►
From YouTube: Jenkins Governance Meeting, Jun 17, 2020
Description
Recording of the regular Jenkins Governance meeting. At this meeting we discussed the terminology updates and agreed on an action plan w.r.t new names for "master", "whitelist" and "blacklist" terms. We also agreed to update the Jenkins Code of Conduct to Contributor Covenant 2.0, to proceed with enabling Community Bridge funding in the project (JEP-15).
Full agenda and meeting notes: https://docs.google.com/document/d/11Nr8QpqYgBiZjORplL_3Zkwys2qK1vEvK-NYyYa4rzg/edit#heading=h.cgd8zbewht8o
A
Hello,
welcome
to
the
junkies
governance
meeting
today
is
june
17th
and
we
have
several
topics
in
our
agenda,
so
we
will
start
from
news
and
updates
in
the
project.
Then
we
will
talk
about
updating
the
code
of
contact
and
then
I
will
talk
about
approving
the
community
bridge
funding
page
for
allowed.
It's
a
flow
up
to
the
previous
discussions
we
had
a
couple
of
weeks
ago.
Then
we
will
talk
about
hosting
plugins
with
proprietary
libraries.
A
A
A
A
So
on
june
19th
we
also
had
uncoordinated
disclosure
of
the
security
risk,
so
we
knew
about
that
for
a
while,
and
we
were
planning
the
kicks
but
taking
the
disclosure.
We
had
two
block
uploads
to
junkies
at
the
factory
and
basically
applause
were
blocked
from
june
9th
to
june
15th.
So
we
enabled
them
on
monday
and
it
caused
some
impact
on
plug-in
maintenance
but
yeah,
sorry
for
any
inconvenience.
Now
everything
should
be
restored
so
for
plug-in
maintenance.
We
communicated
the
updates
and
it
should
be
somewhere
in
this
thread
yeah.
A
So
it's
here
so
this
story,
at
least
for
me,
plugin
maintenance
is
over.
Definitely
we
have
a
lot
to
learn.
We
started
the
discussions
about
using
another
identity
management
service
which,
and
it
would
be
a
third-party
management
service
so
that
we
wouldn't
need
to
host
that
and
we
will
hold
the
public
respect
for
all
the
issues
and
probably
next
week,
once
all
the
events
are
handled,
because
we
still
have
some
follow-ups
and
the
infrastructure
I
came
to
finalize.
A
A
A
So
for
this
year
we
got
a
60,
000
dollar
donation
from
aws
to
keep
trying
aws,
and
we
run
jenkins
agents
and
the
agency
agents
on
aws,
as
well
as
a
number
of
other
services,
it
kind
of
works,
and
it
definitely
helps
us
to
reduce
the
cost
of
sponsorship.
Because
yeah,
when
we
started
optimizing
for
the
cost
for
asia,
we
were
at
something
like
almost
twenty
thousand
dollars
per
month,
which
was
above
our
target,
so
how
usage
of
aws
etc
helped
us
a
lot
to
optimize.
B
C
A
A
A
This
is
the
version
which
was
updated
and
since
that
we
have
never
updated
it.
At
the
same
time,
there
are
two
versions
which
are
currently
available,
so
one
is
version
1.4,
which
was
became
available
in
2017,
so
it
provides
a
lot
of
changes,
especially
covering
social
media,
providing
examples
of
advice,
behavior
not
only
prohibited
one
like
ours,
but
also
some
best
practices,
and
it
keeps
evolving
version
2.0.
A
It's
also
linked
from
the
mailing
list.
It
goes
even
further
because,
firstly,
it
stops
focusing
on
project
instead
of
that
it
starts
focusing
on
the
community.
So
maybe
you
have
heard
about
a
project
called
community
covenant,
so
basically
a
contributor
covenant
to
the
zero
includes
community
equivalent
right-hand
side.
A
There
is
a
lot
of
enhancements
and
boarding
in
scope,
etc.
Why?
I
proposed
updating
to
1.4.
Originally
there
were
two
issues.
