Minutes of the MiniTOP on the 2011-12-06

Setting

The MiniTOP will be held via telco 22:00 CET

Attendees: magu, marcus, uli, michael, dirk

Topics

(skip to agenda)

Action items from last meeting Meeting Action Items

Agenda

1. "Software-Assessment works slow"

2. bug#794 Display certs in admin console

3. bug #827 - New Points calculation / Thawte patch

4. Patches queue

  1. Translingo bug #985

    • https://translations.cacert.org (http://translations.cacert.org/) (replacement for translingo)

    • the translingo.cacert.org had been in operation far longer, so I think it is possible that some users migrated to translingo.cacert.org, without telling us.
    • I would suggest to mass-mail the email addresses of the translation-project leaders in the translingo database, to inform them, and to ask them to speak up if they still need it
    • last foreign uploads 2008 on about 13 + cacert projects
    • whohas translingo server console access?
      • mario
    • req for console access for michael to contact project leaders, Updates?
    • Transfer In, Transfer Out problems
    • Update from new deployment ?
    • opened for: create an account can now be started
    • Michael current state:
      • import and export routine works
      • script to incorporate updates needs fixed
    • next: complete language handling needs to be updated
    • accept lang handler needs fix
      • FF de, de_de
      • IE 6 de, 8,9 de_de
    • working session within last meeting: michael, marcus
      • infos from meeting 2011-10-18
        • pdf code needs rewrite (uni code library, move to external server (outsourcing))
        • message cert notification - uses perl code, text source not avail (get bind-text-domain)
    • current state?
    • Marcus sent mailing to translators, no response so far, no tests so far (week 3)
      • Morten NO
      • Emanuel IT
    • current state:
      • create test system accounts dutch@test, espania@test and so on, let users do their tests
      • Magu, Marcus will give it a try
      • a couple of testers has started testing and reporting within the last 7 days
      • results: de, fr, en, pl, es, pl
    • last meeting: working session bug#985 translingo transfer

      • Michael: needs 2nd review
  2. bug#894 "Haeckchen bug" - review done, changes needs reviewed again

    • 3

      Dirk

      bug#894 assure someone patches (checkbox)

      (incl wot.php changes)
      tested by 2, needs 2nd review, deploy
      new test round

      {0}

      ? / u1 / m1

    • review by dirk in session, review ok
    • current state:
      • needs testing
      • Magu, Marcus will pickup the task
      • one and last test and report done 2011-11-19 (week 4)
    • running arbitration a20111001.1 prob

      • checkbox on AP, "Haeckchen bug" helps to pass the "old" assurance
      • alternates: adding comment field if checkbox is not set
    • current patch: check on AP to disable
      • patch transfered to cacert-devel
    • first test: first two checkboxes set, ok
      • pojam case potential problem
        • < 18 years -> 10 pts, < 14 years -> 0 pts

        • 2011-11-01 -> 10.php: 0 pts, 15.php -> 10 pts

        • 14 years limit started with pojam, limit given by pojam reached, issue upto 10 pts
    • test report from 2011-11-29
      • 0 checkbox

        error missing checks

        only 1st checkbox

        error missing checks

        only 2nd checkbox

        error missing checks

        1+2 set

        ok

        1+2+3 set

        ok

    • ready to deploy?
  3. bug#540 No key usage attribute in cacert org certs anymore?

    • also: bug#905

    • Policy group discussion - Extended key usage -> p20111113, motion CARRIED

    • deployment
      1. prepare fixes -> Michael to prepare diffs, against svn

      2. sending to testserver
      3. transfer to critical system
  4. Marcus: working session bug#789 OA field extension

    • magu to test
  5. Marcus: working session bug#859 Activity on Account

    • Michael: needs 1st review + transfer to testserver
  6. bug #976 - database restructure preperation

    • current state summary:
      • transfered to critical system, patch has been applied
      • database upgrade, scheduled for Wed Nov 23rd, successfully finished
    • downtime was about 5 min
    • cacert user has all permissions
      • Michael: proposal to limit permissions, eg remove, drop, index, references
      • magu: problem, can we expect that all works as before?
        • uli: if there are permission problems, this will be logged and logs the source
      • Update: Michael + Wytze worked on this, problem solved?

