TSC Meeting (05 May 2020) Agenda: v3.2.1 patch release

[blag]

TSC Agenda May 5th, 5:30pm UTC, 12:30pm ET, 9:30am PT

Administrative Items

• Next meeting is June 2, 2020 ( @blag )
• Community Engagement
• Process for becoming a contributor (e.g. better documenting volume/velocity of commits/commitment to get promoted) ( @punkrokk / @armab ). Review status of net new contributors.
• LF Updates ( @dzimine )
• FOSS Programs ( @punkrokk )

Releases:

• v3.2.0 ( @armab / @punkrokk ) Retrospective
  • what went well
  • what didn't went well
  • improvements/suggestions to the process
• v3.2.1 ( @punkrokk / @armab )
  • Front End Security Updates
  • Bug Fixes
    • pip pinning fun Pinning pip to 20.0.2 to fix build issues introduced in pip 20.1 st2#4929
    • Fixed a bug in persisting Orquesta workflows to the database where a key containing a . would fail to write to MongoDB (regression). #4932 - Fixes for field escaping in orquesta workflows st2#4933
    • Ansible/Puppet/Chef? ( need owners )
  • OpenAPI spec generation ( missing JS dependencies)
• v3.3.0 ( @blag / @punkrokk )
  • [ ]
  • ...

Security

• St2web, st2clientjs, StackStorm-Exchange/web, st2chatops
• Security Patch Policy ( @punkrokk ) ref: https://stackstorm.com/2018/12/20/stackstorm-v2-9-2-and-v2-10-1-a-security-release/

Technical Agenda

• JavaScript Tech Debt ( security and general)

  • We have one dev willing to put effort into patching and improving webui and JS, need one or two more, and someone to drive the roadmap here

• Drop Mistral support

  • Proposed version: v3.3.0
  • Approved:
  • Owner:
  • Concerns:
  • Comments:
  • will we need to uninstall mistral in RPM/DEBs?
    • Will any packaging updates be needed for the final version or uninstall

• Drop RHEL 6 support

  • Proposed version: v3.3.0
  • Approved:
  • Owner:
  • Concerns:
  • Comments:

• Drop Python 2.7 in ST2 v3.3?

  • Packaging
    • How will this affect Ubuntu 16 packages?
    • How will this affect RHEL 7 packages?
    • What else is involved?
  • Proposed version: v3.3.0
  • Approved:
  • Owner:
  • Concerns:
  • Comments:

• [Proposal] Pinning build dependencies Stackstorm/discussions Proposal: Pin only minimum versions of pip and setuptools #2

  • Proposed version: v3.3.0
  • Approved:
  • Owner: (@blag ) ?
  • Concerns:
  • Comments:
  • pip
  • setuptools

• [Proposal] Convert Makefile to use Python's Invoke

  • Proposed version: v3.3.0
  • Approved:
  • Owner: (@blag ) ?
  • Concerns:
  • Comments:
  • ci
  • st2
  • orquesta ?
  • orquestaconvert ?

[arm4b]

More items to add to the meeting agenda:

• v3.2.0 retrospective:

  • what went well
  • what didn't went well
  • improvements/suggestions to the process

• Follow-up for EL8 support and U14 deprecation from v3.2:

  • Ansible, Puppet and Chef deployments

• st2web and st2chatops maintenance issues:

  • potential security vulnerabilities due to outdated dependencies
  • seeking support/contributors/maintainers for the repositories
  • potential v3.2.1 patch release to address dependencies

• Move away from JS-based st2chatops (Proposal: Move away from JS-based st2chatops #8)

---

Based on current developments there is a chance of v3.2.1 patch release before committing efforts towards v3.3.0.

[arm4b]

More Javascript maintenance debt to add to discussion:

• Issues in generating https://api.stackstorm.com/ due to JS issues Broken CD build results in outdated api.stackstorm.com st2apidocs#9. More context: api.stackstorm.com is unsync with openapi.yaml (CD) st2#4051