Jenkins Governance Meetings, 22 Aug 2022

Previous Meeting Next Meeting

⏯

youtube image

►

From YouTube: Jenkins Governance Meeting August 22, 2022

Description

Jenkins governance meeting August 22, 2022

A

Welcome everyone: this is jenkins governance meeting, it's the 22nd of august 2022, thanks for being here, topics I see on the agenda today include news action items, upcoming elections, cdf topics, jenkins.io website revert and forums and community topics. Any other topics we need to put on the agenda.

B

Nope, oh okay, great go ahead. There was a whole discussion on the blue ocean. Pr do we want to talk about that in that anymore? I don't know if that's a governance thing.

A

Yeah, I think well, I think it's worth discussing. We've got the right people here, because kevin's here you're here, I'm here at minimum three people who are very involved in that poll requester here so yeah, let's blue ocean disclaimer, uh current status and I've got some information from the past thing. So, let's carry that forward. I should have copied it in already. Here we go and maybe what we call it is admonition. So we use the same word every time.

C

A

Any other topics that need to be added to the agenda.

B

A

Okay, all right so news. uh The jenkins.

A

2.2.361.1 release is scheduled for september 7 2022. It will require java, 11 or java 17.. No more java, 8 support.

A

Thanks to chris stern for volunteering, as the release lead, the release checklist is open, feel free to help out, as this is chris's first opportunity as a release lead. So if you see something that looks a little funny coach and encourage and help uh grateful to alex brandes for his ongoing encouragement and for tim jacom we'll do a cdf blog post, in addition to a jenkins blog post and the upgrade guide and the change log thanks to kevin martins and to basel for their work on the upgrade guide, the changelog, etc.

A

Any questions or topics on that item.

A

Okay, next then action items- and here I have to acknowledge- we've made some progress on the linux foundation. Funds transfer, but it's not yet available in the final mode on the site the crowdfunding site should increase by about.

A

I believe it was about another one thousand five hundred dollars or one thousand six hundred dollars after the linux foundation has transferred the funds into our account that were given to us by google summer of code 2021, so that we should expect to see further funds arrive there uh and next action item was jenkins: doc's sig mailing list. I've made no progress and it'll likely be several weeks before I make progress on that contributor summit blog pass post, no progress, but I've made progress on other blog posts and the cdf zoom account this one.

A

I think gavin you had the right approach. Gavin suggested forwarding the or including a private google group.

A

In the in the the cdf mailing list right, so that they would get all the notices of the the token when it's updated.

B

Yeah I mean the other option is just to add each person individually to the zf maleness, but I don't know how hard it is to do because I've never seen or heard of this mammalist until this week. Right.

A

And that's that's a michelle mark. No.

A

uh She's, a cdf person is the ultimately the one to decide and I think she'll pick the hey, let's add one list and then let people subscribe and unsubscribe from that list.

A

So I'll I'll see, if I can't push that forward with michelle, I think that's a good idea, gavin! Let's just do it.

A

Anything else on the cdf zoom account question.

A

Hi, oleg all right so next topic- and I believe this was added by gavin- was upcoming elections.

B

Yeah um just was thinking about it. um I we do the elections every december-ish november, um which is coming out pretty fast. um I believe, specifically, the board members who are up for election do not and get involved in the election. So that's me and evelina this year, so someone else has to be involved and I figure the discussion is happening sooner than later. So it's not a surprise is a good plan, but.

A

Yeah good suggestion, so we've usually relied on the infrastructure officer. In that case, that would be damian duporto. But I don't know that he's aware that he's he's that that usual.

D

Person there are two parts: firstly is infrastructure part I mean this voting thing etc, which can be duplicated from this course. If we stick to the process from the previous year and to be honest, this, what I would advocate for to stick to the process at least once uh and yeah then also the result: the logistics part like announcements, waiting candidates, etc. It's usually a governing board member doing it.

B

Well, I mean last year: olivia did everything so.

A

Well, so is this one where we ought to put it on? I could probably be the one who takes on that announcement and betting candidates, thing uh coordinate it with damian and if he needs to do the whole thing or if I get overloaded.

D

Maybe this is for the entire world, ah okay at least how it's written in the governance document, okay, uh yeah, so announcements etc. Whatever works, I can also participate in these things if some help needed, but yeah I still cannot commit on my bandwidth, I mean I will be definitely be able to send emails, etc, because everything can be reused from previous years, but.

