Re: Geronimo 2.0 Release suspended due to security issue found before release

2007-08-14 Thread Prasad Kashyap
At this point, I am not really sure. We can always easily move them around. If you have or can envision a lot of CLI tests, we can create a separate testsuite for it. This separate testsuite won't have to start/stop selenium server too since it is cmdline. If you want to drop it under deployment-

Re: Geronimo 2.0 Release suspended due to security issue found before release

2007-08-14 Thread Donald Woods
Where were you thinking? Should we start a new subdirectory for cmdline tests? Or could it go under deployment-testsuite? -Donald Prasad Kashyap wrote: > Good catch Donald. Can you please throw in a small test(s) in our > testsuite framework so that we can catch things like this ? There are >

Re: Geronimo 2.0 Release suspended due to security issue found before release

2007-08-14 Thread Prasad Kashyap
Good catch Donald. Can you please throw in a small test(s) in our testsuite framework so that we can catch things like this ? There are a lot of tests there already that can act as a template/example and help you with your testcase. Let me know if you need more help. Cheers Prasad On 8/13/07, Do

Re: Geronimo 2.0 Release suspended due to security issue found before release

2007-08-14 Thread Vamsavardhana Reddy
Verified that the fixes address the security bug Donald has identified. No regression is observed in case of GERONIMO-2266 and GERONIMO-2267. I suggest others verify any scenarios they can think of for possible regression. Vamsi On 8/14/07, David Jencks <[EMAIL PROTECTED]> wrote: > > I've now f

Re: Geronimo 2.0 Release suspended due to security issue found before release

2007-08-14 Thread David Jencks
I've now fixed GERONIMO-3407 in trunk, rev 565657. I added new methods to ContextManager and removed direct use of LoginContext. Among other things this may make implementing jaspi slightly easier. New methods are: public static LoginContext login(String realm, CallbackHandler callbac

Re: Geronimo 2.0 Release suspended due to security issue found before release

2007-08-13 Thread Vamsavardhana Reddy
On 8/14/07, David Jencks <[EMAIL PROTECTED]> wrote: > > I think I've fixed GERONIMO-3404 and GERONIMO-3406 in trunk, rev > 565599. It might be a good idea for this to get a review before we > port it to branches/2.0 and possibly branches/2.0.x. We may also want to make sure GERONIMO-2266, GERONI

Re: Geronimo 2.0 Release suspended due to security issue found before release

2007-08-13 Thread Vamsavardhana Reddy
David, Though there are a few other minor fixes (that may not come in the way of TCK, for e.g. R565355) that I would have wanted in 2.0.1, I felt that this may not be the right time to bring up those as we may not "any" additional delays in getting 2.0.1 out, perhaps we may have to think about a 2

Re: Geronimo 2.0 Release suspended due to security issue found before release

2007-08-13 Thread Kevan Miller
On Aug 13, 2007, at 9:27 PM, David Jencks wrote: I think I've fixed GERONIMO-3404 and GERONIMO-3406 in trunk, rev 565599. It might be a good idea for this to get a review before we port it to branches/2.0 and possibly branches/2.0.x. I'm looking things over now... May take me a bit... Eas

Re: Geronimo 2.0 Release suspended due to security issue found before release

2007-08-13 Thread Matt Hogstrom
I'll go ahead and update branches/2.0 to 2.0.2-SNAPSHOT as this needs to be done regardless. On Aug 13, 2007, at 8:03 PM, David Jencks wrote: So before we all jump onto option 2 maybe we should consider just how big a change this set of bugs is causing and comparatively how much branches/

Re: Geronimo 2.0 Release suspended due to security issue found before release

2007-08-13 Thread Prasad Kashyap
+1 to option 2. Let's get 2.0.1 out of the door ASAP. Cheers Prasad On 8/13/07, Matt Hogstrom <[EMAIL PROTECTED]> wrote: > All, > > Earlier today one of the Geronimo committers discovered a bug in the > command line deployer where a null user / password on the deployer > command line will allow

Re: Geronimo 2.0 Release suspended due to security issue found before release

2007-08-13 Thread David Jencks
I think I've fixed GERONIMO-3404 and GERONIMO-3406 in trunk, rev 565599. It might be a good idea for this to get a review before we port it to branches/2.0 and possibly branches/2.0.x. I haven't decided how to fix GERONIMO-3407 yet, and could be talked out of it for 2.0.1. The problem woul

Re: Geronimo 2.0 Release suspended due to security issue found before release

2007-08-13 Thread Jarek Gawor
Matt, We could at least release/publish the transaction and connector bits, right? Jarek On 8/13/07, Matt Hogstrom <[EMAIL PROTECTED]> wrote: > All, > > Earlier today one of the Geronimo committers discovered a bug in the > command line deployer where a null user / password on the deployer > com

