Content Comparison

TCR-52 ui-claims

• Joshua not present

Technical Council Sub-Groups Updates

GitHub RFCs

Wiki RFCs

Officially Supported Technologies (OST)

• Kong and Keycloak: 
  • Craig McNally For OSS release, only current version is supported.  Craig extrapolated / predicted dates for upcoming releases.  We're currently on 3.7 which is an LTS for the enterprise version.  Can estimate and say 3.12.  Or can just say "the most recent version" whatever it ends up being.
  • Marc Johnson Last time Craig said that Eureka doesn't use Kong or Keycloak directly, it uses custom FOLIO things that use Keycloak and Kong internally, so thought we agreed we'd only bother versioning the FOLIO-specific stuff and not the underlying software.
    • Craig McNally Our libraries use the base images, and then add some things on top of it.  I.e. Keycloak adds our FOLIO login page theme.  With Kong, adds some declarative language for startup.  So base image plus extensions.  FOLIO versioning policy uses underlying major & minor versions; uses patch version for the local customizations.
    • Marc Johnson These are fist-party things now.  So we should version them later, we do those way later in the OST process.
    • Tod Olson The rough predictions are useful as a reminder.  Relate to Marc's point, it would be useful to have a one-sentence explanation here of that relationship of FOLIO Kong to underlying library.  And useful to link to support policy for enterprise and OSS versions.  All useful info because it's complicated.
    • Marc Johnson Governance interest for those distributing without an enterprise agreement, it will be impossible for them to be supported for a whole flower release.  People will have to be used to the idea that they're not deploying Kong and Keycloak, they're deploying derivations.   No value in locking down versions now since they are first-party dependencies now.
  • Charlotte Whitt NL Sweden uses Keycloak for other things, will they need to use both that and this FOLIO-specific version?
    • Craig McNally Depends how they're using it, would need more info.
  • Craig McNally This is applicable to third-party discussion because what we add is pretty thin.  We'll likely have to upgrade during a CSP, i.e. there may be security vulns found. 
    • Also, Keycloak Admin Client libraries are now being released separately.  Release cadence not clear yet.  Easiest thing to say is just "latest version".
    • Marc Johnson All comes back to the policy stuff, how specific (or not) we want to be in this document.  Gap in our governance model.  At some point, we may want to reflect if this model is working as useful info.  For CSP stuff, that should be taken up with RSMG, some upgrades would not be "critical", although that policy isn't consistently applied.
    • Craig McNally Comes down to reactive or proactive.  May not know about vulns.  Depends how proactive we want to be.
  • Consensus to list both as "latest version" for now.
• Trillium marked as accepted.
• Java21 issue (Sunflower) – Owen posted in #tech-council.
  • Marc Johnson We went to Java 21 because Spring libraries required it, and for some reason didn't do dual-support.  Can change the docs to do dual support.  17 has plenty of time left on support.  We should also come back to a discussion of how we communicate OCR changes – these things are only useful if people know about it.
  • Jenn Colt Yes Zak asked how it was communicated.  WRT Sunflower Java 17, fine changing it if no objection.
  • Tod Olson Compiled Java bytecode knows what version it was compiled to, and JVMs contain internal backward compatibility.  So one would expect something compiled on 17 to run on 21.  Not saying if written for 17 to compile for 21.
  • Marc Johnson We version the JDK and JVM.

• •   If we were confident in Tod's point, we could say we support JDK17 but only JVM 21. 
  • Tod Olson Julian suggested in the chat to only make this exception for Grails.
  • Marc Johnson This might not be the only team that has this problem with 21.  If we make this restriction, might have to change that later.  But ok if it makes people more comfortable.  And nobody is validating this.
  • Craig McNally Indirectly validating, i.e. older version of Spring Boot would be found by tooling if it has a vuln.  Where is Spring Boot requirement for Java 21?
  • Jenn Colt Another option is to not update the doc, and just have someone breaking the policy.
  • Craig McNally We can version Grails 6, and have a sub-bullet acknowledging that it conflicts with the JVM requirement.
  • Decision was to write the exception under the Java 21 note, specifically for Grails modules.

3 straw polls (see Voting Rule Comparisons)

• Straw Poll: Slack yes/no: Result 3 for yes, 5 for no
• Quorum for making a decision which may involve a vote: Result Over 1/2 or over 2/3? 6 for Over 1/2, 3 for over 2/3
• Minimum number of ‘Yes’ votes to pass a motion

1. Majority of votes cast

2. Majority of those present

Result 4 to 4

Some members think about changing the votes for the last straw poll.

Marc Johnson if you have a higher quorum, then majority of votes would fix low vote decisions. On the other hand, on low quorum and option 2 fixes it too.

Today:

• ...