Page MenuHomePhabricator

Deploy Produnto extension to production
Open, Needs TriagePublic

Description

  • Security Review for Produnto: T423761: Application Security Review Request : Produnto extension
  • Add the submodule and add it to extension-list
  • Deploy on beta sites
  • Train deployment
  • Create DB tables in wikishared x1
  • Enable on testwiki
  • Pilot deployment to hiwiki, pawiki, orwiki, tewiki, mlwiki planned for early in September

Event Timeline

SBisson triaged this task as High priority.Apr 14 2026, 5:34 PM
SBisson raised the priority of this task from High to Needs Triage.

https://www.mediawiki.org/wiki/Help:Extension:Produnto does not have any useful content. It should be updated before it is in production.

Mentioned in SAL (#wikimedia-releng) [2026-08-13T03:05:10Z] <TimStarling> created Produnto tables on beta T421436

Change #1324963 had a related patch set uploaded (by Tim Starling; author: Tim Starling):

[operations/mediawiki-config@master] Add Produnto to extension-list

https://gerrit.wikimedia.org/r/1324963

Change #1324964 had a related patch set uploaded (by Tim Starling; author: Tim Starling):

[operations/mediawiki-config@master] Enable Produnto on Beta

https://gerrit.wikimedia.org/r/1324964

Change #1324965 had a related patch set uploaded (by Tim Starling; author: Tim Starling):

[operations/mediawiki-config@master] Enable Produnto on testwiki

https://gerrit.wikimedia.org/r/1324965

Change #1324966 had a related patch set uploaded (by Tim Starling; author: Tim Starling):

[operations/mediawiki-config@master] Enable Produnto on pilot wikis

https://gerrit.wikimedia.org/r/1324966

Change #1324963 merged by jenkins-bot:

[operations/mediawiki-config@master] Add Produnto to extension-list

https://gerrit.wikimedia.org/r/1324963

Change #1324964 merged by jenkins-bot:

[operations/mediawiki-config@master] Enable Produnto on Beta

https://gerrit.wikimedia.org/r/1324964

Mentioned in SAL (#wikimedia-operations) [2026-08-21T04:24:36Z] <tstarling@deploy1003> Started scap sync-world: Backport for [[gerrit:1324963|Add Produnto to extension-list (T421436)]], [[gerrit:1324964|Enable Produnto on Beta (T421436)]]

Mentioned in SAL (#wikimedia-operations) [2026-08-21T04:44:28Z] <tstarling@deploy1003> tstarling: Backport for [[gerrit:1324963|Add Produnto to extension-list (T421436)]], [[gerrit:1324964|Enable Produnto on Beta (T421436)]] synced to the testservers (see https://wikitech.wikimedia.org/wiki/Mwdebug). Changes can now be verified there.

Mentioned in SAL (#wikimedia-operations) [2026-08-21T04:59:24Z] <tstarling@deploy1003> Finished scap sync-world: Backport for [[gerrit:1324963|Add Produnto to extension-list (T421436)]], [[gerrit:1324964|Enable Produnto on Beta (T421436)]] (duration: 34m 48s)

Mentioned in SAL (#wikimedia-operations) [2026-08-24T23:57:26Z] <TimStarling> on db1220 x1 wikishared created Produnto tables T421436

tstarling@deploy1003$ sql --wiki=enwiki --cluster=extension1 --write
...
wikiadmin2023@10.64.32.36(enwiki)> use wikishared;
...
wikiadmin2023@10.64.32.36(wikishared)> \. /srv/mediawiki/php-1.47.0-wmf.16/extensions/Produnto/sql/mysql/tables-generated.sql
Query OK, 0 rows affected (0.004 sec)

Query OK, 0 rows affected (0.004 sec)

Query OK, 0 rows affected (0.003 sec)

Query OK, 0 rows affected (0.003 sec)

Query OK, 0 rows affected (0.003 sec)

Query OK, 0 rows affected (0.003 sec)

Query OK, 0 rows affected (0.003 sec)

Query OK, 0 rows affected (0.003 sec)

Query OK, 0 rows affected (0.002 sec)

wikiadmin2023@10.64.32.36(wikishared)> SHOW CREATE TABLE produnto_file_text\G
*************************** 1. row ***************************
       Table: produnto_file_text
Create Table: CREATE TABLE `produnto_file_text` (
  `pft_hash` binary(64) NOT NULL,
  `pft_text` longblob NOT NULL,
  PRIMARY KEY (`pft_hash`)
) ENGINE=InnoDB DEFAULT CHARSET=binary
1 row in set (0.000 sec)

