2024-11-04 Meeting notes

Jenn Colt is next, followed by Florian Gleixner

Reminder:  Please copy/paste the Zoom chat into the notes.  If you miss it, this is saved along with the meeting recording, but having it here has benefits.

Maccabee Levine

Tod Olson

Jakub Skoczen

Craig McNally

Jenn Colt 

• CC: Maccabee Levine
  • No CC this morning
• PC: Tod Olson
  • Call for Ramsons BugFest testers, need to recruit more people to help with upcoming BugFest.
  • Claiming app: Presentation on new app to support workflows to claim missing serials, will entail a new UI module using existing backend. New functionality brought to PC while still in design phase! More detail in the presentation linked in the 2024-10-31 Product Council Meeting Notes
    
    • Presentation: New app proposal - Claiming
• RMS Group:
  • Nothing relevant
• Security Team: 
  • We should discuss ownership of mod-graphql see agenda item below.
• Tri-council Application Formalization:  
  • Group has paused while POs and App Interaction work on spreadsheet from Taras

• 06 Nov 2024 - Dedicated discussion:  Go continued
• 11 Nov 2024 - Regular TC meeting
• 13 Nov 2024 - Dedicated discussion:  Topic TBD
• 18 Nov 2024 - Regular TC meeting

All

• Craig McNally followed up with VBar on the FQM RFC... 
  • VBar will update with current state and discussions from Wolfcon

Nothing new here.

Check Recurring Calendar...

• Craig McNally made progress on a couple things here...
  • Spoke to Christopher Spalding and got access to Election Runner - Setup was very easy, and free for < 20 voters.
  • Reached out to Boaz Nadav Manes wrt the google form used in the last election for nominations - Still need to see how much of this can be reused.
• It's also come to light that Taras Spashchenko will be leaving the project soon, so we have 2 seats to fill.
• Timing
  • Two weeks for nominations + One week to vote
  • Assuming we can get the word out (and nomination form) by 11 Nov 2024 (Next Monday), we should have results by the end of the month. 
  • Does this timing work?
• Communication/Announcement
  • Since it wasn't clearly captured in previous notes - the plan is to post to #tech-council, right?  Also maybe to the other council channels?  
    • Maccabee Levine should post to wider channels, probably developers or implementers
  • Do we need to be concerned that we may not get enough nominees, or that not posting this to a wider audience may be viewed negatively?
    • Craig McNally we did not have too much candidates recently

From Julian Ladisch in #tech-council... Do we need to discuss?

There's a request to get a fix being back-ported to Morning Glory (R2 2022): https://github.com/folio-org/mod-authtoken/pull/164
Does FOLIO support this, or should we suggest that people (upgrade to a supported flower release or) fork the repository, do the changes in their fork, and use their own docker hub space to publish the fixed container?

Notes:

• Was this raised with the RMS group?  Any updates?
• Julian Ladisch: yes, raised with RMS group

This is mostly an FYI, but also raising this here in hopes of finding a volunteer to help with this...

• mod-graphql is unmaintained.  Charlotte Whitt indicates that the Thor team does not have bandwidth for this.  
• There are several security-related issues here, dating back to 2021.  Most of this is regarding outdated, unsupported versions of 3rd party dependencies, but there are also at least one known vulnerability too.
• It seems the project needs to find a new owner for this module.
  • Sought advice from the folio chairs.  It was suggested that we engage Khalilah Gambrell (Lead PO). 
  • Khalilah indicated that there aren't any teams with capacity to take this on, especially while hardening for a release.  She also notes that EBSCO + EPAM teams have already taken on a significant number of modules previously maintained by the now defunct Prokopovych team.
• Noteworthy considerations:
  • This module is written in node.js
  • the z39.50 module depends on mod-graphql, so removing it from future releases may be problematic
• Jakub Skoczen probably dependency on z3950 could be removed, so we could get rid of mod-graphql at all
• Marc Johnson ask z3950 responsibles if they think removal is possible
• Maccabee Levine announce a note in slack too the planned removal of mod-graphql in case someone else uses it

Follow-on Q & A/ discussion on approval of the Go language for module development.