A

Good so in terms of a timeline, oh like the the timeline, then would be usually it's a september uh begin gathering, candidates or gather candidates, um october and, and that means announce and gather candidates and then october, finalized candidates and november. Do the voting.

D

Yes, something like that within.

A

The new officers, new new officers, uh effective early december.

D

Yes, new officers and both members.

A

Oh all, right, sorry, new yeah! Thank you new board members and officers yeah very good. Okay,.

D

Yeah, so we could probably shrink the timeline a bit uh yeah from what I've seen having a long elimination period haven't been very successful in the past als.

D

So we would still need uh to confirm uh eliminations with candidates to get their statements so for that one or two weeks would be a must, but I think that even if we started uh on october 1st, we could have completed this process.

D

Okay meetings touched earlier too.

A

Sorry gavin did you have some comment: nope, oh okay, all right! So how about? Let's put the mark to bring the topic to the jenkins in from eating tomorrow,.

A

With the infra team- or maybe maybe it's better to do an online discussion rather than put it in the meeting so.

A

um So we we get the topic out there saying hey here's, what we think we want to do, let's propose a plan and.

A

So I'm oh, like I'm with you on the let's use, let's use discourse as the voting location again, gavin. Any reason that you have why we would not want to use the same voting technique we used last year.

B

I don't think we use discourse for voting. I think we did this course for the senate.

A

Oh, oh right, I'm sorry you're right right. It was what we did is we used discourse to register to vote and then we we used the the system from cornell to do a today. Do the actual voting.

B

No objections to me, though I don't know if this is well yeah. No, I think the the registrations part worked well. I don't think um how we were organizing the list of candidates inside of discourse as well, but that's something whoever manages it can decide how to organize it. I think user facing it should still be the same process as last year. Okay,.

A

And then voting through the through condorcet.

A

A

Voting system system at cornell university, and they were they- they had to actually do some emergency recovery work for us last year and seemed to do it all right.

A

Very good anything else on the on the upcoming elections.

B

No, but if they want to host outside of the university, I can probably help arrange it. Oh okay, good all right, it's not necessarily part of the election, but just because I think I can.

A

And the professor that that runs the server interacted with us very positively through that so gavin may be able to host, may have resource access to resources.

A

A

Excellent: okay, anything else on upcoming elections.

A

Okay, next topic was cdf topics. Oh, like anything that you want to share there.

D

uh Well, uh one thing: if you're curious, uh there is a summary update on cdf2c activities in the pc channel on the cdf slot, so a few items from there that might be of an interest uh so yeah. I continue on stc chair for another year after the elections in the twc, um but yeah. As I said, it will be my last term, so I have strong opinion that I shouldn't overstay more than two terms so yeah, so by august 2023.

D

I will step down one way or another from this post and I will be organized in handover.

D

uh So one impact on jenkins that currently I represent kinda represent jenkins in the ecd of governing board, and I keep pushing for topics like project infrastructure. Sorry for the outcome is not visible because there is no outcome but be sure I push it every time and the next meeting is on thursday uh but yeah, so I will be bringing up this topic there.

D

A

Yeah knife: oh: go ahead.

D

Yeah, sorry, uh no just go ahead because then there would be other topics.

A

So I've I've reached out with first pope to the cloudbee's representative on the board. I just got back from vacation, so I'll check again to see if I've actually got an answer in my email.

D

Okay, so a few other updates, uh so first of all, uh a project pc was accepted to the cdf as incubating project is a distributed package delivery network.

D

um In my opinion, it doesn't really impact anything for jenkins, including potentially upcoming changes in artifactory plugin. Introducing this support tool. I already talked to jfrog that it should be rather a separate plugin.

D

You know the story about artifactory plugin um yeah, also for pluggable artifact storage, et cetera. It might be some follow-ups.

D

Another update there is a new project started cdf reference architecture, so this project was presented at the toc meeting at the best practices meetings.

D

I can share a link to the slide deck but uh ultimately is attempt to provide a reference architecture for whomever deploys application delivery flows, including cio cd and in theory. This reference architecture should somehow find balance between all cdf member projects and other projects in the ecosystem.

D

I have no idea how it would particularly happen. Of course we do have some interest. That jenkins is listed there. The recommended solution, let's see for ci, I'm not 100 sure about cd but uh needs uh to be determined. I will share the link.

