State of project

[benzkji]

as I remember, there were some reorgs at Mozilla. How was this project affected? Is there anyone around, maybe doing a release? Any plans how to continue?

Thanks for any infos.

[some1ataplace]

Not sure, we are all asking the same questions.

Last time this happened, had to go on Matrix chat and ask for someone from Mozilla who hangs out there to pick up the project again because it gets abandoned because of things like that.

https://chat.mozilla.org

[benzkji]

Read a bit more. It seems that django-csp will be included in django core (#135), as soon as #36 is resolved, and that seems on it's way.

https://code.djangoproject.com/ticket/15727

[some1ataplace]

Yes I know about that. But since that PR is under review and is being drafted, we need to first get someone from Mozilla to maintain the project again and push the changes so that the main django core devs can implement it in a future version of django.

[pmac]

Hi. My apologies for letting this languish a bit. I have permissions on this repo but didn't realized that the active maintainers had both left Mozilla and left the project. I'm looking at #36 but it's a lot, so I'm going to have to come up to speed and see what we need to do to get it done. There is some activity within Mozilla on this now though, so hopefully we'll get it done soon. Thanks for filing.

[kunambi]

Dear @pmac ,

It's been a little over a year, do you have any new information to share?

[stevejalim]

Hi @kunambi and @some1ataplace - I work on @pmac's team and we now have appropriate access to manage/maintain the project.

Looking at #36, I definitely agree that it's a lot for anyone to wrap their head around cold and so I am thinking about the best approach for getting things over the line.

@some1ataplace, if I/we can promise that we'll get the code merged and releases done, I am politely wondering if you would be willing and have time available to complete #36? I'm asking this based on your very helpful comment here, plus the fact that @DylanYoung seems to have gone quiet on that thread. I hope this doesn't seem too cheeky to suggest -- and no worries if it's not viable. If you'd prefer to discuss this directly, feel free to email me on [email protected]

Thanks,
Steve

[some1ataplace]

@stevejalim To be honest, I am no longer using this library due to not hearing anything back for such a long time and am instead handling CSP on my website myself using middleware. However, I don't wish to do that if django core implements django-csp library directly after 36 is complete.

For my latest replies on 36, I was not sure what I was doing or how exactly the report-only feature works in the first place. I was asking an earlier version of ChatGPT for help without actually testing the code in hopes of any of the replies sparking somebody to do something or get some ideas for solving the issue. So most of that code I posted is probably wrong due to most AI making stuff up.

With newer better versions of the AI though, I am sure somebody could figure this whole thing out. Sorry I could not be of more help. I wish for you and your team and this project much success.

[stevejalim]

Updating the community for where we're at now.

While the project fell into an unmaintained state for a while, we've been trying to a ring-fence some time for it.

To that end, I'm currently planning to:

• get it back to health - see Reawaken development #204
• get a new release - initially a 3.8rc with changes from Reawaken development #204 in it, then a 3.8 which will be functionally the same as 3.7 (but I want to check the commits over the last couple of years to confirm that nothing has changed in behaviour)
• review and triage outstanding Issues and PRs
• Deal with Allow enforced CSP and Report-Only at the same time #36 which must be solved if this is to potentially still make it into Django Core (and we need to check back in with Django see whether they still want to do this)

If you've been holding of contributing because (understandably) it's been very, very quiet here, please rest assured that I (and @pmac and @robhudson!) are around and now have appropriate project access to make things happen again.

[stevejalim]

Closing this as @robhudson has a great-looknig solution to #36 so we're looking good