>>> [!note] Migrated issue <!-- Drupal.org comment --> <!-- Migrated from issue #2940731. --> Reported by: [hestenet](https://www.drupal.org/user/54034) >>> <h2><a href="https://www.drupal.org/project/automatic_updates/issues/3319030">Drupal 10 roadmap</a></h2> <p><span class="drupalorg-gitlab-issue-link project-issue-status-info project-issue-status-1"><a href="https://www.drupal.org/project/drupal/issues/3319030" title="Status: Active">#3319030: Drupal Core Roadmap for Package Manager and Update Manager</a></span></p> <h2>Initiative Overview</h2> <p>The goal of the Automatic Updates Initiative is to provide safe, secure automatic updates for Drupal sites. This is an essential <a href="https://www.drupal.org/about/strategic-initiatives">strategic initiative</a> for Drupal 9 core for two reasons:</p> <ol> <li> <p>Manually updating sites is difficult, time-consuming, and expensive, and the difficulty of updating Drupal is repeatedly raised as a top concern for using Drupal.</p> </li> <li> <p>Delays between the release of a security advisory and the deployment of the corresponding Drupal update result in a time window where sites are vulnerable to exploit. Many sites do not apply updates for 2-4 weeks after the release of a security advisory, and site owners who want to ensure the security of their site need to have site maintainers available during the 1200 EST security release window (which is in the middle of the night for much of the Eastern hemisphere).</p> </li> </ol> <p>Both these factors increase Drupal's cost of ownership and decrease user confidence in the platform.</p> <h3>How to get involved</h3> <p>Join the <code>#autoupdates</code> channel of the <a href="https://www.drupal.org/slack">Drupal community Slack</a>.</p> <p>Meetings are held on the every other Tuesday at 1:00 PM EST in the <code>#autoupdates</code> channel. Minutes from past meetings and agendas for upcoming meetings can be found in the <a href="https://www.drupal.org/project/issues/automatic_updates?status=All&amp;component=Meetings">Automatic Updates project queue</a>.</p> <p>Work is currently going on in 4 projects:</p> <ol> <li>The 8.x-2.x branch of the Automatic Updates Contrib project. This work will be port to Drupal core directly. Issues to be worked on can be found in the <a href="https://www.drupal.org/project/issues/automatic_updates?version=all_8.x-2.*">issue queue for 8.x-2.x</a></li> <li>The <a href="https://github.com/php-tuf/php-tuf">Github PHP-TUF library</a>: this will ensure updates are correctly signed</li> <li><a href="https://github.com/php-tuf/composer-integration">A Composer plugin to integrate PHP-TUF signing</a> with Composer. This depends on drupal.org's packaging pipeline and Composer facade supporting PHP-TUF signing, which is being built under the supervision of the DA.</li> <li>The <a href="https://github.com/php-tuf/composer-stager">Github Composer Stager library</a>: this library will enable Drupal core to stage updates before they are applied</li> </ol> <h3>Session recordings</h3> <ul> <li><a href="https://www.youtube.com/watch?v=wmhD6lA3PRs&amp;feature=emb_logo">Nashville</a></li> <li><a href="https://www.youtube.com/watch?v=RCzCijmB_2g">Seattle</a></li> <li><a href="https://www.youtube.com/watch?v=ZkxraI-oUE0">DrupalCamp London</a></li> <li><a href="https://www.youtube.com/watch?v=qHaSCPi0324">DrupalCon Global</a></li> <li><a href="https://www.youtube.com/watch?v=aFzctR2Q69o&amp;list=PLpeDXSh4nHjTP7vRC6LCak9adK2yp1P5S">DrupalCon Europe 2020</a></li> <li><a href="https://www.youtube.com/watch?v=PsukgSNgo-8">DrupalCon North America 2021 Initiative Keynote</a></li> <li><a href="https://www.youtube.com/watch?v=ho-jWbMFhys">DrupalCon North America 2021: Technical Overview</a></li> </ul> <h2>Automatic Updates architectural spec/overview</h2> <h3>Background: Personas</h3> <ul> <li><strong>Deploy and Ignore</strong>: Once the site has the functionality needed, there's little maintenance or updating. Doesn't subscribe to PSAs. </li> <li><strong>Site owner who cares once a year</strong>: Deploy and ignore w/ an exception once a year</li> <li><strong>Diligent but with Simple Needs</strong>: Typically applies updates within a week of release, possibly longer for non-security updates. Follows up on PSAs by directly updating the live site.</li> <li><strong>The Sophisticate</strong>: Needs to apply at least one build step (for CSS, Composer, etc.). Runs QA in a pre-production environment. May deploy to a multi-head cluster.