First
of
the
issues
that
we're
going
to
show
whether
this
is
the
foundation
would
be
fine
with
us
going
to
2.0,
because
we
also
have
ongoing
discussion
about
the
graduation
process
and
one
of
the
acceptance.
Creativity
is
adopting
code
of
conduct,
and
this
is
the
foundation
now
uses
version
1.4
and,
as
you
may
imagine,
version
2.0
is
not
exactly
compatible,
so
we
need
the
confirmation
where
the
cdf
would
be.
A
Another
obstacle
was
that
version
2.0
basically
had
no
change
lock,
so
it
was
discussed
and
I
made
a
best
ff
attempt
to
write
a
changelog
thanks,
a
lot
to
jeff
for
feedback,
because
a
majority
of
this
change
lock
is
based
on
the
feedback
in
our
developer
managers
and
also
communications
in
the
contributor
government.
So,
right
now
you
can
see
that
there
is
ongoing
discussion
about
working
et
cetera,
but
at
least
there
is
a
changelog
which
we
can
use
for
reviews.
A
D
C
A
To
technical
oversight
committee
on
monday,
once
we
have
had
this
full
request,
we
got
confirmation.
I
will
say
that
to
the
agenda
of
talk
meeting
to
formally
approve
that
talk
meeting
yesterday
was
cancelled,
but
yeah.
I
believe
that
initial
feedback
is
enough
for
us
to
adopt
to
continue
with
adoption.
If
you
want.
E
A
D
D
C
A
A
I
I
think
we
should
check
alignment
also.
There
is
cdf
code
of
conduct
and
I
think
that
we
should
have
a
two
level
escalation
process.
So
first
escalation,
as
is
to
the
governance
board
and
second
level,
would
be
cdf,
because
why
it's
important,
we
may
have
some
cross
project
issues
or
if
somebody
disagrees
on
the
project
level,
offering
a
way
to
mitigate
it
on
a
high
level
would
also
make
sense.
A
C
Yes,
so,
and
that
pull
request,
because
it's
going
into
the
governance
section
will
be
tagged
for
government
governance
and
therefore
it
won't,
it
won't
immediately
be
merged.
Even
if
people
list
approval
or
is
that
one
where
we
should
be
holding
off
approval
until
it
comes
to
the
governance
board,
we
review
it
without
giving
an
approve
yeah.
A
A
Obviously
it
doesn't
block
copy
editors
from
merging
the
things,
but
we
have
a
maintainer
guide
at
the
moment
it
was
introduced
one
or
two
months
ago,
and
it
specifically
covers
topic
about
structure
and
ownership
and
in
order
to
prevent
collisions
just
in
case.
So,
for
example,
I
have
a
pull
request
for
updating.
The
donate
page
is
a
subject
for
the
base
agenda,
but
when
I
created
it,
I
also
put
it
on
hold
so:
okay
yeah,
it
prevents
unintentional,
merge
and
well.
If
something
happens,
we
always
have
an
option
to
revert
that.
C
C
C
C
E
Okay,
I
will
also
add
that,
given
the
there
is
a
timeline
for
what
we're
doing
here
and
that's
for
the
graduation
process,
so
this
is
something
I've
I
I
would
love
to
take
it,
but
I
really
think
this
is
something
you
should
drive
home
or,
like
that's
not
me
voting
for
you
to
take
work.
I
don't
mean
it
that
way.
It's
more
yeah!
I
will
need
all
of
you
to
review
that,
because
yeah.
A
A
So
I
would
like
to
ask
for
approval
to
proceed
with
publishing
the
reference
implementation
for
community
bridge
funding
what
it
implies.
We
replace
the
donate
page.
So,
for
example,
here
yeah
there
is
some
wording
changes.
Basically
it
reflects
japan
and
how
we
actually
spend
money,
because
right
now
we
say
that
we
use
donate
money
on
the
to
maintain
infrastructure.
A
So
these
are
two
ways
which
currently
linked,
but
the
spi.
Here
there
is
agreement
that
they
won't
be
accepting
the
nations,
though
they
still
in
fact
do,
but
I
think
it's
time
to
remove
that
and
for
this
vendor
I
believe
we
still
don't
have
response,
whether
they
accept
donations
or
not,
because
william
was
investigating
this
topic,
so
I'm
not
sure.
What's
the
status
there.
F
A
F
The
they
are
just
you
know,
corrupt,
I
don't
know,
what's
really
going
on,
they
don't
answer
mails.
The
website
has
been
updated.
I
think
two
years
ago,
so
yeah
so
not
existing
anymore.
This
interesting
this
website
is
on
and
we
can
access
the
details
of
the
savings
I
think
two
years
ago
it
is
working
but
yeah.
F
A
A
C
A
A
E
C
A
A
A
A
A
Okay,
so
there
was
a
discussion
about
one
of
plugins
which
was
blocked
from
distribution.
It
was
blocked
from
distribution
because
there
was
a
security
report
about
this
plugin,
including
proprietary
code.
So,
basically,
even
if
the
plugin
itself
was
open,
source,
abilify
mit
license,
it
was
pointing
to
alternate
repository
and
pulling
a
private
library
from
there.
Basically,
it
was
distributed
with
this
private
library.
A
At
the
same
time,
we
got
a
clarification
that
the
private
source
code
wasn't
enabled
by
default.
You
would
still
need
to
click
some
buttons
to
get
it
right,
but
formally
our
governance
policy
says
that
we
don't
host
components
with
proprietary
code,
so
this
is
what's
recommended
right
now,
and
I
wonder
whether
you
want
to
reconsider
that
for
dependencies.
B
A
C
A
Yeah,
so
there
would
be
an
interesting
and
important
follow-up
about
improving
our
scanning
tools
because
yeah
right
now
we
don't
verify
what
we
publish,
even
though
artifactory
offers
some
features.
Also,
we
could
update
our
apparent
pumps
for
medium
and
simple
gradle
to
do
some
scanning
so
that
we
could
identify
such
libraries.
A
E
E
A
A
Hosted
so
the
next
topic
technology
updates.
So,
first
of
all,
thanks
to
everyone
who
provided
feedback
in
this
thread,
it
became
a
bit
long
thanks
a
lot
to
alex
for
starting
it.
So
basically,
it
includes
two
major
topics.
One
is
about
changing
the
terminology
for
jenkins
masters,
another
one
changing
the
technology
of
white
history
and
blackface.
A
There
are
a
few
options
suggested,
but
in
the
discussion
there
are
many
other
options
suggested.
I
will
do
a
quick
summary
of
what
we
currently
have
on
the
table
and
yeah
after
that
we
can
proceed
with
the
discussion
so
for
masters.
Originally,
we
started
from
choosing
a
single
term,
so
there
were
a
number
of
options
suggested
I
processed
the
entire
medium
keys
and
put
it
in
the
google
doc.
If
I
missed
something,
please
just
suggest
a
change.
This
google
doc
should
be
open
for
comments
yeah.
A
So
if
you
see
something
mean
just
suggest
but
yeah,
you
can
see
that
there
is
a
huge
number
of
options
already
suggested.
So
the
front
runners
are
controller
and
server,
though
some
other
options
also
have
got
a
decent
amount
of
votes
and
yeah.
Also,
there
is
the
proposals
which
had
on
the
one
road.
A
Top
so
this
was
one
option.
The
second
option
we
discussed
is
actually
splitting
the
term
so
instead
of
just
using
a
single
terminals
instead
of
fridging
smart
statistics
by
use
case,
so,
for
example,
in
the
documentation,
when
you
say
please
go
to
the
jenkins
master
ui,
you
can
just
say
go
to
the
jinx
web
interface.
A
Controller
was
proposed
and
so
on,
so
basically
splitting
this
term
and
proceeding
in
such
way,
which
might
be
a
good
investment
in
the
future.
For
example,
if
we
start
breaking
down
jenkins
to
microservices
or
adjust
to
services,
for
example,
we
already
had
a
prototype
of
multi-tenant
jenkins
and
it
might
be
useful
architecture
investment
for
the
future.
A
C
A
Can
we
run
public
voting
there,
so
I
believe
this
option
is
supported,
because
what
I
yeah,
what
I
don't
want
to
do
is
to
go
through
when
you
find
all
the
junkies
users
through
mailing
lists,
et
cetera
yeah.
Do
we
have
it
for
governance
and
officer
elections?
I'm
not
sure
whether
you
want
to
repeat
it
again,
but.
C
Yeah,
I
agree
would
need
to
be
public
and-
and
still
I
would
take
the
voting-
the
result
of
the
condorcet
voting,
as
only
as
only
one
voice
the
governance
board.
I
think,
still
has
the
the
the
definitive
choice
I
don't
if,
if
it
were
spammed,
if
it
were
overloaded
by
people
who
were
being
malicious,
the
governance
board
could
still
just
ignore
the
public
vote,
declare
that
they
were
ignoring
it.
B
C
B
I
think
there's
less
likely
the
case
that
they'll
be
bad
actors.
If,
if
there
are
only
terms
on
there
that
are
ones,
we
would
accept
yeah
and
no
write-ins
right.
I
think
if
we
have
only
the
terms
that
we
would
be
willing
to
accept,
then
I
think
that
significantly
reduces
or
eliminates
the
possibility
that
bad
actors
could
come
in
and
and
cause
a
problem
with
the
voting.
A
D
A
C
B
A
A
A
A
C
So
I
to
be
sure
that
I'm
understanding,
I
think
what
you're
asking
is,
do
we
like
the
concept
of
splitting
the
term
and
I
like
it
very
much,
but
I
think
even
with
that,
we
still
need
something
that
designates
the
the
terminology
for
the
the
old
term.
The
the
old
representations
did.
Did
I
miss
a
misinterpreter
question
like
yeah,
so
let's
assume,
okay.
A
C
A
A
Meaning
that
you
have
there,
so
basically
he
reflect
master
but
master
in
terms
of
network
topology,
so
we
have
a
central
node
or
whatever
it's
called
to
which
you
connect.
For
example,
agent
connects
to
it
interact
with
that
same
example,
other
components
like
monitoring
systems,
cli,
etc
inside
this
system.
Finally
connect
to
this
central
point,
which
is
not
represented
by
jenkins.
A
A
And,
for
example,
we
also
can
call
jenkins
as
a
storage,
because
it
also
acts
as
the
storage
for
the
system,
especially
now
until
we
have
pluggable
storage
in
place-
and
you
can
continue
so
I'm
not
sure
whether
we
are
ready
to
do
a
deep
dive
into
that
now.
But
I
think
that
maybe
we
should
start
working
on
that
and
updating
our
glossary
right
now,
yeah,
you
did
some
other
page
updates
and
the
documentation.
So
you
have
terms
and
definitions
now
and
here
are
terms
which
are
officially
embraced.
C
A
A
A
A
A
C
A
A
B
C
A
A
A
E
C
E
A
A
Yeah
and
yeah
it's
good
that
we
actually
started
that
several
months
ago
I
mean
revived
the
effort
because
when
the
things
started
with
this
had
something
to
say
including
examples
of
action
et
cetera-
and
it
really
helps
right
now,
because
I'm
not
sure
how
many
mentions
you
see
in
twitter
and
other
channels,
but
yeah,
there
is
quite
a
lot
so
and
yeah
for
us.
It's
helpful
that
we
actually
work
on
that
and
we
started
working
on
that
ago.
A
D
A
Yeah,
there
is
still
a
lot
of
technical
things
to
do,
but
yeah.
I
think
that
just
during
the
documentation
or
is
a
great
first
step
for
us,
because
we
still
have
some
items
there
and
after
that
they
will.
We
can
think
about
api
and
other
things.
So
it's
going
to
be
quite
challenging,
but
I
think
that
we
should
move
forward
there
as
well,
especially.
