User Experience SIG - December 4, 2024

Contributing UX SIG
,
1

2024-12-04T18:00:00Z

Dec 4, 2024

  • Attending

    • Mark Waite
    • Antoine Neveux
    • Bruno Verachten
    • Kris Stern
    • Tim Jacomb
    • Kevin Martens
    • Soham Juneja

  • Topics

    • Jenkins releases
      • Jenkins 2.488 released 3 Dec 2024
      • Jenkins 2.479.2 released 26 Nov 2024
        • Watching bug tracker closely, looks smooth (Spring Security 6 working well)
      • 2.479.3 scheduled for 8 Jan 2025, RC 11 Dec 2024
    • GSoC project proposals
      • Google funds new contributors as the help open source projects
        • Projects have been successful in Jenkins
        • Kris Stern - GSoC lead organization admin
      • Project ideas
      • Would anyone be willing to mentor?
        • No project idea will be submitted to Google without multiple mentors
    • YahooUI removal - progress report and next steps
      • Markus Winter and Tim Jacomb discussing when and how we remove YahooUI from Jenkins
        • Plugin releases are completed (all over 2000 deployments)
        • Waiting for review on the command palette that has been waiting for months
          • PR-7569 - Use a command palette for search (needs more review)
        • Tim suggested to switch the feature flag to default without YahooUI
          • Then switch if off completely after a few weeks
          • Switch the feature flag back in commercial product
        • In the chat channel, make your voice heard there
    • Jenkins Content Security Policy project
      • 3 month project for Yaroslav Afenkin and Shlomo Dahan
        • Funded by Alpha-Omega, improving security of open source projects
      • Blog post with the results from first month
      • Sheet shows the progress
      • Deployment alternatives for more restrictive Jenkins policy
        • Use CSP plugin while developing and testing
        • Final implementation in Jenkins core
      • Basil’s idea to improve migrations (like the CSP migration)
        • Traditional migrations prepare all the plugins, track them in a sheet, release them all, then flip the switch in a weekly release, with an escape hatch if needed
          • Examples
            • Tables to divs
            • PrototypeJS
            • Jakarta EE 9
          • Benefits
            • Simple once the switch is toggled, only one version to support
            • Assured that you’ll have the improvement
          • Weaknesses
            • Burden on implementers to prepare every plugin for compatibility
          • Unlikely to work for CSP because there are hundreds of plugins to change, 10x more than YahooUI
        • Yaroslav suggested a centrally maintained list of CSP compliant plugins
        • Basil suggested that we could use the local CSP results to recommend CSP setting to the user
          • If no CSP violations reported in a week (or 4 days or …), suggest they enable restrictive CSP
          • If CSP violations reported, suggest they disable restrictive CSP, submit a violation report
          • Benefits
            • Adapts to actual plugin use in that Jenkins controller
            • Benefits users that are using CSP compliant plugins
          • Weaknesses
            • Jenkins core implementation is more complicated than a switch or escape hatch
        • Jenkins core feature, not a CSP plugin in its final implementation
    • Recent UI topics