D

So if someone is interested in these high level uh recommendations and white papers, this is a project here you might join, but yeah, I'm not sure how much.

D

It would be for the community uh so a few other updates, so the project called directive we will likely apply for the cdf membership.

D

So directive is a cloud native pipeline engine that is based on cloud events for receiving and sending events, but otherwise it's let's say cloud native pipeline engine that is super flexible in theory and they actually want to introduce it in the cdf.

A

So, oh, like did I get the the name of that project correctly: interactive uh directive.

D

A

Exactly well, thank you.

D

Okay, so like well uh you're all uh no, it's like these because it's kubernetes, so everything can be uh but yeah. Otherwise, it's like that um yeah. So this might have some overlap with jenkins. Well, I uh said many times that the junk this pipeline engine should be pluggable. um It's probably another use case. uh Well, another implementation possibility, along with tecton, which is already a part of the cdf but yeah. Ultimately, cdf is getting more pipeline engines.

D

There are also some discussions about other things, for example, about dagger potential interoperability, etc, etc. So yeah most likely this topic will keep appearing.

D

Obviously it doesn't seem that we have any community bandwidth to make the pipeline engine uh pluggable. At the moment. I'm not sure whether we have much of demand for that. um Don't kill the messenger.

A

Right right, so jenkins, pluggable pipeline engine is not actively developed.

D

Yeah I looked into that several years ago, when I was working on a multi-tenant jenkins, even.

D

Easily, not unguarded. Our main problem is that basically jenkins pipeline has completely separate implementation of the engine and not integrated in the jenkins core, so long story short, it will require some major league hiking um yeah.

D

What else about cdf? Basically nothing. I would say um so one thing to keep in mind that now we have a treasurer uh david lye, so david could potentially help us with all the stories like jesus funding, etc. Once he does the takeover.

D

Actually, I'm not sure whether our money landed in lfx crowdfunding, but if so, it's good.

A

Yeah and when I checked earlier just a few minutes ago, the funny had the funds had not yet arrived. I was glad to see tara, cara de la marc and alyssa, both saying that there was progress, but finally funds, I don't think, have yet arrived.

D

Yeah it will require some additional pump plumbing, okay.

D

So that's it for me all.

A

Right thanks any questions to oleg on cdf topics.

A

Okay, next topic, then, was the blue ocean admonition current stuff. My fingers blue ocean admonition, current status.

A

So we've added a statement of the current state of blue ocean to a number of different pages. We had several additions. We had one asking basel to add the administration to the plug-in documentation. I think that's done right. Basil, I've seen it and I've seen.

C

Website, as well as the readme on github, when you find the repository great.

A

All right so then we had one more, which was add the admonition to the docker hub entry for the blue ocean container, and that one is the, I think, the most the most needed, because that container gets much less attention than any other than any of the officially maintained containers.

A

Unfortunately, that one I've not done yet- and I don't think anyone else has- has made any progress on it.

B

um I've been meaning to bring up with the excuse me the platform team.

B

um There is an issue with that, one specifically and then in docker in general, where people are installing plug-ins expecting it to take effect the next time they launched a new image and it doesn't because plugins are installed to the ref directory and not the actual plugin directory and jenkins on startup doesn't override your plugins directory with anything in ref. It only only copies new files over or sorry non-non-existent files.

B

So there's been a couple like that's. What really was the big issue with the blue ocean upgrade and all the issues in the farm and people were like. I downloaded the new image and it still broke you're like yep that'll that'll happen.

A

Okay, so uh that's further motivation, then to get people off the now is the is.

B

The standard container.

A

B

Different well, the center container doesn't contain plug-ins or very few. They all get installed on startup and that's it. um The problem is that it's a it's a limitation with the design and not the block blue ocean plug-in or the blue ocean image. Specifically right. So there's been a couple other people who have posted things like I've. I been creating a docker image with these plugins in the past, but they don't update.

B

When I update the plugin you're like yeah, you got to delete your plugins directory and let it copy the new files over again on top of them, because jenkins home is outside of the document here.

A

B

Okay, so I don't know what the right solution to this is, um but it is related to this and something that we should think about further.

A

Yeah, so it may need changes in the official jenkins container as.

B

Well, it may need changes in core because I think copying ref to jenga's home is a core thing and I don't know if okay.

C

Would we would we prioritize that.

