Upgrade GeoServer to 2.27.2 to fix vulnerabilities #570
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Changes from upstream image: kartoza/docker-geoserver@v2.25.4--2024.11.17--e7732f7...v2.27.2--2025.08.05--f411524 Note unfortunately there was no github tag for our existing `2.25.2--v2024.06.25` so the compare link above the best approximate diff we can have. From the diff, the geoserveruserid has changed so we needed to update to match.
github-actions
bot
added
ci/deployment
Collaborator
E2E Test ResultsDACCS-iac Pipeline ResultsBuild URL : http://daccs-jenkins.crim.ca:80/job/DACCS-iac-birdhouse/3537/Result ❌ FAILUREBIRDHOUSE_DEPLOY_BRANCH : upgrade-geoserver DACCS_IAC_BRANCH : master DACCS_CONFIGS_BRANCH : master PAVICS_E2E_WORKFLOW_TESTS_BRANCH : master PAVICS_SDI_BRANCH : master DESTROY_INFRA_ON_EXIT : true PAVICS_HOST : https://host-140-118.rdext.crim.ca PAVICS-e2e-workflow-tests Pipeline ResultsTests URL : http://daccs-jenkins.crim.ca:80/job/PAVICS-e2e-workflow-tests/job/master/354/NOTEBOOK TEST RESULTS |
… test against the proper GeoServer
github-actions
bot
added
the
feature/WPS
Collaborator
E2E Test ResultsDACCS-iac Pipeline ResultsBuild URL : http://daccs-jenkins.crim.ca:80/job/DACCS-iac-birdhouse/3538/Result ❌ FAILUREBIRDHOUSE_DEPLOY_BRANCH : upgrade-geoserver DACCS_IAC_BRANCH : master DACCS_CONFIGS_BRANCH : master PAVICS_E2E_WORKFLOW_TESTS_BRANCH : master PAVICS_SDI_BRANCH : master DESTROY_INFRA_ON_EXIT : true PAVICS_HOST : https://host-140-118.rdext.crim.ca PAVICS-e2e-workflow-tests Pipeline ResultsTests URL : http://daccs-jenkins.crim.ca:80/job/PAVICS-e2e-workflow-tests/job/master/355/NOTEBOOK TEST RESULTS |
Collaborator
E2E Test ResultsDACCS-iac Pipeline ResultsBuild URL : http://daccs-jenkins.crim.ca:80/job/DACCS-iac-birdhouse/3542/Result ❌ FAILUREBIRDHOUSE_DEPLOY_BRANCH : upgrade-geoserver DACCS_IAC_BRANCH : master DACCS_CONFIGS_BRANCH : master PAVICS_E2E_WORKFLOW_TESTS_BRANCH : master PAVICS_SDI_BRANCH : master DESTROY_INFRA_ON_EXIT : true PAVICS_HOST : https://host-140-118.rdext.crim.ca PAVICS-e2e-workflow-tests Pipeline ResultsTests URL : http://daccs-jenkins.crim.ca:80/job/PAVICS-e2e-workflow-tests/job/master/358/NOTEBOOK TEST RESULTS |
mishaschwartz
approved these changes
Aug 11, 2025
fmigneault
reviewed
Aug 12, 2025
| "${BASH_IMAGE}" \ | ||
| bash -xc 'if [ -z "$FIRST_RUN_ONLY" -o ! -f /datadir/global.xml ]; \ | ||
| then chown -R 1000:10001 /datadir; else echo "No execute."; fi' | ||
| then chown -R 2000:2000 /datadir; else echo "No execute."; fi' |
Member
There was a problem hiding this comment.
Maybe make this a parameter for the script, e.g.: GEOSERVER_DATA_OWNER?
If latest birdhouse is used but GEOSERVER_VERSION is pinned to an older version, this would break its configuration.
Collaborator
Author
There was a problem hiding this comment.
Been testing on our Staging with existing data imported from production and the new GeoServer dynamically set all the permissions properly ! We don't even need this script anymore !
