ckan / ckan/ideas

Upgrade SOLR - currently documented versions are End of Life

Open
#232 5 comments 3 reactions 0 assignees View on GitHub
Dominant language
No language data
Stars
39
Forks
1
PR merge metrics
No merged PRs in 30d

Description

I'm concerned that following our CKAN install instructions result in installing old versions of SOLR, which are not supported by security patches any more. This has been flagged a few times, but I thought it worth collecting the key info together to help agree a way forward.

SOLR considers the [last two major versions are good](https://lucene.apache.org/solr/downloads.html). At time of writing that's 8.x and 7.7.x. Older versions are 'End of Life' - i.e. no support.

CKAN's use of SOLR, using instructions [Install from source](https://docs.ckan.org/en/latest/maintaining/installing/install-from-source.html#setup-solr) and CKAN's [Install from package](https://docs.ckan.org/en/latest/maintaining/installing/install-from-package.html):
* Ubuntu 18.04 - [solr-jetty](https://packages.ubuntu.com/bionic/solr-jetty) includes SOLR 3.6.2, released 2013-01-16
* Ubuntu 16.04 - [solr-jetty](https://packages.ubuntu.com/xenial/solr-jetty) includes SOLR 3.6.2, released 2013-01-16
* Ubuntu 14.04 - is now into [ESM], requires payment for security patches, so we should probably stop supporting that now anyway

I think in reality most production installs of CKAN deviate from these instructions, using more recent docker images or installing later SOLR versions, so there is not a security panic. However different people take different approaches, the tech team receive lots of requests for help, tips are scattered across lots of different locations, and so it would be helpful if we centrally document a good approach.

* SOLR 3.6.2 - @boykoc has a hack to fix the solr-jetty problem: https://github.com/ckan/ckan/issues/4762
* SOLR 6.5 - @boykoc has an install recipe: https://github.com/ckan/ckan/issues/4916#issuecomment-515564751
* SOLR 6.5 - @jakubklimek has a similar install recipe https://github.com/ckan/ckan/wiki/Install-and-use-Solr-6.5-with-CKAN
* SOLR 7 - @smotornyuk had a PR for SOLRv7 schema https://github.com/ckan/ckan/pull/4387 although that has been dropped now in favour of a SOLRv8 version
* SOLR 8.4 - @smotornyuk has done a PR for SOLR 8.4 https://github.com/ckan/ckan/pull/5143 although he notes it is experimental and potential issues with ckanext-spatial

@TkTech [suggests](https://github.com/ckan/ckan/pull/4387#issuecomment-411578297) each CKAN version supports the two latest/supported SOLR versions, which I think sounds sensible.

Because Ubuntu's packages are always behind SOLR's, @TkTech [suggests](https://github.com/ckan/ckan/pull/4387#issuecomment-411578297) we document installing from source a recommended recent SOLR version. We might bear in mind that compared to the single command `sudo apt-get install solr-jetty`, installing from source needs a bit more, according to https://www.digitalocean.com/community/tutorials/how-to-install-solr-on-ubuntu-14-04 and https://lucene.apache.org/solr/guide/6_6/taking-solr-to-production.html
* download and untarring the jar
Then either use `sudo bash ./install_solr_service.sh solr-x.y.z.tgz` or manually:
* create /opt/solr/etc/jetty-logging.xml, /etc/init.d/jetty
* create the solr user and home directory (/opt/solr)
(not counting editing /etc/default/jetty which we document already)
I guess we should suggest using install_solr_service.sh, and advanced users can always revert to the manual steps if they see fit.

Contributor guide

No contributing guide indexed for this repository

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.