| Time | Item | Who | Notes |
|---|
| EDGCOMMON-47. |
| Mitigations are known and until edge modules are fixed a message should be posted Julian Ladisch to announce that in the appropriate channels A backport to Kiwi is not needed because of easy to implement mitigation options: - Use different credentials for each tenant. OR
- Remove the X-Okapi-Tenant HTTP header from requests to these edge modules.
|
|
|
| mod-configuration has been discussed on the development channel recently. Developers like it because they can simply drop variables to the /configurations/entries API. Simply use the "configuration.*" permission shared by all modules and you are done. No need to add schema validation, no need to add dedicated permissions, no need to add a dedicated API.
Drawbacks: - A big institution need config write permissions with module granularity. One member of staff may be allowed to edit circulation config but not aquisition config.
- No validation. mod-configuration cannot validate a POST or PUT request because it doesn't know. Only the module it belong to knows this. Relevant use case: Using curl/wget/postman/...
- No documentation. mod-configuration has no documentation, one needs to search, maybe the module's README has some? A dedicated module API always publishes the API documentation at https://dev.folio.org/reference/api/
- Performance. Requests to mod-configuration result in latency. If the config API belongs to the module the module can cache it and can invalidate the cache if the config is changed. Caching requests to mod-configuration will always result in a time period with outdated values. In mod-inventory-storage we've combined fetching the HRID config and HRID generation into a single SQL query.
- Coupling. Modules should be loosely coupled and therefore each module should store its own configs.
It was requested that a formal RFC/Architecture Decision Record been created if mod-configuration should no longer been used for module-specific configurations.
Team decided we want to have this as a RFC. Target should be to have this implemented within Nolana. Could discuss in your meetings while the RFC process moves on.
Today: |
| Official security support policy on releases |
| Security team needs - How many releases from now has to be supported? (3-4 releases or less?)
- Priority/Risk will likely factor into this as well.
- Also a matter of capacity
- Should be raised to the PC → Axel can bring this with a paper/proposal to the PC - not yet.
- Probably want to bring this to the TC as well at some point, even if only for awareness.
- WOLFcon session?
- Axel will produce a paper that outlines that problem by next weeks meeting.
- Chris to ask his stakeholders about TAMU needs - not specifically, but has started to have some conversations
- https://docs.google.com/document/d/1Un5OlutEh7M2p3AzxE8g20NmdeEhrC0KCNkfd_QLkRw
- Continue discussion from slack... Spring Boot LTS
- We need to communicate the expectation better - e.g. add something to the platform release notes indicate how long P1 security issues will be backported to that release.
- As long as we upgrade to the latest LTS release of Spring Boot in each flower release, we should be in decent shape - only ~1 mo. where we're running a version of Spring boot that's no longer supported.
- Note that we're currently a bit behind with this, even if we upgrade edge modules, etc. in a Lotus HF, kiwi and Juniper will be running older, unsupported versions for some period of time. Going forward we'll need to be diligent about this to avoid getting into this situation again.
- Update? Have we added anything to the MG release notes?
- Not yet... Craig McNally will refresh his memory on what we agreed to at previous meetings and will send out a strawman message in the slack channel for review.
- Textproposal:
Morning Glory will receive security fixes for critical issues until Orchid is released (est. Spring 2023).
Detailed information on particular issues will be provided by the security team. With this release there will be no other security hotfixes on Kiwi.
- Put this textproposal for the release into a ADR to forward this to the TC
- Julian Ladisch to set up that ADR
Today: |
5 min | Update on | Jira Legacy |
|---|
| server | System Jira |
|---|
| serverId | 01505d01-b853-3c2e-90f1-ee9b165564fc |
|---|
| key | FOLIO-3317 |
|---|
|
| Axel | - Axel Dörrer Should be removed from week to week agenda and Axel will monitor for progress and report back
- MODEUS-139 has been moved to the next sprint
- Leipzig Devs mentioned that filling up memory can not only be solved by a limit on uploads. It also should consider multiple simultainous uploads as scenario.