I was going to delete this script, but given your comment, I'll just revert this script to before and avoid calling it in the pre-docker-compose-up. Anyone hardcoding an older version of GeoServer will need to call this script manually. Sounds good for you?
Collaborator
There was a problem hiding this comment.
If you're going to do that @tlvu can you please leave a comment at the top of this file that says that it's deprecated and telling the user that it's no longer needed for newer versions of geoserver (and let them know which versions it's fixed for)
That way we'll know that it's no longer needed and why.
Collaborator
Author
There was a problem hiding this comment.
That way we'll know that it's no longer needed and why.
Yes will do. I still have a few problems with this new GeoServer and our existing data to sort out. The upgrade did not work seamlessly. Will update this and probably other configs to get the upgrade to work correctly at the same time.
…WPS will use Ensure we can hit the local GeoServer on test servers. Otherwise we will be unable to test GeoServer upgrade on test servers.
Collaborator
E2E Test ResultsDACCS-iac Pipeline ResultsBuild URL : http://daccs-jenkins.crim.ca:80/job/DACCS-iac-birdhouse/3617/Result 🆘 ABORTEDBIRDHOUSE_DEPLOY_BRANCH : upgrade-geoserver DACCS_IAC_BRANCH : master DACCS_CONFIGS_BRANCH : master PAVICS_E2E_WORKFLOW_TESTS_BRANCH : master PAVICS_SDI_BRANCH : master DESTROY_INFRA_ON_EXIT : true PAVICS_HOST : https://host-140-46.rdext.crim.ca
|
tlvu
added a commit
that referenced
this pull request
Aug 30, 2025
Collaborator
E2E Test ResultsDACCS-iac Pipeline ResultsBuild URL : http://daccs-jenkins.crim.ca:80/job/DACCS-iac-birdhouse/3616/Result ❌ FAILUREBIRDHOUSE_DEPLOY_BRANCH : upgrade-geoserver DACCS_IAC_BRANCH : master DACCS_CONFIGS_BRANCH : master PAVICS_E2E_WORKFLOW_TESTS_BRANCH : master PAVICS_SDI_BRANCH : master DESTROY_INFRA_ON_EXIT : true PAVICS_HOST : https://host-140-154.rdext.crim.ca PAVICS-e2e-workflow-tests Pipeline ResultsTests URL : http://daccs-jenkins.crim.ca:80/job/PAVICS-e2e-workflow-tests/job/master/418/NOTEBOOK TEST RESULTS |
Collaborator
E2E Test ResultsDACCS-iac Pipeline ResultsBuild URL : http://daccs-jenkins.crim.ca:80/job/DACCS-iac-birdhouse/3618/Result ❌ FAILUREBIRDHOUSE_DEPLOY_BRANCH : upgrade-geoserver DACCS_IAC_BRANCH : master DACCS_CONFIGS_BRANCH : master PAVICS_E2E_WORKFLOW_TESTS_BRANCH : master PAVICS_SDI_BRANCH : master DESTROY_INFRA_ON_EXIT : true PAVICS_HOST : https://host-140-20.rdext.crim.ca PAVICS-e2e-workflow-tests Pipeline ResultsTests URL : http://daccs-jenkins.crim.ca:80/job/PAVICS-e2e-workflow-tests/job/master/419/NOTEBOOK TEST RESULTS |
Collaborator
Author
|
@mishaschwartz @fmigneault FYI kartoza/docker-geoserver#760 if you ever have GeoServer upgrade problem like I do. I've kept the official GeoServer image from kartoza as default image in this PR because not all instances will have upgrade problem with this official image. If you need alternate images, look at that issue. Ouranos have 2 production GeoServer. One will use the official image, the other one will use an alternate image. |
