 Welcome, everyone. This is Jenkins governance meeting. It's the third of October. Thanks for being here. So items I had on the agenda news, action items, antler with Basel leading that discussion, then upcoming elections, and that's mostly me giving a status report and CDF topics if Oleg joins us, or if there are others to talk there and then forums and community topics and Gavin we usually have you lead that one are there other topics that need to go on the agenda. Okay, then let's go ahead. We have two open open action items. Oh, whoops, let's go back to news first, use me news. So, next LTS is coming out on Wednesday, two days from now to three 61.2 relatively smaller set of changes in it, as is pretty common for a dot to release. Thanks Basel for your contributions there thanks Kevin as well. The process has started and contributions are coming in at a, at a really quite pleasing pace. It's good to see lots of interaction on the chat channels it's good to see many pull requests arriving. And they are in general useful and helpful. I've seen relatively few spammy pull request so it looks like the, the technique the digital oceans using this year that they learned from last year to reduce spam has really helped a bunch. Thanks very much to digital ocean if there any there's anybody you that you can share our thanks to in the company we're very grateful to them. Yeah, I can do that. And next piece of news DevOps world was postponed. Thanks to Hurricane Ian. It's, it's, it's not going to happen live it will be virtual so the postponement there, their plan is to create a virtual conference but they're trying to work out the details what it will mean to do that virtual conference. That means that the contributor summit was postponed and we've got to have some more thinking on that what does it mean for the contributor summit. I mean contributor summit needs a different approach than a face to face contributor summit so I've started some thoughts and I'll send those around after I've had a chance to give them a little more time to, to develop and evolve. Does that mean I can't wear my hoodie. No, because it never happened. No, of course you can wear your hoodie because it's going to happen. But thanks for asking that's fair, fair question. So one last item to break out of it. Honestly, that's all I wanted. Well done. So one last item I have is that two weeks from today I will be out of the office. I'm going to go take some vacation time with my spouse, and she and I are going to be out of country. I need a volunteer to lead the meeting. Gavin you've got zoom access would you be willing to be the zoom zoom recording person etc. So now that I can get back in. So yeah. Great. All right. That's it. Anything else on the news topics before we go to the next. Okay, action items then. I've still got the action item to use community that Jenkins.io for the doc sig, the doc sig mailing this continues to be almost no traffic. It's just going to take a while. This certainly won't happen until November at the earliest. I was surprised to see we had an advocacy email, like, first time in like six months. So, yeah, it's another interesting one. And there, there are several like that right the platform sig mailing list gets maybe one or two a week and mostly the requests there are, please tell me how I can contribute, but then they disappear and don't actually contribute. Yeah, I suspect they don't want to get replies. A lot of times when you sign up for Google group if you're not paying attention you have the don't send me things. Oh, oh okay so they may be asking a question we we respond and they never even see the answer. It's definitely been an issue with mailing list in the past I don't know about Google group specifically. Okay, thanks thanks for the pointer I may, I may extract their email address and send it to them directly so that they know they got an answer. Good, good pointer thanks. The last time was easy CLA and Oleg's taken that he'll document it. Right now, it's showing that it works right so the thing that we need is just documentation not not that it doesn't work because Kevin registered and it worked just great for him. Any other topics on on action items before we go on. So the point we need to decide if you want to enable CLA on other repositories like, I don't know, because we don't need to sign a CLA to commit to Jenkins right or submit to Jenkins. So we do not require a CLA for submissions we do require a CLA for if you become a core contributor to get access yeah. Right, right. I don't know if we actually need to ever enable the bot or anything. Good question and it's a I think that's an open topic for for future discussion. I remember there was a previous discussion about this on the developer list. About a year ago maybe, or many months ago. And I think the, but I, but I recall was that we wanted to keep it disabled to decrease the barrier to entry. I don't know if that has changed recently but that was the last consensus that I recall. We'll say you use the CLA pretty much has zero barrier you just click a couple buttons. I'd rather be finished setting up and full use before we look at enabling anywhere. Right, that I think that makes sense let's be sure that we're confident in it. And then we can decide if we wanted to play it elsewhere, including getting it documented. Right, that's part of the confidence building exactly. All right, anything else on action items. Okay next topic then is antler Basel you want to give us an overview and talk us through. So I've been investigating this bug regarding