Jenkins Governance Meetings, 8 Sep 2021

Previous Meeting Next Meeting

⏯

youtube image

►

From YouTube: Jenkins Governance Meeting, Sep 8, 2021

Description

Jenkins governance meeting September 8, 2021 with topics including the intentional two week delay of Jenkins 2.303.2, the skip of Jenkins 2.310, plugin hosting process status report, and a detailed discussion and approval of the upcoming elections

A

um Welcome to the jenkins governance meeting we're recording today it is the 8th of september 2021. We abide by the jenkins code of conduct. Let's share that screen and take a look at the proposed agenda. Here's the agenda proposal, any things that need to be added to the agenda before we begin working through the agenda.

B

There was one thing I left on the notes in the last meeting. Sorry am I muted, it says zoom says immediate. um I said I postponed talking about commercial support lists. uh I think we can postpone talking about it again, but we can put it in the bottom list and see what happens. Okay, great.

A

Good, okay thanks and I added something since I needed the initial draft olek had suggested. He was wondering if we might consider moving the meeting one hour later, to make it easier for him to attend.

A

uh For me, it's gonna.

C

Be very late one hour later: okay, so.

B

C

B

Okay, good, I think julie, said the same thing last time he asked.

A

But I don't he's not here to say anything, okay, so topic for discussion, we'll discuss it when we get there. I think it sounds like the answer. Is that's not a great time for others?

A

Okay, any other topics we need to add.

A

Nope, okay, so news news. The jenkins project confluence instance, was attacked, we've blogged about it. We blocked the releases we reset user passwords investigation is continuing, but releases are now allowed. Although tim jacomb reports that the continuous delivery releases through jeff 229 are not yet working so needs more investigation.

C

Something to add here in the current state conference will not be back, so we we failed to maintain it correctly in the past, and I don't want to to bring that service back, so I'm currently investigating um options, because that instance did contain valuable information.

C

Most I mean we already migrated a lot of information to the to the plug-in, so the key repositories but um conference. You contain a lot of information.

C

Sorry, we only partially did it. We only partially did it true. um So in.

B

C

B

What I was where I was talking with mark in the earlier chats about this is: I was thinking we could spit it out on a on a private vm somewhere that doesn't have internet access and then just run it through the exact same code that we do the migration thing with. So it does all the trimming of the other stuff. We don't care about, dump a bunch of uh ascii doc files and then commit it to git repo that handles the plug-in side, the non-plug-in side.

B

We could do pretty much the same thing, but we just have to make sure we don't release anything, that's secure! That was locked down for security reasons, but that was my thing.

C

So um so first, I already copied uh the machine on a different machine. So it's already. We already have a backup both for the database and for the machine, so I'm currently working on that temporary machine, which I would like to do as soon as possible. I tried two other options. In my case, I explore dumping exporting everything to html files, so I have them on my machine at the moment. The only thing is the the rendering is not as nice as um on conference. That's the first thing and second thing: the url change.

C

So, for example, if you go to conference, you will not see a dot, html and stuff like that, and for some reason, when you dump, when you export everything to html, it also introduce some random number in url. So that's one of the option. Another option that I'm currently um looking at to see how feasible it is would be to just deploy um to use conference clouds, because the reason why we can't use jira clouds is because of the limiter who has access to it.

C

But in this case we could just consider that maybe five or ten people have right access to commissions clouds. I already have a license for it, um because I did some experimentation with atlassian clouds um within the year, so that would be another option. I I don't I'm against that option. I.

B

Minus one on there, I do not think we should deploy confidence again.

B

It was a pain to maintain his pain to keep spam out. I don't think we want to ever. Have it running again.

C

I'm just saying conference club: we don't that's a sense option, we don't we don't maintain it. I.

B

Don't but I don't, I think we already have enough pieces, we don't need more pieces.

C

Yeah true, my my my plan was just to have a read on the conference cloud.

B

um But yeah you're more than welcome to handle any of this off you to want to me because I I it is interesting to me. So I I don't mind doing it. If you have other things to do.

C

Okay, I can, I can give you access to the machine, then add the rsshk there and we can see them together after this call.

