Date

26 May 2022

Attendees

Name	Present
Craig McNally	Y
Julian Ladisch	N
Axel Dörrer	N
Ryan Berger	Y
Chris Rutledge	Y
Jakub Skoczen	N
John Coburn	Y

Discussion items

NOTE: Detailed notes weren't captured for today's meeting. For the most part the time was spent reviewing the Kanban board. We left comments on several JIRAs, but nothing worth explicitly noting here.

Time

Item

Who

Notes

Official security support policy on releases

Security team needs

How many releases from now has to be supported? (3-4 releases or less?)
Priority/Risk will likely factor into this as well.
Also a matter of capacity
Should be raised to the PC → Axel can bring this with a paper/proposal to the PC - not yet.
Probably want to bring this to the TC as well at some point, even if only for awareness.
WOLFcon session?
Axel will produce a paper that outlines that problem by next weeks meeting.
Chris to ask his stakeholders about TAMU needs - not specifically, but has started to have some conversations
https://docs.google.com/document/d/1Un5OlutEh7M2p3AzxE8g20NmdeEhrC0KCNkfd_QLkRw
Continue discussion from slack... Spring Boot LTS
We need to communicate the expectation better - e.g. add something to the platform release notes indicate how long P1 security issues will be backported to that release.
- TODO: figure out the wording of this and get it added to the Morning Glory release notes wiki page.
As long as we upgrade to the latest LTS release of Spring Boot in each flower release, we should be in decent shape - only ~1 mo. where we're running a version of Spring boot that's no longer supported.
Note that we're currently a bit behind with this, even if we upgrade edge modules, etc. in a Lotus HF, kiwi and Juniper will be running older, unsupported versions for some period of time. Going forward we'll need to be diligent about this to avoid getting into this situation again.

Today:

Update? Have we added anything to the MG release notes?
- Not yet... Craig McNally will refresh his memory on what we agreed to at previous meetings and will send out a strawman message in the slack channel for review.

5 min

Update on FOLIO-3317 - Getting issue details... STATUS

Axel

Axel Dörrer Should be removed from week to week agenda and Axel will monitor for progress and report back
MODEUS-139 has been moved to the next sprint
Axel Dörrer waiting to hear back from Ann-Marie B. about the data-import ticket ... maybe target Nolana?

Today:

Defer update until next week since Axel Dörrer is out today.

5-10 min

RMB-902 - Getting issue details... STATUS

OKAPI-1081 - Getting issue details... STATUS

Team

Notes from previous weeks:

Discussions are ongoing, currently blocked on a decision being made.

Document the options on the wiki to facilitate these discussions and the decision making process.
- Julian Ladisch to take this on.
By this group? By the TC?
How do we constrain the module names? If so, where/how?
- Various restrictions: Postgres, Hosting infrastructure (Kubernetes/ECS/etc.)
What about the tenantId restrictions?
- Also part of the above discussion/decision.
Some design choices have been suggested.
- See Tenant Id and Module Name Restrictions
- Security team to review on their own and ask questions as needed
Julian Ladisch to raise awareness of Tenant Id and Module Name Restrictions via posting to #sys-ops and #development slack channels
Conversation is still in progress, there has been feedback from several people
In general, it seems most agree with the proposal
Maybe some minor adjustments are needed.

Today:

Defer update until next week since Julian Ladisch is out today.

5-10 min

STCLI-190 - Getting issue details... STATUS

Team

Notes from previous weeks:

There's a PR that hasn't' moved in a while... What's the status? How do we move this forward?

Ryan Berger / John Coburn to help push this along.

Was there another PR against stripes-testing?

ui-test:94 Was merged, a problem was reported, leading to this being reverted.
Appears to be an environmental problem.
The JIRA is now unassigned... it isn't clear who has the ball here.
Added a comment to STCLI-190 tagging Khalilah, Ryan, and Zak
This PR has been reverted because of issues with the included changes of kopy version. The idea is to exclude the kopy changes by now to move forward with this.
Last week:
- No movement, but a PR should be coming soon.

Conversations are ongoing within the Stripes Arch. group.
Maybe replace kopy with something else that's better maintained
Maybe roll our own replacement

Today:

Merged this week.
Zak updated kopy version (one major version)

5-10 min

MSEARCH-357 - Getting issue details... STATUS

Team

have we heard anything from the mod-search devs on this? Is it possible to use the openSearch client, or possibly make it configurable which client is used?

5-10 min

MODEXPW-67 - Getting issue details... STATUS / MODEXPS-109 - Getting issue details... STATUS / FOLIO-3448 - Getting issue details... STATUS

Team

Has there been any progress here?

Last week it was noted that there was a slack conversation started about this. Need to check in on Oleksandr Bozhko's progress (he's was investigating the problem.

Today:

no news in the last 7 days... Craig McNally to nudge him and see where this stands.

5 min

edge-lti-courses

Team

edge-lti-courses has been unmaintained since July 2021. Open Jiras:

key	summary	created	updated	assignee	priority	status

Loading...

Refresh

Today:

No real news here... Erin N. mentioned that she'll raise this with the staff at Duke. Maybe someone there can support these modules.

*

Review the Kanban board.

Team

There are several JIRAs on our board that haven't moved in a long time (well over a year in some cases...)
- Do we want to possibly close these as won't do?
- Craig McNally to look into how we can sort the board by last updated date, making it easier to see what's been lingering

Action items

ALL to figure out exactly what we want to say about backporting security fixes and get it added to the Morning Glory release notes wiki page. (To be discussed in Slack)
- Craig McNally to get this started.

Browser not supported