Backdrop CMS Weekly, 14 Mar 2019

Previous Meeting Next Meeting

⏯

youtube image

►

From YouTube: Backdrop weekly - Mar 14th

Description

Today’s development agenda: http://bit.ly/2u6VR2P

A

Hello, everybody out there in the world of backdrop, it's March 14th 2019, and this is the weekly developer backdrop meeting where we go over all of the priorities for a backdrop, kind of progress updates from this past week and where we are heading for the next week. So let's see Gemma's not here today, so I'll be running. Things start to finish, updates to the p.m. see here. Normally we have this section for from the pmc, but there are some issues in the PM CQ that need boats.

A

Please see the need, vote label and add your thumbs up or thumbs down to the top post in the issue. So.

A

Tim is telling us that it's also yes, happy pi day everybody Tim actually brought I into the office or wait. Oh, you brought PI to the Hangout. How kind of you.

A

Okay, now that's less kind actually showing us PI, but it's better when it was imaginary. Okay. Well, let's see well jump right into website related development tasks. So backdrop CMS org, let's see we recently had a PMC vote on a security release policy and then got that updated and documented. It's at backtalk CMS slash security. So we now have an official policy as opposed to a fuzzy policy that whenever we make any security release, it will be for the current release of backup plus the previous release.

A

So that basically means I guess there would be from the start of a minor release. There would be, let's see eight months.

B

Eight months coverage.

A

Yeah, so that's good to finally written that down. Sometimes when we made security releases, we'd only do the current version, and sometimes we do the previous one. Sometimes we would go back to if it was really severe. So now this policy actually being established, we have something that we can point to and say this is what we need to do: every every release ever every security release.

A

Let's see also, let's see, issue 515 I'm not familiar with this one.

A

Set of maintenance status for projects, so oh, so this basically is suggesting that we start keeping track explicitly of whether or not a module is actively maintained or like minimally maintained or supported so and and then unsupported. So the idea being that as you're browsing for modules, you could tell quickly if a module is being actively updated or not. So it's an interesting proposal, it's suggesting it be automated gen basically looks like she just posted this yesterday. So it's issue 515. In the backdrop CMS word issue queue discussing.

A

You know if that seems like it would be useful.

A

Let's see, we've got an item in the agenda. We've been having problems at the forum site, so there's question here: how is the spam this week? I know that we've got a kiss net module currently activated. So it's open question saying you know: is it working or not, Tim you're active on the forums quite regularly. Do you have any updates? Do you can give us well.

C

Now to say, I haven't seen any spam in the last week. I think somebody else saw some over the weekend. I I've been on the last two days from haven't seen any so so I'm not sure. Well,.

A

It sounds better than what it had been and have we re in abled registration. So that's it email confirmation is no longer or sorry manual. Acceptance is no longer required. We.

C

Had done that, which is why I think this way I'm popped up again, although it didn't pop up for about a week and then it's only been sporadic so I'm, not.

A

Sure interesting.

C

Yeah, that's spammer.

A

Sometimes they're inconsistent with their actual.

C

Thanks I, don't know it's possible. Somebody turn that back on when we got that last mattress BAM, we should I should verify that. Okay, well, I, look right now: okay,.

A

Great, thank you.

A

Let's see well we'll just keep rolling on forward here into the back drop project, update and we'll come back to the forum with that question. So, let's see in the on the product side of things backdrop 112 for came out yesterday, which was a security release. So there was a update. Two views module four triple seven that fix three security issues as views module is in core reported those into backdrop and then made a new core release.

A

So all three of them are, you know, weird ones where, basically, you have to be an administrator already to exploit them, but nonetheless, you know it's always good I get to be up to date and give all those things fetch up. So everybody out there update your backdrop sites. So, let's see items for the next bug fix release, which is now one twelve five, everything that was not completed or hadn't been done.

A

It's now been bumped to the next bug, fix release, there's a few new or not actually new, but a few remaining RTO right to left language issues. We merged a couple just earlier today: breadcrumb being displayed RTL and password strength indicator being displayed RTL both of those things have been fixed, there's still a number of other RTL issues you can find in the kid hub issue queue and in particular one that is problematic.

A

That Gregory has been working through is 3504, which is the ckeditor icons when you're dragging and dropping the toolbar there's pull request filed there. It needs a little bit more work that there's some problems with margins going on in there. So anybody, if they have some time to help with some CSS on that I, think we're looking for additional hands there.

