ongoing support for Cantaloupe

[wkdwyerNIH]

@adolski our organization is considering Cantaloupe vs. serverless and would like to assess the support that we can expect for each. There has not been much activity in the past year for Cantaloupe, and you seem to be the primary contributor. Seeing that there are currently 63 dependencies, any of which could have a security issue, reach EOL, etc. There may be some risk there. I would appreciate any thoughts you have on this or any information you could share that would help in our assessment.

thank you

[msimkunas]

We would also be interested to know about the project status. @adolski Any news regarding this?

[adolski]

Hi,

Development on Cantaloupe is paused while we work on other things. I don't know for how long, but probably for a good while. We are still using it here and depending on it, with no plans to stop doing so, or really even ability to stop doing so due to our reliance on some of its features, so we will have to see what happens.

[adolski]

I hope it's still safe to use, if it ever was, but I can't make any claims in that regard. You will have to look through the code and the pom.xml (and the LICENSE.txt, which contains a liability disclaimer) and judge for yourself.

[msimkunas]

Thanks for the clarification. I understand that there are no guarantees but since you as well as many others are using it and depending on it I can only assume that it's relatively safe. Just to be clear, you're not using some internal build with updated dependencies, are you?

[adolski]

We usually use public releases. A few times we've needed some new feature early so we've used a pre-release build. But we don't use anything that isn't available in this repo.

[msimkunas]

Thanks for a prompt reply.

You've mentioned that development on Cantaloupe is paused at the moment. Does this also include any maintenance/security updates, such as dependency updates, or are you only halting feature development?

I hope these questions are not a hassle! We are currently evaluating whether continuing using Cantaloupe is a viable option and would greatly appreciate your input.

[adolski]

That's OK. I guess if something really urgent were to come up, we would try to address it. But it's a complete pause, not a partial pause.

[janhoy]

Have you considered inviting key contributors as committers / maintainers on the project? They could help with patch releases with dependency upgrades, test and merge bug fix PRs and generally keep the project alive, while current maintainers are busy with other tasks.

Would be a pity if the project rots or splits into several forks due to lack of maintainers.

I can volunteer to help add dependabot for smooth dep upgrades, and triage some of the bug reports and test PRs.

[srbbins]

Hi All,
@wkdwyerNIH, @janhoy @msimkunas, thanks for the feedback and offers for assistance!
We at UIUC are committed to ensuring Cantaloupe can continue to be a sustainable project for the community. We've set up a meeting at the end of this month with Josh Hadro and Glen Robeson from IIIF to work out an arrangement for Glen to take on some of the work regarding dependency updates and the like. I'll be honest and say we don't have a ton of experience with this type of collaboration as Cantaloupe is our only in-house project with an OSS codebase that has wide community adoption, but I expect it may evolve to include other participants as well. In any case I wanted to make sure we responded to this thread (if late) and explained our current directions. Also, let me know if would be helpful to post a message somewhere else.
--Seth Robbins

[janhoy]

Hi. Thanks for responding. The project will surely die or be forked if you do not find a way to maintain it, issue new releases, respond to bug reports, review PRs and create a space for users to discuss.

It is hard to expand from in-house to a more diverse community. And there are many paths you could follow. At least three paths come to mind

• Continue having all committers inhouse - requires allocating more resources to the project to succeed
• Expand the community, allowing external committers - sharing maintenance load while keeping some control of vision and direction
• Incubate the project with an open source foundation

I myself is active with Apache Software Foundation and know first hand how important a thriving community of committers and users is to the success of a project. I believe for you option 2 would be the most beneficial, i.e. growing the community by inviting existing PR contributors to be maintainers. Entrust them committing code, doing releases etc. For this to work you'll probably need to document project policies, decision making procedures, what role UoI will play etc. There are some good advice on community building here https://opensource.guide/building-community/ and many other places. Although it may feel scary to give up some control, you'll most likely find that entrusting contributors will be a net benefit to the project and give it a chance to survive.

Fingers crossed for the future of Cantaloupe!

[rivimey]

@janhoy Just wondering, is Cantaloupe the sort of project the Apache Foundation might take on? I agree building an active community is hard and many of those I've seen that work need some type of commercial income (e.g. from support) to make it work. Getting to the point where that is feasilble is very hard.