C

Because I don't see a strong, I don't know what the original motivation was to have a separate blue ocean image, but.

B

I think the image was in the.

C

Documentation to if that motivation was to increase adoption, I think it's already served its purpose. Yeah.

B

No, I'm pretty sure the container was just to be like hey one. One command will get you certain.

A

Right um and and we dropped its use in documentation, 12 or 18 months ago, so there's there's, there's not really a compelling reason to to do anything except deprecate. The blue ocean container, but I think what gavin was describing may also be an issue in the actual controller container that we officially support as well like.

B

Like for me, I actually own this container with all the plugins pre-installed so that I can roll back if I need to, but I specifically have helm, delete because there's a flag in the helm, container or helm config that deletes the plug-in directory on startup right. So that's how I get around it, but it's a really ugly hack and people who are not using helm like using openshift or just using docker by themselves. Don't have that option.

C

I think that would be, I think, I've run into this issue in the past as well, and I've done the same exact work around by deleting the plugin directory on startup.

C

um So I don't know if there's a ticket file for that already, but that might be a good ticket to uh to have in the either in the docker packaging, um butt tracker or the core buck tracker, because I I think I'm familiar with this problem. I remember having to delete that directory before yeah.

B

I have not brought it up specifically, so I don't know if there's a ticket, but it's been on my list for a while too, and this discussion with blue ocean reminded me that I should bring it up.

C

B

Bluish and specifically.

C

You know we could. uh We could just print a warning saying that this image is deprecated and then sleep for two minutes right. That's.

B

C

Right that would that would wake people up if they haven't, if they haven't.

B

Noticed I doubt it honestly, I think, especially with kubernetes you just hit deploy. You wait till it's about and you're good to go. You don't really wait. You don't go. Oh it's two minutes slower today than it was yesterday.

A

Yeah, but but finding a way, I I think we do need to find a way to communicate to users that they're running a deprecated container yeah. I don't know what that method is, but I think we owe it to them. It might be an administrative monitor that says. Look your container name is something we think you should not be using anymore.

B

Even if it's something like you write a file to the disk, the minute, the mid, monitor, checks that file and it was cool, you're running an image. That's based on one that we don't support.

C

B

Could be done as.

C

Well, wouldn't be pretty, but it would get the message across. That's what mattered.

B

Yeah and it would catch anyone who's, extending blue ocean where you, if you're looking at the image, you wouldn't catch that so but that's a platform's sake thing, not a governance thing.

A

Yes right so topic for platform sake: okay,.

B

I'm very good at volunteering, other people.

A

Understanding scope anything else on blue ocean admonition, current status.

A

Okay, next topic, then, was we had a jenkins dot. Io uh website layout, look and feel improvement poll request that came in from a new contributor.

A

After three or four of us had reviewed it, we decided hey, let's merge it. Then we detected several cases where oh it'd regress something decided. Let's, let's revert it so we've reverted now we're hoping that that contributor will continue he's expressed interest in bringing the change in as a series of smaller pull requests. I haven't seen any of those smaller poll requests, yet I'm hoping that the contributors is busy with the university and we'll see them.

A

If not, the concepts are there and others could pick up and try those small improvements, one step at a time.

B

Did something recently change with rss feed.

A

Oh, I don't, I don't know because.

B

I just got noticed: maybe they got published, but I just got a notice yesterday I have um rss thing for the jenkins thing and essentially I got one two three, four, five, six notifications and new posts yesterday for a week or two worth of blog posts. So I'm wondering if we accidentally broke something and fixed it or it's just been my script, maybe or something I don't know.

E

Yeah I'd, so I fixed the bug in the rss feed that had the wrong url so that if your rss reader uses the canonical url, that defeat provides, that might be a cause. It might be. Oh yeah, it's not my script, I don't know so. I think the individual entry urls didn't change, but the canonical url of the entire thing changed, because it was still pointing to a coursekit.org test site that hasn't existed in a decade and if some sort of idea is computed using that it's it's understandable, nice.

B

Also welcome daniel yeah thanks daniel.

E

A

Okay, anything else on the jenkins.io website revert before we continue to next topic.

E

So I have a question about the review criteria for some projects in the for some parts of the project.

E

It seems to me that for certain kinds of contributions.

E

Reviewers would approve the contribution, as well as its exact opposite like if someone moves something from right to left. Thanks for the contribution, that's great someone moved something from the left to the right. Thanks for the contribution.

