<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"><html><head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8"></head><body>A new request with request id 15108 has been created by koha-devel-request@lists.koha-community.org. Short info on the request is : <br><br>Title : Koha-devel Digest, Vol 191, Issue 4<br>Category : <br>Description : <div>Send Koha-devel mailing list submissions to<br> koha-devel@lists.koha-community.org<br><br>To subscribe or unsubscribe via the World Wide Web, visit<br> https://lists.koha-community.org/cgi-bin/mailman/listinfo/koha-devel<br>or, via email, send a message with subject or body 'help' to<br> koha-devel-request@lists.koha-community.org<br><br>You can reach the person managing the list at<br> koha-devel-owner@lists.koha-community.org<br><br>When replying, please edit your Subject line so it is more specific<br>than "Re: Contents of Koha-devel digest..."<br><br><br>Today's Topics:<br><br> 1. Workflow improvement suggestions for security releases<br> (Jonathan Druart)<br><br><br>----------------------------------------------------------------------<br><br>Message: 1<br>Date: Wed, 6 Oct 2021 17:28:39 +0200<br>From: Jonathan Druart <jonathan.druart@bugs.koha-community.org><br>To: koha-devel <koha-devel@lists.koha-community.org><br>Subject: [Koha-devel] Workflow improvement suggestions for security<br> releases<br>Message-ID:<br> <CAJzKNY5Y4TiCeuTEkNSVre9LkE807mJc6wPswkppf-kzdTNo6w@mail.gmail.com><br>Content-Type: text/plain; charset="UTF-8"<br><br>Hello devs,<br><br>As you must know we had two hard months, several very bad bugs hit us.<br><br>The release team had to coordinate and it was not an easy task.<br>We noticed some flaws in the workflow and I would like to suggest some<br>improvements to discuss.<br>The main problematic issue is to backport patch series to different<br>stable branches.<br><br>1. LTS<br>I think it's time to have a Long Term Support release. We noticed that<br>some people are still using very old versions, having a version that<br>is maintained several years could help them.<br>We could backport critical security bugs only. 4 (5?) years would be great.<br><br>2. Communication<br>Once the issues have been reported and fixed, I've alerted the first<br>cycle of people around me. Their job was to alert a second cycle.<br>Should we have a list of people we trust? Ask the (general) mailing<br>list who wants to be in the loop? That means adding them to the<br>security group on bugzilla (or at least adding them when the bug has a<br>fix) and CC them when private discussions take place.<br><br>3. Synchronisation<br>Release maintainers are spread around the world (and timezones suck).<br>Getting feedback can take time, several days (like: "try", "don't<br>work", "try again", it's 3 days!).<br>Then when you plan to release on Wednesday, and things are only ready<br>on Thursday you need to wait until Monday as part of the world is<br>still enjoying the weekend!<br>I don't have a solution for that, apart from the Monday postpone or...<br>more anticipation.<br>Same problem for the time of the release, I've picked 12 UTC as the<br>"most convenient" slot for a release, but it won't (ofc) fit<br>everybody's needs. My point was that if we communicated enough<br>beforehand (but not publicly) it should not be a problem.<br>Let me know if you have ideas to improve that!<br><br>4. Infrastructure improvement<br>We don't have CI/Jenkins for the security repository. We need one!<br>That must be a top priority of the next cycle. We need to help RMaints<br>and make the security release process easier and less stressful.<br><br>5. Apply patches<br>We need a script to apply the patches on the different branches,<br>automatically. That's an easy bit to develop and it will help us a<br>lot.<br><br>6. More visibility on the status of the patches<br>RM and RMaints must put their progress on the bug report itself. A<br>comment "Will be pushed, RM had a look at this" or "Backported for..."<br>should be added.<br>That must be added to the "Release process" wiki page.<br><br>Let us know if you have any questions or remarks.<br><br>Cheers,<br>Jonathan<br><br><br>------------------------------<br><br>Subject: Digest Footer<br><br>_______________________________________________<br>Koha-devel mailing list<br>Koha-devel@lists.koha-community.org<br>https://lists.koha-community.org/cgi-bin/mailman/listinfo/koha-devel<br>website : https://www.koha-community.org/<br>git : https://git.koha-community.org/<br>bugs : https://bugs.koha-community.org/<br><br><br>------------------------------<br><br>End of Koha-devel Digest, Vol 191, Issue 4<br>******************************************<br></div><br><br>NOTE: You are receiving this mail because, the Requester/Technician wanted you to get notified on this request creation.<br></body></html>