Jenkins June 2021 Contributor Summit, 25 Jun 2021

Previous Meeting Next Meeting

⏯

youtube image

►

From YouTube: Guava update

Description

Jenkins Contributor Summit June 25, 2021 - Guava Update Track

slides https://docs.google.com/presentation/d/1czif5VDoYvgP88SjRxSK42uF7eRtAfG9h7ith7hbwQY/edit?usp=sharing

A

So without further.

B

A

I am going to share my.

A

Screen for some reason, I can't share a single window. I have a problem with you, so I'm doing what I hate doing, sharing my whole screen. Okay, so uh do you see my screen?

A

C

A

So um we're going to put full screen if that works. Obviously, that does not.

A

I thought it was this way anyway. Let's, let's keep this uh presentation this way, that's fine! It should speak enough or that's not big enough. Tell me so um yeah. I wanted to make a quick update of the guava work. You know that was started some times ago.

A

You have, you may have seen if you didn't that's okay, because I'm going to explain again some updates here and there on the developers, mainly and so on, on some various efforts around basically being able to upgrade guava in jenkins core. So in jenkins score. uh So I looked for an old cat picture.

A

We have, we are using guava guava, eleven quaver 11 was released in 2012 and the last version is going about 30., so we want to upgrade for various reasons. One main reason is security.

A

De facto, if we see if someday you know, there is a cv, that's discovered on global old version and we may be vulnerable that just kids project may be vulnerable and then upgrading fixing will not certainly be easy, as you can imagine, because this is very old and nobody about, but maybe the jks product would be able and willing to back port whatever.

A

So this is a problem, um so we started looking into what it would take to upgrade so um there's a jab ongoing that was started by somebody else than our team, so because our team at cloud base is starting looking into the bigger picture, there has been a lot of efforts from various members in the community. Not looking for cloud b's, um there is so I created just before. Did the computer submit an epic because I thought it was? It would be nice to start and gathering things around.

A

There has been a few pr's and so on that were, you know, started before. So this is the one I I'm going to look into it for now and then so uh james nord, on the call right now, I think so started to look into some some months ago. Some weeks ago. uh You know what would um happen if we would upgrade genting score. uh The version of guava inside jenkins score from 11 to 30.. Basically, james use the rev api.

A

You know tool basically a tool, uh rave api, this one that analyzes the um api and there there's backward compatibility and so on and uh added that in the mix using usage, plugins tool, that's a tool from the jkins community. That's going to be scanning the whole byte code of the plugins of project ecosystem to find potential breakages future packages. So because going back to my slides, uh basically, what we want to do is to upgrade all plugins to check whether they are working.

A

So I'm going to show you uh and it's going to be a good description following up the the mentioned earlier about the plugin eol policy lifecycle work that some people here were in about the importance of clarifying what plugins we need to fix and the plugins that may be. You know too old to have somebody care about.

A

So this list is the following: this is the plugins that may be impacted by the java upgrade, so I'm scrolling, as you can see, a few plugins in that list are cloudbiz proprietary because of the way we scanned, but that's most of them are open source.

A

So you can see this is a small project right. So why am I today talking about this? It's basically to raise awareness, because we need the jenkins community to participate uh in that effort.

A

Many fixes needed are a good way if you want to, you know, create your first open source. Pr, that's probably a good um candidate work, because most work are going to be, should not be very tricky in many many cases. So I'm going to explain afterwards what I mean by not not too tricky so yeah. We need people, but I'm going to now explain a bit more precisely what it takes and you will see it's not rocket science. Any question at this point.

A

So what does need to be done to adapt plugins to guava? It's?

A

You know you're going to look at a given plugin and then you're going to upgrade locally there's multiple ways to do what I'm describing right now, but let's one way is to basically upgrade locally your palm to force 30., that's not in practice, that's going to be used, but that will be simple enough to run your tests using huawei 30.. If that works, you're good, these plugins will work, and then we can consider this plugin is like okay stamped as okay to work.