Collaborator
Author
|
Let me know if I can merge now or you need time to test upgrade your GeoServer. |
Collaborator
E2E Test ResultsDACCS-iac Pipeline ResultsBuild URL : http://daccs-jenkins.crim.ca:80/job/DACCS-iac-birdhouse/3627/Result ❌ FAILUREBIRDHOUSE_DEPLOY_BRANCH : upgrade-geoserver DACCS_IAC_BRANCH : master DACCS_CONFIGS_BRANCH : master PAVICS_E2E_WORKFLOW_TESTS_BRANCH : master PAVICS_SDI_BRANCH : master DESTROY_INFRA_ON_EXIT : true PAVICS_HOST : https://host-140-118.rdext.crim.ca PAVICS-e2e-workflow-tests Pipeline ResultsTests URL : http://daccs-jenkins.crim.ca:80/job/PAVICS-e2e-workflow-tests/job/master/423/NOTEBOOK TEST RESULTS |
Collaborator
Author
|
https://daccs-jenkins.crim.ca/job/PAVICS-e2e-workflow-tests/job/master/423/consoleFull The rest are known errors. You might want to check |
Collaborator
E2E Test ResultsDACCS-iac Pipeline ResultsBuild URL : http://daccs-jenkins.crim.ca:80/job/DACCS-iac-birdhouse/3628/Result ❌ FAILUREBIRDHOUSE_DEPLOY_BRANCH : upgrade-geoserver DACCS_IAC_BRANCH : master DACCS_CONFIGS_BRANCH : master PAVICS_E2E_WORKFLOW_TESTS_BRANCH : master PAVICS_SDI_BRANCH : master DESTROY_INFRA_ON_EXIT : true PAVICS_HOST : https://host-140-118.rdext.crim.ca PAVICS-e2e-workflow-tests Pipeline ResultsTests URL : http://daccs-jenkins.crim.ca:80/job/PAVICS-e2e-workflow-tests/job/master/424/NOTEBOOK TEST RESULTS |
fmigneault
reviewed
Sep 5, 2025
Collaborator
E2E Test ResultsDACCS-iac Pipeline ResultsBuild URL : http://daccs-jenkins.crim.ca:80/job/DACCS-iac-birdhouse/3629/Result ❌ FAILUREBIRDHOUSE_DEPLOY_BRANCH : upgrade-geoserver DACCS_IAC_BRANCH : master DACCS_CONFIGS_BRANCH : master PAVICS_E2E_WORKFLOW_TESTS_BRANCH : master PAVICS_SDI_BRANCH : master DESTROY_INFRA_ON_EXIT : true PAVICS_HOST : https://host-140-118.rdext.crim.ca PAVICS-e2e-workflow-tests Pipeline ResultsTests URL : http://daccs-jenkins.crim.ca:80/job/PAVICS-e2e-workflow-tests/job/master/425/NOTEBOOK TEST RESULTS |
fmigneault
approved these changes
Sep 5, 2025
Collaborator
Author
|
@fmigneault thanks for the approval. You still want to check the failure I mentioned in #570 (comment) because that failure was not there before this PR. If I merge this PR now, all future pipeline run will have that new failure. I will wait for @mishaschwartz approval as well, in case he uses GeoServer and have upgrade problem as well. |
mishaschwartz
approved these changes
Sep 9, 2025
Collaborator
Author
@fmigneault can you take a look at the server (I do not have SSH access) because |
Member
|
I found these issues in the logs. Cowbird seems to have attempted the Maybe the request format changed? https://github.com/Ouranosinc/cowbird/blob/1a91e446e0445acfde5b059e1aceb3bec7ab6e62/cowbird/handlers/impl/geoserver.py#L745-L770 I'm seeing a few log entries hinting that But reaching GeoServer: |
fmigneault
requested changes
Sep 19, 2025
Member
fmigneault
left a comment
fmigneault
left a comment
There was a problem hiding this comment.
