Page MenuHomePhabricator

Deploy Produnto extension to production
Closed, ResolvedPublic

Description

  • Security Review for Produnto: T423761: Application Security Review Request : Produnto extension
  • Add the submodule and add it to extension-list
  • Deploy on beta sites
  • Train deployment
  • Create DB tables in wikishared x1
  • Enable on testwiki
  • Pilot deployment to hiwiki, pawiki, orwiki, tewiki, mlwiki planned for early in September

Event Timeline

There are a very large number of changes, so older changes are hidden. Show Older Changes
SBisson triaged this task as High priority.Apr 14 2026, 5:34 PM
SBisson raised the priority of this task from High to Needs Triage.

https://www.mediawiki.org/wiki/Help:Extension:Produnto does not have any useful content. It should be updated before it is in production.

Mentioned in SAL (#wikimedia-releng) [2026-08-13T03:05:10Z] <TimStarling> created Produnto tables on beta T421436

Change #1324963 had a related patch set uploaded (by Tim Starling; author: Tim Starling):

[operations/mediawiki-config@master] Add Produnto to extension-list

https://gerrit.wikimedia.org/r/1324963

Change #1324964 had a related patch set uploaded (by Tim Starling; author: Tim Starling):

[operations/mediawiki-config@master] Enable Produnto on Beta

https://gerrit.wikimedia.org/r/1324964

Change #1324965 had a related patch set uploaded (by Tim Starling; author: Tim Starling):

[operations/mediawiki-config@master] Enable Produnto on testwiki

https://gerrit.wikimedia.org/r/1324965

Change #1324966 had a related patch set uploaded (by Tim Starling; author: Tim Starling):

[operations/mediawiki-config@master] Enable Produnto on pilot wikis

https://gerrit.wikimedia.org/r/1324966

Change #1324963 merged by jenkins-bot:

[operations/mediawiki-config@master] Add Produnto to extension-list

https://gerrit.wikimedia.org/r/1324963

Change #1324964 merged by jenkins-bot:

[operations/mediawiki-config@master] Enable Produnto on Beta

https://gerrit.wikimedia.org/r/1324964

Mentioned in SAL (#wikimedia-operations) [2026-08-21T04:24:36Z] <tstarling@deploy1003> Started scap sync-world: Backport for [[gerrit:1324963|Add Produnto to extension-list (T421436)]], [[gerrit:1324964|Enable Produnto on Beta (T421436)]]

Mentioned in SAL (#wikimedia-operations) [2026-08-21T04:44:28Z] <tstarling@deploy1003> tstarling: Backport for [[gerrit:1324963|Add Produnto to extension-list (T421436)]], [[gerrit:1324964|Enable Produnto on Beta (T421436)]] synced to the testservers (see https://wikitech.wikimedia.org/wiki/Mwdebug). Changes can now be verified there.

Mentioned in SAL (#wikimedia-operations) [2026-08-21T04:59:24Z] <tstarling@deploy1003> Finished scap sync-world: Backport for [[gerrit:1324963|Add Produnto to extension-list (T421436)]], [[gerrit:1324964|Enable Produnto on Beta (T421436)]] (duration: 34m 48s)

Mentioned in SAL (#wikimedia-operations) [2026-08-24T23:57:26Z] <TimStarling> on db1220 x1 wikishared created Produnto tables T421436

tstarling@deploy1003$ sql --wiki=enwiki --cluster=extension1 --write
...
wikiadmin2023@10.64.32.36(enwiki)> use wikishared;
...
wikiadmin2023@10.64.32.36(wikishared)> \. /srv/mediawiki/php-1.47.0-wmf.16/extensions/Produnto/sql/mysql/tables-generated.sql
Query OK, 0 rows affected (0.004 sec)

Query OK, 0 rows affected (0.004 sec)

Query OK, 0 rows affected (0.003 sec)

Query OK, 0 rows affected (0.003 sec)

Query OK, 0 rows affected (0.003 sec)

Query OK, 0 rows affected (0.003 sec)

Query OK, 0 rows affected (0.003 sec)

Query OK, 0 rows affected (0.003 sec)

Query OK, 0 rows affected (0.002 sec)

wikiadmin2023@10.64.32.36(wikishared)> SHOW CREATE TABLE produnto_file_text\G
*************************** 1. row ***************************
       Table: produnto_file_text
Create Table: CREATE TABLE `produnto_file_text` (
  `pft_hash` binary(64) NOT NULL,
  `pft_text` longblob NOT NULL,
  PRIMARY KEY (`pft_hash`)
) ENGINE=InnoDB DEFAULT CHARSET=binary
1 row in set (0.000 sec)

Change #1328752 had a related patch set uploaded (by Tim Starling; author: Tim Starling):

[operations/mediawiki-config@master] Grant produnto-update to groups that have editprotected

https://gerrit.wikimedia.org/r/1328752

Change #1324965 merged by jenkins-bot:

[operations/mediawiki-config@master] Enable Produnto on testwiki

https://gerrit.wikimedia.org/r/1324965

Mentioned in SAL (#wikimedia-operations) [2026-08-27T03:31:07Z] <tstarling@deploy1003> Started scap sync-world: Backport for [[gerrit:1324965|Enable Produnto on testwiki (T421436)]]

Mentioned in SAL (#wikimedia-operations) [2026-08-27T03:35:51Z] <tstarling@deploy1003> tstarling: Backport for [[gerrit:1324965|Enable Produnto on testwiki (T421436)]] synced to the testservers (see https://wikitech.wikimedia.org/wiki/Mwdebug). Changes can now be verified there.