</li> </ul> <ol> <li> <h3>Validation, readiness checks and notifications<br> <h3> The Automatic Updates module verifies that it is safe to apply an update to a site prior to downloading an update, and informs the site owner if updates cannot be installed automatically. </h3></h3><p>The readiness check API is being developed in the 8.x-2.x branch of <a href="https://www.drupal.org/project/automatic_updates">the contrib project</a>. See <span class="drupalorg-gitlab-issue-link project-issue-status-info project-issue-status-7"><a href="https://www.drupal.org/project/automatic_updates/issues/3230045" title="Status: Closed (fixed)">#3230045: [Meta] Create validation listeners</a></span></p> <p>The readiness checks include (but are not limited to) the following:</p> <ul> <li>Is the site on the latest release of core?</li> <li>Does the site codebase match the official release? (I.e., no patches applied, no hacks to core, etc.</li> <li>Does the site have outstanding database updates?</li> <li>Is there available disk space?</li> <li>Are file permissions configured appropriately?</li> <li>[Still needed / not yet added] Is the memory available sufficient for updates to be installed? Issue: <span class="drupalorg-gitlab-issue-link project-issue-status-info project-issue-status-13"><a href="https://www.drupal.org/project/automatic_updates/issues/3159920" title="Status: Needs work">#3159920: Add a PHP Memory Readiness checker</a></span></li> </ul> <p>In addition to the readiness checks, we're also adding display of critical security Public Service Announcements on the Drupal site status report and administration pages: <span class="drupalorg-gitlab-issue-link project-issue-status-info project-issue-status-7"><a href="https://www.drupal.org/project/drupal/issues/3041885" title="Status: Closed (fixed)">#3041885: Display relevant Security Advisories data for Drupal</a></span>.</p> </li> <li> <h3>Signing and verification</h3> <p>Signing of Drupal releases will be handled according to <a href="https://theupdateframework.io/">The Update Framework</a> (TUF) specification. drupal.org will provide signed versions for Drupal releases and vendor libraries that will be needed for updates.<br> Core will use the <a href="https://github.com/php-tuf/php-tuf">PHP-TUF</a> library which implements a client library. This library is currently being developed may be used by other PHP CMSes.</p> <p>The PHP-TUF client library will require Composer integration to verify the packages before they are installed via Composer. This is done by way of a plugin for Composer 2.1 or later: <a href="https://github.com/php-tuf/composer-integration">https://github.com/php-tuf/composer-integration</a>. The plugin depends on TUF signing information being available for all requested packages, which is being added to drupal.org's packaging pipeline and Composer facade under the supervision of the Drupal Association. </p></li> <li> <h3>Staged update and rollback</h3> <p>The update functionality in Drupal core will need attempt to run an update via Composer and be able to determine if the update succeeded. If the update was not successful the site should be left unaffected and in a working state. If the update was successful, the production site should switch to the new codebase with 0 or minimal maintenance mode window needed.</p> <p>An earlier proposal for this was <span class="drupalorg-gitlab-issue-link project-issue-status-info project-issue-status-1"><a href="https://www.drupal.org/project/drupal/issues/3093093" title="Status: Active">#3093093: Replace single index.php with a frontend controller that supports A/B updating (automatic updates)</a></span>.</p> <p>However, we encountered some issues with that, and our current proposal is <span class="drupalorg-gitlab-issue-link project-issue-status-info project-issue-status-1"><a href="https://www.drupal.org/project/drupal/issues/3199171" title="Status: Active">#3199171: Automatic updates: For MVP, instead of an a/b bootloader, implement a semi-atomic composer update with a brief maintenance-mode window</a></span>.</p> </li> <li> <h3>Update installation</h3> <ul> <li> <h4>Composer-managed sites</h4> <p>Composer-managed sites are supported in the 8.x-2.x version of <a href="https://www.drupal.org/project/automatic_updates">Automatic Updates contributed module</a>. This 8.x-2.x version of the module does not support sites that are not managed by Composer.</p> <p>The 8.x-2.x version of the this module is being prepared for inclusion in Drupal 10 core.</p> <p>Per #2 and #3 above, <a href="https://github.com/php-tuf/composer-integration">https://github.com/php-tuf/composer-integration</a> will provide the TUF integration and <a href="https://github.com/php-tuf/composer-stager">https://github.com/php-tuf/composer-stager</a> will provide the staging and rollback support.</p> </li> <li> <h4>tarball-managed sites</h4> <p>In-place automatic updates for tarball-based sites for Drupal 7 are provided in the 7.x-1.x version <a href="https://www.drupal.org/project/automatic_updates">Automatic Updates contributed module</a> (development funded by the European Commission).