Metabase is distributed as a jar file as a download from https://www.metabase.com/start/oss/jar
We need to investigate how we want to fetch, install and configure the service, and develop a process to monitor for vulnerabilities and handle software updates.
From https://www.metabase.com/security
"We publish our security advisories on Github." and https://github.com/metabase/metabase
| Status | Subtype | Assigned | Task | ||
|---|---|---|---|---|---|
| In Progress | greg | T377362 EPIC: Trino/MinIO/Hive-Standalone-Metaserver/Dagster/Metabase/Superset Implementation | |||
| Resolved | Dwisehaupt | T377363 EPIC: Metabase Implementation | |||
| Resolved | Jgreen | T375030 [Metabase] Investigate packaging, install, security monitoring. |
A new version was released yesterday (v1.50.26), and this is the version linked from the github project page. The metabase download site still links to the previous version v1.50.25.
Unzipped metabase.jar has the file version.properties with line "tag=v0.50.25".
unzip -p ~/Desktop/metabase.jar version.properties
From there, we can fetch https://api.github.com/repos/metabase/metabase/releases and parse/concatenate the changelogs for available versions after what we have installed.
Changelog review, fetching, and packaging has been automated into a new FR admin tool called package_getter.
Still to do: vulnerability and update tracking.
Closing this because there's nothing left to do to support the open-source version we are running . Packaging and update-tracking is complete. Note T383256: [Metabase] Switch from metabase "open source" to "enterprise" is open, and switching to the enterprise version would require a new approach to version tracking and packaging.