Jenkins not compiling on Java 18 or newer. And I've realized that this problem is caused by our use very old version of antler dating back to around 2007. And this is still used for two features the crontab parsing and parsing the label expressions for build agents. And in particular, this maven plugin that we're using does not appear to have survived the migration from subversion to get. It's not like I can just go and file a pull request to add Java 18 support and you know get a new release and then upgrade to it. It's one of those things that is sold that that is prohibitively difficult to make any changes to it at all. Leaving the only viable path forward to be an upgrade to antler for which is the current version of antler that's actively developed. I've, I've spent some time on Twitter, reading tweets from the antler community and I identified consulting firm and reached out to Federico, who is the principle of this consulting firm that has experienced performing projects from antler two to antler for and Federico is kind enough to scope out the work confirmed that there's interest in the project scoped out the work and has written us proposal, including a very kind discount, because this is a resource project. And so, my, my goal in this meeting is to go over that proposal. I've already discussed it on the developer mailing list on the technical side, and there wasn't really any major concerns there, expressed. But what I'd like to accomplish in this meeting is to go over the proposal from a governance side, including the cost, and to answer any questions and to take this to vote to see if we'd like to go forward and engage with Federico and with the instrumenta to start this project. Thank you. Did you want me to go through the proposal more detail. I was thinking, do we let's pause here to see if anyone else has questions even before you start into the proposal. So Gavin or Kevin, any questions from you on on the concept or the, the why why do this migration. No, I mean, I think basil pointed out the fact that we, I mean, it's a little overkill for the use we're using it for but I think no one's going to ever get around to fixing it or removing it so I think we should just fix it. And I'm a big, I think we should spend some of the money that we have been fully hoarding for the last couple years. So, in general, I'm in favor of it, I don't have any concerns, unless it's over our budget, then I have concerns. Well, and it's in it is what I can confirm it's well within our budget we've got over 7,000 in the account currently so so the 2700 Euro that's proposed will will readily fit and I think I agree with you Gavin that I think it's much more practical for us to spend these funds on experts to do this, then it is for us to ask somebody to develop antler for skills for what is a relatively narrow use case. Let's, let's just get it done. I think you're right. Yeah, I mean, like I mentioned in that blow point, you know, it's not out of the question that we could rewrite this functionality from scratch. But nobody has really, you know, volunteered to do that. And this does seem to be the easiest path of least resistance that I can identify with the lowest risk to causing regressions. And also, you know, the most kind of the most straightforward path that involves the least amount of code change to what we have already so that's why I kind of proposed this. But the grammar for both of those things. Well, maybe like cron but the for the label selector is so complex and people have done so many weird things in the past with it. I wouldn't want to even begin to write a parser myself. Yeah, I mean, it could be done, you know from scratch. I think, for example, Alex Earl, has we written the parser for token macro in the last couple of months to be a from scratch parser rather than using. There was some framework that he was using that I think he got rid of and simplified so I mean, things like that and out of the question is just that someone needs to volunteer to do it and nobody has. And this is why I've kind of gone this other route instead of updating what we have already. Good. So Basel, do you want to take us through this and I assume we need to make it big enough that people like me can still read it. Sure, so. So this code is already has automated test coverage. So that's kind of one of the main points in our favor. You know this should not be a high risk engagement. The project the project builds with Java 11 we've got tests that can be run and tell a J or your favorite ID. So it should be pretty straightforward to go and adjust this code. And further this kind of this document kind of talks about the credentials from this consulting firm, but they've been very involved in the other projects, as well as doing these kinds of migrations and other types of programming language projects. I'm very confident in reading everything that I read from, not only their own marketing materials but and seeing their engagement on Twitter and on, you know, other, other resources like stack overflow, you know they're very active in the antler community, which gave me a lot of confidence in this particular group. So if you want to scroll down further I think the next page talks about the, what we're asking for specifically. So, the ask on our side was for strumenta to prepare pull request, and essentially to do what it takes to get that pull request across the finish line. And I volunteered myself as the point person to work with them during that period, including helping them with any development questions that they