Automatic Updates Initiative meeting on August 11

:calendar: Alright - it's time for our bi-weekly AutoUpdates Initiative meeting!This meeting:➤ Is for core developers, initiative contributors, the Drupal Association and anyone interested in the initiative.➤ Usually happens every other Tuesday at 1700 UTC.➤ Is done over chat.➤ Happens in threads, which you can follow to be notified of new replies even if you don’t comment in the thread. You may also join the meeting later and participate asynchronously!➤ Has a public agenda anyone can add to: #3163951: Automatic Updates Initiative meeting on August 11➤ *Transcript will be exported and posted* to the agenda issue. For anonymous comments, start with a :bust_in_silhouette: emoji. To take a comment or thread off the record, start with a :no_entry_sign: emoji.

0️⃣ Who is here today? Comment in the thread below to introduce yourself and tell us why you are joining us.

1️⃣ Do you have any topics to propose for the meeting today? Feel free to propose them in this thread, and then I will give them their own unique threads for discussion.

2️⃣ TUF sprint recap! - Last week we collaborated with TYPO3 and Joomla to begin defining the PHP-TUF project: https://github.com/php-tuf/php-tuf - This is a replacement and improvement for https://github.com/drupal/php-signify which is currently used for signing the contrib module's updates. - Read more about the TUF spec to learn a lot about handling secure updates: https://github.com/theupdateframework/specification/blob/master/tuf-spec.md - There are lots of issues in this project where you can get involved.

3️⃣ TUF next steps - Our meetings are now biweekly on Tuesdays at 0100 EDT / 1500 UTC. - There are lots of issues to work on in the GitHub queue! - We have a TUF contribution half-day Fridays at noon EDT / 1700 UTC. Anyone is welcome to join and pair with active contributors, or to drop in and out. - There will be another sprint in Sept. to make more progress on the update signing architecture. Please respond to the poll! https://doodle.com/poll/mzvau8vc5dwmz3kd#table - Finally, we're writing a blog post about our collaboration on PHP-TUF! Email Tim Lehnen (hestenet) if you want to help with the blog post. (edited) 

4️⃣   Composer 2 and Composer dependency issuesMixologic's pull request to fix the deletion of the /core directory in the Composer 2 alpha was accepted! :tada:#3135247: Composer's "prefer-stable" setting cannot be relied on to produce a stable release^^ Ted has done some review on the latest proposal to solve the prefer-stable problem.TO DO:Someone could help draft release notesSomeone could help draft change recordsSomeone could roll a new patch with Ted's review changes(edited)

#3043521: [META] Update readiness checks for autoupdate (pre-flight check)

5️⃣   When should readiness checks first run? When the auto-updates module is first installed?#3162655: Create Automatic Updates Readiness Checks in new experimental module (edited) 

6️⃣ Are you joining the half-day work session on PHP-TUF on Friday(noon EDT / 1700 UTC)? What are you working on? Are you looking to recruit anyone to work on something? (edited) 

About 2940739, PSA can serve as an alert system 'in' a Drupal site. And as per 2940739, it can be public and accessible to everyone (edited) 

7️⃣ The first step in moving AutoUpdates to core is moving the relevant data about PSAs into a core display. This is the core issue: #3041885: Display relevant Security Advisories data for Drupal(The related issue for the current contrib module work being ported over is linked)Any one presently working on that or have other updates or thoughts about it?

:checkered_flag: That concludes our formal agenda for this #autoupdates meeting - but you can continue the conversation in the threads above. Thank you for attending.

Participants:

tedbow, Bhavin Joshi (he/him), hestenet (he/him), dts, drumm, xjm, eiriksm, greg.1.anderson, mbaynton