• DevOps topics were discussed last wednesday
• Discussion:
  • Craig McNally Can other teams take over go-based modules? We learned mit mod-graphql this can be a problem
  • Maccabee Levine Should be a MOU from the Organization
  • Jakub Skoczen Does not depend only on programming language. Most time the teams lack resources and not knowledge.
  • Marc Johnson Not only the programming language, but also central tooling has to be considered. Not central policy for new languages. Need guidelines for new languages
  • Jenn Colt When should a module be considered to be abandoned?
  • Craig McNally mod-graphql most security vulnerabilities raise from outdated dependencies. Unclear if this is exploitable. Upgrading dependencies is not easy.
  • Julian Ladisch At least one security issue known, but does not directly affect Folio.
  • Marc Johnson No policies for new languages regarding tooling exist
  • Jakub Skoczen As we proposed go, we figured out tooling, devops and so on. Discussion seems to be endless, we had 2 topics: CI/CD and developing of a demonstration module. Either formulate clear questions about topics in question or take a vote now or soon.
  • Craig McNally Most of questions have been raised in the RFC. Concerns about managing multiple languages have all been discussed
  • Jakub Skoczen Can invite developers from the team if there are more questions.
  • Marc Johnson Static code analysis group will look at it
  • Craig McNally Remaining questions should be answered at Wednesday and we plan to take a vote them

Review decisions that are in progress.  Can any of them be accepted?  rejected?

Currently there is a PoC, developed by Maccabee Levine, of a utility to catalog Github PRs that have been labeled with the "breaking change" label. We would like to get developer feedback on the feasibility of this label being used more often, and the usefulness of this utility. 

Previous Notes:

• A workflow for these pages. When do they transition from one state to another. Do we even need statuses at all ?

Stripes architecture group has some questions about the Poppy release.

Zak: A handshake between developers, dev ops and the TC. Who makes that decision and how do we pass along that knowledge ? E.g. changes in Nodes and in the UI boxes. How to communicate this ? We have a large number of teams, all have to be aware of it.  TC should be alerted that changes are happening. We have a couple of dedicated channels for that. Most dev ops have subscribed to these channels. How can dev ops folk raise issues to the next level of community awareness ? There hasn't been a specific piece of TC to move that along.

Craig: There is a fourth group, "Capacity Planning" or "Release Planning". Slack is the de facto communication channel.  There are no objections to using Slack. An example is the Java 17 RFC. 

Craig: The TC gets it on the agenda and we will discuss it. The TC gets the final say.

Marc Johnson: We shouldn’t use the DevOps Channel. The dev ops folks have made it clear that it should only be used for support requests made to them.

Jakub: Our responsibility is to avoid piling up technical debt.

Marc: Some set of people have to actually make the call. Who lowers the chequered flag ?

Craig: It needs to ultimately come to the TC at least for awareness. There is a missing piece. Capacity Planning needs to provide input here. 

Marc: Stakeholders / Capacity Planning could make that decision. Who makes the decision ? Is it the government or is it some parts of the body ?

Marc: the developers community, the dev ops community and sys ops are involved. For example the Spring Framework discussion or the Java 17 discussion. But it was completely separate to the TC decision. It is a coordination and communication effort.

Marc: Maybe the TC needs to let go that they are the decision makers so that they be a moderating group.

Jakub: I agree with Marc. But we are not a system operating group. Dependency management should be in the responsibility of Release management. There are structures in the project for that.

Jason Root: I agree with Jakub and with Marc also. Policies should drive operational/release/support aspects of Folio.

Jason Root: If the idea of “support” is that frameworks are supported, then of course the project should meet that.

Marc Johnson
Some group needs to inform OleksAii when a relevant policy event occurs.
These documents effectively ARE the manifestation of the policy.

Craig: This is a topic for the next Monday session.

Craig to see if Oleksii Petrenko could join us to discuss the process for updating the officially supported technologies lists.

Possible topic/activity for a Wednesday session:

Discuss/brainstorm:

• Ideas for the type of developer-facing documentation we think would be most helpful for new developers
• How we might bring existing documentation up to date and ensure it's consistent 
• etc.