Code review for security advisory coverage applications

This project application https://www.drupal.org/node/2267557 is a good example of a large project. I would say this is a good candidate for a single project promotion, but it would still have to go through some security checks. The volume of code is quite large though - it seems unfair to ask klausi or others to review all of that.

So the question I'm raising is, what do we want to do when there's a very large project being submitted? They are unlikely to get proper reviews. Even if they do get one, it's unlikely that they will receive enough to make it to RTBC.

• [D7] Mini Blocks
  https://www.drupal.org/node/2410675#comment-9548617
• [D7] Doublefield Formatter https://www.drupal.org/node/2392703#comment-9594743 (security)

See https://groups.drupal.org/node/454073

We are holding a virtual sprint during the Drupal Global Sprint weekend, January 17-18. See https://groups.drupal.org/node/447258

The goal of this sprint is to work on project application reviews, particularly helping the Git admins reduce the current RTBC backlog.

Please signup if you are interested in participating. Collaboration for the sprint will happen in the #drupal-codereview IRC channel.

Hello Everyone,

I talked with a few Git admins about organizing an application review sprint to occur during the Drupal Global Sprint Weekend (https://groups.drupal.org/node/447258). This would be a virtual sprint, so all locations are welcome. The main purpose of the sprint would be to help reduce the RTBC backlog.

We would need Git admins on-hand to approve users, and any non-admin volunteers to help however they can. Of course, I don't consider the exact details up to me. We'll need a person or two to help organize/spearhead efforts.

This wiki page is created to keep track of AjitS's manual reviews of projects in the project application queue. As a reviewer I hope to get more advice from more experienced reviewers. Please use the comment field to add your advice, corrections, and observations.

Reviews list

Full project promote list

<

ol>

This wiki page is created to keep track of fusionx1's manual reviews of projects in the project application queue. As a reviewer I hope to get some advice from more experienced reviewers. Please use the comment field to add your advice, corrections, and observations.

Part of the project application review process is to ensure that users have a good grasp of Drupal concepts before we allow them to promote sandbox projects to full projects.

There are handful of core maintainers that are not git vetted users.

I propose the following:

We audit the MAINTAINERS.txt file for Drupal 7 and Drupal 8 and promote everyone who is a

• Branch maintainer
• Component maintainer
• Module maintainer
• Theme maintainer
• Core mentoring lead
• Initiative owner
• Topic coordinator

If we have promoted a user with the git vetted user role and find security issues in their code afterwards we should not remove the git vetted user role. This can always happen and we have a process to deal with security issues.

If the project has no stable release yet please report the problem as critical issue in the public queue.

If the project already has a stable release please please report the problem with the "Rport a security vulnerability" link on the project page. That will create a private issue on security.drupal.org where the coordination with the security team happens.

Problem/Motivation

Reduce the duplication projects : While reviewing the project applications the duplication of the projects is bit time consuming and we have to find the projects first and then request the user to mention the difference with their sandbox project and the existing drupal.org projects.This process is taking too much time time and will take git administers & reviewers to follow up the application again & again.

https://www.drupal.org/node/2326343#comment-9089051
https://www.drupal.org/node/2323567#comment-9089153
https://www.drupal.org/node/2325405#comment-9089157
https://www.drupal.org/node/2322009#comment-9089463
https://www.drupal.org/node/2314061#comment-9089537
https://www.drupal.org/node/2294899#comment-9089579
https://www.drupal.org/node/2300519#comment-9095603

Prajwal

This wiki page is created to keep track of naveenvalecha's manual reviews of projects in the project application queue. As a reviewer I hope to get more advice from more experienced reviewers. Please use the comment field to add your advice, corrections, and observations.

This wiki page is created to keep track of gaurav.pahuja's manual reviews of projects in the project application queue. As a reviewer I hope to get some advice from more experienced reviewers. Please use the comment field to add your advice, corrections, and observations.

pgautam's reviews for various project application reviews. This is a part of mentoring to become a code review administrator eventually. Please provide valuable advice through comments.

[D7] SN Quick Field Module
https://www.drupal.org/node/2070535#comment-7778641

[D7] Turbo SMS
https://www.drupal.org/node/2084559#comment-7844349

[D7] PM User Image
https://www.drupal.org/node/2079961#comment-7824749

[D7] Meetup Login
https://www.drupal.org/node/2086333#comment-7849041

[D7] Access Profile Edit
https://www.drupal.org/node/2275023#comment-8820059

[D7] Histogram
https://www.drupal.org/node/2185761#comment-8798393

[D7] SAML2 SP
https://www.drupal.org/node/2283525#comment-8936855

[D7] Empty Link
https://www.drupal.org/node/2297073#comment-8936779

[D7] search_replace_blocks_menus
https://www.drupal.org/node/2267323#comment-8936569

[D7] Comment Smiley
https://www.drupal.org/node/2308015#comment-9009123

[D7] Page Background

[D7] GPA Calculator
https://www.drupal.org/node/2315327#comment-9034125

[D7] Quick Views Display List
https://www.drupal.org/node/2331047#comment-9120741

This wiki page is created to keep track of er.pushpinderrana's manual reviews of projects in the project application queue. As a reviewer I hope to get some advice from more experienced reviewers. Please use the comment field to add your advice, corrections, and observations.

Reviews List:

Full Project Promote Issues:

As of this morning, there are only 80 issues in needs review and 70 marked as RTBC. Of those in RTBC, none of them are older than three months. Of those in the needs review status, only one has a creation date of over a year. (There are many reasons that go into why project applications take a long time; which include volunteer reviewer availability and responsiveness of the person applying.)

So far in my reviews, I have not objected to applicants having a README.md instead of README.txt.. This mainly because it does the job just as well, and it also looks like README.md may one day be supported by drupal.org infrastructure (see: Allow README.md to optionally render a project page).

However, the Module documentation guidelines says

All modules should provide a README.txt file.

There is no mention of README.md at all.

Edit: This has been fixed now.

After having browsed through a number of review threads I noticed that very many of them received the following comment: