(CANCELLED) LTS WG Meeting - 2016-12-12 8:00 PM UTC

[MylesBorins]

Invited

@nodejs/lts

When

🎉 It didn't happen! 🎉

Where

NOWHERE

Agenda

nodejs/node

• crypto: allow adding extra certs to well-known CAs #9139
  • Approval to land on v4 and v6
  • Is this important enough to release v4.8 as the next Argon release /cc @sam-github
    • Did you notice I found a good use for the code names there! 🎉

In closed environments, self-signed or privately signed certificates are
commonly used, and rejected by Node.js since their root CAs are not
well-known. Allow extending the set of well-known compiled-in CAs via
environment, so they can be set as a matter of policy.

• backport util.inspect.custom #9688

Add a util.inspect.Custom Symbol which can be used to customize util.inspect() output. Providing obj[util.inspect.Custom] works like providing obj.inspect, except that the former allows avoiding name clashes with other inspect() methods.

Minutes

Yeah no...

[MylesBorins]

I do want to mention that the only two things we have on the agenda are approvals for Semver-minor backports, and a decision about doing an argon minor back to back. All of these should be able to be discussed in an async fashion.

If people are up for it I would like to suggest we postpone the meeting and use this thread to discuss the issues above instead.

Thoughts?

[sam-github]

Nice :-). I think there was a move to drop the "v"s from the versions to get people used to it before the 8.x release.

[Fishrock123]

1. I think we should probably wait until the PR to be able to use system CAs/Custom CAs lands?
2. Seems unimportant.

[MylesBorins]

@Fishrock123 #9139 has landed
¯\_(ツ)_/¯

edit: OH NVM... in a release

... I'll show myself out

[Fishrock123]

Huh? The PR I mean is nodejs/node#8334

That way we don't need two minor releases.

[MylesBorins]

@sam-github can you please comment on the difference between nodejs/node#9139 and nodejs/node#8334

edit: from the PR

Note that #8334 addresses a similar but not identical use-case, and works better for those (like linux distributions) that are willing to recompile Node.js to use OpenSSL's default certificate store. #8334
doesn't address those who cannot recompile, do not have access to the system certificate store, or
who are are on a system where the default certificate store is not exposed as an OpenSSL compatible
store (for example, OS X and Windows).

This discussion is about 9139 not 8334

[Fishrock123]

This discussion is about 9139 not 8334

I don't think they are mutually exclusive. I think if we are going to do a minor in LTS for one we might as well wait and do both.

[sam-github]

Unrelated. #8334 is to allow linux distros to not only link against system openssl (which node already supports at configure time), but to also use the system openssl's CA roots instead of the built-in.

I don't see why one would wait for the other.

[sam-github]

I'll be looking at 8334 today, though, fwiw.

[MylesBorins]

@Fishrock123 I was talking to @sam-github at interactive and it would appear that v4 and v6 are broken for using certain proxies without these CAs, making it difficult to use those version in certain regions.

I almost view it as a bug fix for that scenario

[sam-github]

Its no a regression, because its sucked for awhile, but @amarzavery (coincidentally) brought up the difficulties some communites are having using node, I pointed him at my PR. It would be nice to get this out, but if it needs to simmer a bit, I guess they can wait a bit longer for a usable npm.

[Fishrock123]

but if it needs to simmer a bit, I guess they can wait a bit longer for a usable npm.

It will take a while regardless. I don't see what a potential extra couple weeks makes in this case given it'l probably be more than a month out to begin with.

[sam-github]

Could be. I heard if this doesn't go in now, then it causes a cascade of even longer delays, but I don't understand the release pipeline ATM.

When are patches released? When minors? Why was the last 7.x a 7.2.1 instead of a 7.3.0? When will the next 6.x and 4.x come out? Will they contain only patches, or minors and patches?

I'm not sure I see the benefit of waiting for 8334 to land before releasing 9139. We save ourselves from two back-to-back minor releases, but what does that buy us? It's my assumption that the risk of releasing 9139 and 8334 is the same, whether they're bundled together, or released separately in two releases.

Also, 8334 does not solve the self-signed corporate cert issue for corporate Windows users. Waiting on 8334 could have an impact on corporate Windows users with no benefit to them, or to the Node community.