Unofficial Updater 2 for ColdFusion 8
So earlier this month, I wrote What does a fully patched ColdFusion 8.0.1 Server look like? which outlined my frustration and problems with the way Adobe currently releases hot fix and security updates for ColdFusion. Ultimately, my conclusion was that Adobe needs to release Update 2 for ColdFusion 8. While it felt good to write it all up, it didn’t solve the basic problem of getting a fully patched ColdFusion 8.0.1 Server. I still have to update multiple servers and applying all the published hot fix and security updates in order by hand just isn’t an option. It is too time consuming and error prone.
So after studying all of the published hot fix and security updates for ColdFusion 8.0.1, I was able to produce this matrix. Out of the 24 items published, only 5 had to be completely installed and another 5 are partially installed. Of the remaining 14 items, 10 were superseded (mostly from CHF4 and ASPB11-04) and the last 4 items were system configuration specific or didn’t need files applied. Cutting down on the number of patches that need to be applied was great. Now I just needed a way of doing it repeatedly against multiple servers.
Automating the process
For me it was clear that writing an Apache Ant script would be the best choice since I only want to write it once and have it run on Windows, Mac, Linux/Unix. The process was simple, get information about how ColdFusion is installed, backup the files, download the updates from Adobe and finally apply them based upon the published instructions. I got the script working great, but required that Java 1.5+ and Ant 1.7+ with ant-contrib to be installed to run. The Java requirement wasn’t a problem, but I couldn’t guarantee that Ant with ant-contrib would be available on the server since I had to hand it off to the system administrators to run it. The solution, AntInstaller. It allows you to package Ant scripts in a run-able installer that only requires Java. AntInstaller had another bonus in the ability to create both a GUI and text based installer. This got me thinking.
Creation of Unofficial Updater 2
If I tweaked my Ant script to work with all the ColdFusion installation types and package it with AntInstaller, I could create my own Unofficial Updater 2. Given the fact that others have to be encountering the same problems and it is extremely doubtful that Adobe will be releasing an Update 2 any time soon, I have released it to github. All the scripts and information is there. The run-able installer is also available to download, Unofficial-Updater2.jar. The installer does not contain any of the updates inside it, you must have an internet connection so they can be downloaded.
Please read the instructions that are packaged with Unofficial Updater 2, but here are some of the important items.
Unofficial Updater 2 is NOT endorsed by or have any ties to Adobe. I have tried to make sure Unofficial Updater 2 works in all possible configurations, but you use it at your own risk. It only updates files and will not modify any system configuration files such as jvm.config, web server connectors, or system registry. Make sure the ColdFusion Server/process is NOT running before using Unofficial Updater 2.
Lastly, if you have any comments, ideas, or updates please feel free to share them, that was one of the reasons I released Unofficial Updater 2 on github.
9 Comments
David Epler wrote on 12/14/11 3:34 PM
Yes, java -jar Unofficial-Updater2.jar will run it.Please see the documentation at https://github.com/dcepler/unofficial-updater2/wiki/Using-Unofficial-Updater-2 for more details.
Ben wrote on 12/21/11 3:17 AM
Great stuff, one gotcha I found was that you need to have the JDK installed if you are only running the JRE, it can't find lib/tools.jarhttp://www.oracle.com/technetwork/java/javase/downloads/index.html
David Epler wrote on 12/21/11 10:33 AM
Ben,I haven't run across that as a problem. The easiest solution though would be to use the JVM that is packaged with ColdFusion (or being used by in J2EE installs) to execute Unofficial Updater 2 with since it is already installed and meets the minimum requirements.
Charlie Arehart wrote on 12/21/11 11:12 AM
Interesting, David. I'd missed this when you came out with it.For others who may come upon this entry later (it was just mentioned on a list today), I wanted to share a few observations that I don't see David mentioning above.
First, he has had 3 follow-up blog posts since this one, where he discusses updated. Of course, if you go to the github page he links to above, you'll always get teh latest version.
But if you want to see the other 3 entries, just do a search here (on his site) for "update to unofficial updater". That will find the next 3. (David, you may want to consider adding a new category or tag for this, and update all 4 entries and future ones to use it, to make it easier for people to find such related entries.)
Also, it may be worth updating the entry to add mention that you've created a wiki for the updater. I do now see that you mention it as a 2nd point in a comment above, but some may stop reading that comment if they're not interested in its opening sentence, about how to install it with java/jar commands.
For those interested, the wiki is at
https://github.com/dcepler/unofficial-updater2/wiki/Using-Unofficial-Updater-2
Finally, thanks David for the kind regards on the related entry I had done. Indeed, we should note that since I wrote that, and also since David wrote this entry here in April 2011, Adobe has started discussing the next release of CF, now code-named Zeus, which will in fact have a built-in automated hotfix management process, that should really help a lot with the struggles we've identified.
Keep up the good work, David.
Charlie Arehart wrote on 12/21/11 11:15 AM
Doh, wish I could edit my entry. I see I started a sentence but didn't finish it. Where I mentioned the updated blog entries and I said, "he discusses updated", of course I meant to say "he discusses updated versions of the unofficial updater". See my typo also of "teh". :-(
Charlie Arehart wrote on 12/21/11 11:18 AM
Sorry, one more thing: I want to point out to David (and readers) that I have added links to his entry here (and the earlier one) in my relatively new CF911 wiki, where I offer organized and hand-managed links to resources related to various categories of CF server troubleshooting.See the category on "hotfixes":
http://www.carehart.org/cf911/wiki/index.cfm/Hotfixes
David Epler wrote on 12/21/11 12:56 PM
Charlie,Thanks for the suggestions. The posts were filed under a category "UU2", which to me means something. I have renamed it to "Unofficial Updater 2" so it should be more obvious to get to the posts without having to search. Hopefully, I'll get the related entries working shortly.
The best link everyone to use is actually RIAForge, http://uu2.riaforge.org since it has links to everything (github, download, wiki, and recent blog posts).
I think I was the one clapping loudest when Adobe first showed off the automated hotfix management in Zeus at RIACon this past August. Now if Adobe can back port the functionality to 9 and/or 8 that would be great.
Charlie Arehart wrote on 12/21/11 1:32 PM
Thanks, David. As for them being under a category of UU2, you're saying that besides being listed as ant and coldfusion, there was a UU2? Wow, I must have just missed that. I would have gotten that it was an acronym. Perhaps being so short it was just easy to miss. :-) Thanks for changing it to the longer one, if that may help any readers.As for your offering the riaforge link, yep that's great, since it has the blog posts. I had looked for such on the github page but didn't see any, which is what prompted me to offer the note really (when I later saw that there were updated entries that others might miss.)
Finally, as for the prospect of Adobe back-porting the Zeus automated hotfix mechanism to 8 and 9, I should have added: they have indeed indicated (publicly) that they plan this. No stated timeline for when, though. :-) Let's keep hope alive.
Harry wrote on 12/14/11 1:53 PM
Do I run this with just c:\> java unofficial-updater2.jar ?