D

Let's see other things that we're working on I'm, sorry Nate before you move on there's another sort of like nasty one I feel we're nested table drug guidance of being drugged towards the opposite direction. So when you drag them left, they drive right, but I can't find the ticket for it now.

D

So this should be also given a priority, because it's not just styling issue is just functionality as well, but that is really weird.

A

Yeah that sounds reminiscent of the history of table drag. It makes me wonder how, when that would have happened.

A

Yeah I would suggest this, maybe just a debugging step, maybe switch to search the admin theme so I've been feeling that, like we haven't changed table, drag in a way that I can recall. Oh it's also.

D

It's also valid width for d7. Oh okay, yeah well,.

A

Then that's not good yeah yeah. That would be a big big issue because it's functionality, like you, say, okay, yeah. Let's keep track on that. One I think if you find that one we should add to the agenda. You know, since we're red-hot on these RTL issues and that one's actually functionally really did we pick at Cornell hell, yeah update on the forum, while we're taking a little break. Moderation is not turned on for the forum's right now so sign up.

A

You know you can just go right through with email confirmation, which sounds like good news like thus far no spam people can join the forum easily. So two two good things.

A

Let's see next up.

D

When, in the mean time, sorry Nate I found the ticket, so it's alright, yeah, thirty thirty five, seventy three and I have a full request date for it.

D

I'll, add it to the agenda: hey.

A

Let's see one twelve five items support multiple security, equivalent security releases. This issued 3524 there's discussion in progress about how to best handle that in project module to make it so that's, for example, the one eleven seven released that week released yesterday as the same fixes as 112 four, and so we want to make it so that it's okay to be running one. Eleven seven and update module won't yell at you about having being out of date when you're running one, that's already fully patched.

A

Let's see, we've had an issue since one twelve came out when options element was integrated that if you previously had options elements, you might get a fatal error because the same function was defined in the contribute of the module 3485 still in discussion. There is to best how to best handle that we've got two issues that are in the process of getting adequately tested that are kind of big issues.

A

Cloning, a layout breaks both layouts that ones a troublesome one issue: 2673, there's poor request that fixes the problem that needs tests to confirm that cloning works as expected, see, there's also an issue that recently got a test that causes a fatal error that if you potentially create a piece of content, upload a file to it and delete the file up from under backdrop. It might cause a fatal PDO exception, but upon writing a test we're having trouble actually reproducing it.

A

So never seen that issue personally either so 3462 we have effects and a test created, but we need to actually determine the scenario in which that problem happens might be based on some contributing the problem.

A

Let's see and there's other issues that are tagged, 112 5, you get the full list of them in the github issue tracker, it looks like there's 36 items currently tagged for that milestone and a good number of them, 4 or 5 are marked, are TBC, so I'll be doing some more reviewing in the near future to get through those yeah. Actually I'll just do a call-out right. Now that are reviewing is is really really on top of its game. Right now, we've got you know. Earlier.

A

Today we had a dozen our TBC issues, there's 60 issues that are currently needs review. That's just great. You know, I mean we're really moving through the process of you know, killing people's work, reviewed and merged into core on a regular basis. So I've been really pleased with our current momentum, especially on these, like maintenance related things like it's nice, just to see the constant iteration, let's say 111 hour. Sorry 113 is the next minor release that will be coming now.

A

It's May 15, 2009, teen and we've got a number of issues here that we would like to get into that minor version.

A

Recently, added to the agenda looks like just yesterday that file for matters I, don't think this correct field for matters that in Drupal 6 you had the ability to add settings to for matters and that functionality disappeared in Drupal 7 back in Drupal 8 actually, but this adds that functionality back in the courts issue 1376.

A

That issue is currently actually marked. Our TBC I'm, probably gonna, be the chromosome that says we need test coverage on that. A.

A

Little more evil than I expected. So, let's see other big-ticket items, telemetry issue 285 the idea that we would start collecting information about the environment, on which backdrop is being run still no serious progress on that. We've. We've done a lot of ideas, but the there's there's been no initial stab at attempting to implement a separate telemetry module, thus far, yeah okay,.

C

Can I interrupt in just ask absolutely how complicated a proprietary we expect that to be.

A

Well, I, don't think initially it will be very complicated, especially the kind of day that we're expecting to collect and it can be really minimal. But I do think that we want to get it right because it's going to be like update module basic, it's gonna be Web. Services based, you know. So our backdrop sites are going to be communicating with backdrop CMS org. So the part that makes it complex is that it's it's a web service.