Re: Geronimo 2.0 Release suspended due to security issue found before release

2007-08-13 Thread David Jencks
So before we all jump onto option 2 maybe we should consider just how big a change this set of bugs is causing and comparatively how much branches/2.0 has changed since 2.0.0 was cut. It looks like there have been about 15 commits to branches/2.0 that aren't version changes, many of them si

Re: Geronimo 2.0 Release suspended due to security issue found before release

2007-08-13 Thread Anita Kulshreshtha
+1 to option #2 Cheers! Anita --- Matt Hogstrom <[EMAIL PROTECTED]> wrote: > All, > > Earlier today one of the Geronimo committers discovered a bug in the > > command line deployer where a null user / password on the deployer > command line will allow a user to deploy modules to a 2.0 serve

Re: Geronimo 2.0 Release suspended due to security issue found before release

2007-08-13 Thread Kevan Miller
On Aug 13, 2007, at 4:59 PM, Matt Hogstrom wrote: 2. Take the tags/2.0.0 to create a branches/2.0.1 This would mean that we need to update branches/2.0 to 2.0.2- SNAPSHOT Copy the existing tag over and apply the security fixes. Repsin and release. Personally, I vote for option 2. Bas

Re: Geronimo 2.0 Release suspended due to security issue found before release

2007-08-13 Thread Joe Bohn
+1 to option 2 Joe Matt Hogstrom wrote: All, Earlier today one of the Geronimo committers discovered a bug in the command line deployer where a null user / password on the deployer command line will allow a user to deploy modules to a 2.0 server. This is an unacceptable security exposure a

Re: Geronimo 2.0 Release suspended due to security issue found before release

2007-08-13 Thread Hernan Cunico
Here is the link to the dev site home page with the latest update http://cwiki.apache.org/GMOxSITE/ within the next hour geronimo.apache.org should get updated. Cheers! Hernan Hernan Cunico wrote: +1 for option 2, it seems the quickest one. I just put the "News" out, it takes some time to ge

Re: Geronimo 2.0 Release suspended due to security issue found before release

2007-08-13 Thread Hernan Cunico
+1 for option 2, it seems the quickest one. I just put the "News" out, it takes some time to get propagated. Cheers! Hernan Matt Hogstrom wrote: All, Earlier today one of the Geronimo committers discovered a bug in the command line deployer where a null user / password on the deployer comma

Re: Geronimo 2.0 Release suspended due to security issue found before release

2007-08-13 Thread Paul McMahan
On Aug 13, 2007, at 4:59 PM, Matt Hogstrom wrote: 2. Take the tags/2.0.0 to create a branches/2.0.1 This would mean that we need to update branches/2.0 to 2.0.2- SNAPSHOT Copy the existing tag over and apply the security fixes. Repsin and release. +1 for option 2 Best wishes, Paul

Re: Geronimo 2.0 Release suspended due to security issue found before release

2007-08-13 Thread Donald Woods
Matt Hogstrom wrote: All, Earlier today one of the Geronimo committers discovered a bug in the command line deployer where a null user / password on the deployer command line will allow a user to deploy modules to a 2.0 server. This is an unacceptable security exposure and as such we have

Re: Geronimo 2.0 Release suspended due to security issue found before release

2007-08-13 Thread Jay D. McHugh
+1 for option 2

Re: Geronimo 2.0 Release suspended due to security issue found before release

2007-08-13 Thread Jarek Gawor
+1 for option 2. Jarek On 8/13/07, Matt Hogstrom <[EMAIL PROTECTED]> wrote: > All, > > Earlier today one of the Geronimo committers discovered a bug in the > command line deployer where a null user / password on the deployer > command line will allow a user to deploy modules to a 2.0 server. > Th

Re: Geronimo 2.0 Release suspended due to security issue found before release

2007-08-13 Thread Vamsavardhana Reddy
At this point, we will want to get a release out fast and address only those issues (like the security bug Donald has found and hopefully only this) that are blocker. +1 to option 2, create branches\2.0.1 from tags\2.0.0. Vamsi On 8/14/07, Matt Hogstrom <[EMAIL PROTECTED]> wrote: > > All, > > Ea

Geronimo 2.0 Release suspended due to security issue found before release

2007-08-13 Thread Matt Hogstrom
All, Earlier today one of the Geronimo committers discovered a bug in the command line deployer where a null user / password on the deployer command line will allow a user to deploy modules to a 2.0 server. This is an unacceptable security exposure and as such we have abandoned the relea