Certification Team: In recent months the certification team concentrated mainly on the development of the first pre-test planned for autumn 2008. While part of the team gathered potential test questions the other team members planned the event itself.

With the help of many volunteers a significant number of questions have been gathered. Each question is reviewed by the certification team based on teaching value, understandability, and technical accuracy. More questions for the exam are needed and will help improve the quality of the certification. If you would like to suggest certification questions please send them to questioncollection.certification@typo3.org – the mail-address of the question collection team.

The planning of the pre-tests and the first certification exams continues to progress well. During the TYPO3 Developer Days in Elmshorn, Germany the team provided a short presentation about certification and the team’s planned next steps. At this event, 15 new people registered for the first exams. This illustrates the strong interest in certification within the TYPO3 community.

Learn more about the T3CON08 on page 86.

For the first time, this international TYPO3 developer community event took place in Elmshorn near Hamburg, Germany. 150 TYPO3 enthusiasts from 11 countries shared their knowledge and enjoyed the excellent weather. The agenda included 28 presentations with topics like: productivity, usability, working with Eclipse, extension programming techniques, TYPO3 5.0, FLOW3, and more. Everybody enjoyed the presentations as well as the main social event, which resulted in all the nerds taking a dip in the swimming pool. Also, this time the 10%-female attendees found their way to the Nordakademie Elmshorn for some fun of their own. The excellent location provided an enjoyable and inspiring overall atmosphere. Responses from the event evaluation survey indicated that attendees were pleased with the entire event. The TYPO3 Developer Days T3DD09 will take place again in Elmshorn, Germany and will be held on May 14-17, 2009.

Only a few weeks after TYPO3 4.2 was released, the Core Team started detailed planning for TYPO3 4.3. The team appoints release managers for every new version. Oliver Hader was chosen to lead the development of this new release. The team has decided to change from approximately a yearly release cycle to approximately a 6-month release cycle. This means that version 4.3 is planned for release this Fall. Oliver is publishing weekly status reports to help keep the community informed about the progress.
TYPO3 4.x development has recently moved to a dedicated TYPO3 development server at http://svn.typo3.org. Having our own Subversion server will enable many special features that are probably too technically detailed to mention here ;-). Please note that if you have been using the old Subversion repository, you should follow the instructions for changing to the new server.

After the introduction at this year’s T3DD08, the first sponsored projects for TYPO3 4.x have been announced. Sponsored projects are a new way that agencies/companies using TYPO3 can support TYPO3 development. Sponsored projects result in increased funding going to developers, primarily Core Team members, to enable them to focus more of their time on the TYPO3 Core. We expect this to significantly speed development.

The first Bug Day took place on June 27th. This was the first of many Bug Days which are now planned to occur on the last Friday of every month. The purpose of Bug Day is to foster community involvement and, of course, to get bugs fixed.

Recently a Contributor License Agreement based on the Apache Contributor License Agreement was created for both FLOW3 and TYPO3 5. The agreement grants most rights to the TYPO3 Association while ensuring that contributors maintain full rights over their contributions. This is an important agreement to protect both the TYPO3 community and individual contributors.

Version 5 development continues on many fronts. Configuration mechanisms in FLOW3 have been refined and the configuration cascade is now fully implemented. The cache mechanism has been enhanced. The initial Validator and Property Editor are nearly finished. The documentation of the Model View Controller (MVC) framework has begun. Brainstorming on implementing flexible persistent storage continued.

After meeting with experienced software engineers and additional discussions at the T3DD08, the 5.0 Team decided to enhance its software development processes and to take advantage of more elements from the eXtreme Programming Toolkit. The team adopted User Stories and is finding ways to adapt the SCRUM process to the special requirements of a distributed open source project. In addition, the team decided to perform continuous integration during development. The concept of continuous integration is simple: commit changes early (or continuously) and immediately run automated tests to verify that all contributions work together (integrate well) and are of a certain quality. The slides from FLOW3-related presentations at T3DD08 are available for download. The recording of the main session "Hitchhiker’s Guide to FLOW3" is also an episode of T3CAST. T3CAST is a new podcast series designed to share behind-the-scenes details throughout the development process of TYPO3 5.

The increasing number of reports of TYPO3 extension vulnerabilities indicates that security awareness within the TYPO3 community is growing. During the first half of 2008, the team issued security bulletins for 38 extensions. In comparison, only 20 security bulletins were issued for extensions throughout all of 2007. As a result, the internal work flows to react to reports more quickly was optimized and a new ticketing system using the Open Ticket Request System (OTRS) was implemented.

T3DD08 provided an excellent opportunity to discuss and identify new strategies to address the growing number of vulnerabilities found in extensions. One result of the discussions is the new Collective Security Bulletins, which enables to summarize multiple warnings for multiple extensions in a single bulletin. From now on, Collective Security Bulletins will be used for extensions with relatively low download numbers from the TYPO3 Extension Repository (TER) or low importance to the community.

The team also successfully fixed a security vulnerability within the TYPO3 core related to uploading files. In addition, the team is developing a policy that describes how the Security Team operates. This document will help formalize the processes and will be publicly available to enable the community to understand exactly how the Security Team functions.

A more detailed version of this Quarterly Report containing links to further information can be found on http://association.typo3.org/home/past-activity-reports/