A

When we are landing an upgrade of guava 30 in jenkins core, if it blows up, then we need to fix this plugin so that it works with both what does mean fixing, which here I explain here.

A

It means that first recommendation is getting rid of guava usage when that makes sense, if you're using say guava, I don't remember the name unmodifiable list. Probably you can switch away from this one and use the collections dot. Unmodifiable list api, for instance, that's the standard from the jdk.

A

um That would be the simplest way when guava is used or if you're, using one utility class or something from guava. If you can't, then you need to try. You need to make it work with the same code in a forward compatible way uh between guava 11 and guava 30.. That means that your plugin, if you're doing nothing, meaning not forcing guava and then you will be using guava 11 and then you force using guava 30.

A

You run just mv and verify twice before and after it should work and succeed the exact same way when you're.

A

In that case, uh you are good, with the pretty important caveat that if your plugin has no test coverage whatsoever, what I'm saying is wrong, because then you won't see faders, you won't see breakages, but then, if this plugin is missing tests, that may be actually the right moment to add some to to show that it's not breaking so then it's going back to you know usual um development process, so maybe using code coverage, tooling and so on and so forth to to cover the values edges and then going back to the process.

A

I'm describing right now.

A

A

I was going to be a quick update, so that's uh everything I wanted to raise to discuss today. So if there's no question, that's fine. I think I'm going to.

A

Is anybody just there just yeah, not just looking at the right that somebody hear what I'm saying.

D

A

Yeah, I was just just a bit that suddenly uh worried that I was muted since uh 20 days.

C

A

C

We're ready for you to start your presentation.

A

Exactly suddenly, I had a small like cold sweat, as we say in french, okay, cool, so yeah you see it's an easy thing, just a few plugins to check.

C

So, as you said, the the reason why we're talking about this day is when the there's. This is something that needs to happen, but also that it's something that that is very much parallelizable right, that that anyone.

D

A

C

A

It's a yeah, it's a great opportunity like, for instance, in the jenkins community. For four years we have been labeling some jira issues as newbie friendly. I think most of these fixes are newbie friendly if you're a java developer, if you're not very much experienced in genghis development, this is going to probably be an easy one for you to enter. You know open source play with it interact with nice people we have cookies um and and and help this thing to move forward, because, basically, what we want, like I'm, going to re-explain that very quickly.

A

Just to you know, step back. We want to agree jenkins, the guava version engine kids core, but to do that and not make the whole ecosystem explode. We want to fix the ecosystem. First.

B

What about with all the clients that are candidates to be deprecated, applying the policies that we want to apply all those all those plugins that are only compatible with 1 400 and this kind of stuff.

A

That's a very good question, so uh yeah uh something like one hour ago. We had a session that was pretty productive about uh plugin, ul policy and so on. um So I think the example you just gave is an easy one. We don't care if the plugin only works with 1.40 400.

A

Probably those plugins are already that defacto, but if a plugin still works on the 2.280 or 90 something weekly yeah, that's a different issue yeah to be defined. uh We definitely want to that's part of why we were pushing for this discussion today. Definitely james was talking about that because I think the gen kids community. If we manage to have a life cycle policy, somehow it will reduce the size of the work needed for grava. Absolutely those things are very much intertwined.

B

Also yeah, I asked because recently I I tried to break the version of the apache miner sshd in the core and we managed to extract the the plugin as a small and we are struggling yet with the repair cushions of bumping, diversion and and so on. And then it's been seven months or something like that to the thing yes on. It's only one plane and uh has a few dependencies sustained or something like that. Much more.

C

We feel you yeah, I mean, I think the the thing to be to to note here is that that creating creating the prs to to make the change is, is one key step, because then you can say: look we've done our due diligence that the community has done its best. Here's the change. If it doesn't get merged, then we can, or there doesn't, there's enough traction in the plugin. Then.

C

Then you'll have a baby, making very interesting noises on your lap, um so that then, as long as you've done that, then then there's a second discussion that you can have that says. Look we've done this nothing's nothing's happening it's time to let that go right or someone needs to step up to to take over that maintainer ship or whatever it's sort of it's. It's it's not directly the eol question, but it's it's one where you can say: we've done the work now it's up to whoever cares about this plugin.

