Express TC Meeting 07-31-2019

[dougwilson]

Who

The entire community is welcome to tune in and observe the meeting live at the time below. The following people are listed here as explicit invitees to get an email notification about the upcoming meeting:

Invited:

• @expressjs/express-tc

When

Jul 31, 2019 - 23:30 UTC

Where

YouTube Live

• Viewers: https://youtu.be/Y0HaLT0EM7U
• Participants: https://hangouts.google.com/hangouts/_/ytl/JqXRcjylFaCJmb-ReebPqE2LUSAFonsE12X_Ks728Rs=

Agenda

• Continuation of previous meeting Express TC Meeting 06-26-2019 #81
• Go over list of project priorities and top issues Document the current 'top 10' express' issues nodejs/package-maintenance#233 (comment)
• Discuss Move req prototype to separate repo #82

Propose other agenda topics which can be added to this list.

[wesleytodd]

Proposed Items:

• Go over list of project priorities and top issues Document the current 'top 10' express' issues nodejs/package-maintenance#233 (comment)
• Discuss Move req prototype to separate repo #82

[dougwilson]

@wesleytodd updated agenda with those 👍

[wesleytodd]

From the Package Maintenance WG meeting today, it would be great if we could also discuss release automation. @dominykas mentioned work being done which might help us.

[dominykas]

This a bit late for me (2:30am...) - is this always on at the same time?

[wesleytodd]

Typically it is. I wonder, could you point us to some of the work you have done on this, and we could check it out and schedule a follow up discussion at a time better for you?

[dougwilson]

One thing that would need to be discussed re automation is how we can still keep npm 2FA publishes intact, which was a big issue from the npm compromised accounts.

[wesleytodd]

keep npm 2FA publishes intact

I think this is specifically what @dominykas can offer some help with.

[dominykas]

This is the tool I mentioned: https://github.com/nearform/optic - it's a PoC, but it works and is relatively easy to run (I have an instance running at https://optic.goodnight.to [no SLA] if you're interesting in playing with it, but security paranoid people should run this themselves anyways).

To try it out on my instance:

1. Sign in with Google (should be relative easy to add GH signup, but it's a PoC, so...)
2. "Add new secret by filling in details" - last button (although you can play with other options).
3. Enter whatever you like in Issuer and Secret (it's safe to enter real data there, because it stays in your browser, but please don't trust me 😉)
4. Click the + to generate the token
5. curl https://optic.goodnight.to/api/generate/[token] that was generated
6. You should get a browser notification with an option to approve - once approved - the curl will receive the OTP.

This also works if you add this app to your homescreen on Android, although there might be more work needed there.

This means that it is possible to set up a publish with 2FA from CI by passing the --otp=$(curl ...) as a param. I hope one day this will be native in npm, so unsure how much effort should be spent on maintaining this tool... But I do have an idea on how to make it work for groups of people, or alternatively it can be repurposed as a Slack integration, etc.

I also have a PR open to enable this for semantic-release: semantic-release/npm#176. semantic-release is quite opinionated, but so far I've been able to bend it to my will and there's some nice plugins (e.g. rather than enforce a commit prefix convention, it can work off github labels, although I haven't tried that).

[dougwilson]

Thanks for that. I will be checking it out, as that was really the main thing that stood in the way of more automated (and consistent) releases, especially as I continue to see chatter around surfacing if a package is published with 2FA or not made me really hesitant to turn it off for a CI setup. I really appreciate you pushing forward to get 2FA support. And TIL npm accepts a --opt option, even.

[wesleytodd]

Top Priority issue starter list:

pillarjs/router#48
pillarjs/router#60
expressjs/expressjs.com#1037
#82
expressjs/express#2237
expressjs/express#3730

TODO for @wesleytodd:

• Open issue to document adding history sections (unreleased) section
• Add history entry to PRs
• Open issue to setup issue templates with checklist for history and other things

[blakeembrey]

@wesleytodd I can help on type definitions in whichever modules are needed, feel free to point me to specific repos and I'll work through them as I have time. It sounds like the router is the first one.

My main issue has been the stance on TypeScript within Express.js and other repos. I use a lot of the modules and would love to type them correctly if we're officially supporting the definitions. A lot of the lower-level modules in jshttp are simple places to start with how it could work to maintain (smaller surface area, less buggy types, etc).

[wesleytodd]

This would be great @blakeembrey! I mentioned you on the call but I didn't want to volunteer you for something :)

Maybe we can make a "TypeScript Support" discussion issue where we can organize the plan? That way I can add that to the "Key Objectives" issues so that we can get others who want to be involved in the TS story to get onboard.

[LinusU]

Sorry for missing this meeting 😞

Maybe we can make a "TypeScript Support" discussion issue where we can organize the plan? That way I can add that to the "Key Objectives" issues so that we can get others who want to be involved in the TS story to get onboard.

I'm happy to help out with TypeScript definitions 🙋‍♂