The following is the GNU All-permissive License as recommended in https://www.gnu.org/licenses/license-recommendations.en.html

Copyright (C) 2024 Free Software Foundation sysadmin@fsf.org

Copying and distribution of this file, with or without modification, are permitted in any medium without royalty provided the copyright notice and this notice are preserved. This file is offered as-is, without any warranty.

Contributions are welcome. See https://savannah.gnu.org/maintenance/fsf/.

MediaWiki

MediaWiki is used by these sites:

• https://directory.fsf.org
• https://libreplanet.org
• https://wiki.endsoftwarepatents.org
• http://gplv3.fsf.org (now a static site)

For general information, visit the mediawiki page on brains.

Upgrading

• Make sure to transfer over / maintain the custom patch on our CAS module.
• Also disable Piwik / Matomo image tracking on the new site

We strongly prefer use of LTS releases.

Read the general MediaWiki documentation for upgrading. Read release-specific notes on upgrading to the new and intermediate versions. Do a test run on a dev server first.

We should translate this workflow to git in the future.

Backup

Login to each instance.

ssh root@libreplanet.org
ssh root@directory.fsf.org
ssh root@wiki.endsoftwarepatents.org

Make sure to make backups of the doc root and the database. You may need to make an additional binary-formatted backup, as recommended by the wiki upgrade instructions, with:

cd /var/www/
rsync -avhSAXP wiki/ wiki.bak-$(date +%Y-%m-%d)/
mysqldump --default-character-set=binary --user=root mediawiki > mediawiki-binary-$(date +%Y-%m-%d).sql  # LibrePlanet wiki
mysqldump --default-character-set=binary --user=root wikidb > wikidb-binary-$(date +%Y-%m-%d).sql  # FSD & ESP
dump-mysql

Check for the database characterset setting in the LocalSettings.php file.

Patch

If you are upgrading one increment, the patch file is available in the release links. If you are upgrading more than one increment, you must generate the patch.

Download patch

cd /root/src/mediawiki/
wget https://releases.wikimedia.org/mediawiki/1.31/mediawiki-1.31.8.patch.gz
wget https://releases.wikimedia.org/mediawiki/1.31/mediawiki-1.31.8.patch.gz.sig

Verify signature

gpg --verify mediawiki-1.31.8.patch.gz.sig mediawiki-1.31.8.patch.gz

These keys have been used for tarball signatures:

• 1D98 867E 8298 2C8F E0AB C25F 9B69 B310 9D3B B7B0
• 41B2 ABE8 17AD D3E5 2BDA 946F 72BC 1C5D 2310 7F8A

Unarchive

gunzip mediawiki-1.31.8.patch.gz

Generate patch

Download Tarball

cd /root/src/mediawiki/
wget https://releases.wikimedia.org/mediawiki/1.31/mediawiki-1.31.8.tar.gz
wget https://releases.wikimedia.org/mediawiki/1.31/mediawiki-1.31.8.tar.gz.sig

Verify signature

gpg --verify mediawiki-1.31.8.tar.gz.sig mediawiki-1.31.8.tar.gz

These keys have been used for tarball signatures:

• 1D98 867E 8298 2C8F E0AB C25F 9B69 B310 9D3B B7B0
• 41B2 ABE8 17AD D3E5 2BDA 946F 72BC 1C5D 2310 7F8A

If the release change is very minor, such as 1.27.2 to 1.27.4, you can generate a diff between the two unpacked tarballs with diff -urN and apply the patch to the existing installation instead of starting from a new docroot and copying changes. (As of 2017-11-15, we have various changes in our installations that need to be preserved, including the Vector template on the directory.)

tar zxvf mediawiki-1.31.8.tar.gz
diff -urN mediawiki-1.31.6/ mediawiki-1.31.8/ > 1.31.6-8.patch

Cleanup the directories.

rm -fr mediawiki-1.31.6
rm -fr mediawiki-1.31.8

Apply patch

Copy the patch to the MediaWiki instances.

scp mediawiki-1.31.16.patch root@directory.fsf.org:/root/
scp mediawiki-1.31.16.patch root@libreplanet.org:/root/
scp mediawiki-1.31.16.patch root@wiki.endsoftwarepatents.org:/root/

Change to the directory.

cd /var/www/wiki

See the changes that the patch would make with a dry run.

patch -p1 --dry-run < ~/mediawiki1.31.6-8.patch

Note: Make sure you are not upgrading during the FSD meeting.

Make a notice on our OOB notice board like so.

wiki.endsoftwarepatents.org, libreplanet.org, and directory.fsf.org will be going offline for a MediaWiki security patch.

Stop apache.

service apache2 stop

Apply the patch.

patch -p1 < ~/mediawiki1.31.6-8.patch

Update with composer

Consider using a different user for composer like we do with drupal8.