</p> <p>The 8.x-1.x version of this module which supported tarball-based sites for Drupal 8 is <strong>no longer supported</strong>.</p> <p>[More detail here]</p> </li> </ul> </li> </ol> <h2>Roadmap</h2> <h3>[Complete!] Phase 1</h3> <p>Phase 1 included developing a Drupal 7 and 8 contributed module with readiness checks, security public service announcements, and in-place manual and automated updates for tarball-based sites.</p> <ul> <li><a href="https://youtu.be/eKu8ibRljvE">Video walkthrough of the Phase 1 module code</a></li> <li><a href="https://www.drupal.org/docs/8/update/automatic-updates">Drupal 8 module documentation</a></li> </ul> <h3>[In progress] Phase 2 (Initial core requirements)</h3> <p>Phase 2 of the initiative is to add the initial requirements for automatic updates to Drupal 9 core. The initial core module will provide automatic updates for:</p> <ul> <li>Core only</li> <li>Composer-built sites only</li> <li>Patch/security releases only</li> <li>Updates for the installed minor version</li> </ul> <p>Phase 2 requirements:</p> <p>[Outline and issue list here, based on most recent meeting]</p> <ol> <li> <h4>Completed &#127881;: Port PSA functionality to core <code>system.module</code></h4> <p><span class="drupalorg-gitlab-issue-link project-issue-status-info project-issue-status-7"><a href="https://www.drupal.org/project/drupal/issues/3041885" title="Status: Closed (fixed)">#3041885: Display relevant Security Advisories data for Drupal</a></span></p> </li> <li> <h4>Port the 2.x branch of <a href="https://www.drupal.org/project/automatic_updates">the contrib module</a> to core</h4> <p>This will add two new modules to core: Automatic Updates (<code>auto_updates</code>) and Package Manager (<code>package_manager</code>). Package Manager provides the underlying API to create and manage a staging area in which to modify the Drupal code base, and will be used by the <a href="https://www.drupal.org/project/project_browser">Project Browser</a> module as well. Automatic Updates will implement the readiness check API along with several basic checks, plus the functionality to update core (and only core) in the UI or during cron.</p> <p>Core will also receive new third-party runtime dependencies, specifically <code>php-tuf/composer-stager</code>.</p> <p>The modules are being added to core in <span class="drupalorg-gitlab-issue-link project-issue-status-info project-issue-status-13"><a href="https://www.drupal.org/project/drupal/issues/3253158" title="Status: Needs work">#3253158: Add Alpha level Experimental Update Manager module</a></span>.</p> </li> <li> <h4>Composer support</h4> </li> </ol> <h3>[Not yet in scope] Phase 3 (Post-stable features)</h3> <p>The following features are not part of the initial core scope, but may be added in future releases once the core module is stable:</p> <ul> <li>Automatic updates for contributed modules/themes</li> </ul> <h2>Initiative Team</h2> <ul> <li><a href="https://drupal.org/u/dstol">dstol</a> (Initiative Coordinator)</li> <li><a href="https://drupal.org/u/david-strauss">david-strauss</a></li> <li><a href="https://www.drupal.org/u/heddn">heddn</a></li> <li><a href="https://drupal.org/u/mbaynton">mbaynton</a></li> <li><a href="https://drupal.org/u/pwolanin">pwolanin</a></li> <li><a href="https://drupal.org/u/xjm">xjm</a></li> <li><a href="https://drupal.org/u/tedbow">tedbow</a></li> <li><a href="https://drupal.org/u/effulgentsia">effulgentsia</a></li> <li><a href="https://drupal.org/u/phenaproxima">phenaproxima</a></li> </ul> <h2>Related initiatives</h2> <ul> <li><span class="drupalorg-gitlab-issue-link project-issue-status-info project-issue-status-7"><a href="https://www.drupal.org/project/ideas/issues/2958021" title="Status: Closed (fixed)">#2958021: Proposal: Composer Support in Core initiative</a></span></li> <li><span class="drupalorg-gitlab-issue-link project-issue-status-info project-issue-status-7"><a href="https://www.drupal.org/project/ideas/issues/2940733" title="Status: Closed (fixed)">#2940733: Site Builder Tool/Project Browser initiative</a></span></li> <li><span class="drupalorg-gitlab-issue-link project-issue-status-info project-issue-status-16"><a href="https://www.drupal.org/project/drupal/issues/2940737" title="Status: Postponed (maintainer needs more info)">#2940737: Add more telemetry to Drupal core</a></span></li> <li><span class="drupalorg-gitlab-issue-link project-issue-status-info project-issue-status-7"><a href="https://www.drupal.org/project/ideas/issues/2940739" title="Status: Closed (fixed)">#2940739: Project messaging channel in core initiative</a></span></li> </ul> > Related issue: [Issue #2367319](https://www.drupal.org/node/2367319)