A

Excellent, thank you. Okay, so olivier and gavin we'll work together on alternatives, for what do we do to get that to not lose the data, that's in the confluence server without ever bringing back a consulate server great. Thank you.

A

All right next topic was that jenkins 2.303.2. The next lts is has been delayed by two weeks agreed with the security officer, the release officer and others, and it will include security fixes.

A

So the extra two weeks will give us some time to assure that they're in there etc.

A

And then 2.310 has been skipped due to the confluence outage or the conflicts instance issue, and I'm assuming jenkins 2.311. Next week, though, we may have it this week, depending on.

C

So on that topic, we still have access to the container um that generated the file for the version to the three one zero. So we may manually finish the release or we can just trigger a new weekly release. I think those are fine to me. Okay,.

A

C

Of our objections.

A

At the board level, gavin from you or from evelina, if we were to call the 2.310 weekly release a loss and just say we're not going to do it is that okay uh you're going to.

B

Yeah, no, no objection from me.

C

So so, just for the context I already finished manually releases on the past I mean I maybe I did once or two they were so yeah, I'm pretty confident to finish it as long as you keep the content.

B

Already, I I don't think it matters, I mean the version numbers. Never at one point they were like you could say this is 52 weeks ago, but really honestly, the version numbers are not absolute enough for us to ever make that distinction. So it doesn't matter if we want to burn three ten, that's fine three eleven either way.

A

Great, so you've got the flexibility old ava to make the call burn it or don't burn it. Either is fine. Okay,.

C

A

Great. Thank you uh next topic. I I put this on gavin. Did you want to share hosting status? How it's going do we need to enlist additional help, etc?.

B

uh It wouldn't hurt to have more people. It's not really that big a deal. I haven't really done it in a week because of the confidence issue I haven't touched anything to do with releases, but generally it looks like there's not a lot of requests to come in.

B

I have like six I haven't dealt with yet uh tim is helping with. Actually, I think tim and mark are helping with the actual uh rpu uh repository, which is probably the bigger, more complex one. um The actual initial hosting requests are pretty simple, uh there's one so far, there's one plugin I kind of want to just say no to, and I don't know why I shouldn't, but I kind of just keep putting it off.

B

uh Essentially, this user wants to add a java applet and a new tcp port to jenkins as a plugin, and I kind of just want to say. I don't think this is a good, safe thing for the community. You could have it for your own. Personal use, that's fine, but I think I want to deny it from so.

B

And then daniel did reach out and say there are some tooling he can run for scans, so he may or may not start doing that. I don't know I'm not totally worried about I'm just gonna, you know keep plugging away, try to do my best where I can.

B

I would like to move it all into, like I said in the mailing list, eventually, I'd like to see hosting and github access all that as pull requests, so we have that all managed we have recorded. We have a history because, right now we have no idea who has access to what reposts.

B

uh No, it's tracking, uh it's actually artifactory access, not github access.

A

Right, it's no github um yeah right.

A

And it's it's really hosting partially right, so it's tracking, it's tracking one piece of a hosting request, because the hosting request is more than just artifactory access. It's also github access. It comes in.

B

As a jira request, then it does a bunch of checking, then uh it when it gets approved it forks. The repo creates the rpu request, it's just a lot of moving parts, and I want to reduce that and I you know for that's one side I want to reduce and then the other side is. I know we've had trouble when someone says I want to take over this thing and we're like okay.

B

uh Well, you have to do this step in this step and this person has to do this one, and this person has to do this one and it gets really complicated and I kind of just want to make it all pull requests so that one person can improve it and all done.

B

But I don't see that happening intensive, it's just one of the things I love to do.

A

I, like it, okay, great anything else that you wanted to share there gavin in terms of hosting nope.

B

uh I guess I'll start approving them again now that we're not fully green lit, but we're greenish right. We're no.

A

Longer we're not no longer hard red yeah like a weird yellowy vomit green thing. Oh, oh thank you. That was a lovely image. My day has just started: you're welcome elections. Let's go to something more positive, olivier.

C

So um I hope that you that you read my math suggestion, so the idea is to use this course as a place to submit um nomination and also to record people. I mean tourists are people who are interested to participate to the election.

