View source for Toolhub/Progress reports/2021-08-13

{{Toolhub progress report nav}}
Report on activities in the Toolhub project for the week ending '''{{SUBPAGENAME}}'''.

== Security review status update ==
{{Tracked|T273020}}
{{Tracked|T288532|Resolved}}
{{Tracked|T288542|Resolved}}
{{Tracked|T288536|Resolved}}
{{Tracked|T288539|Resolved}}
{{Tracked|T288539}}
{{Tracked|T288535}}
{{Tracked|T288551}}

The initial findings of the security review were [[phab:T273020#7271039|delivered on 2021-08-09]] as expected. Many thanks from the team to [[User:SBassett (WMF)|Scott Bassett]] for his work on this important task. Bryan has attempted to triage the feedback into things that need to be fixed prior to launch and things that need more investigation or are blocked for technical reasons:

; Required interventions
:*{{Done}} [[phab:T288532|Update Toolhub python dependencies with known security patches]]
:*{{Done}} [[phab:T288542|Update nodejs libraries that fall within current semver constraints]]
:*{{Done}} [[phab:T288536|Add timeouts to crawler calls to external URLs]]
:*{{Done}} [[phab:T288539|Add `force_escape` filter to Django template translation content]]
:*[[phab:T288539|Ensure that production deployment includes a Strict-Transport-Security header for toolhub.wikimedia.org]]

;Desired improvements
:*[[phab:T288535|Find vulnerabilty scanner to run periodically on Toolhub python dependencies]]
:*[[phab:T288551|Investigate replacing vue-cli with vite and webpack with rollup for Toolhub]]

{{Clear}}
== Kubernetes deployment progress ==
{{Tracked|T280881}}

[[User:Legoktm|Kunal Mehta]] from the Foundation's [[mw:Wikimedia Site Reliability Engineering#Service_Operations|Service Operations]] team and technical volunteer [[User:Majavah|Majavah]] submitted a flurry of patches earlier this week that move us closer to the production deployment. We believe the remaining work (besides testing all of these changes!) will be to connect the Toolhub service running in the Kubernetes cluster with the [[wikitech:Varnish|Varnish]] service which is part of the Wikimedia [[w:Content delivery network|CDN]].

== User experience improvements ==
{{Tracked|T286164}}

An [[gerrit:705519|omnibus patch of user interface improvements]] authored by Srishti was merged this week. These changes to the spacing, colors, and size of various user interface elements are inspired by our past [[Toolhub/Progress_reports/2021-07-02#Design_review|design review]] from folks working for the Foundation's [[mw:Design|Product Design]] team.

== Content licensing ==
{{Tracked|T288832}}

We very recently realized that establishing a content license for the toolinfo records and lists stored in Toolhub had been overlooked. [[phab:T288832|T288832]] has been created to track this need. Bryan has reached out to the Foundation's [[Wikimedia Foundation Legal department|Legal]] team for their professional advice on how to establish the default license. Watchers should not expect to see detailed information from the Legal team on the Phabricator task for reasons which are explained at [[Wikimedia Legal Disclaimer]].

Community members with strong and informed opinions on [[w:CC0|CC0]] and [[w:CC-BY-SA|CC-BY-SA]] license strengths and weakness are invited to provide their comments on the task as well.

== Wikimania 2021! ==
As reported [[Toolhub/Progress reports/2021-08-06#Toolhub_at_Wikimania|last week]] and the [[Toolhub/Progress reports/2021-07-30#Toolhub_at_Wikimania|week before]], we will be holding some Toolhub focused sessions during Wikimania 2021.

* [[wikimania:2021:Submissions/How to find tools to improve your workflows|Lightning talk titled "How to find tools to improve your workflows"]] on 2021-08-14 at 16:15 UTC in "building 4" of the main conference.
* [[wikimania:2021:Unconference/Toolhub|Unconference sessions]]
** Toolhub Introduction, Saturday 2021-08-14, 18:00-18:30 UTC
** Quality Signal Sessions: The Wikimania edition, Sunday 2021-08-15, 18:00-18:30 UTC
** Quality Signal Sessions: The Wikimania edition, Sunday 2021-08-15, 18:30-19:00 UTC

== Wrap up ==
All long term watchers of the project will likely realize that we did not achieve our hoped for 2021-08-12 production deployment target. We came very close, but ultimately there were more tasks left to complete in the final week than it was reasonably possible to accomplish. Bryan hopes that everyone is understanding of these delays, but also informed of what remains to be done and progress on those goals.