undo approval given new errors observed
Collaborator
Author
This is odd because our 2nd production GeoServer did use this image and pulled properly last week ! Maybe there is a de-sync between the API and the actual storage on DockerHub because I tried to pull the same image again and it works ! I've re-push the image again to hope to "refresh" the Dockerhub API. Can you Wait a sec, CRIM pipeline do not test upgrade ! So GeoServer api changed and Cowbird has to catch up? |
Member
Most probably. This is my impression as well. Maybe there is a new or modified parameter in the body, headers, auth that the new GeoServer doesn't like the format. Another possibility is that GeoServer is doing something odd unrelated to API change. The 409 (conflict) error suggests that the workspace was properly created via the API since it cannot be recreated, and that auth worked for it to do it once, so the API is not entirely different. However, why other datastore creation request fails, I don't know. |
Member
|
Following the steps of https://github.com/Ouranosinc/PAVICS-e2e-workflow-tests/blob/master/notebooks-auth/geoserver.ipynb I've created a local request session and tried doing the requests. # s : requests.Session with all logins
r_g = s.get("https://host-140-118.rdext.crim.ca/geoserver/rest/workspaces/testcowbirdjupyter")
# retrieving the workspace definition works
r_g.json()
{'workspace': {'name': 'testcowbirdjupyter', 'isolated': True, 'dateCreated': '2025-09-19 13:55:39.577 UTC', 'dataStores': 'https://host-140-118.rdext.crim.ca/geoserver/rest/workspaces/testcowbirdjupyter/datastores.json', 'coverageStores': 'https://host-140-118.rdext.crim.ca/geoserver/rest/workspaces/testcowbirdjupyter/coveragestores.json', 'wmsStores': 'https://host-140-118.rdext.crim.ca/geoserver/rest/workspaces/testcowbirdjupyter/wmsstores.json', 'wmtsStores': 'https://host-140-118.rdext.crim.ca/geoserver/rest/workspaces/testcowbirdjupyter/wmtsstores.json'}}
# 'payload' defined as in the notebook
payload
{'dataStore': {'name': 'test_datastore', 'type': 'Directory of spatial files (shapefiles)', 'connectionParameters': {'entry': [{'$': 'UTF-8', '@key': 'charset'}, {'$': 'shapefile', '@key': 'filetype'}, {'$': 'true', '@key': 'create spatial index'}, {'$': 'true', '@key': 'memory mapped buffer'}, {'$': 'GMT', '@key': 'timezone'}, {'$': 'true', '@key': 'enable spatial index'}, {'$': 'http://test_datastore', '@key': 'namespace'}, {'$': 'true', '@key': 'cache and reuse memory maps'}, {'$': 'file:///geoserver-test-data', '@key': 'url'}, {'$': 'shape', '@key': 'fstype'}]}}}
#
r_g_ds = s.put(url=f"https://host-140-118.rdext.crim.ca/geoserver/rest/workspaces/{workspace_name}/datastores/{datastore_name}", json=payload)
r_g_ds.status_code
404
r_g_ds.text
'No such datastore: testcowbirdjupyter,test_datastore_local'Corresponding logs produced by the docker when doing these requests: For completion, I've tried doing a POST. |
Collaborator
Author
|
@fmigneault with the back-compat PR merged, I think Ouranos is very close to be able to catch up with tip of BH. Do you have any timeline about fixing this one? Ouranos prod already use GeoServer 2.27.2 to prevent vulnerabilities so we would really this PR to be merged the day we catch up with tip of BH. |
Member
|
I have not been able to identify what changed between the versions, nor if anything actually changed intentionally or if this is a regression. It seems unlikely that GeoServer would suddenly change how their API is defined since that could break many existing implementation out there. Something to validate with upstream devs. Do you think you can follow up with them? |
Collaborator
Author