5. Michaels workqueue

  1. OCSP server - timeout 10 min too short, 3 days to long, recommendation is 24-48 hours max, verisign: 7 days, startssl: 2d
  2. Build + Document Emergency Patches Path
  3. New function to TMS - edit notary table record
    • bug #980

    • infos from last meeting
    • testers needs editing individual notary records: fields "method", "awarded", "points"
    • easier to create notary records with testserver (add F2F), and edit existing record, doesn't need to check for assurer-from, assuree-to and so on
    • Update?
    • Michael (2011-11-15): after some other bug reviews

6. Dirks workqueue - The List of open / running / unhandled bugs

  1. VBscript for Vista/Win7 (select keysize >= 1024) - reminder to dirk

    • x1 Dirk, new bug#964
      DEV: bug#918 (Part II) (a20110312.1) Weak keys: /pages/account/.. 4.php, 17.php to combine ? (/includes/keygen.php) DEV

      current state: test /account/4.php added to testserver
      Marcus will do detailed tests on Wed
      some references added to bug#964

      {-}

    • as part of
    • x1 Arbitration case a20110312.1 Weak keys bug #918 / bug #954 / bug#964

    • Current state:
      • {g}

        pre mailing sent

        {g}

        keys revocation script to bulk revoke weak keys, new bug #954, finished

        {-}

        dirk: DEV: a20110312.1 bug#918 Weak keys: /pages/account/.. 4.php, 17.php to combine ? (/includes/keygen.php) DEV
        vbscript needs to be improved with select box key size and lower limit to 2048 (based on https://wiki.mozilla.org/CA:MD5and1024)
        Api CertEnroll (MS crypto provider)
        new bug#964
        current state: test /account/4.php added to testserver
        Marcus will do detailed tests on Wed
        some references added to bug#964 - codename "BlackJack"

        {g}

        Weak keys blog post, published

        {g}

        Weak keys article published by Hanno(July 28), link is in CAcert's blog post (July 30)

        {b}

        weak keys: problems with cryptostick (to test at Froscon with Juergen ?)

    • cert enroll infos under bug#964

    • vista and win7 works with other engine !CryptoAPI (?) => Cryptography API: Next Generation

    • dirk: has not started the virtual machine
    • Question from Marcus: did someone contacted illuminat?
      • No, Marcus: to contact illuminat
      • illuminat will give it a try, first needs download of testserver image
    • Update?
      • marcus: illuminat not yet seen last time
      • baseline requirement - keyssize >= 2048 to fix till end of 2011

      • how to proceed?
      • dirk: 1st step, to bring win test server localy online
      • marcus: to contact illuminat
      • Do we have other developers who may pick up this project?

7. General Bugs List Overview

  1. Bugs to Review #1, transfer to testserver - Currently 4

    • uli

      bug #977 admin console text fix

      admin console Sysadmin - find domain - lists 2 tables - one for user accounts, one for org accounts, naming issue

      {0}

      uli

      bug #967 OA isassurer check

      Give an OA the oppertuntiy to check if a desiginated Organisation Admininistrator is a CAcert assurer

      {0}

      uli

      bug #859 admin console interface

      feature request: show activity on an account in the admin interface, new update /!\

      {0}

      inopiae

      bug #981 OA overview (dupe of bug #943)

      New layout of view for Organisation Administraors in account/id35

      {0}

  2. Bugs under testing: - Currently 5

    • neo

      bug #985 move translingo to translations

      check language settings under testserver

      {0}

      inopiae

      bug #920 Join - single name only (eg Indonesian)

      details under bug number
      present to Policy Group ?

      {0}

      uli

      bug #855 admin console interface "unknown" + "empty" assurance method fields, needed for correct testing on testserver

      admin console lists "empty" and "Unknown" assurance types on listing given Assurances

      {0}

      3

      Dirk

      bug#894 assure someone patches (checkbox)

      (incl wot.php changes)
      tested by 2, needs 2nd review, deploy
      new test round

      {0}

      ? / u1 / m1

      7

      uli, ted

      bug #789 OA edit domain fix

      Editing domain for organisations does not work
      new update 2011-09-26
      more fixes, more testing
      * testcase scenario
      * open org, edit 1st domain in new window, edit 2nd domain in new window
      * results in: change made in window 2, written to record in window 2
      * needs cross checking

      {0}

      ? / u7 / m7

  3. Needs 2nd review + transfer to Critical team, to bundle, to deploy - Currently 1

    • define priority eg. 10,2, and so on, proposed order: from 1 to 10

      8

      Ted, uli

      bug #957 Resize the comment field on https://secure.cacert.org/account.php?id=27 so more information is visible

      last update 2011-08-19
      tested 3 times
      ready to deploy?