A

Yeah, that's what we've done for digester work.

C

And I think I think that that pattern is one that we should that we can continue to follow.

A

I think this is an ideal pattern, that's the the least worst case or something at least, but this bad uh way. You know finding prs, but then that means still liam that you know you need to spend time finding a pr that probably nobody will attend to.

C

Right, my point here is something that that, like I mean, if it's a small pr then great, if it's a large pr, then maybe it's I mean that's more problematic but, as we were saying this is this is generally not a hard. These are not. These are not hard pr's to do.

C

uh Many hands make light work kind of thing going on then great right. If we get enough people in like that that jump in on this hey, if, like I mean, I think, that's another point here- that that contributorship isn't just, I did the work and it got merged it's I did the work. I did the work and it had moved this this project forward, even if that that pr does not get worked.

D

Yeah and I think if if it doesn't get merged and someone new has stepped up and said, this plug-in is important to me so I'll kind of do this that that's a step towards kind of getting that plug-in maintained. It's like hey, it's important to me. I've done this work. I I use the plug-in and I want to keep it's important for me to keep using. So it's hopefully a way to then go well. This hasn't been merged and you know come to a community level list and they'll go. Why isn't this being merged?

D

And we say well, you could ask to adopt the plugin if you wanted and you know become a maintainer of it so yeah I I.

C

Get a number of tools that I've taken on contributorship to not plugins specific tools. It's like! Oh well. I I want to do this. One thing: oh, it's needs more help and that's how you you. That's that's the onboarding process right.

A

So yeah it's, I guess, let's, let's.

C

Agree, it's not ideal, but it's it's something.

A

I guess let's stable this discussion on the or maybe we can keep going. I don't mind, but you know the plugin ul is kind of a separate subject, even if it would help you know it's a connected but different subjects, and you see why it was so important that we allowed it to that earlier today. Indeed, um great, I think we're done it was really. I think my next step is just I'm going to do like one thing and one question: somehow I'm going to update uh maybe send an email to the developer.

A

Many leads or something maybe the discourse should create a thread there. Probably and then a question is like: do you think I should create a jira issue for each of the plugins in the epic? I can automate something to do that. I'm not going to do it by hand, but maybe that would uh yeah. I I see you ivan. I agree I mean I was not thinking. I was going to spend my evening uh creating 300 steer issues um but yeah.

C

So yeah that would I mean that, would that would be helpful, but I I'm do we have a blog post or something for this, because I think there's some interesting stuff to be talked about with with this like hey, you know, jenkins has this, has these things and I mean it might be yeah.

D

There's a visibility thing there too, because, like people, that's great.

C

But it's! This is actually something that the community. You know.

A

Yeah, that's a good point. That's that's even more why you.

B

A

I would probably want to create a jira for each because then.

B

We can have.

A

A blog entry and then tell people, you know, use this filter everything that's showing up. There is up for grab and you can. You know, assign yourself with the plugins you care about, and then you, you know it's clear for you or something yeah.

C

Yeah um yeah, I I I'd be up for writing that blog post I'd. Be that that's something I'd like to talk about. I think it's the kind of thing where it's it's worth, raising the. Why we're doing this? What we're doing? Why yeah? Why it's hard? Why it's easy kind of just it's an interesting view into the community into the jenkins.

A

Yeah, just plus plus you know absolutely doing what we're doing right now, but that's okay, because you know right now we are the group here. I don't think a lot of people are going to be watching and listening to that and so on making it ebola. You know twitter account of jenkins and the blog would probably also make the impact way bigger.

C

A

So I've written some actions, so I'm going to write something on the dev list. Maybe on this course I will check whether like what he thinks the we need to finish somehow, but that's going to be mid-term long term because anyways, we know what we need to do for the plug-in side of things, uh create jiras for plugins and then write a blog entry about the upgrade for raising awareness and getting hopefully a scaling for for free for those, like hundreds of things, to fix.

A

Thank you. Everybody.