C

Explain everything in the proposal here so that that's basically the main domain change that would happen compared to last year, so no good form or no other option. So that's yeah, that's something that I would like to improve. I did not receive feedback um except gavin and oleg, so I guess people are fine with that proposal.

C

So what I would like to do for the next step, my plan, my initial plan, was to start promoting the new election uh starting by for tomorrow, but I think I would need some time to write a blog post um so yeah. If, if people are fine with the the the timeline, I will maybe just delay everything for by one week uh or maybe several days.

C

So yeah, so the most important thing is: we have enough time to collect, nomination and to integrate um and to register.

A

uh Participants, so so olivier one thing that wasn't immediately clear to me is sending a message to the group election committee. So I can see the group here. How do I send a message to the group? Is there some action I do here on so that's interesting. Can you.

C

Go up so I guess there is a permission that I have a request here, not normally. So let me double check normally, that's something that I tested with tim yen, but I guess he uh sent me access so.

A

C

So if I, in order to.

A

In order to subscribe to vote, I will no normally yeah. Normally, if you are on the ground.

C

A

Here and I would click this button- the request yeah.

C

But next next to that button you should see a message, but I can fix the permission for tomorrow.

A

Okay, so so I will go there, I will click here and here there will be a button that says, send a message to this group.

C

So if, if you go to the group, um voters, selection, voters, I think that's the name, okay election voters, which is here all right. um I know that's the same, because I disabled the ability for people to notify members of this group so yeah. This is a permission issue that we can fix tomorrow. Mark.

B

Can you write a reply on that thread on which thread on the previous one just says the the one that this thread that one I just write a like a comment saying. uh I want to try to message this group and I don't have permission that way. If anyone else has the same problem, they can see it and reminds of the vri to fix it later.

A

Like it was election committee group right, he group, but there was no button to send the message. There was a button.

A

To request to join, but not to send a message, so is that what you're suggesting gavin, yeah mardus yeah, great okay, excellent.

A

B

I read: go ahead on the blog announcement idea and earlier the news I made it a lot easier on jenkins io to turn on commenting. um I was just thinking you know this reminded me. So essentially you can just uh say discourse true, and it will enable commenting. You don't have to create a topic and link it in everything else with that before which I think mark- and I looked at it- looks pretty good.

A

Yeah and I was I was thoroughly impressed, the the the change means I can reference discourse and it will create a thread automatically if there isn't one. So the the the example is here on this most recent blog post. When we look at the bottom of it discuss one reply, there's a reply: I'm gonna go check yeah. I think it said. I think the reply is just me making it listed well, except now. There's no control here that lets me click it. So we may have some more work to do.

A

I can't get there um yeah.

B

I'll take a look I'll, take a look.

C

Right there yeah, why can you just quickly check the election committee group sure.

A

C

Oh yes, there it is, and so now you can send a message so.

A

Now I could, I could send a nomination by typing it here. I.

C

A

As such and such great okay, that that's nice and easy super.

C

And while you're here, maybe you can show how to join the election photo.

A

Group, oh yes, I can do that, certainly so election voter group here, um so I'm currently in it. So I'm going to leave first and now the way you join it is you click here.

A

It appears and you click the join button in the top right hand corner and now I'm a.

C

Member, yes, and so what I will do at the end of the month. um I will just export the email address for every people in this group and then we'll use a tool, the same tool that we used last year and two years ago, which is a condorcet voting system and so invitation will be sent from that application.

A

So and ballots then, are likely sent in sent through condorcet in october, or is that in are you? I guess.

C

A

Us the timeline in the blog post.

C

Yeah, so my my proposition was to wait. One month of people could take one month to nominate officer or board members and during that timeline. During the same time, people would also register um to devote to the voter group, and then we would take one week to review the nomination and contact the different nominees to to double check with them. If they are interested or not, and after one week we would send, and so we will close the group on the voters, nobody will be able to join and then we would.

C

We will invite every members of the group um to participate in direction.

A

And, and during the nomination phase I will nomin the names of nominees be visible or you'll just accept. If you get the same nomination multiple times for a person, we can accept.

