# Governance Meeting, June 26, 2023

**URL:** <https://community.jenkins.io/t/governance-meeting-june-26-2023/8196>\
**Category:** Community\
**Tags:** meeting, governance\
**Created:** [June 27, 2023, 2:37am UTC](https://community.jenkins.io/t/governance-meeting-june-26-2023/8196 "2023-06-27T02:37:29Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![MarkEWaite](https://dub1.discourse-cdn.com/flex013/user_avatar/community.jenkins.io/markewaite/32/20_2.png) [@MarkEWaite](https://community.jenkins.io/u/MarkEWaite)\
**Post date:** [June 27, 2023, 2:37am UTC](https://community.jenkins.io/t/governance-meeting-june-26-2023/8196/1 "2023-06-27T02:37:29Z")

</div>

2023-06-26T17:00:00Z

[![](https://europe1.discourse-cdn.com/flex013/uploads/jenkins/original/2X/3/3a85beb9d0d7630b9a646549e2bde7746708ba13.jpeg "Jenkins Governance Meeting June 26, 2023") ](https://www.youtube.com/watch?v=83YhwHqwIUE)

## Jun 26, 2023

Participants: Mark Waite, Alexander Brandes, Ullrich Hafner, Basil Crow, Bruno Verachten, Oleg Nenashev

Agenda:

- News
  - Jenkins 2.401.2 releases Wednesday June 28, 2023
  - CDF Technical Oversight Committee election is in progress
    - Mark Waite nominated from the Jenkins project
    - 4 seats on the committee, 6 candidates
    - Please cast your ballot (email invitations sent to those eligible to vote (from [opavote.com](http://opavote.com)))
    - Deadline for voting is today

- Action Items
  - EasyCLA to be documented by Oleg
    - Kris Stern submitted an individual CLA with a signed PDF and through the Linux Foundation
      - Kris wants to join the Security team
      - ICLA not strictly required for current work

    - NEW: [Alexander Brandes](mailto:mc.cache99@gmail.com) finished documenting EasyCLA in [Document EasyCLA by NotMyFault · Pull Request #104 · jenkinsci/infra-cla · GitHub](https://github.com/jenkinsci/infra-cla/pull/104)
      - No more GPG armor, no more printing of PDF files
      - Links to documentation from Linux Foundation with their screenshots

  - Mark Waite submit [jenkins.io](http://jenkins.io) pull request to combine subprojects and SIGs into a single concept - “working groups”
    - Roadmap update pull requests
    - More pull requests needed

  - Retire the Chinese Jenkins site
    - Chinese site link removed from [www.jenkins.io](http://www.jenkins.io) header
    - Kevin Martens (Docs Officer) tracking [help desk ticket](https://github.com/jenkins-infra/helpdesk/issues/3379) to replace the Chinese pages with redirects to the English pages
      - Need a redirect from [Jenkins](https://www.jenkins.io/zh/) to [https://www.jenkins.io/](https://www.jenkins.io/zh/)

  - Mark Waite archive the governance meeting notes to a GitHub repository, use the Google doc as the working document, then publish final notes
    - Gavin has prepared the archive, need a destination repository
    - See the [infra help desk ticket](https://github.com/jenkins-infra/helpdesk/issues/3271) tracking the discussion
    - Will use jenkins-infra as the location
      - Accept that we’ll place them in jenkins-infra as recommended in the help desk ticket

  - Mark Waite [retrospective on signing certificate renewal process](https://docs.google.com/document/d/1BB2TueNTLhK3TcJ5senSSSMdzy9D95DxPXuWNzL3k2s/edit#) and its improvements
    - Not yet collected the details of the retrospective, still to be done
    - Code signing certificate for MSI and WAR files
    - PGP signing key for RPM and DEB files
      - Debian key packaging improvements (some other projects use that technique now)

    - Notification and process improvements
      - Reimbursement improvements

- Upgrade from Jira 8 to Jira 9 - Mark Waite
  - [IT-25544](https://jira.linuxfoundation.org/plugins/servlet/desk/portal/2/IT-25544) submitted to the Linux Foundation - end of life in October
  - Step 1 planned for July 6, 2023, up to 2 hour outage for database upgrade
    - Pacific time - afternoon (2:00 PM Pacific)
    - Database upgrade in step 1

- GitHub sponsors as a fund raising source for the Jenkins project - Mark Waite
  - [Newstack article](https://thenewstack.io/github-sees-open-source-organizational-donations-spike/) on a new GitHub program for larger scale funding of open source
  - Oleg notes that it is not easy to have GitHub sponsors deposit funds into LFX Crowdfunding
    - Would need GitHub Sponsors to transfer to a Stripe account, then to LFX account
    - LF Charities is a non-profit