A

You know, and so that means a change on backdrop, CMS org and to backdrop itself and I think that's the part that against people a little deterred, you know we we don't need to. Even do it directly on the backdrop see my store codebase, although that would probably be ideal yeah.

D

There's a lot of moving parts, there's a lot of things that need to start happening and I'm, not sure if we have a technical sort of like an implementation guide line and like plan what the kit. So, where would start, but we agreed that there should be a telemetry module like a separate module. So.

C

I partly I asked that question, because there I think there are people out there that are willing to contribute like I'm, very specific things, if you say hey, we need help on X and they don't necessarily come to the meeting. So they don't necessarily hear about something like telemetry. Some of the other issues we're talking about have been. um You know, other people are well into it feels like if this is really one, that's very specific that there's a lot of thoughts, but nobody's done that started it.

C

Yet it might be a good thing to like try to spread the word that hey. This is something we'd really like somebody to step in and help with. Does that make sense? Or is it something that somebody that's? You know I'm, not thinking of a complete newbie, but maybe somebody that did a lot of backdrop work, but there just hasn't been around for the last three months. Yeah.

A

Yeah, absolutely in truth, we can build that one part without the other. We could build the entire telemetry module and just purely set up what the API would do. You know how it would send information without ever receiving ends, so we can actually bill that, like one whole side, the the backdrop module is probably the more accessible part of this project and and just spec out what how it would send the requests and then actually like stuff out saying you know it would just actually like debug to the screen.

A

Saying I sent this information in a right to watchdog or something like that, and then we can write 90% of the module except for the part, that's and where it sends the HTTP request, and then then that would reduce the scope of complexity quite a bit because you don't have to build the module part is.

D

There currently any functionality that is in core that will need to be moved to that module. Like the thing that we had decided that the update taking part would still remain in core, but sending whatever information we have now might be in telemetry so that it can be optional.

A

Yeah I I think that yeah that sums it up, we might need some way. I. Think right now, when we check for updates, there's like you pass in via querystring I, think the list of all modules or list of all projects that you have and then update module records.

A

All that information I think that I don't know separating that up might be kind of complicated and from from a historical perspective, we need to maintain that so that all the usage charts don't just like drop off and like I'll disappear for every previous version prior to telemetry existing. So we probably need something where, once this option exists inside of the telemetry module, we would add an extra query string to update module when it asks for updates.

A

Basically saying like do not track or something like that, so that update module could cease to collect that information. So.

D

No two great things as in stop receiving any updates. We can have it that only new installations, a pop-up, comes up and it's disabled by default. It says: please help us collect data and so and so and for existing sites. We can have a message popping up and saying this site has been configured to send us data. You can opt out which is a more decent thing and I guess yeah letting people this is.

D

This is what sort of like a sort thing: click here to find out what we have been collecting and if you agree just help us sort like improve the public. I, don't think we're gonna have so many people just disabling it. Oh I.

A

Meant just that for people that are running old versions of backdrop, we need to continue collecting usage information for their old version, Google prior to telemetry, existing ok yeah. That makes it so we can't just move all of the data collection into telemetry, because all of the current sites are sending it via update module, so yeah, so we'd probably need to somehow figure out a way to yeah to make that compromise happy yeah. We might also get into a big mess here that.

A

You know, project usage right now is all is all integrated with project module you know, and so, if we move this into telemetry we're going to end up kind of getting this fuzzy area between, like telemetry updating project module on bankruptcy, master org, but I think, let's table all of that right now. You know just collecting building out the the user interface in the module, adding the options, sending the request collecting that collecting the data and then preparing the request.

A

I guess I should say these are all things that we can work on without you know, without answering those questions. Quite yet yeah.

A

Oh, let's see here actually I'll continue talking of things that related back top CMS org. Before going into other features, we also have issued 1992, which is one of these complicated issues with bankruptcy, most org as a service and backdrop being client that is consuming. That issue. 1992 is package signing which is in progress.

A

John Franklin posted new updates yesterday and a substantial amount of code with two approaches to pluggable integrations for handling signed packages. One using GPG and one using open, SSL I haven't had time to parse through everything that he's written there yet, but that now needs some additional review, but that's awesome to see that work. These been putting together.

A

Let's see working backwards now, ad translatable strings to a core config files issued 34:55 is an issue that starts adding config, translate or translatable strings to config files just enumerate what strings are configurable, but it's just been needs review for, like over a month now, I feel bad I haven't had a chance to take a look at it, but 3455 is an issue that could definitely use some review and, lastly, dashboard issue.

A

A

The status here is a little bit weird.

A

No it's but Gregor did you want to say something about this yeah.

