TSC Meeting (14 Nov 2023) - v3.8.1 patch release progress, v3.9.0 release plans

[arm4b]

November 2023 @StackStorm/tsc 1 hour meeting:

• Tuesday, 14 November 2023, 09:30 AM US Pacific / 06:30 PM EU CET
• See StackStorm TSC Meetings #33 for the schedule and how to join
• TLDR; Jitsi link: https://meet.jit.si/StackStormTSC

Meeting Agenda

Quick StackStorm News and Updates

Quick news, updates, shoutouts and what's new around the project from the last TSC meeting.

v3.8.1 Release Progress

• Target: before EOY - on track 👍
• Project - https://github.com/orgs/StackStorm/projects/34
• Release Manager: @armab
• Release Assistant: TSC volunteer needed!

Fixing the 🔴 broken st2 builds - ✅ almost done - Thanks everyone!

• st2
  • Use codecov-cli over python-codecov st2#6036 - thanks to @FileMagic
  • Fix Orquesta Integration Test Codecov Upload st2#6046 - thanks to @FileMagic
  • CI: Update ruby 2.4 -> 2.6 to fix CircleCI Packagecloud deploy step st2#6045
  • Remove unused codecov for Orquesta integration tests st2#6048
• orquesta
  • Fix CI Python 3.6 not available on ubuntu-latest github workflow orquesta#257 - thanks @amanda11 @nzlosh
• st2-packages
  • CI: Update ruby 2.4 -> 2.6 ro fix PackageCloud deploy step st2-packages#729
• ansible-st2
  • Fix e2e tests, drop Ubuntu18 ansible-st2#332 - thanks to @setswei
• puppet-st2
  • TBD by @bishopbm1
• docker
  • Change BATS image st2-docker#259 thanks @ZoeLeah
• k8s
  • Update K8s to latest version stackstorm-k8s#379 thanks @zoeLeah
• e2e-tests
  • Fix win e2e test - update the location for WinRM powershell setup script st2cd#473
  • https://github.com/StackStorm/ops-infra/pull/424 thanks @amanda11
  • Switch to MongoDB 4.4 fo U18 st2-packages#730
• st2web
  • Fix build, pin lerna version st2web#1008 - thanks @guzzijones

Updating StackStorm dependencies and upstream CVEs - very close

The StackStorm's upstream dependencies need updating. Multiple projects : st2, st2chatops, st2web, orquesta, OS-level dependencies (docker). Identify dependencies to bump, update.

• orquesta
  • Allow networkx<3 for Python 3.7 or newer orquesta#255
  • Reduce jsonschema requirements to allow 3.2 orquesta#251
  • Prepare for orquesta v1.6.0 release orquesta#258
• st2 (WIP)
  • Update Orquesta to v1.6.0 st2#6050
  • Update cryptography and pyOpenSSL (security) st2#6055
  • Fix EL7 build for Orquesta v1.6.0 update with 'python_version' markers st2-packages#728
  • Bump eventlet to fix setting SSLContext minimum_version property that results in RecursionErrors st2#6061 - thanks @jk464
  • Update requests to fix CVEs (security) st2#6062 - thanks @jk464
  • Update gitpython (security) st2#6063
• st2web
  • Update dependencies st2web#1009 thanks @enykeev
  • Update Node version to current st2web#1010 thanks @enykeev
  • Update additional dependencies st2web#1020 @enykeev
• st2chatops
  • !HELP WANTED! - Regenerate npm-shrinkwrap to up-to-date dependencies (security) st2chatops#133

v3.9.0 Release Planning

• Project: https://github.com/orgs/StackStorm/projects/31
• Target: ???
  • +1m, +2m, +3m after the patch release?
• Release Manager: TSC volunteer Needed!
• Release Assistant: TSC volunteer Needed!
• Major changes:
  • Drop py3.6
    • Drop U18
    • Migrate py3.6 -> ??? for EL7
  • Add U22
  • Upgrade MongoDB to v6.0
  • SSO/SAML support (PRs by community)
  • pants builds?

[jk464]

For EL7 - CentOS 7 goes EOL on June 30, 2024 - so 3.9.0 could drop support for EL7 and just support EL8/9 going forward.

It is possible to install python 3.8 on CentOS 7 by using rh-python38 from SCLo repo.

But is it worth going to the effort to do that if by:

Target: ???
+1m, +2m, +3m after the patch release?

There's only going to be 3-5 months of support on EL7 left by the time 3.9.0 is out?

[amanda11]

For EL7 - CentOS 7 goes EOL on June 30, 2024 - so 3.9.0 could drop support for EL7 and just support EL8/9 going forward.

It is possible to install python 3.8 on CentOS 7 by using rh-python38 from SCLo repo.

But is it worth going to the effort to do that if by:

Target: ???
+1m, +2m, +3m after the patch release?

There's only going to be 3-5 months of support on EL7 left by the time 3.9.0 is out?

EL9 isn't in the 3.9.0 list of changes on here. EL9 would require adding python 3.9 support (which might not be a huge issue now we have the unit-tests passing on python 3.9.0).

It would be nice to swap EL7 for EL9 with python 3.9, but not sure its possible in the timescales. But depends on effort to move for EL7, or do we just drop EL7 from 3.9?

Equally though RedHat no-longer officially support python 3.8 on EL8, it reached end of support May 2023. So although you can do it, its not on their application stream lifecycle anymore.

However RedHat are only supporting python 3.9 until May2024 on both EL8 and EL9, and the long support is only on python 3.11 - see https://access.redhat.com/support/policy/updates/rhel-app-streams-life-cycle#rhel8_application_streams.
So even moving to python 3.9 is short-lived in relation to RHEL application lifecycles.

[jk464]

Ah @amanda11 I didn't check the support story on EL8/9 before commenting, my bad for assuming.

I do think its worth adding Python 3.9+ support to the list features aimed for in 3.9.0.

Looking at https://endoflife.date/python - Even Python 3.8 has only got 10 months (14 Oct 2024) of support left - so If not done in 3.9.0, a 3.10.0 release of StackStorm would need to be out by then, otherwise StackStorm wouldn't be available on any supported version of Python after 14 Oct 2024.

I'm vaguely aware that Red Hat or Ubuntu do provide additional support to Python after the Python EOL (I can't recall the exact details, other than what you've commented above on Red Hat). However at this point its probably worth getting support for the latest version of Python we can into 3.9.0 (and keep Python 3.8 support until October next year) - because if anything else, as @armab and I have been seeing with Python 3.6, being stuck on such old release of Python is starting to cause issues with outdated dependencies, accumulating CVEs, and no support for fixed versions.