Page MenuHomePhabricator

Dropped Security Patches in Wikimedia Production
Closed, ResolvedPublicSecurity

Description

Something appears to have happened between the branch cut from from 1.45.0-wmf.1 to 1.45.0-wmf.2 and 1.45.0-wmf.3 in /srv/patches on deployment:

  1. The 5 core patches under 1.45.0-wmf.1 appear to have been reverted to previous versions and the 05-T394396.patch was accidentally dropped and has not been deployed to 1.45.0-wmf.2 and 1.45.0-wmf.3. I've corrected the core patches under /srv/patches in d7f4f9afae and will re-deploy 05-T394396.patch shortly. I can't see anything obvious in the commits so I don't know if this was a timing issue/race condition or if there is perhaps some issue with mwpresync? I had done the basic restructuring and added some CheckUser patches in 118715f522 (Mon May 19 21:03:49 2025 +0000) which seems to have then been overridden by the time /srv/patches/1.45.0-wmf.2 was prepped.
  2. The aforementioned CheckUser patches from 118715f522 were also seemingly dropped and then were not deployed to 1.45.0-wmf.2 and 1.45.0-wmf.3. @Dreamy_Jazz noticed this and has since re-added the patches and re-deployed them to 1.45.0-wmf.2 and 1.45.0-wmf.3.

Details

Risk Rating
High
Author Affiliation
WMF Technology

Event Timeline

sbassett updated the task description. (Show Details)
sbassett claimed this task.
sbassett moved this task from Incoming to Our Part Is Done on the Security-Team board.
sbassett added a project: SecTeam-Processed.

Everything related to this issue has been fixed, resolving for now. I think we (Security-Team et al) just need to be careful about making updates to anything under /srv/patches from Friday night through Monday morning, given the timing around @SecurityPatchBot's work.

sbassett triaged this task as High priority.Jun 2 2025, 4:30 PM
sbassett changed the visibility from "Custom Policy" to "Public (No Login Required)".
sbassett changed the edit policy from "Custom Policy" to "All Users".
sbassett changed Risk Rating from N/A to High.