Check for Updates community module

GeoServer GeoServer Developer
,
1

Introducing Check for Updates, a new community module that tells administrators when the GeoServer they are running needs attention. It reads a small JSON feed that is published in the GeoServer GitHub repository, and reports:

  • a newer patch release in the running series
  • that the running series has moved to maintenance, or is no longer supported
  • a newer release that the geoserver.org/blog announcement marks as a security release
  • a published security advisory that applies to the running version

Please comment on the Pull Request: [GEOS-12228] Check for Updates community module by petersmythe · Pull Request #10069 · geoserver/geoserver · GitHub

Unfortunately, GeoServer administrators rarely learn timeously about security releases and CVEs for the version they run. They currently have to follow the blog, the mailing list/discourse or GitHub advisories, or their own organisation’s CVE monitoring.

This module tells the administrator, in the GUI i.e. in their face, what applies to their running version:

image
image657×389 12.4 KB

If they don’t log into their GeoServer daily, they can set up a REST probe from their monitoring solution, but this currently does not handle notice dismissals.

Please read more about the functionality in the proposed documentation or https://docs.geoserver.org/main/en/user/community/updates-checker/ once the PR is merged.

Feed

The feed is a static versions.json file, generated in the GitHub - petersmythe/gs-updates-checker · GitHub repo. Upon acceptance of this community module, I would like to move the feed first to https://github.com/geoserver/gs-updates-checker but ultimately into the GitHub - geoserver/geoserver: Official GeoServer repository · GitHub workflow, a sparse checkout that runs every 15 minutes, only updating versions.json when there is a change - 100% automated. The reason for keeping it in the main GeoServer is for maintainability.

Gabriel requested an UPDATES_CHECKER_FEED_URL override, to cater for GeoServer Cloud - which we will work on next. You can also use this override to point to the current temporary feed for evaluation.

Concerns about privacy/phone-home functionality

Firstly, this is opt-in, as a community module/extension. Administrators must want to benefit from the functionality.

Secondly, the feed is hosted by GitHub (or jsDelivr CDN), and we have no ability to get any logs from these hosts. Yes, the GeoServer’s public-facing IP address will be logged by them.

Third, it’s a static JSON file, no version number or any other payload is passed in the HTTPS request

Compatibility

I have implemented it with 100% Java 11 code, using GWC’s org.json 20231013, so that a single nightly build JAR can be dropped into any GeoServer running from 2.23 - so the last 3+ years. Guidance on this approach would be appreciated, please.

AI policy

I have read GeoServer AI policy. I did use AI to perform the work. I believe that the contribution meets all 5 requirements: Responsibility, Understanding, Correctness, Feasibility and Maintainability, but I fully expect to be challenged on it, and I am up to that.

Jira issue: Jira

I look forward to your critical reviews and guidance

Peter
GeoServer PSC

4

Here’s a really quick test for you to run, using the pre-release JAR on an older version (2.28.3) which will produce warnings:

# 1. fetch the release artefact into a folder
mkdir -p ~/gs-libs
curl -sSL -o ~/gs-libs/gs-updates-checker.jar \
  https://github.com/petersmythe/geoserver/releases/download/updates-checker-test-2/gs-updates-checker-3.1.0-SNAPSHOT.jar

# 2. run GeoServer 2.28.3 with the folder mounted and the alpha feed
docker run -d --name gs-2283 -p 8080:8080 \
  -v ~/gs-libs:/opt/additional_libs:ro \
  --env UPDATES_CHECKER_FEED_URL=https://raw.githubusercontent.com/petersmythe/gs-updates-checker/alpha/versions.json \
  docker.osgeo.org/geoserver:2.28.3

#3a. login and view the Welcome home page

#3b. or check the REST call
curl -u admin:geoserver -X POST http://localhost:8080/geoserver/rest/updates-checker/check