D

So I've had an initial pass added and it looks good. We mentioned that in the previous meetings as well. If we fix a few police, a few things that are missing sort of like certain strings repaired, because because a lot of the blocks were copied from an initial implementation and then changed some of the strengths like field labels check box labels refer to all the things than what the blocks are meant for and there's other small issues here and there.

D

But there are too many to just list, so we decided last week that it might be better if I file the pull request against the gents brands, because it's okay, so github has this. This wonderful feature where, if you find a single line with something that that needs sort of like changing, you can propose a change and then the person that has filed the pull request can accept it easily. But these changes require this thing works only for single lines, and these changes that I'm talking about are like more complicated than that.

A

D

Promised that I was going to work over that this past weekend, but I got sidetracked. I literally started working on it about 40 minutes before we start at the meeting so and I'll work on it over the weekend, so yeah but yeah. The main thing is to take out is that we should manage. This is like the status.

D

The functionality of it as it is now is way better than what we had before, and we should merge as soon as possible as soon as we polish these things, so that we give people a chance to sort of like test the new feature, because it before it gets actually most for one to thing and we can yeah, we can iterate on one or neither improving or adding more blocks.

A

Yeah I'd like to think a little bit about. We could do exactly that like what are our options for iterating like if we add new blocks, you know I. Imagine that means that we might remove the previous ones. You know like I'm, curious about I, don't.

E

Think we have any plans to remove anything all of the stuff. That's on their to-do list is like add a block for XYZ and they're different from what it does currently yeah.

D

And one of the ideas that we had there, that could be a follow up if we don't make it by the time that 115 needs to be rolled out is that we have a news block that tells people news about the community, so we can, even if, if the dust, what is that go-to place for most people, we can add messages on that news, block, saying: hey, there's a new block for what now, which does the next? You can use it another. So that's the iterative benefit well,.

A

Yeah and like other things like views like with the checkup it's in the default state, and if so you know, then we would automatically add the block. But if it's been overridden, we don't change it any any further. Yeah.

D

A

D

Some discussion about because this has been implemented as I lay out, so there were a few people, I think a couple of people that mentioned use cases of using multiple passports instead of one that can like happen at a later point. Yeah.

A

Yeah agreed and I yeah and I, don't know like per user dashboards. I think would be like just a different thing entirely, not.

D

The user I think it was fair role initially, but yeah yeah.

A

Same same sort of thing, yeah, yes, although yeah even then, like layouts, are already pretty flexible, that you could just conditionally show where hard blocks or add layouts at the same pass like yeah, okay, great great great, so that's coming along. It does look very nice now, I that the little change to just had some icons just really change things dramatically. I stopped you trying.

B

D

A

Whelming but but it's much better yeah.

D

Which brings back the discussion that was done like years ago about adding some sort of, if not an icon font, some icon sort of like framework within core that can be used for menus menu items. Things like that mm-hmm and it's it's just ready, study and I. Think it's one in one of the tickets that people relate visually with icons and can absorb and remember things and work faster than reading text, and it helps with multilingual people as well.

D

Instead of remembering English words, for example, if the interface is not being translated, they can sort of like relate the tasks to the items being used.

A

Superior okay, awesome, well, I think that's enough on that. There's also 113 milestone. That has a number of other issues that you can check out on the github issue. Tracker.

A

Let's see, there's one Q&A or general discussion question here regarding unmaintained modules: slash contributes what slash security team! Is this something that you met at Gregory or Jen.

E

A

I wanna summarize that yeah.

E

So I think this is something where um herb dual came across a control that hadn't been updated for like two years or something it's a big ones flag and so he's like. Oh I, think this project is abandoned and so I would like to remove the maintainer from maintainer or from the readme I'm D. But when I like at mention the maintainer and the issue, he showed up immediately and added a comment. So I was like I, don't think we should be removing maintainer just because they haven't done anything for a couple of years.

E

I think what we need is the field the Drupal has. It has like a maintenance status. That'll tell us like how actively that project is being maintained and that's different from our emergency contact, which is like. Oh, we have a security update. We contact the maintainer and I think if we had a security update for flag, the maintainer would be available to help with that, but we do need a way to communicate to people that this project isn't actively being worked on right now and so I think.

E

Integrating that flag from drupal.org that has the maintenance status like is actively maintains that minimally maintained would be good, but I think that so I said up that taxonomy I'm, dr. C, Meza, org and I added fields, all the project types but I noticed in that field. There it's a single value option set on drupal.org, where you can have a project that is either actively maintained or seeking additional maintainer or seeking commentators, but you can't have both, and that seemed like something that was a problem like most of my backup.

