 @@ license: https://www.apache.org/licenses/LICENSE-2.0 The Apache Software Foundation projects use Subversion (SVN) or Git for [version control](version-control.html) of their software and documentation assets. This page is about _read-only_ Git mirrors of Apache SVN codebases. [Writable Git repositories](project-repo-policy.html) are also available. -

Read-only Git mirrors

We maintain read-only Git mirrors of many Apache codebases at https://git.apache.org/. These mirrors contain the full version histories (including all branches and tags) of the mirrored codebases and are updated in near real time based on the latest svn commits. @@ -40,6 +39,6 @@ Once you're ready to share your changes with the rest of the project team, you c `git format-patch origin/trunk` -The sooner you share your work, the better. +The sooner you share your work, the better. You can repeat the steps of this workflow as often as you like, producing more patches to be attached to the issue tracker. Once some of your patches are accepted and committed to svn, you can rebase your work against the latest trunk. Alternatively, if you're asked to make some changes, you can go back to the original Git commit and modify it until the project team accepts your changes. diff --git a/content/pages/github-actions-policy.md b/content/pages/github-actions-policy.md index bc80964c3..5607f57fe 100644 --- a/content/pages/github-actions-policy.md +++ b/content/pages/github-actions-policy.md @@ -8,13 +8,16 @@ For details on the use of requirement level terms, see the GitHub Actions Security. ### Dependabot + All repositories using GitHub Actions **must** have automatic dependency management in place using one of these tools: + * GitHub Dependabot for the `github-actions` ecosystem * Forking Renovate using the GitHub actions manager See the [Dependabot](dependabot.html) page for how to configure it, including [grouping security updates](dependabot.html#group-security-updates) so that a burst of advisories does not turn into a burst of CI runs. - + ### Resource use + Due to misconfigurations in their builds, some projects have been using unsupportable numbers of [GitHub Actions](github-actions-secrets.html). As part of fixing this situation, Infra has established a policy for GitHub Actions use: - All workflows **MUST** have a job concurrency level less than or equal to 20. This means a workflow cannot have more than 20 jobs running at the same time across all matrices. @@ -118,7 +121,7 @@ Automated services **MUST NOT** push data to a repository or branch that is subj ### Non-committer contributors and GitHub Actions -GitHub provides an option to allow a non-committer contributor to use GitHub Actions if a previous pull request by that person has been approved. This raises security concerns, and could cause issues with overall use of GitHub Actions. +GitHub provides an option to allow a non-committer contributor to use GitHub Actions if a previous pull request by that person has been approved. This raises security concerns, and could cause issues with overall use of GitHub Actions. The default for this option is to “always require approval for external contributors”. @@ -129,4 +132,5 @@ Projects that have a strong desire to use the “only require approval first tim * A link to a mailing list discussion showing a consensus vote by the PMC noting, that they affirm that they will actively monitor their workflows for abuse, and that they will act accordingly if and when abuse is detected. Failure to carry out such monitoring and addressing of abuse may result in the workflow settings being switched back to "always require approval for external contributors". ### Details on submitting a GitHub Action for approval + The README file at github.com/apache/infrastructure-actions has a detailed guide for how to add or update a GitHub Action. diff --git a/content/pages/github-actions-secrets.md b/content/pages/github-actions-secrets.md index bec4f1ca4..88d4041f0 100644 --- a/content/pages/github-actions-secrets.md +++ b/content/pages/github-actions-secrets.md @@ -3,7 +3,7 @@ license: https://www.apache.org/licenses/LICENSE-2.0 **GitHub Actions** help you automate your software development workflows in the same place you store code and collaborate on pull requests and issues. You can write individual tasks, called actions, and combine them to create a custom workflow. Workflows are custom automated processes that you can set up in your repository to build, test, package, release, or deploy any code project on GitHub. -***A note on testing***: Some projects would like to use GitHub Actions for complex processes, such as automating their tests of software builds. +***A note on testing***: Some projects would like to use GitHub Actions for complex processes, such as automating their tests of software builds. The _time_ runners are in use (measured in minutes) is unlimited for public repositories so how long a test takes isn't the issue. The issue is tying up limited 'runners' (nodes) while those minutes are running. Apache has a limited number of runners for over 1200 repositories, so the concern would be how many runners the test requires, which are then unavailable to other projects for the duration of the test. @@ -53,7 +53,7 @@ To extend the validity of the token, adjust the `develocity-token-expiry` action required: false ``` -Further information is at these pages: +Further information is at these pages: - Managing Develocity access keys - Short-lived access tokens diff --git a/content/pages/github-pages.md b/content/pages/github-pages.md index 37477b5ca..ae93a45f3 100644 --- a/content/pages/github-pages.md +++ b/content/pages/github-pages.md @@ -1,7 +1,7 @@ Title: GitHub Pages for projects license: https://www.apache.org/licenses/LICENSE-2.0 -Projects with a Git repository can use GitHub Pages (gh-pages) to host and deploy the project website. +Projects with a Git repository can use GitHub Pages (gh-pages) to host and deploy the project website. ### Using gh-pages for staging a website, product preview, or documentation diff --git a/content/pages/github-roles.md b/content/pages/github-roles.md index c4a395290..f31c47d83 100644 --- a/content/pages/github-roles.md +++ b/content/pages/github-roles.md @@ -11,9 +11,9 @@ See Permission levels for repositories. - diff --git a/content/pages/glossary.md b/content/pages/glossary.md index 