GitLab Secure Stage, 1 Dec 2021

Previous Meeting Next Meeting

⏯

youtube image

►

From YouTube: Iteration Retro 14.5 - Secure:Composition Analysis

Description

https://gitlab.com/gl-retrospectives/secure-sub-dept/composition-analysis/-/issues/12

A

Okay, hello, everyone and welcome to the first ever iteration retrospective for composition, analysis group, and uh today I guess we like for for this retro. We have uh two issue: uh the preposition one is for me and uh I just like added it as a kind of placeholder, uh because it's not finished and probably we can discuss it later, and there is one issue uh proposed by fabian about support proxy settings of retargets, and I think that we should discuss this. One.

A

So I can share my screen, so everyone can see the issue.

A

And fabian, could you please like uh tell us uh like some details about this issue and uh what was there.

A

How would they like? uh I was really interested in just like to know how it was break down and what was like details? What was this issue about, and uh what do you think could be done differently.

B

Yeah, so you know where this was. This was about adding support for http and https for keys in the retire.js analyzer, and it's it's important to share a bit of the background. We we had a community contribution uh to implement that feature long ago created long ago, but tests were missing. It's uh it's a bit, tricky to to test that, and also what else about the context so yeah. So we we had these magic requests created long ago. um We had to remember things: oh yeah, 30 and 10 13.

B

Sorry, the 10., um and um this issue was added to the milestone very late in the process. Actually, it was. um It was added to 14.6 during 14th at 6, which is initial, but it happens and.

B

It it had been refined when I started it. I started working on the implementation that is um working on the tests really um and yeah some sometime at the beginning of 1406 uh thiago support engineer um shared um an idea on how to implement the test.

B

So it's it seemed doable but um okay, but then maybe we should we should jump to the retro part, um so I've there's yeah. Actually I'm glad I did that. I didn't know about this upcoming iteration retrospective meeting, as I got lucky um yeah, so um it took longer than expected.

B

I mean it's, it's not um it's not unusual, um but in this particular case uh I kept switching between analyzer the analyzer project, that is a retired gs and the test project because it had to be tested using an external test project, and that was that was um uh that was um well annoying for one thing, but also time consuming um so yeah. Sometimes it's a necessary thing.

B

uh Igd. We can have image integration tests using our spec, but in that case it's not something we could have avoided. I think but yeah it's it's just a waste of uh focus and time um being forced to switch between projects. That's the first point.

B

uh Second point I didn't remember much about http proxy is really, uh and so that's something I could have considered when uh starting the issue. That's that I needed a refresher.

B

um Well, I I know how it works, but there are details. I I had forgotten and as as a result, I didn't my first implementation that the test was um flows, that's something I could have avoided.

B

uh That was the second point in the bullet list. Excuse.

C

Me fabian uh yeah, sorry, three interrupt um yeah.

B

Because I'm gonna.

C

B

For a long time, maybe that's yeah, no.

C

I I just uh want to make sure we are focusing on um on the deterioration value here, because part of the retro you're showing here uh is worse discussing, but it's more like a general retrospective feedback rather than what's really uh matters for the iteration value. Specifically, um I think the third point is more relevant to that yeah. So I will leave you uh continue with this, but I just wanted to make sure that it's clear that this is about the iteration value rather than general retrospective.

B

Yes thanks for saying that, because I does and uh I'm new to this exercise, so thank you. So yes, third point is totally about that. I I wanted to support both http and https proxies and, but eventually I realized that http proxies are not needy. In that case, we don't uh because it's not secure and we only we only care for secure things, features and uh yeah. I guess by better refining the issue.

B

We could have spotted that um because the other thing it takes more time to to test http proxies support and https proxy support.

B

When, when in the middle of that, uh I realized that it took more time and effort and knowledge to to test both so yeah.

A

And I have a follow-up question it where it was possible to actually like split it into two iteration and deliver uh https proxy and all the then http proxy or it's not uh like it's not reasonable.

B

Yeah, um possibly, and but I think I think I was uh influenced by the way the issue created by customer by the way was framed. The issue was http proxy support, okay, so all sorts of proxies, um and when we I mean we uh engineers in this secure composition, analysis group create issues uh we well. Maybe we we would have.

B

We have spotted that right from the beginning, but yeah once the issue is, is created in frame. It's it's a bit harder to to spot that.