  - GitHub supports concept of fiscal hosts and CNCF and Linux Foundation use OpenCollective that might be possible to use
    - GitHub transfers to OpenCollective account of Linux Foundation as fiscal host

  - No observed demand that we should enable GitHub Sponsors
    - No further plans for now, can reconsider in the future

- Budget and expenses - Mark Waite
  - All expenses correctly shown on the [Linux Foundation crowdfunding site](https://crowdfunding.lfx.linuxfoundation.org/projects/jenkins/financial)

- LFX Tooling - Alex Brandes
  - Jenkins project piloted into LFX Security, Alex was exploring it a few weeks ago
    - Why not onboarded the main Jenkins project into LFX Security
    - Pilot project was paused while we waited for the Linux foundation
      - LFX Security could not handle exceptions and false positive handling
        - Snyk allowed it, but subset allowed for LFX Security did not allow it

      - Talked to LFX Security team and finally suspended effort

    - Still no global configuration
      - It would have high rate of false positives with no easy way to exclude
      - Java packaging of Jenkins plugins needs special handling that is not available

    - Could enable it for Jenkins core but not workable for Jenkins plugins
      - Dependencies on other plugins are assumed to be a bundled dependency
        - False positive when plugin A declares a dependency on older version of plugin B

      - Can be done with Snyk and some custom work, but not with LFX Security

  - LFX tooling working group inside the CDF that has started their meetings
    - Tracy Ragan leading, Mark has attended past meetings, invite Alex Brandes to the meetings
    - Expanded scope of LFX Security might be worth more investigation

- Community activity
  - Artifactory bandwidth reduction project [https://repo.jenkins-ci.org](https://repo.jenkins-ci.org)
    - JFrog has asked that we switch our mirrored repositories (repo-1, jgit, etc.) from public to private so that they are not misused as caches by others
    - Changes to be evaluated to test the switch
      - Adjust parent poms to declare multiple repositories

  - Jenkins security team reviewing core pull requests to JavaScript and Jelly for next 2 months
    - Details in the [June 21, 2023 UX SIG meeting](https://community.jenkins.io/t/user-experience-sig-jun-21-2023/8116)
    - Alex Brandes requested 3 reviews and they were reviewed within a few hours of the request

  - [Prototype.js removal blog post](https://www.jenkins.io/blog/2023/05/12/removing-prototype-from-jenkins/) guides new contributors
    - [Prototype.js removal epic](https://issues.jenkins.io/browse/JENKINS-70906) making progress
    - Plugin progress visible in the [tracking sheet](https://docs.google.com/spreadsheets/d/1dpaKALZaK0_HIGy6ony3wnegr1frTg3u1lngG4KdoC8/edit?usp=sharing)
    - Pull requests submitted for most popular plugins
    - Feature flag available to disable prototype in Jenkins core 2.406 and later

  - HTMLUnit 3 upgrades proceeding through [250+ plugin pull requests](https://github.com/search?q=org%3Ajenkinsci+Upgrade+HtmlUnit+from+2.x+to+3.x&type=pullrequests)
    - Completed for [test harness](https://github.com/jenkinsci/jenkins-test-harness/pull/589), [core 2.409](https://github.com/jenkinsci/jenkins/pull/8050), tools, [plugin pom 4.66](https://github.com/jenkinsci/jenkins-test-harness/pull/589), and [plugin bom 2163](https://github.com/jenkinsci/bom/releases/tag/2163.v2d916d90c305)
    - See the [tracking sheet](https://docs.google.com/spreadsheets/d/1ih_gVd9uhxLw4BZ6IeJGrYsvu-DvIF0xovu4wZbaXy8/edit#gid=0) for latest status
    - Thanks to Tim Jacomb and Basil Crow, see Tim’s [replacement script](https://github.com/timja/htmlunit-2.x-to-3.x/blob/97a8841acda9660aa5fbff26ac2514a79749bce0/replace.sh)

  - [4 Google Summer of Code projects](https://www.jenkins.io/blog/2023/05/04/gsoc2023-projects-announcement/) approved and running
    - Thanks to Jean-Marc Meessen, Kris Stern, Alyssa Tong, and Bruno Verachten
    - Mid-term presentations July 6, 2023

  - [Early end of life for CentOS 7](https://groups.google.com/g/jenkinsci-dev/c/vyI0uQvxmm4/m/rpuQ9v_7AAAJ) in the Jenkins project - Nov 2023
    - No negative comments or other dissent from the plan