GeoServer PSC meeting notes, August 26th 2025

aaime-geosolutions · August 26, 2025, 5:51pm

GeoTools / GeoServer PMC meeting - 2025-08-26

Attending

Torben Barsballe
Jukka Rahkonnen
Jody Garnett
Pierre Mauduit
Andrea Aime
Kevin Smith
Peter Smythe

Actions from prior meetings:

[image]None!

Agenda

GeoServer 3
OGC API Processes CITE progress
PR reviews
Chit-chat

Actions

[image]Andrea & Jody OR Peter: 2.26.4 release as time permits

Upcoming Releases

We do not have someone listed for August, any volunteers?

2.26.4 is pending, so it has been a while
Andrea / Jody will coordinate as background activity, no timeframe in mind
Peter should have time this week, and may run the release instead - to coordinate with Andrea & Jody

GeoServer 3

Pierre will be working with Gabe, who is not here.

Java 17 migration has a PR but it is not compiling yet
- OpenRewrite migration applied but the result does not compile yet

Will catch up on chat.

OGC API Process CITE progress

<?xml version="1.0" encoding="UTF-8"?>

Ticket for a portion that I don’t want to implement (due to security / data visibility concerns):

github.com/opengeospatial/ets-ogcapi-processes10

The test suite assumes the job list is always present (but it seems optional in the spec)

opened 10:42AM - 16 Aug 25 UTC

aaime

**Describe the bug** The test suite code seems to assume the job list resource i…s always available, but the specification suggests otherwise. From the [specification abstract](https://docs.ogc.org/is/18-062r2/18-062r2.html#toc0), we can see that the core class only requires ``jobs/{jobId}`` and ``jobs/{jobId}/result``, while the job list is under the requirement class "job list". Later in the spec, we can see a dedicated conformance class for job listing: ``http://www.opengis.net/spec/ogcapi-processes-1/1.0/conf/job-list`` So, it would seem that a server not advertising the job list conformance class, should not receive requests on the "jobs" resource. **Expected behavior** If the job-lib conformance class is not advertised, do not test the "jobs" resource. **Additional context** Making the list of jobs performed via anonymous requests available to the whole world does not seem like a good idea, the client requesting them might not be realizing the results are available to everyone. For a parallel, consider the recent OpenAI case where public conversations with ChatGPT [started popping up on Google searches](https://techcrunch.com/2025/07/31/your-public-chatgpt-queries-are-getting-indexed-by-google-and-other-search-engines/). And yet, this is what the jobs resource offers, [at least in some implementations](https://demo.pygeoapi.io/master/jobs?offset=10).

Other Tests

Array inputs and outputs (too complex for spare time)
Format validation (should pass, need to verify)
Inputs/Outputs of mixed types

PR reviews

github.com/geoserver/geoserver

[GEOS-11852] Remove master password info page, adjust master password workflow (#8584)

main ← sikeoka:GEOS-11852

opened 08:44PM - 02 Jun 25 UTC

sikeoka

+338 -663

[![GEOS-11852](https://badgen.net/badge/JIRA/GEOS-11852/0052CC)](https://osgeo-o…rg.atlassian.net/browse/GEOS-11852) [<img width="16" alt="Powered by Pull Request Badge" src="https://user-images.githubusercontent.com/1393946/111216524-d2bb8e00-85d4-11eb-821b-ed4c00989c02.png">](https://pullrequestbadge.com/?utm_medium=github&utm_source=geoserver&utm_campaign=badge_info) Testing ``masterpw.info`` was generated for ``minimal`` data directory configuration, and empty data directory configuration resulting in a welcome page warning for admin to address. The ``release`` data directory does generate ``masterpw.info`` file. The PR replaces the master password info page that dumps the master password into a file with a link to the REST API to get the master password. Documentation was also updated to clarify that the master password can not be used to log in by default. This has been broken out into several commits: - [GEOS-11852] Remove master password info page - [GEOS-11852] Clarify keystore password in user interface and documentation - [GEOS-11853] Clarify keystore vs master vs root password - [GEOS-11854] Generation of masterpw.info no longer required - [GEOS-11911] GEOSERVER_ROOT_LOGIN_ENABLED # Checklist - [x] I have read the [contribution guidelines](https://github.com/geoserver/geoserver/blob/main/CONTRIBUTING.md). - [x] I have sent a [Contribution Licence Agreement](https://docs.geoserver.org/latest/en/developer/policies/committing.html) (not required for small changes, e.g., fixing typos in documentation). - [x] First PR targets the `main` branch (backports managed later; ignore for branch specific issues). For core and extension modules: - [x] New unit tests have been added covering the changes. - [x] [Documentation](https://github.com/geoserver/geoserver/tree/main/doc/en/user/source) has been updated (if change is visible to end users). - [x] The [REST API docs](https://github.com/geoserver/geoserver/tree/main/doc/en/api/1.0.0) have been updated (when changing configuration objects or the REST controllers). - [x] There is an issue in the [GeoServer Jira](https://osgeo-org.atlassian.net/browse/GEOS/summary) (except for changes that do not affect administrators or end users in any way). - [x] Commit message(s) must be in the form ``[GEOS-XYZWV] Title of the Jira ticket``. - [x] Bug fixes and small new features are presented as a single commit. - [x] Each commit has a single objective (if there are multiple commits, each has a separate JIRA ticket describing its goal). The PR will be merged when all the build checks are green ([see automated QA checks](https://docs.geoserver.org/latest/en/developer/qa-guide/index.html)), there is a code committer review, and the checklist has been fulfilled.

this is ready for review, added GEOSERVER_ROOT_LOGIN_ENABLED from last meeting