Ask Questions and Find Answers

Hi Jorge, Thanks :).  I have it running now with G28 release . But I noitce that I cant replace G28 war file with G27 osgi and toolls folders as I will get errors as shown in my last comment. I have a question, with these vulnerabilites we have to constantly upgrade to the next GA release. Whats the best practice to do the upgrade ? Can we take the latest GA war file and just replace it in the ROOT.war folder? Or Do we have to do a fresh install with the osgi an tools folder?

Thanks

Kevin

Just the WAR replacement won't do it. The WAR contents go together with the OSGi libraries.

Liferay Workspace provides a couple of targets for different environments to build for, you could build docker images and always point them to the same database/filestore/search server. Either way: Best to completely replace (make sure not just to overwrite, as it might leave old code around wreaking havoc)

There's no need to do this every week (for every release), but I'd recommend to stay in shape and with a current version. If you're used to upgrades, they'll be quick, small and easy.
​​​​

Was it Martin Fowler, or somebody else, who said: "If it hurts, you'll need to do it more often". This is the current principle. Not too much is different from week to week.

Thanks Olaf, our use case is that we have monthly/on demand scans from Sonatype, Webinspect and Fortify. Whenever there is a critical vulnerabilty we need to remediate in 30 days. Some of the liferay GA releases addresses these issues. So we looking ways how to install/upgrade theses GA releases easliy. I am big believer in stick with the current releases for sometime and then upgrade. However, due this policy from security team to update these libraries its become top priority.

However, just to summarize what you said so I understand see below

1. Liferay Workspace provides a couple of targets for different environments to build for - Do I update these target workspaces in the gradle.properties with the new GA releaese?  How would this address extracting the WAR, OSGI files?

2. You could build docker images and always point them to the same database/filestore/search server. I am currently looking at this approach as it may fit my use case. After reading the instructions ont he docker upgrade it seems just and update to GA image relase and thats is wala :). Is there a detail documentation on how to use the docker image in liferay? Will this be a better approach for my Use case as describe above?

3. Best to completely replace (make sure not just to overwrite, as it might leave old code around wreaking havoc). I have been maually removing the contents from the ROOT.war leaving it empty and replacing it with the new GA war file in that ROOT.war folder. Are you saying for option 1 or option2 to completely remove the contents of ROOT.war before pulling an image or installing the WAR file manually?

Hope my questions make sense and I am following you correctly :)

Thanks,

Kevin