Engineering Steering Committee Meeting, Nov 3, 2021
Han-Wen Nienhuys, Luca Milanesio, Saša Živkov, Patrick Hiesel
Dec 1, 2021
Discuss the proposed new maintainer(s) and send nomination(s) for the new maintainer(s).
Check with Milutin about a solution for the Trojan source issue.
Request from RedHat for a dedicated channel for notifying about the security releases
We discussed some proposals how to use existing communication means:
- add something to the email subject, for example [SECURITY]
- use CVEs
Additional feedback from RedHat is necessary to make a decision.
Removal of the ElasticSearch support code from Gerrit 3.5
That code was never production ready. The consensus is to remove it.
The Roadmap on the homepage is likely obsolete. Current roadmap which the ESC considers in every meeting is too detailed. ESC should only maintain a higher-level roadmap, all other details in the issue tracker. We should discuss the roadmap on a quarterly basis and on demand.
Trojan source issue
Using special unicode characters may render a diff view in Gerrit UI which is different from what the compiler sees.
OpenStack requested a “scoped credentials” feature. Currently, the generated http password is a kind of scoped credentials where the allowed set of actions is defined by the allowed set of actions of the user owning these credentials. OpenStack would like to have the possibility to generate multiple credentials and assign different scopes to each, similar to the OAuth scopes.
We discusssed this requirement. It is not clear how would the “scoped credentials” feature work together with the (fine grained) permission system in Gerrit and what exactly the possible set of scopes would be. For example, a “Git” scope which would allow only Git operations could be imagined. However, in Gerrit it is possible to do many things over the Git protocol, including setting topics, reviewers, hashtags, etc…
Luca will reach out OpenStack and propose a plugin-like implementation strategy, which could satisfy their requirements.