Date

Call-in Information

Time: 10:00 am, Eastern Standard Time, or 4:00 pm, Central European Time

Attendees

(star)  Indicating note-taker

  1. Dragan Ivanovic (star) 
  2. Georgy Litvinov   
  3. William Welling 

Agenda

  1. M1 mac chip and VIVO
    1. https://github.com/vivo-project/VIVO/issues/3915
  2. I forgot my password
    1. https://github.com/vivo-project/Vitro/pull/421
  3. Audit tool
    1. https://github.com/vivo-project/Vitro/pull/390#issuecomment-1691384685
  4. Avoid lock on graph uri update in RdfServiceSparql
    1. https://github.com/vivo-project/Vitro/pull/424
  5. ABAC
    1. https://github.com/vivo-project/Vitro/pull/398 
      1. https://github.com/vivo-project/Vitro/pull/398#discussion_r1386314871
      2. https://github.com/vivo-project/Vitro/pull/398#discussion_r1385210799
  6. Vulnerability
    1. https://mvnrepository.com/artifact/org.owasp/dependency-check-maven 
      1. https://github.com/vivo-project/VIVO/blob/main/pom.xml#L390
    2. https://github.com/vivo-project/jenatools/security/dependabot
    3. https://github.com/vivo-project/orcid-api-client/security/dependabot

Notes

Georgy and Dragan discussed transcribing audio to text and receiving Zoom AI summaries via email.

Mac M1 chip

The team  touched on a technical issue concerning the use of different Java virtual machines for building and running VIVO applications. Dragan also proposed creation of PR to update the Argon library that seemed to resolve some issues, but the specifics remained unclear. The team also discussed potential security implications of mutable Assembly at runtime. The cause of the problem was unclear, but Georgy suggested it might be related to Apple's Java implementation on Mac, and Dragan expressed hope for a resolution in future releases. The team also discussed the issue of the test failing due to the use of the argon library and considered updating the continuous integration test. In addition, Dragan and William, explored the possibility of creating a Github action to simulate running VIVO on a Mac machine and other OS (windows, linux).

Audit tool

Georgy considered a remote triple store to store data, suggested by Brian, but deemed it too costly. Dragan suggested involving more members of the team, including Milos and Ivan, besides committers, to speed up the review process. Georgy agreed, noting that it would provide valuable experience. The task of reviewing Audit tool PR is assigned to Milos. 

Avoid lock on graph uri update in RdfServiceSparql

This PR is basically refactoring of a previous PR reviewed by Brian. It would be great if Brian can review this PR. 

ABAC

Dragan and Georgy discussed the performance of a page with researchers. Dragan had tried the live instance and found no dropping in performance. Georgy mentioned that he had implemented some efficient methods for advanced role management and that he had not noticed any performance issues. Dragan suggested further testing on the researcher profile page. They also discussed the computational cost and order of checking the rules, with Georgy explaining the comparator in the implementation of the checks.

Vulnerabilities

Dragan identified potential vulnerabilities and discussed the outdated dependency with the team. Dragan also pointed out high and critical severity vulnerabilities related to dependenbot alerts for Jena and the ORCID client API. The team decided to document the critical vulnerability and advise against using SDB in Jena. Georgy concluded that the vulnerability could not be exploited if SDB was not used. Jena should be updated to Jena 5 (probably in VIVO 1.16.0). 

Draft notes on Google Drive

Actions

Previous actions 

  • No labels

All content on the LYRASIS Wiki is licensed under the CC BY (Attribution) license, unless otherwise noted.