Automatic Updates Initiative meeting on August 6th [#3156704]

0️⃣ This month is a special edition of the #autoupdates initiative meeting - feel free to introduce yourself in this thread (edited)

hestenet (he/him)	Tim with the DA :slightly_smiling_face:
dstol	Hi, Dave here
dts	I'm here but also doing the sprint.
JayKandari	Jaideep, joining late night… syncing up..
dww	Derek, US, Black Lives Matter - following remotely mostly, but very excited about the progress you've all made this week!
eiriksm	Eirik from Norway. Lurking through the backlogs, and super excited about the work being done!

1️⃣ Firstly - now that this is a primary initiative for the Drupal 9 cycle, we want to move to a biweekly schedule - PLEASE fill out this poll if you want to participate: https://doodle.com/poll/ugfsm2mb8qnwfpf6 (edited)

mbaynton	s/want/can/ :cry: :wink:
hestenet (he/him)	The current winning times are Tuesdays at 9 or 10 pacific, or 1pm Pacific.
dstol	I'll also be back in US east starting 1 Oct.
dstol	But my schedule until then is :party-dumpster-fire:
JayKandari	The timings for me are way too off for me to attend… 12:30am - 3:30am … No worries. I’m happy to follow up on slack… :slightly_smiling_face:
xjm	@mbaynton So you're saying you've not filled out the doodle because you don't think you can participate in the biweekly Slack meeting?
xjm	@pwolanin (he/him) and @mlhess might also be interested in entering their availability :slightly_smiling_face:
mbaynton	I'm saying I can't realistically contribute to the auto-updates initiative itself for now. I could attend a meeting and like, watch y'all, but I don't want to affect the scheduling.

2️⃣ All this week has been spent collaborating between Drupal, Typo3, and Joomla on the PHP-TUF framework for securing updates. Work will continue both on the PHP-TUF architecture, and individually for the actual implementation for each project. What should our next steps be to continue this work?

hestenet (he/him)

General - need folks to continue collaborating on github.com/php-tuf:drupal-logo: On the Drupal side:The switch to bi-weekly meetings per earlier thread should help keep up momentum.We need to dive a bit deeper into infrastructure implementation in the coming weeks (mostly @drumm) We should spend time with @heddn to begin seeing how the new TUF work could be slotted into the autoupdates module wrapper, as it were.

It's probably worth while having something advertising that we're working on a cross community effort. Seems special enough to warrant it. (edited)

hestenet (he/him)	I can help to kick that off after this contribution week, at least on the Drupal side.
dww	An initiative page would be great. Can point to the relevant d.o projects, issue queues + tags, and also the GitHub repo explaining the cross-project nature of that and why it's hosted elsewhere...
hestenet (he/him)	@dww And that's an important clarification.The secure signing and package delivery portions are what are handled by PHP-TUF - and are the parts that are really cross-project.Wrapping those key pieces into our own Automatic Updates implementation will be project specific - and is the next significant initiative phase.(A clarification that the initiative page could easily make)
JayKandari	Didn’t ran an extensive survey, but I saw few folks landing into the initiative page instead of the Roadmap page .And the initiative page information seems like it requires an update…Thoughts? (edited)
hestenet (he/him)	Hm... good question... those two pages should be more interconnected to each other probably.
dww	FWIW, the https://www.drupal.org/community-initiatives/drupal-core/bug-smash makes heavy use of the new JS issue counting stuff to have a bunch of links to various core issue queue searches, and points to lots of existing docs, a meta/plan issue for all the meetings, etc. I think it'd be fairly easy to do something similar with this initiative...
hestenet (he/him)	That stuff is so cool.
xjm	https://www.drupal.org/about/strategic-initiatives/automatic-updates already exists and links the roadmap
xjm	Updating it requires sufficient permissions to edit https://www.drupal.org/node/2977021/panelizer/default/content
xjm	But the roadmap is linked from the top already.

4️⃣ Other discussion items? Drop them in here and I'll thread them out.

JayKandari	Landing the first autoupdates patch in core? (edited)
JayKandari	or Port PSA functionality to core?
hestenet (he/him)	Porting PSA is more likely to happen first.. I think :thinking_face:

Participants:

hestenet (he/him), dstol, dts, JayKandari, dww, eiriksm, mbaynton, xjm