Bump to GN 4.4.7

.github/workflows/backport.yml

@@ -1,8 +1,9 @@
-name: Automatic backport action
-
+name: ♻ Backport
 on:
   pull_request_target:
-    types: ["closed", "labeled"]
+    types:
+      - closed
+      - labeled
 
 permissions:
   contents: write # so it can comment

.github/workflows/codeql-analysis.yml

@@ -43,7 +43,7 @@ jobs:
         show-progress: 'false'
 
     - name: Setup Java JDK
-      uses: actions/setup-java@v4.1.0
+      uses: actions/setup-java@v4.2.1
       with:
         java-version: 11
         # Java distribution. See the list of supported distributions in README file

.github/workflows/georchestra-gn4.yml

@@ -3,12 +3,12 @@ name: Building georchestra-geonetwork4 artifacts
 on:
   push:
     branches:
-    - georchestra-gn4.2.x
+    - georchestra-gn4.4.x
   pull_request:
   workflow_dispatch:
 
 env:
-  DOCKER_TAG: 4.2.x
+  DOCKER_TAG: 4.4.x
 
 jobs:
   build:
@@ -56,7 +56,7 @@ jobs:
       run: mvn verify -Pit
 
     - name: "publish the webapp as artifact"
-      if: github.repository == 'georchestra/geonetwork' && github.actor != 'dependabot[bot]' && github.ref == 'refs/heads/georchestra-gn4.2.x' && github.event_name != 'pull_request'
+      if: github.repository == 'georchestra/geonetwork' && github.actor != 'dependabot[bot]' && github.ref == 'refs/heads/georchestra-gn4.4.x' && github.event_name != 'pull_request'
       uses: actions/upload-artifact@v4
       with:
         name: geonetwork.war

.gitignore

@@ -66,12 +66,7 @@ web/src/main/webapp/META-INF/MANIFEST.MF
 web/src/main/webapp/WEB-INF/data/0*
 web/src/main/webapp/WEB-INF/data/config/encryptor.properties
 web/src/main/webapp/WEB-INF/data/config/index/records.json
-web/src/main/webapp/WEB-INF/data/config/schema_plugins/*/schematron/schematron*.xsl
-web/src/main/webapp/WEB-INF/data/config/schema_plugins/csw-record
-web/src/main/webapp/WEB-INF/data/config/schema_plugins/dublin-core
-web/src/main/webapp/WEB-INF/data/config/schema_plugins/iso19*
-web/src/main/webapp/WEB-INF/data/config/schema_plugins/dcat2
-web/src/main/webapp/WEB-INF/data/config/schema_plugins/schemaplugin-uri-catalog.xml
+web/src/main/webapp/WEB-INF/data/config/schema_plugins/*
 web/src/main/webapp/WEB-INF/data/config/schemaplugin-uri-catalog.xml
 web/src/main/webapp/WEB-INF/data/data/backup
 web/src/main/webapp/WEB-INF/data/data/metadata_data
@@ -95,8 +90,3 @@ web/src/main/webapp/data/
 web/src/main/webapp/doc/en
 web/src/main/webapp/doc/fr
 web/src/main/webapp/WEB-INF/data/data/resources/schemapublication
-
-#created by build process, looks like badly designed tests
-web/src/main/webapp/WEB-INF/data/config/index/records.json
-web/src/main/webapp/WEB-INF/data/config/index/records_french.json
-

.gitmodules

@@ -7,3 +7,6 @@
 [submodule "web-ui/src/main/resources/catalog/lib/bootstrap-table"]
 	path = web-ui/src/main/resources/catalog/lib/bootstrap-table
 	url = https://github.com/wenzhixin/bootstrap-table.git
+[submodule "plugins/datahub-integration/geonetwork-ui"]
+	path = plugins/datahub-integration/geonetwork-ui
+	url = https://github.com/geonetwork/geonetwork-ui.git