E

Computer projects are marked as seeking additional maintainer, but a lot of them I'm like actively maintaining as well and so I would love to be able to have both of those things indicated at the same time, and so I had proposed in issue. I.

E

Think that Corey's you about automating the value of those fields, I'm, not sure if you guys talked about this earlier, but I think that we also should clarify our policy around and that's what this discussion is, how to handle maintainer if they aren't actively maintaining something versus like okay, if we have bugs for the flag, module and John's not around like we have this bug squad that can come in like merge things but I and something that herb mentions like.

E

Oh, if there's no maintainer than anyone can merge a pull request, and that made me super nervous because I was like no no I, don't think we should let anyone merge anything unless it's a bug squad issue or it's a maintainer I, don't think it should be like a free-for-all projects and how many maintainer x' but I'm, not sure we had a policy around that and so I thought it might be worth discussing whether we thought that we wanted to adopt something like that where it's like. We know, there's a maintainer.

E

If you let people remove themselves, does it then become like anyone who has a four of us? Could merge it or do we want to say only bug squad? People can merge anything if they're, unless their maintenance project I'd.

D

Like to add to that, so so, heads besides sort of like argument, was that the latest commits five, a thing of them over the couple of couple years where by someone else other than the maintainer. So we did ask the question and as soon as we were asking those questions did the actual module maintainer jumped in to say yeah guys are not actually actively maintaining it so feel free to do as you please, like become a maintainer.

D

What have you so I'm, not sure if, in this case like if something like a security issue came up, if the actual the maintainer would actually jump in and help? But we seem to not have that problem and more because of those cases we just like.

D

We want to say we I mean the the security team dancing and fixes it, and when it comes to merging things, I would like to sort of like have a policy discussed and agreed upon where, if there is a ticket that has been filed, there's a pull request and there's like a bunch of people like two or three people that came and said. We've tested this and it works, and then, if also knowledgeable, people in the community come and say that the implementation was is acceptable and they have no arguments.

D

If the maintainer doesn't respond, then we should be allowed to meds by we I mean again the squad, someone that is officially responsible and also perhaps make an official release.

E

D

E

That include feature quests, as well as what fixes, because I feel like if we don't have somebody like guiding the project in any specific direction. This is sort of like a backdrop, philosophy thing as well like just having having everybody merge, pull request just with other people that marking our TBC I feel it's a little presumptuous like it would be good to have somebody be like this is where we're going. These are the things we want in this project.

E

These are the things that should be sub modules and without that guidance, I feel like it kind of especially for a really popular module. It kind of opens the door for it becoming a big mess. Yeah.

F

Yeah I think should be only secreting pieces in black pieces. Okay, that's.

E

Kind of I mean I'm in the same agreement with you on that, like I, think you know, we have a pretty good process. We've localized about the bugs flood. We haven't actually merged the floor requests that adds that information into the kinship documentation but I think now that we are running into you know. We've had a lot of kinship models that have been out for years now, and some of the people that originally imported them aren't still maintaining them.

E

So we are kind of getting to a point where, like the bug spot would be useful or originally we're like. Let's perhaps this later, when we need it, it might be now later when we need it, but just having something clear so that everybody's on board, with like what happens to the module, if there's no maintainer on it and I, think if there's no maintainer on it, it needs to be marked, as you know, seeking new maintainer and nothing can go in unless it's a bug fix until that module has an owner, yeah.

D

Having said all that, I do like the fact that, and I mentioned, that in one of the local Drupal slack demos I, like the fact that we are a relatively small community and this I like the idea of having moving the burden of maintaining modules, especially the most popular ones, from a single person or two to a community sort of like air force.

D

Having said that, we need to sort of like compromise when it comes to features like the person that pushes forward the feature to be implemented or the people they need to sort of like make some commitment of maintaining the project rather being a one-off thing.

E

Okay, maybe it's time to revisit that pull request for the contribs blog and next week. I'll have a I don't link to that to the agenda, so we can get a final review on. It probably needs to be a rebase I know and make sure we've got that language craft, and then we can add that to the maintainer agreement, once I've learned agrees on it, yep.

C

Sure I'd like to see if your show language, because I'm still just a little bit confused I kind of thought that the bud smug squad could fix Mazdas if there was no maintainer. But if they're like, if I mean in a module and there's been a bug fix sitting there for six months and I just haven't got to it is the bug squad. Oh I've gotta come ahead along and just fix it for me or.