15667d8fe..bbcac32e0 100644 --- a/content/pages/glossary.md +++ b/content/pages/glossary.md @@ -1,7 +1,6 @@ Title: Glossary license: https://www.apache.org/licenses/LICENSE-2.0 - _This page will hold definitions of frequently-used technical terms._ - **checksum** - definition coming diff --git a/content/pages/gradle.md b/content/pages/gradle.md index c1a1e50ed..2984e770a 100644 --- a/content/pages/gradle.md +++ b/content/pages/gradle.md @@ -5,14 +5,16 @@ Gradle, a longtime a leader in developer productivity and build analytics, has b Gradle provides **Develocity** (formerely Gradle Enterprise), a suite of acceleration and analytics technologies for CI/CD systems to help projects identify and analyze trends while optimizing build resources. The result is faster builds, with fewer failures, -Develocity scans, ingests, and caches build data, which it then analyzes. It displays the results in an an easy-to-use interface where project members can identify bottlenecks and roadblocks. Projects can also leverage cached results to ensure that only changes in each new build are tested. This approach results in faster feedback and less use of build resources. +Develocity scans, ingests, and caches build data, which it then analyzes. It displays the results in an an easy-to-use interface where project members can identify bottlenecks and roadblocks. Projects can also leverage cached results to ensure that only changes in each new build are tested. This approach results in faster feedback and less use of build resources. ### Integrating Develocity into project builds -See Project Onboarding Instructions for Develocity. + +See Project Onboarding Instructions for Develocity. If your project runs into difficulties or has questions, open a Jira ticket for Infra. If we can't help with your issue ourselves, we can draw on the ASF's community of Gradle users. Once a project has integrated Develocity into their build process, scans of each new build are sent to the instance at develocity.apache.org. Project members can review the build scan dashboard for graphic analysis. ### Impact + We hope that, with increased insight into build processes, projects will see build time savings across all jobs, reducing queue times and driving down time spent building serially or dealing with build failures. diff --git a/content/pages/hosting-external-agent.md b/content/pages/hosting-external-agent.md index 147a1cf8b..49724f436 100644 --- a/content/pages/hosting-external-agent.md +++ b/content/pages/hosting-external-agent.md @@ -3,7 +3,8 @@ license: https://www.apache.org/licenses/LICENSE-2.0 Individuals and organizations can support the work of the ASF and its projects by hosting Jenkins or Buildbot agents on virtual machines in their own systems. Donors often provide this service to make available extra build resources for a project that needs more than Infra can easily provide. -**Notes** +**Notes** + - Ubuntu is a core supported OS at the ASF and we do not need any external hosting by individuals at this time. - Organizations wanting to donate multiple VMs for Jenkins and/or Buildbot use should email `private@infra.apache.org` to start discussions. @@ -12,9 +13,9 @@ Individuals and organizations can support the work of the ASF and its projects b There are a few things you'll need to know and to adhere to. - Keep up to date with security patches etc,, the obvious stuff; we may want to be added to root alias for security reporting etc. - - Spec requirements: + - Spec requirements: - minimum 16GB RAM - - 500GB Hard disk + - 500GB Hard disk - A permanent static IP address - You must be an ASF Committer. - You must subscribe to the `builds@a.o` email list. diff --git a/content/pages/how-to-mirror.md b/content/pages/how-to-mirror.md index 2a7606fd5..544c5b68a 100644 --- a/content/pages/how-to-mirror.md +++ b/content/pages/how-to-mirror.md @@ -3,7 +3,7 @@ license: https://www.apache.org/licenses/LICENSE-2.0 **NOTE - as of August, 2021, the ASF itself is not accepting further mirror site applications.** -Organizations may wish to create a download mirror that includes the releases of most or all of the Apache Software Foundation's projects. You may mirror either the full distributions tree, or a reduced tree that excludes a few very resource-intensive (disk-wise and bandwidth-wise) projects (see Mirroring techniques). +Organizations may wish to create a download mirror that includes the releases of most or all of the Apache Software Foundation's projects. You may mirror either the full distributions tree, or a reduced tree that excludes a few very resource-intensive (disk-wise and bandwidth-wise) projects (see Mirroring techniques). Here is how to set up such a mirror. @@ -22,7 +22,7 @@ Hosting a mirror has a few requirements: - You should not trim or abridge the mirrored tree in any way. - You should not modify the mirrored tree in any way. In particular, you should not alter or remove HEADER.html or README.html files. See below for adding information about the mirror host. -We encourage you to +We encourage you to - do an **update-check** at least four times a day a day. You may sync a maximum of six times per day, but only if you have a slow or poor connection that causes timeouts. - run the Apache HTTP Server version 2.2 or later and use the following configuration for your web mirror to allow all the features of our download site to function optimally: @@ -93,7 +93,7 @@ Here is how to add information explaining who is hosting the private download mi The contents of README.html appear near the bottom of your mirror's home page. - - Only customize the home-page (top-level) README.html. Do not change any other README.html files. + - Only customize the home-page (top-level) README.html. Do not change any other README.html files. - Don't omit the '/' in `"/README.html"`. Please limit the contents of the README.html to something like: @@ -110,7 +110,7 @@ If your mirror is not working properly, check the following: - Page headers and footers display correctly. - All top-level directories and files on the ASF mirror are present on your mirror. - - Download a couple of files to check that the process works. + - Download a couple of files to check that the process works. - Trying to download a missing file should generate a `404 Not Found` error. You can verify this by modifying one of the valid URLs that you tested above.

