Versions Compared

Old Version 2

changes.mady.by.user Axel Dörrer

Saved on

compared with

New Version Current

changes.mady.by.user Craig McNally

Saved on

Key

  • This line was added.
  • This line was removed.
  • Formatting was changed.

...

TimeItemWhoNotes
5-10 minSpring RCE vulnerabilityAll

See https://spring.io/blog/2022/03/31/spring-framework-rce-early-announcement

  • Jira Legacy
    serverSystem JiraJIRA
    serverId01505d01-b853-3c2e-90f1-ee9b165564fc
    keyFOLSPRINGB-47
  • Julian Ladisch is writing a script to check for vulnerable modules
  • A message/update was posted to #sys-ops:  https://folio-project.slack.com/archives/C9BBWRCNB/p1648740057373649?thread_ts=1648728230.119219&cid=C9BBWRCNB
  • Julian Ladisch has created a few JIRAs for this – he's still working on this.
  • He also wrote a script to list the affected modules - runs periodically
  • The edge modules are probably the most critical - 3 of them are affected.  The related POs are aware.
  • Should these fixes be backported to Kiwi?
    • Prevailing thought is that it should since Kiwi is the latest release and Lotus isn't official yet.
    • Craig McNally will communicate this recommendation to the Capacity Planning group, and possibly Oleksii Petrenko.
    • Additional communication will be made once the path forward is clear.

Today:

  • Update on conversation w/ Cap Planning?
  • No update on conversation deferred to next week
  • ERM issues has been created and linked

Official security support policy on releases

Security team needs

  • How many releases from now has to be supported? (3-4 releases or less?)
  • Also a matter of capacity
  • Should be raised to the PC → Axel can bring this with a paper/proposal to the PC
  • Axel will produce a paper that outlines that problem by next weeks meeting.
  • Chris to ask his stakeholders about TAMU needs

5 min

Update on

Jira Legacy
serverSystem JiraJIRA
serverId01505d01-b853-3c2e-90f1-ee9b165564fc
keyFOLIO-3317
 

Axel
  • Axel Dörrer Should be removed from week to week agenda and Axel will monitor for progress and report back
  • MODEUS-139 has been moved to the next sprint
  • Axel Dörrer  will discuss the data-import ticket with Ann-Marie B. after Lotus.

Today:

5-10 min

Jira Legacy
serverSystem JiraJIRA
serverId01505d01-b853-3c2e-90f1-ee9b165564fc
keyRMB-902

Jira Legacy
serverSystem JiraJIRA
serverId01505d01-b853-3c2e-90f1-ee9b165564fc
keyOKAPI-1081

Team

Notes from previous weeks:

Discussions are ongoing, currently blocked on a decision being made.

  • Document the options on the wiki to facilitate these discussions and the decision making process.
  • By this group?  By the TC?
  • How do we constrain the module names?  If so, where/how?
    • Various restrictions:  Postgres, Hosting infrastructure (Kubernetes/ECS/etc.)
  • What about the tenantId restrictions?
    • Also part of the above discussion/decision.

Today:

  • Deferred again.  Check in on  
5-10 min

Jira Legacy
serverSystem JiraJIRA
serverId01505d01-b853-3c2e-90f1-ee9b165564fc
keySTCLI-190

Team

Notes from previous weeks:

There's a PR that hasn't' moved in a while... What's the status?  How do we move this forward?

Was there another PR against stripes-testing?

  • ui-test:94 Was merged, a problem was reported, leading to this being reverted.
  • Appears to be an environmental problem.  
  • The JIRA is now unassigned... it isn't clear who has the ball here.
  • Added a comment to STCLI-190 tagging Khalilah, Ryan, and Zak

Today:

  • This PR has been reverted because of issues with the included changes of kopy version. The idea is to exclude the kopy changes by now to move forward with this.
10 min

Jira Legacy
serverSystem JiraJIRA
serverId01505d01-b853-3c2e-90f1-ee9b165564fc
keyMODAT-68

Team

Context:

The ask is to review this story, and more specifically the comment thread.  We can discuss more next week.  The goal is twofold:

  1. Awareness of what's being proposed
  2. Possibly make recommendations to the CP team if we have strong feelings about the direction the project goes with this.

Today:

  • Revisit next week to let people dig more deeply into this
5 min

Jira Legacy
serverSystem JiraJIRA
serverId01505d01-b853-3c2e-90f1-ee9b165564fc
keyRMB-907

Team/

Julian Ladisch 

The level of exposure is not clear at this point.  Julian Ladisch  will look into it and get back to us.  This information will feed back into conversations with capacity planning group wrt backporting to kiwi/lotus/etc.  Indications are that there will not be a Kiwi HF3, so it may be that this only gets into Lotus HF1 and Morning Glory.

Today:

  • Is fixed. We can leave it by now as dev teams will use them by the next module build

*

Review the Kanban board. Team



Action items

  •  Julian Ladisch to document the options for restricting tenantId and module names on the wiki (Context:
    Jira Legacy
    serverSystem JiraJIRA
    serverId01505d01-b853-3c2e-90f1-ee9b165564fc
    keyRMB-902
    /
    Jira Legacy
    serverSystem JiraJIRA
    serverId01505d01-b853-3c2e-90f1-ee9b165564fc
    keyOKAPI-1081
    )