Change #1328752 had a related patch set uploaded (by Tim Starling; author: Tim Starling):

[operations/mediawiki-config@master] Grant produnto-update to groups that have editprotected

https://gerrit.wikimedia.org/r/1328752

Change #1324965 merged by jenkins-bot:

[operations/mediawiki-config@master] Enable Produnto on testwiki

https://gerrit.wikimedia.org/r/1324965

Mentioned in SAL (#wikimedia-operations) [2026-08-27T03:31:07Z] <tstarling@deploy1003> Started scap sync-world: Backport for [[gerrit:1324965|Enable Produnto on testwiki (T421436)]]

Mentioned in SAL (#wikimedia-operations) [2026-08-27T03:35:51Z] <tstarling@deploy1003> tstarling: Backport for [[gerrit:1324965|Enable Produnto on testwiki (T421436)]] synced to the testservers (see https://wikitech.wikimedia.org/wiki/Mwdebug). Changes can now be verified there.

Mentioned in SAL (#wikimedia-operations) [2026-08-27T04:11:45Z] <tstarling@deploy1003> Finished scap sync-world: Backport for [[gerrit:1324965|Enable Produnto on testwiki (T421436)]] (duration: 40m 38s)

Does the security review (T423761) still need to be hidden if that task is done?

Change #1329728 had a related patch set uploaded (by Tim Starling; author: Tim Starling):

[operations/mediawiki-config@master] Produnto: Add IPv6 range for GitLab

https://gerrit.wikimedia.org/r/1329728

Change #1328752 merged by jenkins-bot:

[operations/mediawiki-config@master] Grant produnto-update to groups that have editprotected

https://gerrit.wikimedia.org/r/1328752

Change #1329728 merged by jenkins-bot:

[operations/mediawiki-config@master] Produnto: Add IPv6 range for GitLab

https://gerrit.wikimedia.org/r/1329728

Mentioned in SAL (#wikimedia-operations) [2026-08-28T02:58:06Z] <tstarling@deploy1003> Started scap sync-world: Backport for [[gerrit:1328752|Grant produnto-update to groups that have editprotected (T421436)]], [[gerrit:1329728|Produnto: Add IPv6 range for GitLab (T421436)]]

Mentioned in SAL (#wikimedia-operations) [2026-08-28T03:02:18Z] <tstarling@deploy1003> tstarling: Backport for [[gerrit:1328752|Grant produnto-update to groups that have editprotected (T421436)]], [[gerrit:1329728|Produnto: Add IPv6 range for GitLab (T421436)]] synced to the testservers (see https://wikitech.wikimedia.org/wiki/Mwdebug). Changes can now be verified there.

Mentioned in SAL (#wikimedia-operations) [2026-08-28T03:10:50Z] <tstarling@deploy1003> Finished scap sync-world: Backport for [[gerrit:1328752|Grant produnto-update to groups that have editprotected (T421436)]], [[gerrit:1329728|Produnto: Add IPv6 range for GitLab (T421436)]] (duration: 12m 44s)

Change #1332525 had a related patch set uploaded (by Tim Starling; author: Tim Starling):

[operations/mediawiki-config@master] Produnto: use wgCopyUploadProxy to contact GitLab

https://gerrit.wikimedia.org/r/1332525

Change #1332525 merged by jenkins-bot:

[operations/mediawiki-config@master] Produnto: use wgCopyUploadProxy to contact GitLab

https://gerrit.wikimedia.org/r/1332525

Mentioned in SAL (#wikimedia-operations) [2026-08-31T03:11:04Z] <tstarling@deploy1003> Started scap sync-world: Backport for [[gerrit:1332525|Produnto: use wgCopyUploadProxy to contact GitLab (T421436)]]

Mentioned in SAL (#wikimedia-operations) [2026-08-31T03:29:26Z] <tstarling@deploy1003> tstarling: Backport for [[gerrit:1332525|Produnto: use wgCopyUploadProxy to contact GitLab (T421436)]] synced to the testservers (see https://wikitech.wikimedia.org/wiki/Mwdebug). Changes can now be verified there.

Mentioned in SAL (#wikimedia-operations) [2026-08-31T03:44:24Z] <tstarling@deploy1003> Finished scap sync-world: Backport for [[gerrit:1332525|Produnto: use wgCopyUploadProxy to contact GitLab (T421436)]] (duration: 33m 20s)