E

That's great, is this just a cynical.

E

Idea that I'm having or would you say, that's actually something that that you can see happening like do we actually look at the.

E

Proof, the exact opposite.

E

So in this particular case, I think the color scheme was changed from sort of a grayish thing to orange or something- and I was wondering about if a year down the line, someone showed up and said well, this looks terrible, we're switching from orange to gray. Would that be approved as well.

A

Good question: I, in terms of my ability to review those kind of style changes. I rely on others, tastes and sense and if they say they they like it, I think I'm willing to say yes, I like it as well so, but would that prevent me from switching back in the future? Probably not so. I think your your answer at least speaking specifically about mark weight.

A

I can't speak for anybody else, but for me there are definitely times when I would either approve a contribution or approve the exact opposite, because I don't worry about those two things at that level. So I think that's what you're saying right daniel is merit of a change critically enough to not reject to then reject if it were the exact opposite.

E

Right, I think, usually you can go one way going from something to better, but if you go from something to something but different, that seems like a waste of time of everyone involved right, agreed.

A

Yeah now- and in this case I don't think it was actually going back to the opposite, but I assume that your question was asking that as a thought experiment as a hey, is this indicating we need to be more careful in, in our reviews of things to jenkins jenkins.io.

E

So in this case, I think uh I can answer the question with. Yes should be more careful, because in this case the fund was changed from a very deliberate recent choice to use the platform default font and the pull request went to ariel and feedback in the pr said. We don't want ariel and then it was first removed and added back again and then merged, but I'm thinking about um more generally.

E

If I don't know if a border is made rounder in the corners and then another pull request shows up and says we don't want corners. That are quite that rounded one of the two pull requests should not be merged would be my position here and I now wonder whether we are in general prepared to provide such feedback.

C

Well, I always try to look for justification and to apply the needs justification label if there isn't one present you know so my my criteria for merge for core is not only is this not introducing your aggression?

C

That's that's, obviously a criterion, but on top of that, I'm always trying to ask myself what problem are we trying to solve and is this the desired solution for that problem? In many cases it's stated explicitly.

C

Sometimes it's only implicit- and in that case it's harder to review the change, because it's requires the reviewer to take on the burden of filling in the implicit justification in their mind, and you know sometimes that could be very easy for the reviewer, if they're very familiar with that area of the code, if they're not familiar with it and the justification is implicit, it can be very challenging and in in such cases it's a fine line, but sometimes I will avoid reviewing these types of changes and other, in other cases, I'll step in, but ask for more explicit justification, and I found that most people are willing to provide a justification if asked for it.

C

um It's it. Doesn't it's not it's not in my experience, a request. That's too too much to ask it's not like asking people to implement. You know very large amount of monotonous work or something it's just more like explain the problem you're trying to solve, but how the solution solves that problem and- and I I think, that's really the only the only uh best- the best solution to this problem um that that could really change the conversation, because sometimes you know I ask that question and there's the answer I get is.

C

Oh, I didn't realize that the problem was more complicated than what I had originally thought or oh now, that now that we phrase it that way, there's maybe multiple solutions to this problem, and this might not be the solution we choose. So just starting with the question: what problem are we trying to solve? In other words, what's the justification for this? um In my experience, that's the best answer and I would never be afraid to ask that question as a reviewer or a maintainer.

A

Good guidance, so for those of us who are on we're doing reviews of content for jenkins.io, particularly structural changes, it's a good good place to ask for justification. Good hint thanks, yeah, so daniel in this particular case. Do you think that would have would have helped us get clarity. I think here we had a large change that came in as a single change instead of a series of smaller steps and the proposal for the re redo of it is: let's do it as a series of small steps where we can evaluate each step.

E

If that makes sense for the specific changes it's been a while already, so I don't know the exact details, but sometimes you are in the situation where each by each part on its own doesn't quite make sense and you need all of the parts together for it to really make sense right.

E

um But in general I mean it's a general guideline in the project and I think elsewhere as well to have small-ish self-contained changes.

E

And if then, you know, there's one change for the color scheme and we can ask why and if the answer is well, I like orange a lot, and maybe that's not quite the justification we we want for changes of this kind.

B

I I can see this also being a case of revolution, so you know someone coming in saying this change improves my life, so we should merge it and you're like we're like yeah, but you know you haven't really interacted with anyone outside of your narrow company or person. You don't know how it affects you know. So you know, because I've been thinking about how many, how many times, how many people we've had in last few weeks join various channels saying I want to get involved with the jenkins community. I know java.