Mentioned in SAL (#wikimedia-operations) [2026-08-27T04:11:45Z] <tstarling@deploy1003> Finished scap sync-world: Backport for [[gerrit:1324965|Enable Produnto on testwiki (T421436)]] (duration: 40m 38s)

Does the security review (T423761) still need to be hidden if that task is done?

Change #1329728 had a related patch set uploaded (by Tim Starling; author: Tim Starling):

[operations/mediawiki-config@master] Produnto: Add IPv6 range for GitLab

https://gerrit.wikimedia.org/r/1329728

Change #1328752 merged by jenkins-bot:

[operations/mediawiki-config@master] Grant produnto-update to groups that have editprotected

https://gerrit.wikimedia.org/r/1328752

Change #1329728 merged by jenkins-bot:

[operations/mediawiki-config@master] Produnto: Add IPv6 range for GitLab

https://gerrit.wikimedia.org/r/1329728

Mentioned in SAL (#wikimedia-operations) [2026-08-28T02:58:06Z] <tstarling@deploy1003> Started scap sync-world: Backport for [[gerrit:1328752|Grant produnto-update to groups that have editprotected (T421436)]], [[gerrit:1329728|Produnto: Add IPv6 range for GitLab (T421436)]]

Mentioned in SAL (#wikimedia-operations) [2026-08-28T03:02:18Z] <tstarling@deploy1003> tstarling: Backport for [[gerrit:1328752|Grant produnto-update to groups that have editprotected (T421436)]], [[gerrit:1329728|Produnto: Add IPv6 range for GitLab (T421436)]] synced to the testservers (see https://wikitech.wikimedia.org/wiki/Mwdebug). Changes can now be verified there.

Mentioned in SAL (#wikimedia-operations) [2026-08-28T03:10:50Z] <tstarling@deploy1003> Finished scap sync-world: Backport for [[gerrit:1328752|Grant produnto-update to groups that have editprotected (T421436)]], [[gerrit:1329728|Produnto: Add IPv6 range for GitLab (T421436)]] (duration: 12m 44s)

Change #1332525 had a related patch set uploaded (by Tim Starling; author: Tim Starling):

[operations/mediawiki-config@master] Produnto: use wgCopyUploadProxy to contact GitLab

https://gerrit.wikimedia.org/r/1332525

Change #1332525 merged by jenkins-bot:

[operations/mediawiki-config@master] Produnto: use wgCopyUploadProxy to contact GitLab

https://gerrit.wikimedia.org/r/1332525

Mentioned in SAL (#wikimedia-operations) [2026-08-31T03:11:04Z] <tstarling@deploy1003> Started scap sync-world: Backport for [[gerrit:1332525|Produnto: use wgCopyUploadProxy to contact GitLab (T421436)]]

Mentioned in SAL (#wikimedia-operations) [2026-08-31T03:29:26Z] <tstarling@deploy1003> tstarling: Backport for [[gerrit:1332525|Produnto: use wgCopyUploadProxy to contact GitLab (T421436)]] synced to the testservers (see https://wikitech.wikimedia.org/wiki/Mwdebug). Changes can now be verified there.

Mentioned in SAL (#wikimedia-operations) [2026-08-31T03:44:24Z] <tstarling@deploy1003> Finished scap sync-world: Backport for [[gerrit:1332525|Produnto: use wgCopyUploadProxy to contact GitLab (T421436)]] (duration: 33m 20s)

Change #1324966 merged by jenkins-bot:

[operations/mediawiki-config@master] Enable Produnto on pilot wikis

https://gerrit.wikimedia.org/r/1324966

Mentioned in SAL (#wikimedia-operations) [2026-09-14T23:13:47Z] <tstarling@deploy1003> Started scap sync-world: Backport for [[gerrit:1324966|Enable Produnto on pilot wikis (T421436)]]

Mentioned in SAL (#wikimedia-operations) [2026-09-14T23:17:47Z] <tstarling@deploy1003> tstarling: Backport for [[gerrit:1324966|Enable Produnto on pilot wikis (T421436)]] synced to the testservers (see https://wikitech.wikimedia.org/wiki/Mwdebug). Changes can now be verified there.

Mentioned in SAL (#wikimedia-operations) [2026-09-14T23:26:46Z] <tstarling@deploy1003> Finished scap sync-world: Backport for [[gerrit:1324966|Enable Produnto on pilot wikis (T421436)]] (duration: 12m 59s)

All done, I think.

I granted produnto-update to global groups with editprotected. The checkbox didn't show up on metawiki so I had to make the changes using mediawiki.org.

The next step is to deploy it to all wikis, but that wasn't asked for in the task description, that's why I resolved the task.

@tstarling can you provide a draft please?

Produnto has been deployed to mediawiki.org and five Indic language wikis. We want to hear your feedback on this experimental product. Produnto allows users to use Lua modules hosted in Wikimedia's GitLab.

Thank you, can I get one line on what the benefit of this deployment is for users? As in what is the benefit of now having Lua in Wikimedia's GitLab? >>! In T421436#12336266, @tstarling wrote:

Produnto has been deployed to mediawiki.org and five Indic language wikis. We want to hear your feedback on this experimental product. Produnto allows users to use Lua modules hosted in Wikimedia's GitLab.

Thank you, can I get one line on what the benefit of this deployment is for users?

It simplifies the sharing of Lua code between wikis. Instead of copying each individual Lua module from one wiki to another, users will be able to easily share packages across all wikis.