I know @Joe is going to be out over the next few weeks. I'm uncertain how spun up on this @akosiaris is.

(Internal Release-Engineering-Team) update train-dev environment checkouts

• service.version: 1.41.0-wmf.2
• trace.id: 64d6572a-9121-4d97-8f89-0b6c0f8478be
• Find trace.id in Logstash

Sorry for the delay. Added Zoranzoki21 to the extension-UnblockMe group on Gerrit.

Sorry for the delay, you should have +2 for that repo now @Yaron_Koren

{{done}}. @cjming already had +2 on this repo and has been merging changes. So, this change is, in effect, just to push tags to the repo—no reason for this request to linger for a week.

Some notes from the API Gateway & Thumbor SRE Check-In

There are a lot of good use cases for private repositories:

hrm, github did change their rsa key: https://github.blog/2023-03-23-we-updated-our-rsa-ssh-host-key/

I will be out of office Thu, 16 Mar–Tue, 21 Mar

I will be out of office Thu, 16 Mar–Tue, 21 Mar

Might be a good task for @FGoodwin since she's familiar with the magic here

This task was resolved in T324710: Application Security Review Request: Device analytics

In T331647#8682660, @taavi wrote:

You sure that's the correct group? The deploy_airflow keyholder key can be accessed by the following groups:

# Shared deploy ssh key for Data Engineering maintained
# Airflow instances. For now, all admins of Airflow instances
# can deploy any Airflow instance.
deploy_airflow:
  trusted_groups:
    - analytics-deployers
    - research-deployers
    - platform-eng-deployers
    - airflow-search-admins

In T330070#8667684, @MatthewVernon wrote:

@thcipriani can I ping you about this approval, please?

In T285354#7171268, @Krinkle wrote:

Consider enforcing the privacy policy we come up with, with a CSP rule. If there isn't a task for that yet, perhaps we can create one for it. That way, in the event a misconfiguration, bad upgrade, or misunderstood plugin, etc. causes a third-party connection we will have a task for "New thing didn't work, let's figure out why" or "Fix X before re-trying upgrade" instead of "Oops, we're leaking data, how long will we let it sit like that?".

We currently have a CSP rule on Phabricator, WordPress (techblog), Jenkins, doc.wm.o, and various other services. I don't know if we can include it yet in the standard expectation for new services in production, but perhaps it's time that we make it so.

(removing this as a train blocker—fixed enough to no longer blocking deploys, but there are lingering followups we may want to address here)

We collect metrics now.

In T331138#8675246, @Joe wrote:

@thcipriani what does the Unstewarded-production-error tag mean, in practice? Is there a process to get someone to look into this?

I'm not sure I was able to explain how serious this problem is, and how legally dangerous it is not to fix it.

I believe this is happening now. Just noticed that this task was lingering.

In T330942#8660076, @Ladsgroup wrote:

This might be the culprit: https://gerrit.wikimedia.org/r/c/operations/mediawiki-config/+/891962/2/wmf-config/filebackend.php

Let me double check everything.

Declining as product owner of GitLab.