FITS Maintenance Update Recommendations - Q1 2026

[awoods]

FITS Maintenance Update Recommendations - Q1 2026

Summary

This issue tracks critical maintenance updates needed for FITS 1.6.1-SNAPSHOT, prioritizing security patches, outdated tool signatures, and dependency updates. All updates must follow the conservative approach outlined in CLAUDE.md - stability over features, with comprehensive Docker testing.

🚨 Critical Security Updates (IMMEDIATE)

1. Log4j Security Update (HIGH PRIORITY)

• Current: 2.19.0
• Recommended: Latest stable 2.x (avoid 3.0.0-beta)
• Risk: Log4j vulnerabilities are actively exploited
• Files: pom.xml:17

2. GitHub Actions Security Update

• Current: actions/checkout@v2
• Recommended: actions/checkout@v4
• Risk: Older actions may have security issues
• Files: .github/workflows/build.yml:13

📅 Quarterly Maintenance (OVERDUE)

3. DROID Signature Files Update

• Current: V109 (May 24, 2023 - 9+ months old)
• Action: mvn -P update-droid-sigs generate-resources
• Impact: Missing newer file format signatures affects identification accuracy
• Files: tools/droid/DROID_SignatureFile_V109.xml

🔧 Tool Version Updates (EXTENSIVE TESTING REQUIRED)

4. JHOVE Update (Conservative Priority)

• Current: 1.28.0
• Latest: 1.32.1
• Impact: PDF/TIFF validation changes may affect institutional workflows
• Testing: Compare validation outputs before/after upgrade

5. Apache Tika Update (Major Version - High Risk)

• Current: 2.8.0
• Latest: 3.2.3
• ⚠️ CAUTION: Major version jump - metadata output format may change
• Testing: Comprehensive comparison of XML outputs required

6. DROID Update (Major Version - High Risk)

• Current: 6.5.2
• Latest: 6.9.3
• ⚠️ CAUTION: Format identification changes impact preservation workflows
• Testing: Side-by-side output comparison essential

🛠️ Infrastructure Updates

7. Maven Plugin Updates

Multiple Maven plugins can be updated:

• spotless-maven-plugin: 2.43.0 → latest
• maven-compiler-plugin: 3.10.1 → latest
• maven-assembly-plugin: 3.4.2 → latest

📋 Recommended Implementation Plan

Phase 1 (This Week - Security Critical)

• Update Log4j to latest stable 2.x version
• Update GitHub Actions to checkout@v4
• Update DROID signatures (low risk, high impact)
• Test with Docker: docker run --rm -v $(pwd):/fits:z -v ~/.m2:/root/.m2:z fits-test mvn clean test

Phase 2 (Next Month - Functionality)

• Update JHOVE with conservative testing
• Update Maven plugins
• Full regression testing in Docker environment

Phase 3 (Next Quarter - Major Changes)

• Plan Tika major version update (extensive testing)
• Plan DROID major version update (extensive testing)
• Coordinate with digital preservation community for change notifications

⚠️ Critical Testing Requirements

Per CLAUDE.md - ALL TESTING MUST USE DOCKER:

# Build test container (run once)
docker build -f docker/Dockerfile-test -t fits-test .

# Run comprehensive tests
docker run --rm -v $(pwd):/fits:z -v ~/.m2:/root/.m2:z fits-test mvn clean test

# For tool updates - regenerate test expectations (REVIEW DIFFS CAREFULLY)
docker run --rm -v $(pwd):/fits:z -v ~/.m2:/root/.m2:z fits-test mvn -Doverwrite=true clean test

⚠️ WARNING: Never run mvn test directly on host - Docker testing is required for consistent results.

🎯 Success Criteria

• All security vulnerabilities addressed
• DROID signatures current (within 3 months)
• All tests pass in Docker environment
• XML output changes documented and reviewed
• No breaking changes for institutional workflows

📚 References

• FITS Developer Manual
• Project Maintenance Guide
• Docker Testing Requirements

---

Remember: FITS is mission-critical infrastructure for digital preservation institutions worldwide. Changes to tool outputs can break institutional workflows. Prioritize thorough testing and clear documentation of any changes.

Assignees: Harvard LTS maintenance team
Labels: maintenance, security, dependencies
Milestone: 1.6.2-SNAPSHOT

[sarahd-wu]

I've completed the Log4j Security Update and the GitHub Actions Security Update. However, when working on the DROID Signature Files Update, I've come across an odd network bug with the Maven action mvn -P update-droid-sigs generate-resources.

I first updated the droid-sig-pom.xml parent pom version from 1.6.0 to <version>1.6.1-SNAPSHOT</version> . Once updated, I ran the Maven action, and received this error log:

Caused by: org.apache.cxf.interceptor.Fault: Response was of unexpected text/html ContentType.  Incoming portion of HTML stream: <html>
<head><title>307 Temporary Redirect</title></head>
<body>
<center><h1>307 Temporary Redirect</h1></center>
<hr><center>CloudFront</center>
</body>
</html>

And a brief section from the stack trace:

at uk.gov.nationalarchives.droid.signature.PronomSignatureService.importSignatureFile(PronomSignatureService.java:94)
        at uk.gov.nationalarchives.droid.signature.SignatureManagerImpl.downloadLatest(SignatureManagerImpl.java:371)
        at DroidSigFileUpdater.updateSignatureFiles(DroidSigFileUpdater.java:84)

I believe that the URL endpoint to update the DROID signature may be either inaccurate or outdated. Since the endpoint is fetched from the DROID repo, it may be a DROID issue. However, it very well could also be my network.