I do not have any contacts with the GeoServer team. All my previous discussion was with the GeoServer docker image author/team (Kartoza) which is not part of the GeoServer team. Kartoza just repackage GeoServer in a docker image, they do not change the GeoServer code base. Since you know the problem better, maybe you should talk to the GeoServer team directly. Maybe start with reading their release notes (https://github.com/geoserver/geoserver/releases) from the existing 2.25.2 see if something is fishy before reaching out to them? |
Member
|
@tlvu I can do it at some point, but just flagging that this is far low in my todos. I will be more focused on STAC and DGGS integrations for quite a while. |
Member
|
A quick search led me to this:
Their respective changes date from 8 and 11 years ago! So, I don't know why the request have been working since even before these changes were introduced, or why the just suddenly started to break, but I guess the request should be changed for |
Collaborator
E2E Test ResultsDACCS-iac Pipeline ResultsBuild URL : http://daccs-jenkins.crim.ca:80/job/DACCS-iac-birdhouse/3735/Result ❌ FAILUREBIRDHOUSE_DEPLOY_BRANCH : upgrade-geoserver DACCS_IAC_BRANCH : master DACCS_CONFIGS_BRANCH : master PAVICS_E2E_WORKFLOW_TESTS_BRANCH : master PAVICS_SDI_BRANCH : master DESTROY_INFRA_ON_EXIT : true PAVICS_HOST : https://host-140-216.rdext.crim.ca PAVICS-e2e-workflow-tests Pipeline ResultsTests URL : http://daccs-jenkins.crim.ca:80/job/PAVICS-e2e-workflow-tests/job/master/482/NOTEBOOK TEST RESULTS |
Collaborator
E2E Test ResultsDACCS-iac Pipeline ResultsBuild URL : http://daccs-jenkins.crim.ca:80/job/DACCS-iac-birdhouse/3747/Result 🆘 ABORTEDBIRDHOUSE_DEPLOY_BRANCH : upgrade-geoserver DACCS_IAC_BRANCH : master DACCS_CONFIGS_BRANCH : master PAVICS_E2E_WORKFLOW_TESTS_BRANCH : geoserver-test-post PAVICS_SDI_BRANCH : master DESTROY_INFRA_ON_EXIT : true PAVICS_HOST : https://host-140-216.rdext.crim.ca
|
Collaborator
E2E Test ResultsDACCS-iac Pipeline ResultsBuild URL : http://daccs-jenkins.crim.ca:80/job/DACCS-iac-birdhouse/3750/Result 🆘 ABORTEDBIRDHOUSE_DEPLOY_BRANCH : upgrade-geoserver DACCS_IAC_BRANCH : master DACCS_CONFIGS_BRANCH : master PAVICS_E2E_WORKFLOW_TESTS_BRANCH : master PAVICS_SDI_BRANCH : master DESTROY_INFRA_ON_EXIT : true PAVICS_HOST : https://host-140-216.rdext.crim.ca
|
Collaborator
E2E Test ResultsDACCS-iac Pipeline ResultsBuild URL : http://daccs-jenkins.crim.ca:80/job/DACCS-iac-birdhouse/3752/Result ❌ FAILUREBIRDHOUSE_DEPLOY_BRANCH : upgrade-geoserver DACCS_IAC_BRANCH : master DACCS_CONFIGS_BRANCH : master PAVICS_E2E_WORKFLOW_TESTS_BRANCH : geoserver-test-post PAVICS_SDI_BRANCH : master DESTROY_INFRA_ON_EXIT : true PAVICS_HOST : https://host-140-216.rdext.crim.ca PAVICS-e2e-workflow-tests Pipeline ResultsTests URL : http://daccs-jenkins.crim.ca:80/job/PAVICS-e2e-workflow-tests/job/geoserver-test-post/2/NOTEBOOK TEST RESULTS |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Overview
Upgrade GeoServer to 2.27.2 to fix vulnerabilities
See:
As for the docker image changes, unfortunately there was no github tag for our
existing
2.25.2--v2024.06.25so this is the best approximate diff we can havekartoza/docker-geoserver@v2.25.4--2024.11.17--e7732f7...v2.27.2--2025.08.05--f411524
fix-geoserver-data-dir-permis not required anymore, it has been disabled but kept for backward compatibility if we ever need to rollback to older versions of GeoServer. If you need to rollback to any versions before 2.25.2 you might need to runfix-geoserver-data-dir-permmanually, only if it is required. Do not run it if not required. It takes lots of time if you have lots of data.Please backup your GeoServer data before the upgrade. If the upgrade fails, you won't be able to rollback. If you have upgrade problem, please look at kartoza/docker-geoserver#760.
Changes
Non-breaking changes
Breaking changes
Related issues
kartoza/docker-geoserver#755
kartoza/docker-geoserver#760
CI Operations
birdhouse_daccs_configs_branch: master
birdhouse_skip_ci: false