C

Yeah, it's always easier afterwards, obviously yeah, but but I think that's a good point of um keeping that in mind. When doing the refinement. It's clear right now that yeah it could have been spotted during the refinement. So this is maybe some tool that we can keep in mind when, during refinements to constantly re-read the implementation panel, maybe and see what are the separate bits that could be extracted. Maybe- uh and maybe it's not a good candidate uh but uh at least asking the question making the exercise uh could be an interesting step.

B

And maybe we are- uh and it's not even conscious- maybe uh we are hesitant um to do that because it's a customer issue like we don't want to mess with the issues and again.

A

It's not the city's.

B

Conscious sorry.

A

But uh like I started understand, uh these shows, like uh the person created, like community contributor, created merger quest and created an issue at the same time, right.

B

Oh, that's a good point yeah. Maybe we had the issue for the the magiques first. Actually, it's very possible that okay, could you.

A

So uh issue was.

B

Created in july.

A

29 and uh the merger quest was created, oh no, no, uh this show existed long before okay.

B

Don't be far, the magiques was created, yeah yeah.

A

Yeah so yeah, it's kind of like looks like a valid point that we could could actually like check it on uh during refinement, but yeah. That's why we actually do this retrospective to just speak. The things like that.

B

Yeah, maybe um uh maybe that's because I I think I was the one refining that issue.

B

Actually I didn't know it was it wasn't clear to me how we would uh we would uh test the feature, um and if this had been the case, then maybe I would have seen that oh, we need two tests, two integration tests and it's better if you can start with one and do the other one later, uh and thus we should have two issues, but since we didn't have details for um how to test this, um it didn't appear that it didn't appear clearly in the issue.

B

Do you see what I mean, because if you think about it, you think at the practical level you think about the test? Okay, you think about the integration test. Wait a minute. I need two tests. I need two two setups, because there is http proxy support and then https proxy support. Okay, um then it's kind of obvious that oh two is more than one.

A

B

Maybe we need two issues.

D

Yeah I recall looking at this at the mr, I don't necessarily remember the issue and I think the uh the contributor was more than happy to make this and I think, as as we saw, it was more or less code complete. I think the struggle that they had was writing the integration test.

D

Like I think your feedback fabian was, you know we need tests for this, and I think that the as far as I recall, the the contributor replied like I don't have time for it um and I think initially it seems aggressive, but I think really they didn't really understand how to sometimes.

C

We don't understand.

D

How to write the test properly right, um so I think if we were to take a iteration kind of feedback, I think the key is maybe either um you know. I think you mentioned the new integration test suite, but also like make it more accessible or at least guide them further down the path about what it means to have.

D

The test like here take a look at this test, and this and this thing for you to write it, because I think that was really the point where the contributor gave up is they said uh you know I I don't have time for this, and I think it just didn't feel, like figuring out our whole system, so maybe like the next sort of uh step, would be like in the future.

D

The ideal thing would be for the contributor to know and have a very good understanding of what these tests are like and then be free free or to write it.

B

I I I've got mixed big things. I mean I agree, uh yeah it would help in. In most cases I mean we don't have that many community contributions, but normally that would help. But in that particular case, um this test for us http proxies is a first was a first and it's it's not the first email. It's it's now something we can document and we can explain users.

B

I mean our computers, how they can now write integration tests for http support, http proxy support, that's something we can do now, but back then we didn't know and sure I mean our general instructions on how things are tested in these projects would help.

B

But in that case I don't think it would have made a difference, because I was.

D

Telling you, but I would say in that case, like I think, our feedback to the to the contributor was you should write tests for this, and if we don't know- and if we didn't have tests like this before then then in that case we should have just taken it over or something or said, like you know, do you.

C

Know what I mean.

D

Because our feedback was write tests and that, in that case, that was like basically giving giving them uh guidance into a brick wall because we don't know they certainly don't know. Then yeah like that. That's not helpful.

B

Yeah, it was a bit more nervous that we said we need tests and we don't have capacity for that. Do you, and if you, if you do, then we we might have uh well, we wish we'll. We will help you something like that, but um to your point, it's even worse than that. I mean it's changing, but it's worse than that.

B

uh They can't even run java integration tests because of permissions.