E

Yeah I think the answer is yes. As long as there's an RVT issue, that's a bug fix. If somebody on the issue says hey bug flood, this needs to be merged, then they have the bill. You do that for you. Yes,.

C

Yes, data between they're aware, maybe I've been holding off on merging that bug fix for a reason.

E

That would say: I'm not going to merchants because of X. It wouldn't be that you just didn't say anything for six months. Yeah.

C

D

Would be, it would be, of course, I'm coming from the maintainer saying that I'm sort of like I have two concerns about this specific implementation, and then there will be people that are willing to either explain why it was implemented that way or extinct fix it. Yeah.

C

I, don't necessarily disagree with this I think I, just understood when we talked about this last time that the bug squad would be working with modules that weren't maintained and so that whole discussion about whether you know any an active maintainer, then that it adds a grey area. So.

E

Yeah I think I think it'll be also more clear if we can get that like projects that is automated, then that would be a very clear indication of like okay. If your project is minimally minimally maintained or your on maintained, we know the bug squad. Snacks, there's something very clear like that: it'll be like there hasn't been any updates in whatever long. The bugs won't do that, and then that way, your.

D

Hat it'll become, and if it's, if it's simple, not like single line fixes say if we move to a vision, we're like 2.0 we're function is deprecated or if string is not passed through T and someone complains that a I'm trying to translate this module and this bit is not being translated. Then I think these sort of, like small issues, qualified for something that the bag squad would jump in.

D

If there's no response from the maintainer for for for a while, like it makes sense if it's like one line, fixes that no brain is there's no point in sitting there, I'm frustrating the the reactive so like users of those modules unnecessarily.

E

Think that something um okay, so two other questions that came up from this one of them is that this particular issue herb had filed a poll request that removed the current maintainer and I thought that that was a little heavy-handed. Considering the maintainer responded in that issue, I thought we could.

F

E

F

Sorry you've said that before, but he got you to responded to say he agrees.

D

With that yeah.

E

D

So you've made an attempt: I, don't.

E

Think he did because the second poll request still still removed the maintainer.

F

Didn't remove them, it moved into the maintainer.

E

And added a credit yeah.

D

E

So I don't think we should be removing maintainer x' and unless we have another maintainer stepping up cuz to me, then that maintainer line is like it's not a credit section. It's like in case of emergency call this person sort of it's that that's the person who knows the most about the module and that's the person who like if there's a security issue, you're gonna, want to involve in getting it fixed.

E

You know, I, think that the point about like herbs point was that we need a way to indicate to people that this module is not actively maintained and that it doesn't I, don't think that's the same thing as like we're moving the person's name from another I.

D

Have to say that I'm with her on that one because a we can't communicate the fact that there is a person to go to if they are on the credits, and it says for this to backdrop. It means that this person actually has done most of the work, so yeah try to reach them. But at the same time, if we keep that person in the maintain years, when he's not, he doesn't have the energy or or more time to do it. It's sort of like miscommunicating the fact that there is a maintainer whether but.

E

There is a maintainer he's, just not actively maintaining the module, so this is also another thing where I feel like I feel like this. Is it's like getting it's too heavy-handed like you're, just taking things away from people from people, for no good reason like that? The reason that I think herb wanted was like to like show people that this module isn't maintained.

E

We have a solution for that, like what is the purpose of getting in there and like we're moving this guy's name like if we wanted, to even credit sure, put him in the credit section too, but like that's not what this says. This is like. He originally was like hey I'm willing to help with this module.

E

Just because he's not working on it for the last two years doesn't mean he hasn't said like said that, like he's still willing, he still offered that support he's just not actively doing it right now, and so this is the same thing. We're like right now, it's a little weird because all this stuff came from Drupal but like if I ride, a module and I use it on a project and I'm actively supported for a year and then I go off and do another project and I don't work on that month.

E

Over a year they could do the contributors just come and like take my coat away, like that's just seem like you're, really like mean almost where it's like. You have someone who's offered to help and you're saying oh you're, not helping well enough, so we're just gonna. Take your name out of this file. It's just like I. Think removing yourself and maintainer should be. Something is the same in the triple-t needs to come from the person who's. Doing the maintaining saying, hey, please remove me, or it needs to be from someone else.

E

Think: hey I'm willing to step up and do this now I, don't think.

F

It'd be like an arbitrary decision from some governing body to like I'm.

D

F

Not necessarily disagree, but.

