Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

x/website/internal/history: update Release for new security policy #51719

Closed
dmitshur opened this issue Mar 16, 2022 · 2 comments
Closed

x/website/internal/history: update Release for new security policy #51719

dmitshur opened this issue Mar 16, 2022 · 2 comments
Labels
FrozenDueToAge NeedsFix The path to resolution is known, but the work has not been done.
Projects
Go Release Team
Milestone
Unreleased

Comments

@dmitshur
Copy link
Contributor

The Release struct has fields needed to describe a Go release, including a high-level summary of the release content:

Quantifier string          // Optional quantifier. Empty string for unspecified amount of fixes (typical), "a" for a single fix, "two", "three" for multiple fixes, etc.
Components []template.HTML // Components involved. For example, "cgo", "the <code>go</code> command", "the runtime", etc.
Packages   []string        // Packages involved. For example, "net/http", "crypto/x509", etc.

With the previous Go security policy, each minor release was either a bug-fix minor release, or a security minor release, so it was viable to capture that with a single boolean:

Security bool // whether this is a security release

With the current Go security policy (#44918), a Go release may include only bug fixes, only security fixes, or both at once. The last case can't be represented with the current fields, and so the CustomSummary escape hatch has been used so far whenever a minor release included both bug- and security fixes.

Compared to listing components and packages, writing the entire custom summary is more tedious and error prone due to English grammar, and defeats the purpose of having those fields separated out (previously motivated in #38488). The past releases that used CustomSummary followed a consistent pattern, so it's viable to update them to a new representation without significant changes. This is the tracking issue for that.

I've prototyped a fix and will send it via two CLs: the first one adds test data to cover recent releases, and the second changes the struct while updating the test data accordingly (it's mostly changes in whitespace, some trivial grammar diffs and minor intentional fixups).

CC @golang/release, @golang/security.
@dmitshur dmitshur added the NeedsFix The path to resolution is known, but the work has not been done. label Mar 16, 2022
@dmitshur dmitshur added this to the Unreleased milestone Mar 16, 2022
@dmitshur dmitshur self-assigned this Mar 16, 2022
@gopherbot
Copy link

Change https://go.dev/cl/393357 mentions this issue: internal/history: split Release summary into bug- and security fixes

@gopherbot
Copy link

Change https://go.dev/cl/393356 mentions this issue: cmd/golangorg: add test cases for recent release history

gopherbot pushed a commit to golang/website that referenced this issue Mar 21, 2022
@dmitshur
cmd/golangorg: add test cases for recent release history
39819c8 
A following CL will make changes to how release content summary is
represented to support the new security policy, and migrate past
entries. Before doing that, add test cases for the recent releases,
so the upcoming diff will be more informative during review.

For golang/go#51719.
Updates golang/go#38488.

Change-Id: I7d26ac767e69c1ef73a94586f7c166878599864d
Reviewed-on: https://go-review.googlesource.com/c/website/+/393356
Trust: Dmitri Shuralyov <dmitshur@google.com>
Run-TryBot: Dmitri Shuralyov <dmitshur@google.com>
TryBot-Result: Gopher Robot <gobot@golang.org>
Reviewed-by: Carlos Amedee <carlos@golang.org>
Reviewed-by: Carlos Amedee <amedee@google.com>
Trust: Carlos Amedee <amedee@google.com>
@dmitshur dmitshur added this to Done in Go Release Team Mar 22, 2022
passionSeven added a commit to passionSeven/website that referenced this issue Oct 18, 2022
@passionSeven
cmd/golangorg: add test cases for recent release history
810fd44 
A following CL will make changes to how release content summary is
represented to support the new security policy, and migrate past
entries. Before doing that, add test cases for the recent releases,
so the upcoming diff will be more informative during review.

For golang/go#51719.
Updates golang/go#38488.

Change-Id: I7d26ac767e69c1ef73a94586f7c166878599864d
Reviewed-on: https://go-review.googlesource.com/c/website/+/393356
Trust: Dmitri Shuralyov <dmitshur@google.com>
Run-TryBot: Dmitri Shuralyov <dmitshur@google.com>
TryBot-Result: Gopher Robot <gobot@golang.org>
Reviewed-by: Carlos Amedee <carlos@golang.org>
Reviewed-by: Carlos Amedee <amedee@google.com>
Trust: Carlos Amedee <amedee@google.com>
passionSeven added a commit to passionSeven/website that referenced this issue Oct 18, 2022
@passionSeven
internal/history: split Release summary into bug and security fixes
d0b520e 
Make it possible to use the higher-level fix summary fields, instead of
CustomSummary, when a release has both bug fixes and security fixes.

Rewrite the recent hand-written custom summaries to use the new fields,
which produces equivalent output that differs largely in white-space
and some trivial consistency fixes.

Fixes golang/go#51719.
Updates golang/go#38488.
Updates golang/go#44918.

Change-Id: I672cea21f63cb4ab9764efb6cbc783cf503b791c
Reviewed-on: https://go-review.googlesource.com/c/website/+/393357
Trust: Dmitri Shuralyov <dmitshur@google.com>
Reviewed-by: Carlos Amedee <amedee@google.com>
@golang golang locked and limited conversation to collaborators Jun 22, 2023
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Assignees
No one assigned
Labels
FrozenDueToAge NeedsFix The path to resolution is known, but the work has not been done.
Projects
Go Release
Archived in project
Go Release Team
Done
Milestone
Unreleased
Development

No branches or pull requests
2 participants
@dmitshur @gopherbot