      {0}

      ? / u8 / m8

  4. Needs development, deployment, discussion, reminder
    1. bug #835 Migrate CATS onto testserver

      • bug #835 Assurer challenge (on testserver)

        asssigned to Ted, CATS to install on ca-mgr1, awaiting deployment

        {0}

8. Long term projects

  1. strategy plans ... next: strategy for "New Roots & Escrow"

    1. idea: using indirect crl's ?
      • 2 crl's needed, one valid, one invalid crl server
      • more infos available ? who ?
        1. build testserver with special certs
        2. Magu, Michael to send instructions for test deployment
      • meetings ago we've defined Testing requirements and a potential testszenario
      • to remind every meeting
      • Michael: testserver environment deployment
      • Michael will review after Certs extension policy group vote
    2. policy group: define requirements
      • multimember escrow method ?
        • needs risk analyze
        • potential candidates ?
          • Marcus to contacted Benedikt, will contact Thomas K
          • Next step(s)
  2. CI (Update)
    1. description to eclipse testpage, Webinar

      • deployment scenario:
        1. create testusers
        2. testing
        3. delete testusers
      • regression test for standard tests: eg 0,1,49,50,51,99,100,101 pts w/ and w/o CATS passed
      • reminder
    2. Jubula Test-Tool (by Michael) - update?
    3. new proposal by Sven: Webdriver with Maven and Jenkins-CI
      1. Jubula vs. Webdriver
      2. testserver variants
        1. testserver for manual tests
        2. testserver of OS and application upgrades
        3. testserver for CI
      3. test methods
        1. unit test
          • test single modules, exceptions
        2. integration tests
          • test interaction of modules
        3. system tests
          • complete system test, with database interactions, module interactions and much more
      4. sven did some work regarding frontendtest (Webdriver with Maven and Jenkins-CI)
        • Michael did some review: probably needs some seperation
  3. Infrastructure seperation
    • contacting secure-u, oophaga started?
      • Frank, Mario, Ted, Uli, Sebastian ?
    • 2011-12-01: Vienna response

9. next meeting: Tuesday, December 13, 2011 22:00

Minutes

  1. bug #827 mailing results
    • mailing started: 2011-11-27 10:00
    • mailing finished: 2011-12-01 00:00
    • 210.000 mails sent
    • approx 24747 returns (~10%)
  2. "Software-Assessment works slow"
    • Why it takes so long to pass patches ?
      • Does a patch doesn't work as advertised?
      • Or is it: this patch raises security issues?
    • Michael: most problems code quality
      • doesn't qualify on quality
      • not well documented
    • security leaks?
      • not much, not many
      • problems can be
        1. confidentialy
        2. integrity
        3. availability
    • SP: defines review on Security breaches
    • eg points removal, patch written, no security breach, should this patch be passed?
    • Who defines code good to go? Commiter job, quality check
    • 2 tier developers team
      • developers reviews patches
      • software-assessors makes last review
    • Task: transfer patches to production
      • we have to deal with current resources
      • we have to deal with spaghetti code, a mess to review
      • wish list: quality code
      • It does not make sense to pass unfinished code, if the patch pops up 3 months later again
    • sub discussion: google code of summer
    • announcements to the dev mailing list to encourage developers to become active
    • responses to software-assessment project team meeting invitations can be forwarded to developers list
    • developers list: 130 subscribers
    • Marcus -> dirk: announcement of vbscript bug to developers mailing list

      • change keysize
      • merge 2 scripts to one
        • fix on script 1 needs fix in 2nd script too, solutions: include, one file, or comment fix script 2 too
    • Process restructure?
      1. quality level definitions?
      2. fast processing?
        • quality standards?
        • first reviewer has to check quality?
        • 2nd reviewer only checks security breach topics?
        • split commiter review from SA review?
      3. proposal?
        1. first round: committer review, testing, committer review
        2. second round: review by 2 SAs
  3. interrupt: bug#964 -> codename "BlackJack"