[janhoy]

Sure, Cantaloupe would fit well as an Apache project, being Java based, implementing a standard, being broadly useful etc. However, for incubation to succeed, all copyright owners must agree to re-license it as ASL, and the entire code base must be checked for incompatible licenses. And there needs to be a handful active committers already for incubation to succeed. Apache does not have a host of developers ready to take over projects. It is more like existing projects coming to Apache to benefit from a well established framework.

I recommended UIUC to go route 2, inviting committers to their github org, as this is easier, and I read between the lines that they are not ready to "hand over" the project to a foundation, but want to keep tight control over all development. I may have interpreted that sentiment wrongly though. I hope they succeed in reviving the project as a healthy, thriving community, or I'm pretty sure users will look elsewhere..

[srbbins]

Hello Again All,
We met last week with Josh Hadro and Glen Robeson from IIIF, and I wanted to provide an update on Cantaloupe development. In the immediate term we're enlisting Glen's help in bringing Cantaloupe's dependencies up to date. We suspect that in the near to medium future we'll be looking to put together a team from the community to assist in Cantaloupe development, but that effort is in the pre-planning phase at the moment. I know there are some interested watchers on this issue, so please stay tuned.
--Seth

[rivimey]

@srbbins Is there any news from Glen on how the dependency work is progressing?

[janhoy]

Hi. Congrats on the bugfix release!

We suspect that in the near to medium future we'll be looking to put together a team from the community to assist in Cantaloupe development, but that effort is in the pre-planning phase at the moment.

It's been 7 months, would you mind sharing an update to the team-building effort? Such as how many you are going to invite as committers/maintainers, how the governace of the project will be etc.

[glenrobson]

Hi @janhoy, sorry its taken so long to get the bugfix out, but for info I am in contact with the folks at Illinois and hope to work with them on a plan to get more people invovled.

[rivimey]

Hi just wanted to say glad that things are moving again! I have just discovered Cantaloupe (and openseadragon) having been looking for an appropriate image tile server for a while and it does seem to have all that I need. I am a bit nervous of the various security issues someone else reported and so am very glad that you are looking into them. Please do keep users informed of any progress (here?)

I may be able to get some cash out of the end-user of the project I'm working on. Is that helpful, and if so is there a good place to send it? I'm probably talking something like $50 or so - that ballpark.

[glenrobson]

Hi All, hoping to make some progress on updating the libraries this week. I'm planning on jumping on this ticket with questions:

#634

I'm still getting to know the code base so any pointers / comments / advice very welcome.

[janhoy]

Great to see things moving. Please share any progress! Looking forward to a new fresh release!

[janhoy]

What's the latest update on a new release with updated dependencies?

[glenrobson]

Hi @janhoy, this is the latest: #634 (comment). Unfortunately I've been travelling and training a lot since October but looking to get back into this week.

[glenrobson]

Hi All, here is the latest release of Cantaloupe with the security fixes:

https://github.com/cantaloupe-project/cantaloupe/releases

Please let me know if you find any problems.

Thanks

Glen

[marcjansenpiazzablu]

Thanks for the release! We use cantaloupe in our production environments. Can you say anything regarding the future of cantaloupe? Will there be more (and more frequent) security updates in the future?

[glenrobson]

Hi All,

We are planning to move Cantaloupe to a community supported model so that we can get more regular releases and bug fixes. If you would like to be involved in the process (or just want to keep up with what the plans are) please join the IIIF slack and the #cantaloupe-dev channel for discussions and meeting planing.

In the first meeting we discussed finding existing forks and re-integrating them into the main Cantaloupe and then identifying issuse that the community can tackle for the next release.

You can join the IIIF slack channel using the following form:

http://bit.ly/iiif-slack

and then join the #cantaloupe-dev channel.

Hope to see you there.

Thanks

Glen

[glenrobson]

First Cantaloupe call is tomorrow at 17:00 CEST / 16:00 BST / 11:00am EDT / 8:00am PDT. Please see draft agenda with connection details: https://docs.google.com/document/d/1jovu17P1nKxAUiG5kyxy10qUa4URmJNmBKz9LGirbAw/edit?usp=sharing

[rstorey]

Is there an update for this? The project has many outstanding CVEs and the last release was almost a year ago.

[glenrobson]

Hi @rstorey we are working on a release and hope to release it soon.

We have started a Cantaloupe-dev channel using the IIIF slack which you can register for here: http://bit.ly/iiif-slack. We generally meet every two weeks and all are welcome to join to hear the latest and help with developments.