B

Even if they have the knowledge they can't, they can't do it by themselves unless they clone everything, including the test projects. They're not gonna, do that.

A

Okay, so like as we're running uh of time, I just like proposed to like we discuss the issue in full right now, and I propose to just get back to the questions that we have to answer, and this question was I I wrote them so like. I'm not sure it's a great one, but it's like a good place to start and um yeah.

A

So how this item was implemented and we saw that it was implemented by the community contributor in one merge request, and then we actually figure out that there is a possibility to iteration and just dropped, support for http proxy right.

A

Okay and what were the opportunities for iteration.

A

Does anyone want to verbalize it.

D

Well, in my mind, and going back to what we're talking like uh the first part of iteration, was, was making it as like, I'm not even looking at what fabian did like fabian's implementation, I'm really looking at what would have been the next iterative step to allow the community contributor to actually get as close as possible to merging this right and and to me it's. uh It was task test for the blocker right, so to me, uh the the opportunities would have been to allow them to to create a test.

D

um Maybe just just uh I don't know uh some some step towards what it would have looked like in ci, which maybe would have been. Can you test this locally like? How would you test this locally? How would you create this locally? How would you do this manually and then take that manual step and throw it into a um like a looking into a ci script right, um because to me like that's how I test right, like I do it locally.

D

When I see how can I turn this into a ci uh job, and so maybe in the future, as fabian said, if we don't know how something is done, we could ask them like you need clearly that person needed this feature. How are you using it and then maybe we could go from there um and help them show us. Your use case show us how you do this locally in your bash shell, and then we can see how we can turn that into a job.

B

I'll show us using a test project of yours and that's something: we've never suggested to contributors, and then we would be the ones adding that to the um to the pipeline to automatic testing.

D

Yeah and to me that's a great breakdown right, because we don't have to figure out everything we get the user's use case and then we kind of generalize it to the feature that can get implemented.

A

It's actually a really great suggestion, because um I just wanted to remind that.

A

Iteration and context of gitlab for values is something that brings like uh bring value to user, so like uh breaking feature in a few major quests, and they are just like not like kind of like a factor and things it's not iteration, generally speaking, but uh creating like additional step when we uh add some what kind of framework to write integration tests for our community contributor, it's kind of like a user-faced change, sort of speak so yeah, it's a it could be opportunity for integration or for iteration.

D

And just to mention like sometimes when we write uh like we implement a feature and then we write integration tests for it. That is our like. I think, we've seen it before right, like our you know, for example, our our test integration project like java maven. Those are our idealized thoughts about how a project would look would look, but I you know I I would much rather have a user come and say here's.

D

What my use case is here's, how I'm going to use retire.js and then from us to go from there to create a test project rather than um us, idealize, whatever. What we think a test project would look like or anything. I think that that uh that iterative uh aspect that you just talked about to tiana would work both ways right. It would really help us to actually create a more real-world scenario, because we know at least one person did it.

B

I'm very excited, I agree so much with what you just said. I mean, ideally, they would test with their projects and we would learn from that. We learn about the that's. That's awesome, yeah.

A

B

Well, we should encourage that not only that's a good uh intermediary intermediary step, but also we would benefit from that.

D

We would learn from that, so so just uh to piggyback off them, maybe the step of uh refinement. I apologize for talking too much, but the step of refinement could be if it comes from a user to actually ask them for a test project right, maybe that, like if a user reported it can we just. I might not call us too much to reach out to them and ask uh you know we're looking at refining this issue.

D

Do you have a test project that you try to use that we can? Maybe you know, make public uh something that it's a dumbed-down version. You know just your public dependencies uh used and whatever, and uh we could try to use it. That could be a really great um help in refining things, but.

B

Not in that case, because um this constraint of using a proxy is uh when running a dependent scanning in a enough um what's a name on premises in in an environment users, customers don't want to share. So not in that case, but maybe in other cases you see what I mean. I mean good point. Yeah.

A

Yeah, and so we have last question- and we have one one minute into till the end of this meeting, so what we learned and what we'll do differently- and I guess uh like it was already said that we need to uh take more attention to refinement of the customer created issues and you probably asked should ask them to bring their own test projects for the emergency quest right. Okay, so I'll add these answers either to the issue as a comment, and you can like add more things asynchronously.

A

If you want- and I guess uh that's all for today- so I'll- stop, recording.