This and performance review timing.

Update: The Abstract Wikipedia team and Security-Team worked through the vendor scoping doc on Monday, 2021-05-17 (thanks again, all). This document was then sent along to our vendor PM contact that afternoon. I also owe the vendor our Threat Modeling outline doc and Threat Dragon model for review, which I plan to provide them today or tomorrow.

Note that we're using opis/json-schema ^1.0 and symfony/yaml ^5.2 in the forthcoming PHP json-schema code, which will be new. (Though there's already a patch adding the latter to vendor as part of PHP 8.0 prep/clean-up work, IIRC.)

@Jdforrester-WMF @dr0ptp4kt @DVrandecic - I'm going to resolve this task for now, with the following qualifiers:

1. I will continue the planned internal security review work within the more recent pre-launch task at T289322: Pre-launch security review of Wikifunctions, to be completed sometime this quarter (Q2 2021, October to December).
2. Here is a link to the final vendor review, just for posterity's sake. This is obviously internal-only for now even though it did not result in any actionable items in the Security-Team's opinion. This report is the same one linked within the relevant Slack channel for this work.
3. Here is a link to the threat modeling exercise outline (and ThreatDragon json and png), again for posterity's sake, as one of the listed deliverables for this task.

In T274682#7403055, @sbassett wrote:

@Jdforrester-WMF @dr0ptp4kt @DVrandecic - I'm going to resolve this task for now, with the following qualifiers:

1. I will continue the planned internal security review work within the more recent pre-launch task at T289322: Pre-launch security review of Wikifunctions, to be completed sometime this quarter (Q2 2021, October to December).
2. Here is a link to the final vendor review, just for posterity's sake. This is obviously internal-only for now even though it did not result in any actionable items in the Security-Team's opinion. This report is the same one linked within the relevant Slack channel for this work.
3. Here is a link to the threat modeling exercise outline (and ThreatDragon json and png), again for posterity's sake, as one of the listed deliverables for this task.

Thanks, that makes sense. For clarity, what does this mean for review of https://gerrit.wikimedia.org/r/c/mediawiki/vendor/+/716462 – this blocks our deployment to the Beta Cluster.

In T274682#7412907, @Jdforrester-WMF wrote:

...what does this mean for review of https://gerrit.wikimedia.org/r/c/mediawiki/vendor/+/716462 – this blocks our deployment to the Beta Cluster.

I've tagged our team on T290274 and added @Mstyles and myself to c716462 (@Reedy was already there). Looks like we'll just want to do a vendor-ish review of opis/json-schema 1.1.0 and symfony/yaml 5.3.6 prior to merging that patch to mediawiki/vendor. I'd guess we could accommodate that by next week.