CITATION.cff

@@ -0,0 +1,88 @@
+# This CITATION.cff file was generated with cffinit.
+# Visit https://bit.ly/cffinit to generate yours today!
+
+cff-version: 1.2.0
+title: GeoNetwork opensource
+message: >-
+  If you use this software, please cite it using the
+  metadata from this file.
+type: software
+authors:
+  - given-names: François
+    family-names: Prunayre
+    affiliation: Titellus
+  - given-names: Jose
+    family-names: García
+    affiliation: GeoCat BV
+  - given-names: Jeroen
+    family-names: Ticheler
+    affiliation: GeoCat BV
+    orcid: 'https://orcid.org/0009-0003-3896-0437'
+    email: [email protected]
+  - given-names: Florent
+    family-names: Gravin
+    affiliation: CamptoCamp
+  - given-names: Simon
+    family-names: Pigot
+    affiliation: CSIRO Australia
+  - name: GeoCat BV
+    address: Veenderweg 13
+    city: Bennekom
+    country: NL
+    post-code: 6721 WD
+    tel: +31 (0) 318 416 664
+    website: 'https://www.geocat.net/'
+    email: [email protected]
+  - name: Titellus
+    address: 321 Route de la Mollière
+    city: Saint Pierre de Genebroz
+    country: FR
+    post-code: 73360
+    website: 'https://titellus.net/'
+    email: [email protected]
+  - name: CamptoCamp
+    address: QG Center Rte de la Chaux 4
+    city: Bussigny
+    country: CH
+    post-code: 1030
+    tel: +41 (21) 619 10 10
+    website: 'https://camptocamp.com/'
+    email: [email protected]
+  - name: Open Source Geospatial Foundation - OSGeo
+    address: '9450 SW Gemini Dr. #42523'
+    location: Beaverton
+    region: Oregon
+    post-code: '97008'
+    country: US
+    email: [email protected]
+    website: 'https://www.osgeo.org/'
+repository-code: 'http://github.com/geonetwork/core-geonetwork'
+url: 'https://geonetwork-opensource.org'
+repository-artifact: >-
+  https://sourceforge.net/projects/geonetwork/files/GeoNetwork_opensource/
+abstract: >-
+  GeoNetwork is a catalog application to manage spatial and
+  non-spatial resources. It is compliant with critical
+  international standards from ISO, OGC and INSPIRE. It
+  provides powerful metadata editing and search functions as
+  well as an interactive web map viewer.
+keywords:
+  - catalog
+  - gis
+  - sdi
+  - spatial data infrastructure
+  - dataspace
+  - search
+  - open data
+  - standards
+  - spatial
+  - CSW
+  - OGCAPI Records
+  - DCAT
+  - GeoDCAT-AP
+  - Catalog Service
+  - OGC
+  - open geospatial consortium
+  - osgeo
+  - open source geospatial foundation
+license: GPL-2.0

CONTRIBUTING.md

@@ -2,7 +2,11 @@
 
 Thank you for contributing to GeoNetwork!
 
-* Free-software: GeoNetwork is free-software, using the [GNU GENERAL PUBLIC LICENSE](LICENSE.md). Contributions provided by you, or your employer, are required to be compatible with this free-software license.
+* Free-software: GeoNetwork is free-software, using the [GNU GENERAL PUBLIC LICENSE](LICENSE.md).
+* Contributions provided by you, or your employer, are required to be compatible with this free-software license. You will therefor be asked to sign the [Contributor License Agreement](https://cla-assistant.io/geonetwork/) when you are contributing to the repositories. This process is automatically enabled when you create your first pull request via https://cla-assistant.io/.
+
+[![CLA assistant](https://cla-assistant.io/readme/badge/geonetwork/geonetwork)](https://cla-assistant.io/geonetwork/geonetwork)
+
 * Pull-request: GeoNetwork uses a pull-request workflow to review and accept changes. Pull-requests must be submitted against the *main* branch first, and may be back ported as required.
 
 # Pull requests

README.md

@@ -1,8 +1,6 @@
 # GeoNetwork opensource
 
-## Build Health
-
-[![Build Status](https://github.com/geonetwork/core-geonetwork/actions/workflows/linux.yml/badge.svg?branch=main)](https://github.com/geonetwork/core-geonetwork/actions/workflows/linux.yml?query=branch%3Amain)
+[![Build Status](https://github.com/geonetwork/core-geonetwork/actions/workflows/linux.yml/badge.svg?branch=main)](https://github.com/geonetwork/core-geonetwork/actions/workflows/linux.yml?query=branch%3Amain) [![OpenSSF Best Practices](https://www.bestpractices.dev/projects/8626/badge)](https://www.bestpractices.dev/projects/8626)  [![CLA assistant](https://cla-assistant.io/readme/badge/geonetwork/geonetwork)](https://cla-assistant.io/geonetwork/geonetwork)
 