- Axel Dörrer to check back with dev what other possibilities of implementation could be.
Today: |
| 5-10 min | | Jira Legacy |
|---|
| server | System Jira |
|---|
| serverId | 01505d01-b853-3c2e-90f1-ee9b165564fc |
|---|
| key | RMB-902 |
|---|
|
| Jira Legacy |
|---|
| server | System Jira |
|---|
| serverId | 01505d01-b853-3c2e-90f1-ee9b165564fc |
|---|
| key | OKAPI-1081 |
|---|
|
| Team | Notes from previous weeks: Discussions are ongoing, currently blocked on a decision being made. - Document the options on the wiki to facilitate these discussions and the decision making process.
- By this group? By the TC?
- How do we constrain the module names? If so, where/how?
- Various restrictions: Postgres, Hosting infrastructure (Kubernetes/ECS/etc.)
- What about the tenantId restrictions?
- Also part of the above discussion/decision.
- Some design choices have been suggested.
- Julian Ladisch to raise awareness of Tenant Id and Module Name Restrictions via posting to #sys-ops and #development slack channels
- Conversation is still in progress, there has been feedback from several people
- In general, it seems most agree with the proposal
- Maybe some minor adjustments are needed.
Today: |
| 5-10 min | | Jira Legacy |
|---|
| server | System Jira |
|---|
| serverId | 01505d01-b853-3c2e-90f1-ee9b165564fc |
|---|
| key | MODEXPW-67 |
|---|
|
/ | Jira Legacy |
|---|
| server | System Jira |
|---|
| serverId | 01505d01-b853-3c2e-90f1-ee9b165564fc |
|---|
| key | MODEXPS-109 |
|---|
|
/ | Jira Legacy |
|---|
| server | System Jira |
|---|
| serverId | 01505d01-b853-3c2e-90f1-ee9b165564fc |
|---|
| key | FOLIO-3448 |
|---|
|
/ | Jira Legacy |
|---|
| server | System Jira |
|---|
| columnIds | issuekey,summary,issuetype,created,updated,duedate,assignee,reporter,priority,status,resolution |
|---|
| columns | key,summary,type,created,updated,due,assignee,reporter,priority,status,resolution |
|---|
| serverId | 01505d01-b853-3c2e-90f1-ee9b165564fc |
|---|
| key | FOLSPRINGB-58 |
|---|
|
| Team | Has there been any progress here? Last week it was noted that there was a slack conversation started about this. Need to check in on Oleksandr Bozhko's progress (he's was investigating the problem. - no news in the last 7 days... Craig McNally to nudge him and see where this stands.
- Open PR on FOLIO-3448 (Documentation as a warning for developers)
- Craig McNally to check if a new Jira has to be created for that and push on that
- A helper has been developed by Julian to prevent this issue in new/changed code.
- Mikhail F arranged a meeting for this Friday in order to explain all the details to Epam Team leads.
Today: |
| 5 min | edge-lti-courses | Team | edge-lti-courses has been unmaintained since July 2021. Open Jiras: | Jira Legacy |
|---|
| server | System Jira |
|---|
| columnIds | issuekey,summary,created,updated,assignee,priority,status |
|---|
| columns | key,summary,created,updated,assignee,priority,status |
|---|
| maximumIssues | 20 |
|---|
| jqlQuery | key in (MODCR-81, MODCR-80, MODCR-78) |
|---|
| serverId | 01505d01-b853-3c2e-90f1-ee9b165564fc |
|---|
|
Last updates: - No real news here... Erin N. mentioned that she'll raise this with the staff at Duke. Maybe someone there can support these modules.
- Let's give it another week and then we might consider to move this out of the folio repo since there is no maintainer
- We asked Erin N. if there anything new on that
Today: |
* | Review the Kanban board. | Team | - There are several JIRAs on our board that haven't moved in a long time (well over a year in some cases...)
- Do we want to possibly close these as won't do?
- Craig McNally to look into how we can sort the board by last updated date, making it easier to see what's been lingering
|