might have, as well as doing code reviews and doing everything that's needed to shepherd this change across the finish line. The changes are the scope of the changes are to the two grammars, but also to the Java code that is produced by the grammars so the way it works is that Java, the grammar files are kind of compiled by antler into some Java classes. And then we kind of extend those classes in the Jenkins code base. So they're going to be operating at that boundary of the grammars and the immediate consumers on the Java side. And we have clarified that we want all of the automated tests to pass. And the pull request will be accepted. So they've provided here I think they've provided a period of two months that they've guaranteed that the tests will pass. So, this is not the kind of thing that's going to change after it's integrated basically if it works on day one is just going to keep working. So that's the offer from their side. We move on to the next slide this is going through the cost. And you can see that I actually put the wrong number in the agenda, it's actually 1890 euros. I put the first number by accident I think, because there's a 30% discount that they've offered. I have a question about the tax because if you go down to paragraphs, they write that the client has to be a registered business to avoid the value added tax, and then Mark and I were not sure whether we meet these registration requirements. So, we may have to pay that may or may not have to pay the tax. And that is really about it so that's the cost, and that's the tax, and I think that's all I have to present that this. If there are any questions. Thank you so so one of their comments early on. You meant you described it very well, they, they say hey, they will refactor the grammar. And they will have to make some changes in order because antler two to antler for is more than just a minor change right so they're going to do those changes and that's part of this part of this bid part of this proposal. Right exactly. Okay, great. Thank you. Any questions from others. Yeah, so I, the number I put in the agenda is the wrong number that's the post discount number. If you'll get my lap side that needs to be corrected. Yeah, so let me just update that let's see where is the last bullet, the last major bullet. There it is great yes so. So if I just put this as 1900 euro. Right, I forget I forget what the actual it was exactly it was 1890 if I go 1900. And then, yeah. I'd like to mention one more thing as far as the as a token of our appreciation for the discount. We also offered to publish a blog post on the Jenkins blog. And that is technical and content so not, not a marketing blog post. But we're planning them basically writing a thank you blog post and I think we've kind of done this in the past, with other organizations that offer us discounts, including digital ocean and we've, we wrote a blog post for them recently so that's also planned as part of this. So I'll work with students to get that blog post written and published. But we thought that would be a nice gesture to thank them for offering us a discount. Great. Any other questions relative to the antler antler consulting project proposal. So next topic then is a vote. So I'm going to start with mine Mark is plus one. I'm a board member therefore it's a it's a binding vote. Gavin, do you want to share your vote. Yeah, I'm on pyramid. Okay. So we, we lack one more person for a majority of the board so I don't have a vote yet for Oleg, a vote for Evelina. I'll have to ask for those separately and close the case the other board member. So I'll also I would propose we put this as tentative I assume Basel and Kevin you're both plus one. Can I confirm that with the two of you. Yes. Okay. So I'll use email to ask for Oleg and Evelina and Kosaka to give their vote on it. And once we have a majority. I think we can proceed. The deadline that they set is October eight. So, Mark to complete the, the requests and get responses from at least one by October eight. So we can, so we can proceed. So that's Saturday. Correct. That is Saturday. Yeah, it's this week, right. Do we want to reach out to Karen Bernan, the Linux Foundation person and confirm whether or not we need that so you don't if we need to increase that budget. No question. Yes. So let me put that on my list as well. So Mark to well and, and no matter what we need to reach out we need to contact the Linux Foundation to be sure they are able to process this payment that there are no surprises, etc. So, so that's a good thing connect with Linux Foundation. To understand if. If that is required. And to confirm they can make the payment. I'm not concerned about making the payment because that's all through down the expense of I, but yes, the fat is concerning. I mean not even concerning. I suspect Linux is definitely registered business but right. It's, I, for me, given how infrequently we do these kind of things, I think it's healthy for me to be sure that I check with them to understand which things do we need to be sure we've done in order to for this to be smooth and successful I don't want to create undue burden on strument or on Basel in dealing with the financial side of this. Do you have access to specify because I don't as far as I think I do. But I'll double check to be sure. Yeah, I'm happy to do anything else that needs to be done but it seems like it probably be more work to explain it to me then to move forward with your existing contents but if you need my help, then just let me know. Yeah, and that's they given