Nov 28, 2022 Governance Board Agenda

[Mark Waite]

The governance board meets today at 6:00 PM UTC.  Draft agenda is available in the meeting notes.  All are welcome to attend.  See https://www.jenkins.io/events/

Agenda:

• News

  • Jenkins 2.375.1 releases Wednesday, Nov 30, 2022

    • Thanks to Alex Brandes for serving as release lead

• Action items

  • Mark Waite create an empty agenda entry for the next meeting after each meeting

  • Mark Waite submit jenkins.io pull request to combine subprojects and SIGs into a single concept - “working groups”

  • Oleg Nenashev send proposal to Rick to retire the Chinese Jenkins site

  • Mark Waite and Gavin Mogan archive the governance meeting notes to a GitHub repository, use the Google doc as the working document, then publish final notes to GitHub

  • Mark Waite to use community.jenkins.io for the Jenkins Docs SIG mailing list

    • Consider asking Kevin Martens to take the lead on this one

  • EasyCLA needs to be documented by Oleg

  • Mark Waite to propose a pull request documenting the web application server support policy (similar to browser support, Windows support, and Linux support)

    • Many people are saying that “should work” but we don’t test them

      • JENKINS_HOME is different in newer Tomcat

      • No support for multiple Jenkins in a single Tomcat

      • No Java EE 9 support

      • All web containers moved to tier 2 except bundled web container

        • Can declare “known broken” conditions (Java EE vs. Jakarta EE)

        • Pull requests considered so long as they don’t harm tier 1

• Elections

  • Mark Waite opened Jenkins developer discussion of proposed rule changes for next year

    • Allow up to 2 elected board members from a single company - Jenkins developers

    • GitHub pull request

  • Elections are complete.  Thanks to Gavin Mogan and Ewelina for their 2 years of service.  Welcome Ullrich Hafner and Alexander Brandes to the board

  • Permissions changes and membership changes for new board members?

• Governance board meeting time and date

  • Find a time and date that works well for all board members

• CDF Outreach Reboot

  • Dec 14, 2022 10:30 AM EST meeting to restart the outreach committee

    • Contact Lori Lorusso for more information

    • Alyssa Tong and Mark Waite will attend the meeting

[Jesse Glick]

On Mon, Nov 28, 2022 at 9:29 AM Mark Waite <mark.ea...@gmail.com> wrote:

Mark Waite to propose a pull request documenting the web application server support policy […]

• • • Many people are saying that “should work” but we don’t test them

• • • […]

• • • • All web containers moved to tier 2 except bundled web container

Not sure if there was a thread somewhere in which this topic was discussed in writing, but my personal recommendation would be to formally drop support for running in a general servlet container, so that you could only use the bundled Winstone/Jetty via `java -jar jenkins.war` (we could even drop aspects of the WAR packaging not needed by `executable.Main`).

The obvious thing that does not work in other containers is WebSocket support: https://github.com/jenkinsci/jep/blob/master/jep/222/README.adoc#non-jetty-containers

I do not agree that the situation is analogous to the web browser, OS, or Java support policy. We do not bundle a pretested web browser, JVM, or operating system with Jenkins (except insofar as the latter two are supplied by the Docker image).

[Gavin Mogan]

I think slide has also found out that csrf tokens are also broken, something about ips not being passed properly.

--
You received this message because you are subscribed to the Google Groups "Jenkins Developers" group.
To unsubscribe from this group and stop receiving emails from it, send an email to jenkinsci-de...@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/jenkinsci-dev/CANfRfr15_NQxx4k_dOawaPx%2B5MnhL4BaUJOPvB%2BptQ06NN%2BSwA%40mail.gmail.com.

[Alex Earl]

Yeah, you have to set up some stuff in the Tomcat config for it to work.  https://stackoverflow.com/questions/66274652/jenkins-no-valid-crumb-was-included-in-request/71961904#71961904

To view this discussion on the web visit https://groups.google.com/d/msgid/jenkinsci-dev/CAG%3D_DuujppbcfCVNfYNsK6UsOm6i0RG0_Qj8tzK8L8hWSwtivQ%40mail.gmail.com.

--

Website: http://earl-of-code.com

[Basil Crow]

https://github.com/jenkinsci/packaging/pull/350
https://github.com/jenkins-infra/jenkins.io/pull/5747

[James Nord]

> Not sure if there was a thread somewhere in which this topic was discussed in writing, but my personal recommendation would be to formally drop support for running in a general servlet container, so that you could only use the bundled Winstone/Jetty via `java -jar jenkins.war` (we could even drop aspects of the WAR packaging not needed by `executable.Main`).

My employer has several customers where internal policies mandate that WebApps must be run inside tomcat.

So whilst Jenkins is a webapp my company hat would say that the support should remain.

(In other words if you can not use tomcat or $container then Jenkins must not be a war, which has a large overlap but is subtly different from above).

This is not an official statement that even with the above my employer would be happy (or otherwise) with the proposal, this is my personal view.

/James

--

[Jesse Glick]

On Tue, Nov 29, 2022 at 6:29 PM James Nord <james...@gmail.com> wrote:

if you can not use tomcat or $container then Jenkins must not be a war, which has a large overlap but is subtly different

Interesting…so if the basic Jenkins download were to physically switch format somehow, then it would no longer be subject to the Tomcat rule? Or would some practical benefit be lost by not using Tomcat?

[Basil Crow]

Yes I have been surprised at how many users are running Jenkins in
Tomcat, or at least how vocal they have been. My gut feeling is that
dropping Level 2 support for traditional servlet containers is a
non-trivial project: e.g. collecting telemetry to quantify current
usage of traditional servlet containers, announcing the deprecation
months in advance through an administrative monitor, writing blog
posts and migration guides, etc. I am not sure how many users are
running Jenkins in Tomcat out of inertia and would switch if they had
to versus how many users are running Jenkins in Tomcat due to some
corporate policy and would refuse to upgrade if they had to switch to
Winstone. Either way the status quo of Level 2 support is not costing
us much in terms of maintenance burden, so I see no need to prioritize
such a project in the short to medium term.