Verifying the download

diff --git a/content/pages/infra-contact.md b/content/pages/infra-contact.md index 889381abb..cc9967037 100644 --- a/content/pages/infra-contact.md +++ b/content/pages/infra-contact.md @@ -11,17 +11,17 @@ That depends on your role and what you want to do. If this chart doesn't help, I - + - - + + - - + + @@ -32,7 +32,7 @@ That depends on your role and what you want to do. If this chart doesn't help, I - + @@ -42,12 +42,12 @@ That depends on your role and what you want to do. If this chart doesn't help, I + - + @@ -125,12 +125,11 @@ That depends on your role and what you want to do. If this chart doesn't help, I
If you...and want to...then contact...NotesIf you...and want to...then contact...Notes
are anyonereport a security vulnerability in a service that runs on apache.org infrastructuresecurity@infra.apache.orgreport a security vulnerability in a service that runs on apache.org infrastructuresecurity@infra.apache.org You may also encrypt the email to this set of keys. For those using Linux, we have a shell script which might come in handy. See Infra Tools for more details.
share sensitive information with Infraroot@apache.orgshare sensitive information with Infraroot@apache.org See the Infra policy on sharing sensitive information.
report that a service is down and status.apache.org doesn't show it Infra's Slack channelEmail to users@infra.apache.org is an acceptable alternative.Email to users@infra.apache.org is an acceptable alternative.
unsubscribe from a mailing list
discuss something publicly with Infra, or ask Infra a question The #asfinfra Slack channel, or by taking part in a Roundtable (the end of each Roundtable session is an open-mic opportunity for your comments or questions). See https://infra.apache.org/roundtable.html. - Consider these semi-public forums which are not suitable for confidential information.Consider these semi-public forums which are not suitable for confidential information.
get your IP unblocked abuse@infra.apache.org
edit the mail archives of a mailing list you posted to
-