 ## Features
 
@@ -29,7 +27,4 @@ Developer documentation located in ``README.md`` files in the code-base:
 
 * General documentation for the project as a whole is in this [README.md](README.md)
 * [Software Development Documentation](/software_development/) provides instructions for setting up a development environment, building GeoNetwork, compiling user documentation, and making a releases.
-* Module specific documentation can be found in each module:
-
-## Open Source Security Foundation (OpenSSF) best practices status
-[![OpenSSF Best Practices](https://www.bestpractices.dev/projects/8626/badge)](https://www.bestpractices.dev/projects/8626)
+* Module specific documentation can be found in each module

SECURITY.md

@@ -2,7 +2,7 @@
 
 The GeoNetwork community takes the security of the software and all services based on the software product seriously. On this page you can find the versions for which the community provides security patches. 
 
-If you believe you have found a security vulnerability in the software or an implementation of the software, please report it [here](https://github.com/geonetwork/core-geonetwork/security/advisories/new) as described below. Do not publish the vulnerability in any public forums (such as Twitter/X, email list or issue tracker).
+If you believe you have found a security vulnerability in the software or an implementation of the software, please report it [here](https://github.com/geonetwork/core-geonetwork/security/advisories/new) as described below. Do not publish the vulnerability in any public forums (such as social media, user forum, or issue tracker).
 
 ## Supported Versions
 
@@ -11,11 +11,11 @@ Each GeoNetwork release is supported with bug fixes for a limited period, with p
 - We recommend to update to latest incremental release as soon as possible to address security vulnerabilities.
 - Some overlap is provided when major versions are announced with both a current version and a maintenance version being made available to provide time for organizations to upgrade.
 
-| Version | Supported          | Comment             |
-|---------|--------------------|---------------------|
-| 4.4.x   | :white_check_mark: | Latest version      |
-| 4.2.x   | :white_check_mark: | Stable version      |
-| 3.12.x  | :white_check_mark: | Maintenance version |
+| Version | Supported          | Comment                                     |
+|---------|--------------------|---------------------------------------------|
+| 4.4.x   | :white_check_mark: | Latest version                              |
+| 4.2.x   | :white_check_mark: | Stable version                              |
+| 3.12.x  | ❌  | End Of Life 2024-03-31 |
 
 If your organisation is making use of a GeoNetwork version that is no longer in use by the community all is not lost. You can volunteer on the developer list to make additional releases, or engage with one of our [Commercial Support](https://www.osgeo.org/service-providers/?p=geonetwork) providers. 
 
@@ -28,3 +28,16 @@ If you encounter a security vulnerability in GeoNetwork please take care to repo
 * Keep in mind that community members are volunteers and an extensive fix may require fundraising / resources
 
 For more information see [How to contribute](https://github.com/geonetwork/core-geonetwork/wiki/How-to-contribute).
+
+## Coordinated vulnerability disclosure
+
+Disclosure workflow:
+
+1. GitHub [security advisory](https://github.com/geonetwork/core-geonetwork/security) used to reserve a CVE number.
+2. Vulnerability addressed and backported to "latest" and "stable" branches, allowing original reporter to verify nightly build.
+3. Fix available in published release for all "supported versions" identified above, providing an opportunity for everyone to update.
+4. The CVE vulnerability is published with mitigation and patch instructions.
+
+This approach provides everyone a chance to update prior to public disclosure.
+
+Those seeking greater transparency are encouraged to [volunteer as a committer](CONTRIBUTING.md#core-commit-access), or work with one of the [commercial support providers](https://www.osgeo.org/service-providers/?p=geonetwork) to participate on your behalf.

