Automatic Updates Initiative meeting on Sept 21st, 2021 [#3232928]

This meeting:➤ Is for core developers, initiative contributors, the Drupal Association and anyone interested in the initiative.➤ Usually happens every other Tuesday at 1700 UTC.➤ Is done over chat.➤ Happens in threads, which you can follow to be notified of new replies even if you don’t comment in the thread. You may also join the meeting later and participate asynchronously!➤ Has a public agenda anyone can add to in: #3232928➤ Transcript will be exported and posted to the agenda issue. For anonymous comments, start with a :bust_in_silhouette: emoji. To take a comment or thread off the record, start with a :no_entry_sign: emoji.

0️⃣ Who is here today? Comment in the thread below to introduce yourself and tell us why you are joining us. What are you looking forward to this fall? (edited)

hestenet (he/him)	Tim from the Drupal Association, in Portland, OR - coordinator.
tedbow	Ted, Acquia, developer AutoUpdate initiative, Ithaca, NY
eiriksm	Eirik from ny media and violinist.io, Trondheim, Norway. Joining to keep up to date. This fall i am looking forward to a week on the cabin with my family :house_with_garden:
dts	Hi all :slightly_smiling_face: David here.
Christopher Gervais	Christopher is here from Consensus. I'm working on the TUF architecture/deployment (edited)

1️⃣ Do you have any topics to propose for the meeting today? Feel free to propose them in this thread, and then I will give them their own unique threads for discussion. Conversation moving slow? Go ahead and open your own thread in the next numeric order.

2️⃣Manually testing the Automatic Updates module(core prototype)

tedbow	We are working on some instruction for manually testing the module.We are at a point where we have solved a lot of obvious bugs and you can test it locally with these instructions[#3230856]
tedbow	So we want feedback on the module and the instructions itselfHere are the current instructions by themselves https://git.drupalcode.org/project/automatic_updates/-/raw/eac0588fb8861...
hestenet (he/him)	Shall I repost this thread to #contribute maybe?
tedbow	I think I already posted there
hestenet (he/him)	Ah, okay - nvm then
tedbow	but you know “great minds….” :stuck_out_tongue_winking_eye:
hestenet (he/him)	If you get desperate for testers I could escalate to an at-here in this channel, but we're probably not at that point yet.
Christopher Gervais	I've been working on a local DDEV-based test environment for the TUF implementation. I'd like to perhaps integrate the auto-updates tests, as I already have a Drupal, Behat, etc.
Christopher Gervais	not to supplant anything. But I'll be able to test this, possiobly automate some of it
tedbow	ok. the contrib module we are testing though doesn’t integrate with TUF currently
hestenet (he/him)	That is to say, the php client library isn't implementing: https://github.com/php-tuf yet, because there isn't a server yet to sign it - is that right @tedbow?
hestenet (he/him)	Do we have or should we start a new branch where that is enabled so that we can start testing that portion of it as the signing server comes online?
tedbow	Right now the plan is that automatic_updates module itself won’t be php-tuf aware. The https://github.com/php-tuf/composer-integration would take care of the integration with https://github.com/php-tuf/php-tuf.So if you have the composer-integration composer plugin just doing composer require or composer update the requests composer makes would be handled in way that calls php-tuf which will then call drupal.org TUF server side implementationSo basically `automatic_updates will just do normal(besides the staging) composer operations and `composer-integration will handle throwing errors if TUF error occurs.So this could be testing by running composer commands form the command line. as long as composer-intergration is required in the project. There are some tests in `composer-intergration` now but we were on pause to wait for drupal.org work
tedbow	at some point the automatic_updates module will probably just need to something to ensure that the composer-integration composer plugin is present but not much else. @phenaproxima does my description seem right?
hestenet (he/him)	Okay - @Christopher Gervais Are you following that? Sounds like as long as your test environment requires the composer-integration plugin it should be checking for TUF signatures.. (edited)
phenaproxima	@tedbow That seems accurate to me. I don’t think Automatic Updates should really be TUF-aware. Honestly, the most I would maybe do is check for the php-tuf/composer-integration plugin and emit a warning if it’s not there.
tedbow	I think if the 1.0 version of automatic_upddates requires TUF implementation then we should probably not allow updates if php-tuf/composer-integration is not present but we can figure that out later
tedbow	if someone really wants to run without php-tuf/composer-integration there is not much we can do if they remove our validation checker but the default implementation require it
phenaproxima	we can figure that out laterSure. This would be as simple as changing createWarning() to createError()
Christopher Gervais	So this could be testing by running composer commands form the command line. as long as composer-intergration is required in the project. There are some tests in `composer-intergration` now but we were on pause to wait for drupal.org workThis is pretty much what I had in mind, at first (edited)
Christopher Gervais	For example, I've implemented a Behat context that provides terminal steps (eg. "Given I run ...", "Then I should see ...", "The following files should exist", etc.)

3️⃣ If anybody wants to help with instructions for how to setup a develop environment #3233103: Document how to set up a development environment

tedbow	the one thing I think we need is prefer-source
Christopher Gervais	echoing what I said re. topic 2, I could help here in the context of my work on TUF

4️⃣ DrupalCon Europe is coming up fast - do we have volunteers to participate in the initiative update keynote? (Any changes to structure for this one @Gábor Hojtsy (he/him)?)

hestenet (he/him)	I can certainly do so in a pinch, but happy of course to let other folks take the stage.
Gábor Hojtsy (he/him)	No change in structure. I think Dries covers the initiative in his keynote, but the initiative keynote on Thursday is at the end of the conference, so we can do a “takeaway” version that keeps people inspired .
Gábor Hojtsy (he/him)	It is super early for @hestenet (he/him) :smile:
hestenet (he/him)	Heh - yes. But I could also pre-record something as need be. Just need the paramters on time and anything I'd need to do with slides to be consistent with everyone else :slightly_smiling_face:
Gábor Hojtsy (he/him)	https://events.drupal.org/europe2021/sessions/keynote-drupal-core-initia...
Gábor Hojtsy (he/him)	Well, I am also in discussion with DDI to possibly record their segment. I think it would be sad if it would be stiched together recordings. Since its already a virtual stream, how do you convince people next to pay for it live?
hestenet (he/him)	That's fair enough to be sure. And I've been getting up at all sorts of crazy hours for other events so I can do that if we need to :flex:
Gábor Hojtsy (he/him)	It does not need to be you though :slightly_smiling_face:
hestenet (he/him)	For sure! If someone in a closer timezone can manage I will be thrilled :slightly_smiling_face:

5️⃣ Are there other relevant Drupalcon Europe sessions? Do folks want to set up some co-working sessions to get ready?

tedbow	I am not presenting this time. I will take a look at the sessions to see if any are related
hestenet (he/him)	https://events.drupal.org/europe2021/schedule

Participants:

hestenet, tedbow, eiriksm, dts, Christopher Gervais, phenaproxima, Gábor Hojtsy