What we need to know

- + @@ -199,7 +198,7 @@ See the list of [Services and tools](https://infra.apache.org/services.html) Inf

Where should I submit my request?

-If there is a dedicated app, use it. If not, file a Jira ticket for Infra. +If there is a dedicated app, use it. If not, file a Jira ticket for Infra. Please review the tables above before filing a ticket - often you or someone in your PMC can effect the change without involving infra at all. @@ -215,7 +214,6 @@ Please review the tables above before filing a ticket - often you or someone in **Thanks**. Making requests following these guidelines might require a little effort, but saves time for all involved. -

My issue got closed with a request to reopen it

The closed ticket may have a note indicating why we closed it. For instance, the ticket may have lacked information required to confirm or address the issue. diff --git a/content/pages/infra-incubator.md b/content/pages/infra-incubator.md index 9ffdfe8f4..d8ccc106f 100644 --- a/content/pages/infra-incubator.md +++ b/content/pages/infra-incubator.md @@ -55,14 +55,12 @@ Moving existing repositories into ASF version control generally requires a githu If you wish to copy existing code without transferring GitHub stars, etc., your mentor can request **new repositories** for the project via SelfServe. - **Bug tracking** -You can enable GitHub issues (and wikis) via our (.asf.yaml service, a configuration file that controls features such as notification schemes, website staging, GitHub settings, and Pelican builds. This is a per-repo feature. +You can enable GitHub issues (and wikis) via our (.asf.yaml service, a configuration file that controls features such as notification schemes, website staging, GitHub settings, and Pelican builds. This is a per-repo feature. The project can request a Jira instance for issue tracking via SelfServe. - **Confluence Wiki** Every project can have a dedicated space on the Apache Confluence wiki. Project participants can use the space to develop documentation, share planning and process documents, and work collaboratively. They can opt to make some pages in their space available to the public. Request a Confluence wiki space for the project via SelfServe. diff --git a/content/pages/infra-mail.md b/content/pages/infra-mail.md index 6cc513fb3..754a13a76 100644 --- a/content/pages/infra-mail.md +++ b/content/pages/infra-mail.md @@ -1,7 +1,6 @@ Title: Apache Infrastructure mailing lists license: https://www.apache.org/licenses/LICENSE-2.0 -

Participation in the Infra mailing lists is only available to ASF committers.

You can subscribe in the normal way. The moderators will verify that you are an ASF committer, so please either use your `@apache.org` address or its forwarding address. There are public archives for issues@ and site-dev@; all other infra@ lists are private. (We often call it "infra@" because that is less typing, but there is no such list.)