C

um Like with like we did last year, we can accept multiple nominations. We just look at the end of the month. How who were the nominees? We double check that with them, um because we don't want to embarrass them or whatever.

A

And right, okay, so so the nominees names won't be public. The just then just the committee will know about the nominees until you've had a chance to qualify them to see. Are they are they interested and willing.

C

And uh yeah, and the reason why the group of reviewer addiction committee group is small is because we only have person there who are not interested to renew. I will not participate to the election um so, for example, kevin has a mandate for one one more year.

C

I think evening as well. So that's why they are in the group.

A

Great all right any other any other questions or concerns with regard to elections.

C

Okay, so then, I guess the next step for me is to write a blog, post and open appear on jenkins at your website and once once that the blog post is ready. We officially, we officially started the election period, yeah.

A

I wanted to just be sure I get a record for sure of approval, so gavin you're, okay with it. Yes, uh evelina, you're, okay with it.

C

A

I had a trouble.

C

With finding the unmute button, I'm okay with it. Yes,.

A

All right excellent and it's your proposal, but I think we should record your plus one olivia you're, okay, with it yep excellent. Thank you, okay, great okay, so proposal of the move meeting one hour later, I think this one needs to wait until oleg's available and we we have a discussion. We can certainly discuss it. Another time.

C

I would be interested to do it at another time, yeah and even another day.

A

Oh okay, uh gavin commercial support list. Is there anything you want to do there? You want to discuss there.

B

I want it, I just haven't pushed it uh so essentially, I'm I really want, like you know, as someone who does a lot of support, I want to make sure that we have the companies that are offering commercial support an easy way to offer for users to find an easy way to find which one they want to pick. I just don't have a good solution for it. um Maybe we just do a page on jenkins, io and people manage it by pull requests. I don't know.

C

I think that um the page on thinking that you're managed by pull right quest is the best one.

B

My only concern is uh every new company will try to put themselves at the top.

C

As long as as all right.

B

A

B

Do it, I can just see that you know there's fights like I want to be higher than you.

A

Right- and we have- we actually have that that exact condition already is a worry in this page right here, where right, there's a there's, an implied ordering here that that probably shouldn't be implied, but I don't know how to do a non-ordered page right unless.

B

We randomize it, let's, maybe that we want a solution, is make it a like make it uh metadata like what is it yeah we're yaml files right or whatever, so we have metadata and then we just javascript render it and say it randomizes. Each time.

A

I like that, that's actually a very creative solution, so so, but I think you've got a valid point. If we don't have something like that, there's a something implied by ordering in and that we may not intend to imply- and we also have to define a.

C

Rule about when we can remove a name yeah, because otherwise it's too easy to just put your company name there and have I mean, can be listed for years. So this is something that we should review. I don't know once a year.

B

Yeah, like I said this is something I really want. I just it's a bigger problem than just being like yeah. Can I get approval to.

A

Do it right right so is: is this a case for a jenkins enhancement proposal? Is this really outside of the realm of that kind of thing?.

C

I think I would be interested to to to see if there are companies who rebounded.

C

And really want to be listed there, so maybe.

B

We can just maybe we.

C

Can just invite them to.

B

A discussion yeah but say I should return to the existing link that was on the wiki, assuming we can get that list again um and then reach out to them and see if they want to be listed still and if they do then proceed to find out what would be useful for them right.

A

Okay, yeah, because because there certainly are companies at least I think there are companies still that that are doing this all over the world. It's not not just one company kind of thing, so yeah good. There.

B

Was only a dozen on on the wiki page, it just was well, it was four years out of date because no one could update it.

B

You can drop the word for postpone because we started talking about it. Yes, very good, okay, so I guess that's an action for me to see if I can get around to reaching out. Although.

A

It's not a high priority for me right and, and certainly understood, and I think reaching out to others is much more value than in jenkins enhancement proposal. I'm going to just delete that because I think.

B

You've got yeah I'll reach out and get some notes, and then we can I'll put it on the on the community on the community page and see what we get to, because I did start a topic about this. So.

A

Right, excellent, all right, any other topics we should be discussing today.

A

That sounds good.

A

Okay, thanks everybody, I'm going to go ahead and stop the recording.