    • relates to IE8 problem, that certs cannot be created
    • is there a security issue with available fix? also bug#918

    • related 927, 901, 847
    • a patch is online on testserver, but cannot found
    • related patch files, /pages/account/ 3,4,16,17; /include/account.php
    • there are other vbscript pages: ../account/ 6 + 19
  4. bug#794 display certs in admin console

    • 1. review by michael
    • 2 tests done
    • 2nd review dirk and go
    • working session: michael / dirk - git for beginners and runaways
  5. Helping CAcert
    • How does recruitment work?
    • Newsletters, recuring notifications
    • Fosdem -> focus on Nucleus events

    • Recruitment on events?
    • Recruitment page eg events/Recruitment, HelpingCAcert, Jobs

    • Flyers?
    • re-design main page:
      • dirk: 3 news, upcoming events
      • michael: *
      • rss-feed script modification is simple
      • main page cms page, login to secure area
        • public: www.cacert.org
          • secure1: www.cacert.org
          • secure2: secure.cacert.org

Fixed Action Items since last or within meeting


Action Items New

Action items: Meeting Action Items

Software/Assessment/ActionItems

Development, Deployment, Discussion

  • OAO, Ted

    bug #943 change OA admin/assurer text

    needs 2nd test -> Fabian, Marc, Alex? {g} / needs 2nd review -> Ted, rejected

    {-}

    uli, Ted

    bug #824 Org User cert fix Case study

    Organisation User Certificates: Need UI improvement for proper production usage

    {0}

    uli, ted

    bug #823 email address removal fix

    No warning when removing e-mail address from account that certificates will be revoked
    checked by 4, needs 2nd review, deploy
    rejected

    {-}

    inopiae

    bug #920 Join - single name only (eg Indonesian)

    details under bug number

    {0}

    uli

    bug #859 admin console interface

    feature request: show activity on an account in the admin interface
    rejected, certs login doesn't modify "modified" field

    {r}

    Michael

    bug #540

    p20111113 CPS #7.1.2 "Certificate Extensions" adjustments - testing
    uli, marcus: needs full cert create tests
    duplicate report to bug#978
    tested by 3, 2nd review done, transfered
    Ken reported: still has problems, bug kept open

    {0}

    gagern, NEO

    bug #440 Problem with subjectAltName (CSR, renew certs)

    There seems to be a problem with the subjectAltName. Dupes, missing entries, and more, rejected, needs further development

    {r}

    neo

    bug #1025 Domain Dispute issue

    disputes rc and rc2 var prob
    needs work

    {r}

    dirk

    bug #1054 0001054: Review the code regarding the new point calculation

    Thawte patch part II
    needs further work

    {r}

Software Assessors: Review 1 / add to cacert-devel, add to testserver

  • Software-Assessors task

Testing

  • Testers task

    neo

    bug #1004 Stats page improvement

    tested by 2, needs 2nd review

    {0}

    neo

    Bugs #1159 it might be possible to execute commands on the signing server

    {0}

    inopiae

    bug #1065 Wrong wording when sending mails during the assurance process

    {0}

    inopiae

    bug #1162 calcutate (the passwords) hash in php instead of in mysql

    create test scenarios for the software testers /!\
    Full testing /!\

    {0}

    inopiae

    bug #0028 Wrong language for you've been assured & [CAcert.org] Client Certificate emails

    {0}

    inopiae

    bug #988 TTP cap form deployment

    {0}

Software Assessors: 2nd Review, Bundle Package to Critical Team

  • Software-Assessors task

    Ted

    bug #500 Get contact mail adress after resolving test

    tested by 3, requires review

    {0}

    Ted

    bug #1140 Show if a test is passed in learnprogress

    tested by 3, requires review

    {0}

    magu

    bug #1131 Rename _all_ Policies from .php to .html and fix all links

    global policy directory maintenance and update

    {0}

    inopiae

    bug #1010 Reorder the view on organisation certificates

    tested by 3

    {0}

Software Assessors: Bundle Package to Critical Team

  • Software-Assessors task

    inopiae

    bug #1139 Add new fields to the database

    tests through #500 and #1140, 2nd review done, requires transfer

    {0}

Awaiting Response from Critical Team

  • inopiae

    bug #411 Wrong text is made into link

    {g}