@@ -13,7 +12,7 @@ You can subscribe in the normal way. The moderators will verify that you are an - `users@infra`: Infra uses the general discussion list to discuss issues concerning the operation of the Apache Software Foundation systems, and for committers to report problems or issues. This is not the address for questions about the ASF or any of its projects. It is for communication between ASF committers only to support the infrastructure. Anyone may send mail to report problems with ASF systems, but check the status page before mailing to see whether Infra already knows about what you have noticed. - `private@infra`: For the core infra@ team only. It focuses on the infrastructure team working directly on pressing issues. Infra moderates subscriptions, which are restricted to ASF members and current infra [volunteers](infra-volunteer.html). Only -subscribers can post. +subscribers can post. - `commits@infra`: SVN commit messages for the ASF Infrastructure trunk, and Git commit messages for ASF Infra. - `issues@infra`: Messages from the INFRA Issue Tracker. Only ASF committers and people invited by the infra@ team can join. To "post" to this list, file a Jira comment which Jira sends to the list. - `site-cvs@`: Private lists for SVN commit messages for the ASF Infrastructure website. diff --git a/content/pages/infra-news.md b/content/pages/infra-news.md index 91478ff1a..644360f0a 100644 --- a/content/pages/infra-news.md +++ b/content/pages/infra-news.md @@ -11,4 +11,4 @@ license: https://www.apache.org/licenses/LICENSE-2.0 The Maven team is working on a resolution to this issue. Until the fix is available, they suggest **disabling parallel PUTs**. -For details on disabling parallel PUTs, and what to do if you have already run into this problem in a build, see this article in the Infra blog: Parallel PUT problem in repository.apache.org with Apache Maven 3.9.12. +For details on disabling parallel PUTs, and what to do if you have already run into this problem in a build, see this article in the Infra blog: Parallel PUT problem in repository.apache.org with Apache Maven 3.9.12. diff --git a/content/pages/infra-reports.md b/content/pages/infra-reports.md index 05d5c80df..3f0f905a8 100644 --- a/content/pages/infra-reports.md +++ b/content/pages/infra-reports.md @@ -3,7 +3,7 @@ license: https://www.apache.org/licenses/LICENSE-2.0 The dashboard, at infra-reports.apache.org, provides a collection of reports on the overall health and activity of the infrastructure at the ASF. These reports can be helpful in understanding the status of all the ASF 'under the hood' resources, and in assessing the resource cost of some activities, like build processes. -Some of the reports are open to the public, while others are restricted to those who genuinely need them. +Some of the reports are open to the public, while others are restricted to those who genuinely need them. ## Reports available to all @@ -16,6 +16,6 @@ Some of the reports are open to the public, while others are restricted to those - **Jira tickets**: Infra uses this dashboard to track resolution of Jira tickets related to infrastructure work. Gauges and charts cover how quickly issues are resolved and whether the number of open tickets for Jira is increasing or decreasing, and provides a drive-by view of all open Jira tickets. - **Mail Transport Statistics**: This screen, for the Infrastructure team, gives a visualization of how the system is handling ASF and project email. - **Real-time Download Stats**: On this screen, an ASF Member or Committer can select a project to which they belong and get a series of informative charts (over time, by country, by artifact) of downloads of the project's released artifacts. - - **GitHub Actions Usage**: This screen displays the use of GitHub Actions for projects you belong to. The chart can be configured for project (if you belong to more than one), time range and other options. + - **GitHub Actions Usage**: This screen displays the use of GitHub Actions for projects you belong to. The chart can be configured for project (if you belong to more than one), time range and other options. Send questions or suggestions about the dashboard to `users@infra.apache.org`. diff --git a/content/pages/infra-volunteer.md b/content/pages/infra-volunteer.md index d35c5452a..614077f2c 100644 --- a/content/pages/infra-volunteer.md +++ b/content/pages/infra-volunteer.md @@ -1,7 +1,6 @@ Title: Volunteering for Apache Infrastructure license: https://www.apache.org/licenses/LICENSE-2.0 - There are plenty of opportunities for you to help out with the small tasks Infra does every day to keep the ASF infrastructure alive. Some are self-explanatory or involve following the steps in an established checklist; others require a bit of knowledge of server technology. The best volunteers bring a willingness to learn and a good supply of patience in responding to questions from ASF committers and contributors. There are some basic things you could do if you're going to help out with the ASF Infrastructure team. You probably do some or all of these tasks already in your ASF project. @@ -17,4 +16,3 @@ There are some basic things you could do if you're going to help out with the AS **Visit** this Wiki page for details about all the lovely infrastructure tasks waiting for volunteers. **Come talk to us on [Slack](https://the-asf.slack.com/) in the #asfinfra channel!