D
D
E
Already
gone
back
through
all
archived
blog
posts
and
removed
terminology
this
past
weekend,
so
that
was
that
was
already
done,
and
I'd
like
to
thank
everybody
in
the
community
for,
for
you
know
stepping
up
to
do
this.
It's
is
what
it
is.
I
wish
we
didn't
have
to
do
this
more,
not
the
wording,
but
I
wish
the
wording
never
existed.
So
I
just
want
to
thank
everybody.
A
A
A
G
Yeah,
so
just
from
my
point
of
view,
I
I
agree
that
we
should
change
the
terms.
I
am
a
little
curious
about
specifically
the
scope
of
what
we
wanted
to
change.
I
think
with
master
and
slave.
We
kind
of
all
were
on
the
same
page
about
specifically
like
what
we're
talking
about.
I
think
this
for
wireless
blacklist.
There
are
a
lot
of
different
things
that
maybe
we're
referring
to.
I
just
wasn't
sure
if
we
had
any
in
specific,
like
specifically
that
we
wanted
to
talk
about
or
change.
G
B
G
G
In
the
code
it's
used
heavily
as
part
of
api
methods,
annotations,
etc
in
ways
that
would
affect
backwards
compatibility
very
significantly.
If
we
tried
to
change
it,
I
think
that
problem
that
the
proposed
terms,
at
least
I
don't
think
I
would
use
either
of
them
to
describe
script
security.
I
would
probably
just
not
talk
about
the
list
at
all.
B
Yeah,
I
think
I
think
I
think
what
you're
saying
is
context
matters
and
for
what
is
being
used
as
a
replacement.
So
I
I
agree
we
should.
We
should
have
some
recommendations
of
you
know
if
it's
this
context
and
we're
not
going
to
get
all
of
the
context,
because
there
are
over
1500
plugins,
so
someone's
going
to
use
it
differently
than
than
how
we're
you
know
thinking.
G
Yeah
yeah,
I
guess
yeah,
it's
like
so
to
me.
I
feel
like
a
vote
here,
is
not
so
much
on
what
terminology
terminology
to
use
as
it
is
with,
like
jenkins
master,
where
I
think
it's
like.
We
probably
want
consensus.
I
think
the
white
list
blacklist
terminology
is
going
to
be
pretty
plug
and
specific.
So
maybe
the
vote
is
more
of
like.
Can
we
all
agree
that
we're
going
to
consider
this
term
deprecated
as
of
x
y
z,.
B
B
B
B
So
I
understand
there
are
significant
technical
things
we
have
to
take
into
account
with
changing
code.
Significant
I
mean
we
have
like.
There
are
classes
that
are
named
slave.
There
are
classes
in
the
name.
You
know
things
like
that,
so
there
are
huge
technical
things
we
have
to
overcome,
but
we
need
to.
E
E
A
A
Yeah
speaking
of
one
thing
which
we
will
need
to
think
about
is
really
heats
and
plugin
ids,
because
it's
more
visible
than
a
lot
of
api
example,
sage
agents,
we
renamed
this
plugin,
but
well,
there
is
no
magic
here.
It's
this
slave
say
in
terms
of
id
and
changing
that
I
would
say
it's
a
significant
exercise.
A
I
believe
that
technically
it's
possible,
it
will
require
a
lot
of
architectural
changes
and
how
we
manage
plugins,
I'm
changing
called
plugin
management
tools
to
support
the
aliases
or
whatever,
but
yeah.
I
think
we
also
need
to
invest
time
on
that,
because
otherwise
it
will
stay
everywhere
in
the
front
of
users
and
yeah.
That's
a
big.
E
In
the
kubernetes
community,
one
of
the
things
we've
done-
we
started
a
working
group
that,
because
we
have
the
same
problem
in
the
kubernetes
code
base,
so
we're
going
through
and
we're
addressing
that.
But
we
have
a
working
group.
That's
now
started
to
form
to
not
only
address
current
state
but
future
state.