that if if we put you into the mix, it's even more complicated because they they will likely recognize my name they may not recognize you and say oh who is this person and how are they related to Jenkins and Yeah, I don't have any concerns about for this because I believe they just submit a report to expensify and then we get and then whoever has access, which is not me hits improve button. So, right, Mark is probably definitely a leg but maybe Mark. Okay. All right. Thank you. Anything else and on the antler proposal. Thanks everyone. Thank you very much for bringing it next topic. I'm just before we move on, I'll wait to. I'll wait to circle back with instrumental until after we get the majority vote on this. So, correct. Yes, it does. Thank you, buzzle and and you're you're certainly welcome. If you feel you need to you're welcome to share the notes and even a pointer to the recording of the meeting so that they're confident that we are interested if there's any concern from them. But we very much want to want to engage with them and we will do our best to meet their their October 8 gating date. I like that. Okay. All right, next topic was upcoming elections. I have to apologize we've been disrupted a little bit we had hoped to work on these together with Damian while we were at DevOps world hurricane Ian got in the way. I was so confused how an online election was disrupted by hurricane. Yeah, well in this case it was because Mark and Damian we're going to work together and sit together but you're totally makes sense now in context. What, how can a hurricane disrupt an online. That's a lot of things but Damian. Yes, so Damian and I've got to work together on this and he, he only just got back in country after an absolutely horrific experience. He just got back in country about 12 hours ago and so he's, he's trying to get some recovery maybe it was 20 hours ago now that he's trying to recover and he and I will talk some more tomorrow. So what this means practically though is we've got a, I think we need to adjust the timeline. We're in October now. And so we need to gather the candidates and their statements and finalize the candidates by end of October, so that we can do voting in November. Are you okay with that or does that feel too rushed to you do we need to ask for a change of schedule are you comfortable that hey we can get the voting done in in a month in November. Honestly in my past experience, I think the people who are going to sign up are going to be people who sign up in the first week, both voting and candidates. So honest, I don't have any concerns about this. Great. Okay, thank you. Yeah, so Damian and I will do more work on it. And would love to have you be willing to sign up again Gavin, but that's of course your choice. I would be thrilled and be happy to support you as a board member in the future. So we will plan to use the same process as last year and going forward. Any questions about upcoming elections. Nope sounds good. Next was then CDF topics. So here just, there is a new proposal from Damian on the JFrog topic. They've been working very cooperatively with us to try to identify ways to reduce the amount of data transfer we're doing. And what Damian has proposed is a Jenkins enhancement proposal draft of an approach to to work on it. And so I encourage people to please read his draft. It's a good thing for people to consider what does it mean to the project as we try to reduce data transfer and it means we've got to change the real mission of repo dot ci dot Jenkins dot I dot org. This has previously been something very different. And what it was before was using so much bandwidth is to be unreasonable. Right. 50 terabytes a month is an awful lot of data to be transferring. So, so Damian's got this proposal out it needs review it needs comments it needs insights. Sweet we can get our final vote right now. We can this is this is excellent. Great timing. Hi, I'm sorry I was distracted by the office in one company and forgot about the meeting. Thanks for being here much appreciated. So we, if you're okay Oleg we'd like to backtrack a little. We had a proposal from, from Basel to invest 91900 euro in an upgrade of our antler for grammar from antler two to antler for using a consulting service they've given us a quote and buzzing presented his summary of it gave us a good overview. Gavin and I were both plus one on it. If we wouldn't, I was going to get your vote separately but would love to have your vote now, or if you've got questions, we'd be happy to go over and try to address any questions you have. Well, we have a bunch of money like round and not being used. if you're any use of money is better than just keeping them. Great. So can I take that as a plus one? I need to go through the proposal, but yeah, I think it's a plus one, unless there is something really, but come and talk it. I mean, if there is no potential conflict of interest, that's why I think plus one. Okay. All right. So are you okay if I noted as plus one tentative? And if you've got a, could be set a timeout and say, if you've got a concern, express the concern within 48 hours. And yeah, I'm all looking right now. Oh, okay. Great. All right. Just to record the proposal is only like a page and a half. Yeah. Thanks, Oleg. And if there's any other questions, feel free to reach out to me. So are we going to do it through LAPEX mentorship, or how do you see it? I was assuming we do it through LAPEX. I'm not sure it would be mentorship, but I don't. So we want LAPEX to or whoever's, whoever manages that $7,000 that's