Allow outbound connection.

export HTTP_PROXY=http://serverproxy0p.fsf.org:8118; export HTTPS_PROXY=http://serverproxy0p.fsf.org:8118; export NO_PROXY=localhost,127.0.0.1

Update extensions.

composer.phar update --no-dev  # libreplanet.org
/root/composer.phar update --no-dev  # directory.fsf.org

Run update.php. Note: This takes longer on the directory.

php maintenance/update.php

If the upgrade seems stuck, open htop in another pane to see what is running in the background.

Check to see if it ran without error.

echo $?

Start apache.

service apache2 start

Test that everything works.

• Check version pages. FSD LP
• Try various pages.
• Try editing a page.
• Try editing an FSD entry with the form.

Make a notice on our OOB notice board like so.

directory.fsf.org and libreplanet.org are back online.

Consider upgrading modules. Modules may have configs in their directory, so make sure to copy them over. They may also have their own dependencies that need to be installed in the module directory.

Consider uploading core and module code to agpl.fsf.org, but be careful about not including any config files that may contain sensitive information.

Consider rebuilding the SMW data site-wide. This will update pages one by one. https://www.semantic-mediawiki.org/wiki/Help:Maintenance_script_rebuildData.php

Update phpCAS

Check for a new release. Compare with the installed version.

ls -la /var/www/wiki/extensions/CASAuth/CAS
lrwxrwxrwx 1 root root 9 Jun  1 17:07 /var/www/wiki/extensions/CASAuth/CAS -> CAS-1.4.0

If applicable, install the newest version of phpCAS (for example version 1.4.0):

cd /var/www/wiki/extensions/CASAuth/
wget https://github.com/apereo/phpCAS/releases/download/1.4.0/CAS-1.4.0.tgz
tar xvf CAS-1.4.0.tgz
rm -f CAS-1.4.0.tgz
chown -R root:www-data CAS-1.4.0
rm -f CAS && ln -s CAS-1.4.0 CAS && ls -la CAS
/etc/init.d/php7.0-fpm reload

agpl.fsf.org

MediaWiki is not AGPLv3, but GPLv2. After an upgrade or patch, it is good practice to update the tarball.

directory.fsf.org

Login to the directory as root.

ssh root@directory.fsf.org

Verify that the agpl.sh script will remove all sensitive information from the staging directory before we publish.

less agpl.sh

Run the command to generate a new backup.

bash agpl.sh

Log out of the directory.

exit

On your local system, change to a temporary location.

cd /tmp

Download the recently created backup file.

scp root@directory.fsf.org:/root/directory.tar.gz directory.tar.gz

Upload the recently created backup file to agpl.fsf.org.

scp directory.tar.gz root@agpl.fsf.org:/var/www/agpl.fsf.org/directory.fsf.org/CURRENT/

Command line

Manage privileges

createAndPromote.php Documentation

Add bureaucrat to an account that already exists.

cd /var/www/w
php maintenance/createAndPromote.php --bureaucrat --force USERNAMEHERE

Nuking page and page history

NukePage.php doc

Login to the server and navigate to the mediawiki directory.

cd /var/www/wiki

Do a dry-run to verify that you are targeting the correct file.

php maintenance/nukePage.php "User:Doom/Profile"

Output looks like this with a non-zero page id.

Searching for "User:Doom/Profile"...found "User:Doom/Profile" with ID 8312.
Searching for revisions...found 4.

If the line ends with ID 0., do not remove it in this manner.

Nuke the page and page history.

php maintenance/nukePage.php "User:Doom/Profile" --delete

You can copy and paste lines from a user's contribution page and add them to a text file and clean it up and format it with these commands:

editor nuke.sh
sed -i 's/^.* \. \. //g' nuke.sh # Remove front matter
sed -i 's/^N //g' nuke.sh # Remove front matter for redirects.
sed -i 's/ ‎ (.*$//g' nuke.sh # Remove back matter
sed -i 's|^|php maintenance/nukePage.php "|g' nuke.sh # Add front matter.
sed -i 's|$|"|g' nuke.sh # Add closing quote.
sort nuke.sh | uniq > nuke.sh.tmp  # Sort keep unique entries
mv nuke.sh.tmp nuke.sh # Overwrite redundant file with unique file
bash nuke.sh | less # Check that the dry-run does not include ID 0 for any entries.
editor nuke.sh # Remove items that returned ID 0.
sed -i 's|$| --delete|g' nuke.sh # Turn off dry-run.
bash nuke.sh # Nuke.

QualityBox

Consider using QualityBox, which is a free software MW deployment system. Andrew spoke to Gregory Rundlett about it at LP 18. https://discourse.equality-tech.com/ Do not use QualityBox, since the ansible rules are written like bash scripts and can only be run once, while creating the site.