This meeting:
➤ Is for core developers, initiative contributors, the Drupal Association and anyone interested in the initiative.
➤ Usually happens every other Tuesday at 1700 UTC.
➤ Is done over chat.
➤ Happens in threads, which you can follow to be notified of new replies even if you don’t comment in the thread. You may also join the meeting later and participate asynchronously!
➤ Has a public agenda anyone can add to: #3185859: Automatic Updates Initiative meeting on November 17th
➤ *Transcript will be exported and posted* to the agenda issue. For anonymous comments, start with a :bust_in_silhouette: emoji. To take a comment or thread off the record, start with a :no_entry_sign: emoji.

:zero: Who is here today? Comment in the thread below to introduce yourself and tell us why you are joining us.

:one: Do you have any topics to propose for the meeting today? Feel free to propose them in this thread, and then I will give them their own unique threads for discussion.

Comments

hestenet created an issue. See original summary.

hestenet credited drumm.

hestenet credited dstol.

hestenet credited dts.

hestenet credited pwolanin.

hestenet credited tedbow.

hestenet credited xjm.

hestenet’s picture

hestenet
He/Him
Location Portland, OR 🇺🇸
commented
Issue summary: View changes
Status: Needs work » Fixed

0️⃣ Who is here today? Comment in the thread below to introduce yourself and tell us why you are joining us.

tedbow :ocean: Ted Auto-Updates Initiative contributor, from Ithaca, NY, USA, Acquia
pwolanin (he/him) running late - Peter, contributor
dts Hi! David, autoupdates security architecture, SF, CA, US, Pantheon
xjm I have another meeting ATM but will read up after
hestenet (he/him) Tim coming back after meetings to read up. With the DA. Portland, OR
dstol :wave: Dave here, autoupdates carer-abouter, just moved and trying to get back involved

1️⃣ Do you have any topics to propose for the meeting today? Feel free to propose them in this thread, and then I will give them their own unique threads for discussion.

tedbow probably good to have updates from the TUF sprint, maybe multiple topics
pwolanin (he/him) yes, where does it stand?
tedbow probably another thread on composer work
hestenet (he/him) Topic: Would anyone like to be added to the invite for the ad-hoc server-side pair-programming sessions? Scheduled for the next two thursdays and then the following Friday.

2️⃣ PHP-TUF Sprint last week

tedbow We had PHP-TUF sprint Tues-Friday last week.
tedbow We did some work on non-PHP-TUF work too. Composer related
tedbow We have a number of PRs from last week https://github.com/php-tuf/php-tuf/pulls
tedbow getting further on SPEC in this 1 https://github.com/php-tuf/php-tuf/pull/80but ran into some problem in our normalization so this should probably be addressed first https://github.com/php-tuf/php-tuf/pull/88
tedbow @dts worked on making our fixtures deterministic and removed them from the repo. They are generated now via github actions before the tests https://github.com/php-tuf/php-tuf/pull/83
tedbow some of other PRs that were closed last week are here https://github.com/php-tuf/php-tuf/pulls?q=is%3Apr+is%3Aclosed
pwolanin (he/him) interesting - what was the normalization problem?  I was worried we’d hit something there
dts It's not the kind of bug you might have expected.
tedbow because we converted everything to arrays we re-encode we lost the difference between [] and {}
tedbow so signature verification didn’t work
dts Literally between those two exact things (by value), not even those two by type. PHP doesn't lose the information as long as there's content in the array/object.
tedbow we didn’t have any {} before got to targets.json so didn’t notice before. fixing this makes using symfony/validator a little more complicated
tedbow but I think we should be able to fix this soon
pwolanin (he/him) hmm, frustrating - I’ve hit the empty array vs object issue with php json_encode before, but sounds like here it’s a problem because one element is supposed to be array and the other object?
tedbow yeah. because the signature was encoded with the difference
tedbow so we need it too to validate the signature
pwolanin (he/him) sure
pwolanin (he/him) can you use knowledge about which elements are supposed to be array vs object?
dts We are. That's how were solving it
tedbow well. I am still interested to see if we can just preserve them as classes. @dts I am simplified the custom code I needed before to do this….
tedbow very thin class now https://github.com/php-tuf/php-tuf/blob/tedbow_normalizer/src/Metadata/V...
tedbow can almost just use ArrayObject
tedbow I have some more local changes that I haven’t pushed yet
tedbow still work in progress but pushed up my local changes
tedbow We didn’t pick a date for a next sprint IIRC

3️⃣ Composer update in temp directory

tedbow @effulgentsia was looking into this. whether a composer plugin can be used to tell composer to apply an update in a temp directory.we may be able to be able to use this instead of the a/b bootloader (edited)
tedbow I think it looks likely to work but not sure yet.would also have to make sure this works well with other plugins
dstol The appealing thing about the bootloader was that we could test the updated site with either real or simulated traffic
dstol And manage rollbacks through the bootloader
xjm @dstol Yep, I 50% expect we'll still end up with the bootloader as well for a few reasons, but this can get us like 95% of the way there and be safer for more usecases
xjm @dstol So the idea is to get as far as we can with it, and then evaluate whether we still need the bootloader for the safest possible switchover and rollback
dstol :thumbsup: I don't understand exactly the scope of composer update in temp directory either

4️⃣Would anyone like to be added to the invite for the ad-hoc server-side pair-programming sessions?

tedbow raised by @hestenet (he/him)“Scheduled for the next two thursdays and then the following Friday.”he may be busy right but I think you could your leave a message here if you want an invite
tedbow I imagine @drumm will be involved. Not sure who else. @dts?
hestenet (he/him) The current sessions are:Thu Nov 19th - 11am PacificThu Nov 26th - 11 am Pacific (for those not doing US Thanksgiving) Fri Dec 4th - 11am Pacific
drumm Yep
dts I'm involved, yes

5️⃣ Readiness checks #3162655: Create Automatic Updates Readiness Checks in new experimental module

tedbow I need to address the last review. But I have been talking to @dyannenova about potential UX problems especially concerning number of messages.also how you determine which messages will stop an update attempt and which are just warning.I need to update the issue with some of the concerns

Participants:

tedbow, pwolanin (he/him), dts, xjm, hestenet, dstol, drumm

Status: Fixed » Closed (fixed)

Automatically closed - issue fixed for 2 weeks with no activity.

ergonlogic’s picture

ergonlogic
he/him
Primary language English
Location Montréal, Québec 🇨🇦
commented
Component: Code » Meetings