B

How can I help you and I'm, like honestly, you should be on the forums, answering questions and seeing how people use the site before you're, suggesting changes to the site to the thing, and you know this would definitely take that effect, or this would definitely help mitigate this issue where people are making changes because it affects only them and they think it's an improvement, but they don't really know how people are using it.

C

B

Got a couple: I've.

C

Got a couple of jira tickets that I could advertise to people if they're interested in working on java code.

B

Yeah I mean there's in the in the newcomers channel. There are a few people that join recently bang out I want to. I want to help out. Where can I help out and mark? And I are like here's, the darren necklace, but we don't keep uh you know I mean we could have a well that's off topic on that one, but I mean we could have a nice simple landing page for someone to be like. Where can we help out?

B

But I think the important thing is we want to make sure that people are engaged with the community as a whole and not just the one person that it helps, because that is what it's called in the problem. You know one person wants this font. One person wants this other font and back and forth, but I think there's also a lack of like community standards and I don't necessarily mean a full standard guide but, like I know we had some css issues there that in that big jenkins, I o thing that got reverted.

B

But most of us didn't know that that existed in the first place, because it's there's no test for it, which is hard to do. I mean no, no problem. um Was it uh it's it's hard to test css changes but like from an automated point of view, but like there's no comments like saying: oh, this is specifically to handle a specific bug. I remember I fixed one, which I didn't realize was a specific bug to a different one.

B

You know, so it's also very hard from a ui perspective to have that kind of long, lasting documentation, style guy and with ui changes. You kind of just gotta somewhat go for a gut instinct. Unless there's someone leading the whole thing.

E

I mean with with jenkins I o specifically, we are in the quite comfortable situation and I think it's all gavin's fault that we have the test deployments.

E

Which actually makes it pretty convenient to just have the live site and the test deployment up and and compare them and see what changed, obviously, for more subtle changes that only affect a handful of pages or very specific pages.

E

You might not encounter them, but I think the test deployments go quite a long way to to make it easy to understand the implications of something, and especially, if you don't know what a change does or why it exists, that's an important review feedback. Why is this even here?

E

I occasionally ask this in core pull requests changing the ui, because, frankly, I have no clue what the 10 level nested less does or what it's for and if usually the answer is good, and sometimes the answer is: oh right, that's the leftover from something that I can remove. So that's, I think, also important review feedback you can provide. I don't know what this is for. Why does this exist? Please put a comment. There.

C

And experienced developers and mics in my uh that I've worked with have sometimes done self reviews where they will do a review of their own code, where they explain the reasoning for every change that they've made. If that that isn't something, that's obvious from the code itself or the comments, um and you know perhaps not everyone would do that without being asked. But in my experience that helps a lot, especially when you're making a change that has a lot of subtle implications.

C

A self-review is a great place to start so.

A

B

And also I'm just thinking about, I'm always thinking about the preview environments, because I am incredibly lazy when it comes to reviewing actual code changes, as opposed to just reviewing the code itself.

B

um If we started to have standards in the in the pr template about what was changed, we could eventually have a script that actually generates screenshots too.

A

Oh, oh, I see so your idea was if, if the pr template listed the pages or the urls that are being changed, we could hey give me a screenshot of this side by side. I.

B

I think, no matter what you should include a screenshot whenever you make a ui change in any way. um Just because you want to highlight this is what I'm changing and that should take effect for core or website or anything else.

B

But that being said, I would be interested to see if we could uh set up for some new actually generate screenshots for like hey. This page is affected. Generate me a diff, you know, and there are css tools out there. That'll do that. It says. Okay, the ui layout of this page has changed. I'm going to show you a before, and after screenshot.

A

Interesting good, okay,.

A

Anything else with regard to the jenkins.io website.

B

Oh, I moved it to top level because I don't think it was jenkins. Oh.

A

Okay, good to the review criteria, topic.

A

Okay, next topic, then forums and community topics gavin.

B

Yeah, it's been quite a week of anything I wanted to really highlight. uh There were some comments on the last uh I think spring boot, rce uh post. I can't remember what the actual one was. uh Tim has closed it. I made a suggestion to close it and close it. So no one else is going to comment being like hey. What's the news on this new rc, this new alert, um but it is something that we should be aware of that people are asking about. I don't know.

