Open Stack

Here's an update on how this issue is shaping up.

As a reminder, the issue is that the Cinder project team has proposed to 
EOL and delete all current EM branches (that is, stable/train through 
stable/xena) due to the complexity of coordinating a fix for 
CVE-2023-2088 across all affected projects in the EM branches.  Given 
the badness of CVE-2023-2088, the team did not want any unfixed branches 
sitting around for people to use.

In the meantime, there has been a Forum session at the recent OpenInfra 
Summit and ongoing discussion in the TC culminating in the following 
proposal that I believe is coming close to agreement:

"Unmaintained status replaces Extended Maintenance"
https://review.opendev.org/c/openstack/governance/+/888771

Here's my understanding of how the new Unmaintained status (and its 
transition plan) impacts the Cinder team's proposal to EOL all the EM 
branches.

1. stable/train and stable/ussuri can be tagged EOL and deleted.  (For 
cinder, at least, stein and older are already EOL.)

2. stable/victoria, stable/wallaby, and stable/xena will immediately 
transition from EM to Unmaintained status.  This means that the Cinder 
project team has *no obligations* with respect to maintaining these 
branches or their gates.  (Technically, we never did, but now it will be 
completely clear.)  The branches will be renamed to 
unmaintained/victoria, unmaintained/wallaby, and unmaintained/xena to 
make their Unmaintained status unmistakable.

The maintenance of the Unmaintained branches will fall to a 
cinder-unmaintained-core team, whose exact composition is still under 
discussion on [0], but which will be completely separate from the 
cinder-core and cinder-stable-maint teams.  The cinder-core and 
cinder-stable-maint members have no obligation to participate in 
cinder-unmaintained-core (though they can if they want to).

3. The existence and ultimate EOL and deletion of 
unmaintained/{victoria,wallaby,xena} will follow the Unmaintained branch 
policy.  A sketch of what this means over the next few cycles is mapped 
out in this etherpad:
   https://etherpad.opendev.org/p/24gf87QcmV6xF4StbLQx

This email you are reading right now only concerns the way the new 
Unmaintained status proposal affects the Cinder project's plans with 
respect to the current Extended Maintenance branches.  I encourage 
everyone to read the full proposal [0] to understand how Unmaintained 
status will be applied across all projects going forward.

My personal opinion is that Unmaintained status and its transition plan 
addresses the concerns of the Cinder project team with respect to the 
current EM branches; the Cinder team will decide the team's position on 
this issue at today's weekly meeting (1400 UTC) [1].


cheers,
brian


[0] https://review.opendev.org/c/openstack/governance/+/888771
[1] https://etherpad.opendev.org/p/cinder-bobcat-meetings


On 7/6/23 2:01 PM, Brian Rosmaita wrote:
> On 7/6/23 1:05 PM, Nikolla, Kristi wrote:
> [snip]
>> As a courtesy to allow the TC to provide a resolution with coordinated 
>> guidelines for EOL-ing branches across projects, we please ask that 
>> you wait until the end of July at the latest.
> [snip]
> 
> This seems reasonable to me.  The Cinder project has announced its 
> intentions, namely, that we will not fix the gates for any of the 
> branches currently in EM, and that the EOL tags will (eventually) be 
> made at the hashes indicated in the proposed release patches:
> 
> https://review.opendev.org/q/topic:cinder-eol-june2023
> 
> If anyone in the wider OpenStack Community has a desire to have 
> backports merged into these branches, or to keep these branches open 
> longer, now would be a good time to step up and do all appropriate work 
> to make that happen.
> 
> cheers,
> brian
>