Parsec service 1.2.0 release

[gowthamsk-arm]

As we approach the next release of Parsec following an established process, Parsec will be released with v1.2.0, and we are aiming for Mid March.

See the associated milestone here.

Use this thread for discussions about the 1.2.0 release of the Parsec service, including:

• the planned content is due to be released
• the timeline of the release
• the status of the work feeding into the release

Date of the Code Freeze: 14th March 2023 - TBD

Stages:

• Prior Code freeze

  • Identify the hardware/backends to be used for the release testing
  • Identify tests that need to pass on each of the hardware/backends
  • Along with the above 2 points, add OpenSUSE release gate requirement as well in the new release checklist page in the parsec book
  • Publish new versions of all managed crates and configure parsec service and tool to use them. See this guide.
  • Fix any pending issues
  • Check common dependency crates versions between the parsec service, parsec tool, and other crates
  • Review PRs across Parsec repos
  • Merge PRs got approved
  • Check the milestone list

• During code freeze

  • Issue release candidate tag 1.2.0-rc1
  • Check for security advisories (including ignored ones)
  • OpenSUSE packaging for the RC
  • Pull in the latest git dependencies in the crates to ensure the latest release would work.
  • Execute the normal e2e tests on Raspberry Pi hardware:
    • mbed-crypto
    • TPM
    • Nitrokey HSM (pluggable USB)
  • Execute fuzz testing for some time
  • Ask the Linux distributions packagers to try the tagged version
  • Ask the Parsec Yocto maintainers to try the tagged version
  • Ask any interested people to try the tagged version
  • Review the book and make sure all pages are up-to-date. In particular, make sure the Threat Model is up to date.
  • Make sure all the markdown pages (like the README) look good.
  • Make sure the rustdoc pages (on docs.rs) are looking good (before and after the release).
  • If any bugs are reported, we fix bugs and then issue another release candidate, 1.2.0-rcx
  • When All reported issues are addressed, make a GitHub release out of the last tag, which includes its changelog, and ask maintainers to release this version of Parsec.

• Release

  • Push the release tag 1.2.0 for the service and 0.6.0 for the parsec-tool
  • Publish the new quickstart bundle and update the quickstart guide with it

• Post-release

  • Close issues fixed in the release and the past milestone
  • Update, test, and upstream Yocto recipes for Parsec and parsec-tool
  • Make a new issue milestone for the next release
  • Update the Roadmap
  • Update the Parsec Release Process with what we learned.
  • If any bugs are reported, make new MINOR or PATCH tags (that would be 1.2.x for this release)
  • Update the Parsec Tool demo
  • Profit

[gowthamsk-arm]

The meta-security build issue is now resolved with the MR #671 getting merged.

[gowthamsk-arm]

Guillaume reported this issue on GitHub related to parsec 1.1 and parsec 1.2 RC failing to build on openSUSE Tumbleweed with gcc13. gcc13 is still not released. It's in development but reached the bugfix-only stage and openSUSE Tumbleweed decided to switch to gcc13 by default. This is actually failing to build one of the sub-modules included by grpcio-sys crate (not a direct dependency) which gets included in the parsec lock via spiffe. gRPC-rs is a Rust wrapper of gRPC Core (gRPC is a modern, open-source, high-performance remote procedure call (RPC) framework that can run anywhere). Considering the fact that the gcc13 is still in development (bugfix stage) and we are at the end of March when we need to make a release, we will proceed with packaging without spiffe.

Please also check the slack discussion here.

[gowthamsk-arm]

• Execute the normal e2e tests on Raspberry Pi hardware:
• mbed-crypto
• TPM
• Nitrokey HSM (pluggable USB)

The hardware testing on RaspberryPi for mbed-crypto, TPM, and PKCS11 backends has been completed and no regressions were found.

[gowthamsk-arm]

• OpenSUSE packaging for the Parsec service 1.2.0-rc1 and Parsec-tool 0.6.0-rc2 seem to work fine. The parsec service is packaged without the SPIFFE feature. This needs to be fixed in the future releases.

• Meta-security testing for the 1.2 recipes for all providers is completed and found no issues.

• Fuzz testing was executed for 5 days and no issues were reported.

[gowthamsk-arm]

Parsec 1.2 is released.

• Tags pushed to parsec service (1.2.0) and parsec-tool (0.6.0)
• Crates published
  https://crates.io/crates/parsec-service/1.2.0
  https://crates.io/crates/parsec-tool/0.6.0
• Quickstart package uploaded as release artifact
• New quickstart docker image uploaded to the registry