B

I think, honestly, I think in this case we should probably maybe one of us should write a comment at the bottom like for new new alerts, please contact security and then close. The topic.

A

So do we do we want that thinking about? Do we want to go that direction? I guess I guess that's a I'm not sure that the security team wants to be answering requests from people. What about this, because when they, when they detect an issue like on something like that, I believe they publish the statement if we're affected right.

A

So is there a draw statement or a standard statement which would, if we're, if we're affected we'll say so?

A

No, maybe that's too too convenient.

B

A

E

Don't believe that is exactly what the site says hold on. Oh, it.

A

B

So can response here might be nice too right.

E

So do not contact the jenkins security team, asking us for compliance documents, certifications or to fill out a questionnaire. We will not respond to such queries if we consider it necessary to provide a statement in response to incidents such as log for shell or spring shell. You will find the response in our blog, which is not exactly the situation right, because we have outdated dependencies and people are worried about them, but it does not rise to the level of everyone's losing their mind over this.

E

B

Yeah, in this case, it was spring for shell, blog post, which was a good blog post, and then now people are like uh is drinking vulnerable to the new spring framework, vulnerabilities, blah blah and I'm, I guess the standard response should be if we are we'll write a post about it, but it also is like a lack of communication, doesn't mean that we're not vulnerable.

B

So it's hard to say anything, nice easy for that.

E

Yeah, it's difficult right so because we typically would not say yep. We are vulnerable and you're just out of luck for the next two weeks. uh We would just provide a fix if it's important enough, uh I'm sure what the best approach there would be.

E

We get people who basically report vulnerabilities if we will in dependencies in uh on the third mailing list and in the security jira and usually it's in the form of them dumping findings from the security scanner on us, which is quite unpleasant, um and we will typically tell them we're not affected, because we're not- and we usually already are aware of these issues um and that's about it.

E

How? How frequent is this so.

B

This has only happened once in the last two weeks. It was just a bunch of comments on the most recent spring fam framework, uh blog post.

E

A bunch of comments, so many people asked this two.

B

So not many many but uh tim, and I decided to close it a week ago, so only two got through um we're. Just like honestly, this is an old topic. It doesn't need to be rehashed. Okay,.

E

uh Gotta go be right back sorry,.

B

um And then we can come back when I know if daniel comes back. um The next thing was, I was just pointing out. There's it seems to be higher than normal number of help. Requests about jenkins api. I know mark, has dealt with a few and I've dealt with a view. I don't know what's changed. I think it just happens to be this time of year or something, but it seems odd that we're getting a bunch of them all together. Maybe a blog post went out somewhere.

A

Right and I I don't have an explanation for it- either I'm not overly surprised given random events. I assume it's, it will go quiet.

B

Again, apparently, we don't have any involvement with it. It's not in the jenkins ci uh github space, it's not published by anyone. You know so honestly, I'm just like yeah, not our kind of not our problem.

A

And and I think that's a correct statement because it's published through the the python packaging system right.

B

But it's also not in our repo, so we can't look. We don't like there's no and it's very hard to find the actual source code for it, because all the links don't really go the right places and ninety percent of the time I've I've answered with you, should use configuration as code and they go well. We can't make changes and I'm like by the way you should use configuration of the code they're like okay, I tried configuration of the code and it worked and solved this problem like yeah.

B

That's why I'm saying you should use configuration as code right yeah so, like I said, not really concerned just just kind of like one of those weird things that happened this week. um I.

C

Don't need to walk backwards because we're waiting for daniel, but I did have another thought about the spring rce. If we wanted to wait until later to talk about that.

B

C

B

And then cycle back because daniel might be back then, so I did list three more topics that didn't get a conclusion that we may want to push as the governance board. To do. I don't know anything really concrete about the the licensing and naming thing. I honestly think it's fine for us to give them uh okay to use- and you know jenkins development for intellij or whatever like that.

B

But someone should officially reply and I don't really want it to be me.

A

So so this is one where I'm not sure how it how it works, because it's this is not a company asking for a a branding and naming thing it's rather dennis.

A

As a community community contributor has this uh intellij plug-in that helps people who are doing development with stapler and stapler is a common jenkins component, mostly used in jenkins.