D

You have Jace's like dr. Wilma, for example, who he doesn't maintain a few projects actively, but for some others, just when someone requests it is here, it is run it through coder code update order, update as in it comes with no warranty whatsoever, and then he says, I'm moving away, I'm, not maintaining it, and you say that in these cases, which should be on that person to actually remove themselves from the maintainer well,.

E

I, don't think they should do that unless there's another maintainer like I, think like whether you're gonna be actively paying attention to this module for forever. You still need to be the point of contact, maybe the reference until some less comes along. It was all meeting like all of the modules I've ever worked on. How come you list is a maintainer, and that says seeking additional maintainer or seeking new maintainer, and then it says like whether I've ever made another commit to it or not like I'm.

E

Still a point of fact: I don't think we should allow people to port a module without a meeting I. Just think that that's like yeah.

C

We just recently had- and we just recently had a scenario where somebody asked to have their name removed from some modules because he's like I'm done with backdrop I'm, you know I'm not going to be doing backup anymore. I, know that and I don't know what the value of leaving his name on as a maintainer. If he's pretty well.

E

Requested it be removed that sign but I think like in general, you shouldn't let a minute.

C

Ago, though, you said no, we should never let.

E

Them add a module without a maintainer right like oh, okay, yeah, that's different than being like, oh I'm. No longer doing this anymore, like I, think there's definitely situations we could get into where a module ends up without a maintainer, but I. Don't think that that should be like a general like this. Is it's okay for you to like.

D

Yeah it's a thin line, though we shouldn't let the same, because you was we're talking about taking the power away from people sort of like a bad click and I agree with that. But on the other hand, we shouldn't sort of like lock down people and make it make them feel like once they have putted something they have the obligation to necessarily maintain it, because maybe.

E

We need to like pick different words to because, like like the the requirements were having on people to maintain a modular like pretty minimal. It's like, if there's a security issue, you need to communicate with them like we're, not even saying they have to solve it anymore. It's like you, just have to be there. If you are available there, they're not available so I, don't know, I just feel like the the requirements were being a Maitre. What it means to be a maintainer is like you, have your name and that's kind of it. I do.

D

Not I do not disagree with the arguments.

D

Just my thoughts that should just be at the back of our heads is that I would rather someone because most of the simple modules actually work, possibly grabbing them through quarter I, would rather people port modules and put them out there for people to use and then report, if there's issues and eventually have those fixed rather than people having second thoughts and feeling feeling obliged that if they do be sort of like initial porting for on someone's behalf, then they're eternally sort of like bound by an agreement that they need to necessarily just do something about it.

D

Even if it's not something is as little as coming back to us and saying: hey, I'm, not interested I, still, don't think that we should be forcing people to just saying that if you want to port a module, you have to maintain it I think it's more benefit. If people just do do port modules and say I'm not released I'm, not making an official release, here's the port, it no warranties, feel free to jump in and maintain it. If you like, I'm, saying just as a suggestion that there's there's aspects to think about.

E

Like we do have this nice distinction on backdrops that's different than Drupal, where you can have like a module with no official release, and it won't show up in project rouser and it won't show up on backed up CMS toward and I think that might be a good thing where it's like. If your project has an official release, it needs to have a maintainer but like if it doesn't like it's a pool of code, that anyone can use sort of thing.

E

I think that would be fine, because that is also saying, like anything without a maintainer sort of requires a little bit more of a developer understanding. That's like a different level person. Who's gonna like climb off github than it is just gonna use private browser.

F

To install it, perhaps then we should agree on instead.

D

Of saying you're not allowed to port the module, if you're, not adding yourself as maintained you, you are not allowed to make a release of a module unless you're listed as I maintain I. Think that sounds reasonable or or if you are a member of the budget which excludes there. The security releases yeah, yeah anyways. It seems that we need to just sort of like formalize this in ethics. That explains things things work so that people know what they're getting into yeah.

E

Okay, so where do you guys want to work on this sex? It feels like there's like still kind of a lot we have to hash out. Is this the kind of thing we think we need a PMC boat on, or should we just kind of draft it in public like in the contribu and see if we can get like a consensus from people who are active, what we're there on whether what they think is fair and what they think is safe. I think that the contribute.

B

F

A repo item- heart's content- maybe here, okay,.

D

It's where we can file a pull request against the readme okay, yeah.

A

Exactly yeah, we have a whole section on abandoned projects right now like it might be. This.

E

Isn't this like these parties haven't been abandoned right.

A

E

A

Longer want to maintain or.

E

Not like someone else just decides, they want to take your name out of the file.