** - diff --git a/content/pages/jira-account-retention-policy.md b/content/pages/jira-account-retention-policy.md index 926549c2a..5d0758296 100644 --- a/content/pages/jira-account-retention-policy.md +++ b/content/pages/jira-account-retention-policy.md @@ -8,6 +8,6 @@ As of April, 2025, the ASF had 99,115 Jira accounts that had been inactive for m This volume of accounts puts an unnecessary burden on our system, and Infra will be taking steps to: - delete accounts that are more than a year old and have never had any activity. - - disable and anonymize accounts that have been inactive for the past three years, retaining the record of their activity before that time. + - disable and anonymize accounts that have been inactive for the past three years, retaining the record of their activity before that time. ASF Members and project committers can help lighten the load by making sure to always use a Jira account with your ASF credentials (username, email address as they appear in the ICLA you submitted) whenever creating or commenting on a ticket for The ASF, or related to any of our projects. diff --git a/content/pages/jira-approve-account.md b/content/pages/jira-approve-account.md index 216b1104a..81c67a87d 100644 --- a/content/pages/jira-approve-account.md +++ b/content/pages/jira-approve-account.md @@ -9,15 +9,18 @@ The ASF uses Jira as one of its main systems for receiving and tracking bug repo **Note**: a person does not need a Jira account to view existing issue reports and enhancement requests. ## Why we use this pattern + The ASF put the requirement to have an ASF Jira account in place for two reasons: 1. Our system was being swamped with a flood of bot-created spammy tickets. Requiring an account in order to submit a ticket has largely resolved this issue. 2. We currently host our Jira system on an ASF server. We intend to move it to a hosted cloud solution. However, that solution has a hard maximum to the number of accounts it can support, and we are trying to reduce the number of ASF Jira accounts to below that maximum. ## Approving account requests + In general, if the request seems valid--all fields are filled in with appropriate information, the reason for the account does not seem suspicious (or machine-written), and the reason given is not about a security vulnerability (see above)--approve it. Do not worry too much about increasing the number of ASF Jira accounts, as Infra is working on addressing that issue in other ways than rejecting valid requests. If you are in doubt, consult with colleagues on your PMC. ## Inactive accounts + Infra may disable or remove accounts that show no activity over a long period of time. See [Jira acccount retention policy](jira-account-retention-policy.html). diff --git a/content/pages/jira-for-infra.md b/content/pages/jira-for-infra.md index 74b1e3324..96e3de2c0 100644 --- a/content/pages/jira-for-infra.md +++ b/content/pages/jira-for-infra.md @@ -3,7 +3,7 @@ license: https://www.apache.org/licenses/LICENSE-2.0 **Note**: this page is specifically about Jira tickets assigned to the Infrastructure team. General information about Jira and the ASF is at [Jira tickets](jira-guidelines.html). -# Jira tickets for Infra +# Jira tickets for Infra The largest group of Jira tickets assigned to Infra are requests for Infra to perform a task of one sort or another. The next largest category is reports of possible issues in the Infrastructure system. @@ -12,6 +12,7 @@ The largest group of Jira tickets assigned to Infra are requests for Infra to pe We need the right information to respond to your work request or bug report. In addition to the [Writing a good Jira ticket](jira-guidelines.html#writing) advice, see Infra's [What we need to know](infra-contact.html#what-we-need-to-know) list. ## How Infra will respond + Infra may respond in a number of ways, including: - Closing the ticket as **invalid**. Review [Before you create a ticket](jira-guidelines.html#before) for reasons that may generate this response. diff --git a/content/pages/jira-guidelines.md b/content/pages/jira-guidelines.md index 4ca0556f7..c0740e36f 100644 --- a/content/pages/jira-guidelines.md +++ b/content/pages/jira-guidelines.md @@ -3,14 +3,12 @@ license: https://www.apache.org/licenses/LICENSE-2.0 ## Jira tickets - Jira is a proprietary issue tracking product developed by Atlassian that allows bug tracking and agile project management. Atlassian provides Jira services to Apache projects. The tool's name is a short form of the name of the Japanese movie monster, Godzilla, and was an early developer nickname for the application. Anyone can review existing Jira tickets, or issues. You must register and log in if you want to create, comment or vote on, upload attachments to, or watch issues. Only committers can edit, prioritize, schedule and resolve issues. The ASF and many of its projects use Jira to keep track of work to be done. The largest group of tickets assigned to Infra are requests for Infra to perform a task of one sort or another. The next largest category is reports of possible bugs in the Infrastructure system. -
If you ask us to...we need to know...NotesIf you ask us to...we need to know...Notes
create a podling