in our budget, we have them, or in our account, we have them pay this amount to this, to strument of this company. Okay. So it's basically just contract work. Right. It is. It's just, it is contract work to a company that is expert in antler grammars and in antler grammar transitions. Okay. I think it looks perfectly fine. So the only concern is taxation, et cetera, but the as long as they and the LAPEX foundation take care of it and perfectly fine. Great. All right. Thank you. Okay. So that takes care of my action item. So I have one action item to connect with the Linux foundation to be sure that we understand if the, that we know how to pay these, the people at Stramenta and if any value added tax is assessed, there was a concern in the proposal that we have to be a registered business. And so we got to check, is Linux foundation registered in the way that would satisfy that need or not? So who does currently have access to the expensified and if I recall correctly, I asked for membership for board members maybe a one year ago, but since that the board changed and yeah, I'm not sure whether all the access was granted. I have a reporter access and that's it. So no access to expensify as a prover? No. Nonetheless, I'm just not seeing it, but I don't remember ever being a prover. Mm-hmm. So is that something I should take up with them in my conversations as well, Lola, is be sure that board members have approval permission. So you can ask one big problem for the system that it supports on the one. I mean from as far as LFX concerned. Basically a painful LFX expenditure because currently I have a problem with captain all the accounts were created by the Linux foundation and now they can't transfer access to us. Got it. Yeah, for Jenkins, so the project belongs to me, I believe an expensifier back end. I was also the approver. Then we found a way to add more approvers, but I'm not sure who actually got the permission after all this, I'm looking right now, but yeah, it's probably that it's just me. Okay, so we're reasonably confident that you have permission. Yeah, I have permission. So I approve the YDX request reason here, so. Okay, good. All right, so we've got a path forward, very good. Anything else on the Antler contract proposal? Thank you. Okay, so next topic then, we were discussing upcoming elections. Damien and I have got more work to do there. The plan is that we'll announce the elections in October, gather candidates and their statements and finalize them for November voting so that we can proceed with installing the new officers in early December as scheduled. Sorry that we missed, but Damien was disrupt, Damien and I's work together was disrupted thanks to Hurricane Ian keeping me away from Florida and stranding him in Florida. So any questions on upcoming elections? All right, next topic then, CDF topic. So JFrog making progress, Damien has proposed a Jenkins enhancement proposal of how we repurpose or redefine the mission of repo.Jenkinsci.org in order to reduce its bandwidth demands. And he believes that we're going to need a multi-step process and that each of the steps along the way will want to measure the impact of that to see how close are we to our goal of reducing data transfer from 50 terabytes a month to less than 10 terabytes a month. Any questions there? Okay, next topic then was year to project previews at the CDF technical oversight committee meetings. And Oleg, is there anything new that you wanted to share that we had discussed possibly doing a Jenkins presentation in November? Any guidance you want to give us or insights? No, let's just do it when we can. So currently, yeah, we do see either to fight with tick tonic radiation. So we are launching the process and end up in the previews. But at any moment, you're welcome to join. Good, okay. So the Tecton project is graduating? Yep. Excellent, congratulations to that. So there were some questions about the security review because for example, project is we didn't do one for Tecton, we did. So yeah, I think it's going okay. Congratulations to them. That's great. Yeah, so I'm looking into LFX Jenkins account. As far as I can tell, it's just me who have access. Okay, but even if it's just you, that means that if Strumenta submitted a request to be reimbursed, you could approve it. Yeah, so there are two steps. Firstly, I would need to add them as beneficiary on LFX crowdfunding. And secondly, we need to approve the expansion point. Okay, great. Let's go ahead and forward. Thank you. Okay, very good. So I think in terms of that, then Basel, I think we're ready to have you let Strumenta know that it's approved. Okay, great. Thanks for bringing the proposal and please thanks, Strumenta, for the discount. We're very grateful for the 30% discount they're so kindly offering. Any other CDF topics, Oleg, that we need to be reviewing? No. Okay, next topic then was forums and community topics. Gavin, are there topics there that you'd like to highlight? Not really. You already mentioned the new Jenkins as a way story and I was pretty happy with, unhappy with how frustrating or picky the system was but it did work out itself out pretty quickly. Yeah, actually, I was thoroughly impressed. I will yet find a way to get it. Jim Klimov had asked, hey, could he get a t-shirt? And I have promised myself I will find a way to get him a t-shirt. I don't know how that will be but we will find a way to get him a t-shirt. Jenkins is the way t-shirt. It's a great story. It is really impressive. Jim has been very helpful testing changes and also contributing