add-schema.sh

@@ -83,7 +83,7 @@ then
   ${insertLine} a\\
 \        <dependency>\\
 \          <groupId>org.geonetwork-opensource.schemas</groupId>\\
-\          <artifactId>schema-${schema}</artifactId>\\
+\          <artifactId>gn-schema-${schema}</artifactId>\\
 \          <version>${gnSchemasVersion}</version>\\
 \        </dependency>
 SED_SCRIPT
@@ -103,7 +103,7 @@ SED_SCRIPT
 \      <dependencies>\\
 \        <dependency>\\
 \          <groupId>org.geonetwork-opensource.schemas</groupId>\\
-\          <artifactId>schema-${schema}</artifactId>\\
+\          <artifactId>gn-schema-${schema}</artifactId>\\
 \          <version>${gnSchemasVersion}</version>\\
 \        </dependency>\\
 \      </dependencies>\\
@@ -121,7 +121,7 @@ SED_SCRIPT
 \                  <artifactItems>\\
 \                    <artifactItem>\\
 \                      <groupId>org.geonetwork-opensource.schemas</groupId>\\
-\                      <artifactId>schema-${schema}</artifactId>\\
+\                      <artifactId>gn-schema-${schema}</artifactId>\\
 \                      <type>zip</type>\\
 \                      <overWrite>false</overWrite>\\
 \                      <outputDirectory>\$\{schema-plugins.dir\}</outputDirectory>\\
@@ -138,7 +138,7 @@ SED_SCRIPT
 fi
 
 # Add schema resources in service/pom.xml with test scope for unit tests
-line=$(grep -n "<artifactId>schema-${schema}</artifactId>" services/pom.xml | cut -d: -f1)
+line=$(grep -n "<artifactId>gn-schema-${schema}</artifactId>" services/pom.xml | cut -d: -f1)
 
 if [ ! $line ]
 then
@@ -154,7 +154,7 @@ then
   ${finalLine} a\\
 \    <dependency>\\
 \      <groupId>${projectGroupId}</groupId>\\
-\      <artifactId>schema-${schema}</artifactId>\\
+\      <artifactId>gn-schema-${schema}</artifactId>\\
 \      <version>${gnSchemasVersion}</version>\\
 \      <scope>test</scope>\\
 \    </dependency>

auditable/README.md

@@ -0,0 +1,14 @@
+# Auditable Module
+
+The auditable module contains the classes that allow auditing changes in user information using [Hibernate Envers](https://hibernate.org/orm/envers/).
+
+Support for new auditable entities can be added, for example to audit changes in group information. For users auditing:
+
+- Entity with the information to audit: [UserAuditable](../domain/src/main/java/org/fao/geonet/domain/auditable/UserAuditable.java).
+- Related JPA repository: [UserAuditableRepository](../domain/src/main/java/org/fao/geonet/repository/UserAuditableRepository.java).
+- The auditable service: [UserAuditableService](src/main/java/org/fao/geonet/auditable/UserAuditableService.java).
+- The users API updated to use the auditable service: [UserApi](../services/src/main/java/org/fao/geonet/api/users/UsersApi.java).
+
+
+
+

auditable/pom.xml

@@ -0,0 +1,51 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<project xmlns="http://maven.apache.org/POM/4.0.0"
+         xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+         xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
+  <modelVersion>4.0.0</modelVersion>
+  <parent>
+    <groupId>org.geonetwork-opensource</groupId>
+    <artifactId>geonetwork</artifactId>
+    <version>4.4.7-georchestra</version>
+  </parent>
+
+  <!-- =========================================================== -->
+  <!-- Module Description -->
+  <!-- =========================================================== -->
+  <artifactId>gn-auditable</artifactId>
+  <packaging>jar</packaging>
+  <name>GeoNetwork auditable objects</name>
+
+  <licenses>
+    <license>
+      <name>General Public License (GPL)</name>
+      <url>http://www.gnu.org/licenses/old-licenses/gpl-2.0.txt</url>
+      <distribution>repo</distribution>
+    </license>
+  </licenses>
+
+
+  <dependencies>
+    <dependency>
+      <groupId>${project.groupId}</groupId>
+      <artifactId>gn-domain</artifactId>
+      <version>${project.version}</version>
+    </dependency>
+
+    <dependency>
+      <groupId>${project.groupId}</groupId>
+      <artifactId>gn-core</artifactId>
+      <version>${project.version}</version>
+    </dependency>
+
+    <dependency>
+      <groupId>org.springframework</groupId>
+      <artifactId>spring-core</artifactId>
+    </dependency>
+  </dependencies>
+
+  <properties>
+    <rootProjectDir>${basedir}/..</rootProjectDir>
+  </properties>
+
+</project>