A

So we already have it a thing on that that it's like one of the agreement items that's like if your project becomes abandoned, I mean you do not respond to an issue to grant a new maintainer within two weeks. Your project may be modified by an administrator at a new maintainer without your consent. So, like none.

E

Of those things apply in this case it was just some guy. That's like I've, decided that this guy isn't doing a good enough job. Maintaining so I want his name gone right.

A

Oh well, that's.

E

He wasn't even like contacted. He was just like this project is abandoned, I'm, removing his name and then as soon as I mentioned him, he showed up right away, so it key would have responded in less than two weeks right.

A

Yeah, so the process was implied there, but not explicit I. Suppose you know that it's when you, if you would agree to that, it would tell you I, expect to get two weeks notice right.

E

A

E

He responded within you, know, hours yeah so but.

B

E

Stuff away from people like we need to have the same sort of deliberate thing where, like we need a very clear rules about like when something becomes abandoned, like what the requirements are and then be abandoned, and then what would happen and then, if you owned, an abandoned module like I, have a bunch of modules, I haven't added commits to for over a year. I wouldn't want someone to just tell me, with my name for a minute. Cuz I still feel responsible, but I'm also take care of them.

E

We just need to be like okay well like if there is a bunch of stuff that you aren't doing right and there's someone else that wants to do it or the bug squad is or whatever, but what just? We don't have any yeah.

D

And the person that is claiming that the thing is about them, they can always Adams request to add themselves as commenting as without removing the main thing.

E

Right right, yeah.

A

Abandoned projects think seems pretty clear: I think that filing a pull request preemptively without starting it an issue. Oh there is an issue. It's a snowcone.

E

Maintainer there's no new maintainer, it's just like this project is I'm and and remove the current maintainer right.

A

And that if a polar quest was filed prior to two weeks having passed, then that was already no.

E

There's no new maintainer, yes,.

D

E

Process is like, if you want to take over an abandoned project. This is how it happens. That is not this use case. This use cases. One person thinks the other person isn't doing a good enough job of maintaining a module and wants to remove his name. Yeah.

A

Really two weeks should have been there like it's varied like it's like you should file an issue. Saying is this issue? Is this project abandoned, like that seems it's the.

E

Point is that I don't think we should just to remove people from modules, because you don't think they're doing a good enough job. Well,.

A

Absolutely and I think every.

A

E

Is like irrelevant, because that only applies for like if you have a new maintainer, applying yeah.

D

And if we officially have this rule where it says that if the project has no maintainer, then the no release is possible, then the person that would be asking to remove the maintainer would actually be locking the project into being unmaintainable, no relations right unless they offered to add. So. If we make that rule clear people would know that the moment that you suggest a project is unmaintained or remove the maintainer. You also suggesting that there will be no more releases until up maintaining is found. Yeah.

E

Yeah, okay: well, let's um I will take a stab at this document, but Gregory I would love it. If you would help me clarify that with what you just said, I think was very clear: we could get that written somewhere, I, think that makes sense and then I think that maybe we should modify that section so that it doesn't talk about like how does he case how to take over an abandoned project, but just like more generally about like removing maintained members or something and then maybe it would apply, but yeah.

B

E

To get everything every use case clearly defined this book. What will happen? Alright.

A

Yeah, it seems like I mean the process would essentially be the same it just you wouldn't be putting a new maintainer in place. You know, yeah yeah I was.

C

A

A poor request against the readme and then working on it from there yeah.

D

um If someone needs my input back in the days, I used to monitor the notifications from github, just just ping me on Gator. If you need me to review something or you need my input like or my vote as a team cemented, okay.

D

Okay, there's one item that I would like to shortly like bring into focus it's not in the agenda, but we have the security release and yet again the I'm sure that the problem might have come out where we don't support multiple branches for security releases. So people that are still on the 1.11 branch and have updated to the 111. Seven would still get interpretations about a security update pending and I understand that it's not an easy thing to fix, but it should be in the agenda. It.

A

Isn't intend that I think it is yes support, multiple, equivalent security leases, 3524, okay, yeah, sorry, I missed that yeah? Okay, oh I,.

D

Agree, do we not do we have any idea where technical intimidation sort of I plan on you on that yeah.

A

We have ideas, but there's no code yet look at you, yeah. Okay, let's wrap up this meeting we're going ten minutes over already as it is so I think yeah. Thank you. Everybody out there for watching these meetings and thank you guys all for this good. The discussion today. Thank you guys, we'll see you guys on the internet and in, like you said.

D