B

A

So the the question then was hey: what should it be renamed? It used to be called stapler framework support or is currently called stapler framework support for intellij. He was suggesting jenkins development support and I'd like gavin your suggestion to follow the linux foundation, guidelines, ideas plug-in for jenkins development seems like it's using linux foundation. Naming rules very nicely.

B

I would guess that intellij has the same issue where they want their name to be. Last, not first. Oh, oh right, my guess. You know not not saying there's a natural published thing here, but it's one of those things where both companies don't want to use their trademark as advertising, and this is not advertising. This is just making a statement, so I think we it should be fine, but because the trademark is now entirely linux foundation, I don't know who can sign off on it and or if we care.

B

Yeah it'd be an oled question.

A

Yeah, I'm I'm not. The expert, oh, like you're, smiling and I'm curious. If you've got an opinion on this one.

D

Well, for that I don't have an opinion uh except the fact that it has been so this topic has been around for more than one year. So if dangerous is interested in working on that, let's just go ahead and that's it. I believe you already reached consensus so that step clear is not a used outside jenkins and that we would like to rename it. I can uh pull the data, but I was pretty sure that we had a consensus more than one year ago, for it.

B

D

B

D

B

To reach the linux foundation to say: hey, you want to approve this or anything or just go like cool. It's not a commercial thing, we're good yeah. We are perfectly.

D

Good, I mean it's a part of the jenkins project. We are eligible to use our trademark as we wish.

B

Okay in the mark, if you want, if you're about to reply, that's good, otherwise I can try.

D

It later today.

B

Okay, I'm happy with you doing that then.

A

So governance word discussed it today and agreed that jenkins development support.

B

I I would say, as as it is, a community project jenkins development support for intellij is fine or is.

A

B

I would go with his suggestion, though, for an intellij.

A

Jenkins element for intellij, I think that's what the topic says. Okay, let me see. Okay, sorry.

B

Oh just eventually developer support is fine. Yeah, sorry, um okay,.

A

So, as noted or do you want me to open up the issue just for safety's sake, let's open the issue.

A

B

Got four minutes before I have to go so I'm.

A

Just trying to get through everything right so I'm going to go ahead and say yes to that so you're, okay,.

B

A

All right, thanks got it. Okay,.

B

A

And the topic one.

B

Is a prettier one which uh I don't think there's any objections to it though it sounds like some people are thinking. My commenting about that. I don't like pretty or specifically we're having objections to it. I just don't like the tool: prettier, I'm cool with the whole, this setup and prettier as an answer, um but either way I think we should at one point just be like yeah sounds good, so it doesn't stale out because we have a lot of discussions that stale out really easily well.

C

Tim has requested a review from chiang mai or last week, and I approved it. No one else did we have a rule of two approvals are necessary. Okay, so then, again today he requested a review from from the core pr reviewers group, um and that was just earlier today, so no one has had a chance to respond to that. Yet, oh.

B

C

From my perspective, all we need is a second approval to move forward with that.

B

um And then speaking of uh things that I'm afraid that might get lost is the fort repository thing. um I have some concerns about us having to do this again in the future, because we haven't fixed the actual problem, but I'm totally in support, and I think we should move ahead with fixing all the legacy plugins.

A

Great yeah, so daniel.

C

Had a concern about something I wasn't following very closely, but um from from what I could tell that was the only blocker that was preventing us from moving forward.

C

um I don't remember what I don't remember what the issue was.

B

E

B

Remember that this, oh it was on the actual pr or actually on the help desk thing, not the email list.

C

I think, basically, if I remember daniel's concern there was very, we were going to do a bulk action on a large number of of repositories, and I think he just wanted to make sure that we had checked each one in the list to see if that bulk action made sense before blindly.

C

Basically, I think he was basically concerned about doing some sort of a dry run and checking the checking the list of actions before we go and apply it to everything. So you think there are at least one or two oddball cases that we wanted to maybe skip the bulk action.

C

He misrepresented, but I think that was I don't think it was really a hard.

D

It was more like.

B

You know, let's just double check this.

C

Before we, because this is an irreversible change,.

B

Yeah now that I'm seeing that I have to click on the help desk conversation, I can see a lot of that discussion. It's not in the mail list.

C

Yeah, so I think once once we double check everything. We should be good to go.

A

All right cool anything else before we end we're hard stop on time. Any other topics.

A

All right thanks, everybody recording, should be available in roughly 24 hours, we'll meet again in two weeks.