to plugins including just a few that I'm familiar with are the throttle concurrence plugin and the lockable resources plugin. And also I think the IRC bot plugin he is involved with so he's been a great member of our community and it would be great to show our appreciation to him. Wholehearted agreement. His contributions to the get client plugin and the technique they're using are real positives. So yeah, very grateful to him. All right. So there was an open question that I had on there was a question raised to the board mailing list someone asking, hey, please remove a reference to company X on the bug tracker. When I look at the reference, it's actually pretty trivial. It's a host name is all that the reference is but what I wanted was general guidance on the technique when someone asks makes a request like this, hey, please remove this reference. How do we handle it? Is it, okay, I just go delete what I can. Should we do nothing? Just ignore the request. What's the guidance in general? I'm not familiar with the process. Personally on this one, I would just ignore it. It's an automated request which doesn't really have any real purpose. It's like, don't mention this host name. Well, if it's, this was from JIRA. Was this from a JIRA ticket that they wanted the host name removed? Exactly. Everyone who's part of the organization has edit privileges on JIRA descriptions. So I don't think that they need us to do this, right? They could do it themselves if they want it to, it seems like. So I mean, if it's in the description, I guess if it's in a comment, I think you can only edit your own comments, but if it's in an attachment or in the description, I think anyone could edit it. So it may very well be a reasonable response to say, anyone can edit this. So just go and make the change yourself. If it's somebody that's in a comment that the original poster cannot log in again, that could be a legitimate reason to ask an administrator to edit it. If the, if the comment is in a comment, that can no longer be edited by the original account. So the request is from a so-called security team that says they didn't want this host name posted. I mean, honestly to me, that's one of those things that once you put it on a public on the internet, you can't really take it away. So yes, someone could go in and I suspect you're right that the accounting question is no, the person is not there for the reason that's an old account or all the email or all the ticket. But I also kind of been like, I don't even know how many people have access, I mean access to JIRI to go in and edit these things. Yeah, I certainly do. I'm a JIRI administrator. So it turns out I can, I can make any of the changes here that would like to be done. I was, I was as much looking for what's the general guidance. So in this case, the request is, hey, remove references to this thing. I could delete the ticket completely. It's, it's closed. So they got migrated. So you delete the ticket isn't going to have to solve the problem. Exactly. And they didn't ask for a deletion on the migration destination. So, so there's a piece of that where, okay, I could do, I could certainly remove the references, you know, images that might have it in it, any of those things, that's easy to do. And I can, I will happily do that as a way of saying, hey, we did it. We satisfied your request. Is there a general point of guidance there of what? I have low tolerance for automated tooling. So, and it's like the same thing with, yeah, I don't know if you were in the Docker channel last week when some reported there was an issue that in no way made sense. There were, there are windows related CVs in the Linux, in the Linux Docker image. So I have a very low tolerance to these automated scanning tools that don't have any real human interaction to them. So when someone emails us and says, hey, our tool detected this thing, you should remove it. You're like, you know, I would concur with Gavin that it doesn't, it doesn't seem as important as if it's the result of a scanner rather than a human initiated contact. So, you know, we were debating whether to use scare quotes or not. But I think a more accurate term would be a security team bot asked us not to mention the host name, right? So that's very different from an actual security team making their requests in the sense that there's a higher likelihood for it to be low priority or false positive. So yeah, I would agree. We can, we can turn down the bot request but leave open the possibility of accommodating it if it's escalated to a human. That seems reasonable to me. If you want to deal with it, you can deal with it, Mark. I'm not gonna, in these kinds of scenarios, I usually like, unless they actually supposed to, like, I don't know. It's one of these ones where they only caught half of it and they didn't actually look at the content. They just sent us email and you're like, and the concern is that a host name is made public. And you're like, okay, if this is a security concern to you and it shouldn't be, you can change, you should probably change your host name if this is the concern, it's already on the internet. So yeah, it's up to you. You're the man, you can decide what to do, but I don't think as a board, there's any real hard, fast rule. We don't get enough of them to make a big deal. In fact, I don't think I've ever seen one before. Excellent, okay. That covered all the topics for today's agenda then. Any other topics that need to be addressed before we close. All right, thanks everybody. Thank you very much for being here.