Re: [edk2-announce] Research Request

[Jeremiah Cox <jerecox@microsoft.com>]

There is a question of how the below is automated such that when there is a security advisory, a Phabricator instance is patched in a timely fashion.  Perhaps there is a mailing list that would announce these and that could trigger an auto-update script.

It looks like Phabricator has publicly paid out 36 security bug bounties:
https://hackerone.com/phabricator/hacktivity?sort_type=latest_disclosable_activity_at&filter=type%3Abounty-awarded%20to%3Aphabricator&text_query=&page=1 

-----Original Message-----
From: Rebecca Cran <rebecca@bluestop.org> 
Sent: Tuesday, November 27, 2018 2:24 PM
To: edk2-devel@lists.01.org; Jeremiah Cox <jerecox@microsoft.com>
Cc: Knop, Ryszard <ryszard.knop@intel.com>; stephano <stephano.cetola@linux.intel.com>
Subject: Re: [edk2] [edk2-announce] Research Request

On Tuesday, 27 November 2018 14:16:18 MST Jeremiah Cox via edk2-devel wrote:

> Do we have data on what it takes to deploy and operate Phabricator 
> with Harbormaster or Jenkins?  The up front development/deployment 
> activity/costs and then also the ongoing 
> patching/servicing/maintenance costs?  Is Intel planning to provide this?

I haven't integrated Harbormaster or Jenkins, but for just Phabricator the patching/servicing has ben really simple for the year+ I've been running it. 
I'd not consider it 'production' since I'm the only person using it and I'm running from Git master, not a stable branch - but maintenance has been as simple as the following (which could of course be put in a script to reduce the number of steps!):

# Stop the Phabricator daemon
./bin/phd stop
# Update Phabricator
git pull
# Update libphputil
cd ../libphputil && git pull
# Upgrade arcanist (commandline interface) cd ../arcanist && git pull # Upgrade database schema ./bin/storage upgrade # Start Phabricator daemon ./bin/phd start # Reload web server service nginx restart service php-fpm restart

The "storage upgrade" command goes through the database looking for any inconsistencies - missing keys, wrong data types etc., and offers to fix them.

--
Rebecca