This is a transcript for Learn more about Tag1 D7ES - Extended Support for Drupal 7 after EOL in January 2025. Click here to return to Tag1 D7ES - Extended Support for Drupal 7 after EOL in January 2025
[00:00:00] Michael Meyers: Hello and welcome to Tag1 TeamTalks, the podcast and vlog of Tag1 Consulting. In January 2025, Drupal 7 is going to be designated end of life. And it's going to cease to be supported by the community in the way that it has been over the last 14 years, but that doesn't mean that the platform is dead and that you have to migrate to another platform or upgrade to another version of Drupal if you don't want to.
[00:00:25] Michael Meyers: Today we're going to be talking about how you can continue to run Drupal 7 after end of life with Tag1 Drupal 7 Extended Support. With Tag1 D7 ES, the Tag1 team, which has led the creation and evolution of Drupal 7, the team that has helped secure and manage the releases of Drupal 7 for 14 years, we're going to continue to do what we did for free as community volunteers on a paid basis, moving forward to provide you with all the security and compatibility updates that you need to securely run and build on your Drupal 7 platform.
[00:00:56] Michael Meyers: My name is Michael Meyers. I'm the managing director of Tag1 Consulting. And I'm [00:01:00] joined today by Jeremy Andrews, the founder and CEO of Tag1. Welcome, Jeremy.
[00:01:05] Jeremy Andrews: Hello. Thank you.
[00:01:08] Michael Meyers: So at a high level, um, today we're going to talk about, Tag1, Drupal 7 extended support in great detail. What it is, how it works, how it's going to help you run Drupal 7 as long as you need.
[00:01:18] Michael Meyers: And then we'll loop back and we'll talk a little bit more about Drupal 7 end of life, uh, what it is and what your options are in general. So you guys can make an informed decision. So first up, Jeremy. What is Tag1 D7 ES?
[00:01:34] Jeremy Andrews: Yeah, it's prior to end of life of Drupal 7, uh, the community has provided security updates, uh, for Drupal 7 as well as just making sure that it supports modern versions of the LAMP stack.
[00:01:50] Jeremy Andrews: Um, and so D7 ES from Tag1, uh, continues this so that, um, if there are security issues affecting any of the modules that our customers are [00:02:00] using, we will fix those issues and release them. Um, and as versions of PHP go end of life themselves, we'll make sure that Drupal itself can continue to work with more modern versions of PHP and other dependencies.
[00:02:14] Michael Meyers: So pretty much we're going to provide you with all you need to continue running Drupal seven securely, and even enable you to continue to build out your Drupal 7 applications if you want, after end of life. Um, I touched on this a little bit in the opening. Uh, you know, we've been a big part of the development of Drupal 7.
[00:02:32] Michael Meyers: Why should people trust Tag1? Why are we uniquely positioned to do extended support for Drupal 7?
[00:02:40] Jeremy Andrews: Yeah, Tag1 has been intimately involved with Drupal since, uh, back version three, back in 2001, when Drupal was first created. I mean, we've been involved from the beginning. Um, more recently we provided long term support for Drupal 6 for six plus years, doing the same sort of thing for [00:03:00] Drupal 6. And with Drupal 7, we've not only, I mean, with all these releases, including Drupal 6 and earlier, but also Drupal 7 and beyond, we've been writing the code, maintaining the code. Fundamentally, people have been trusting Tag1 as long as they've been using Drupal because Tag1 has been so intimately involved in Drupal development and support and security and all the things people are looking for.
[00:03:26] Michael Meyers: To put that into context, before I joined Tag1 as a team member, um, Tag1, uh, helped me build, uh, multiple businesses, really successful. One of them was examiner. com, which at the time, uh, well, it became the largest site ever on Drupal. It was a top 50 website. Um, working with Tag1, uh, we built out over a third of Drupal 7.
[00:03:51] Michael Meyers: I think Acquia, through their development of Gardens at the time, built out around a third of the platform. We built out, uh, at least a third and the community in general [00:04:00] filled out the rest. We're talking everything, automated quality assurance and testing, migration tool set, like all the tooling for Drupal 7, as well as all the features and functionality.
[00:04:11] Michael Meyers: So Tag1 really played a, you know, an amazing role long before the release of Drupal 7, uh, up to, you know, today. In helping to build and maintain this platform. So, uh,
[00:04:23] Jeremy Andrews: A good example.
[00:04:24] Jeremy Andrews: A good example of that, sorry, Michael, is, um, the automated testing framework, um, which we've we helped build and maintain.
[00:04:31] Jeremy Andrews: It'll be shut down for Drupal 7 when Drupal 7 goes end of life. And so we've already spun up our own version to replace it. And, and after Drupal 7 is end of life, we will continue to do, you know, full regression testing on any and all patches that we release through our program. Um, just an example of something that, you know, we've been so involved for so long, we're the logical people to continue this.
[00:04:56] Michael Meyers: We, have to do a team talk on the QA system. It's one of my favorite things about [00:05:00] Drupal and it does over 10 concurrent years of testing in a single calendar year, it spins up variations and permutations of Drupal and different operating systems with different databases. And so it really ensures, you know, broad compatibility.
[00:05:15] Michael Meyers: It's, you know, when, when people run Drupal. They expect it to work on their system, right? They install it, it should work. And that's what this automated quality assurance and testing system really helps ensure. And so our, you know, ability to, you know, clone that and continue to run that on behalf of the community is going to make a huge difference, uh, versus just receiving patches and not knowing if they're going to work in your specific permutation or instance of the platform.
[00:05:43] Michael Meyers: So it's a critical advantage. So what is D7ES? What does Tag1 D7ES include? And can you give us a sense of what the price points are? I know we're trying to hit really moderate price points to make this available to as many people in the community as possible. Um, what are the, the plans [00:06:00] that are available?
[00:06:01] Jeremy Andrews: Yeah, we have two main plans. Uh, we have what we call the self service plan. And, uh, what that literally is, is we monitor the modules and themes that you have installed, Core, Contrib and otherwise. And, as we see issues, as we find security issues, either by backporting them from, you know, the latest Drupal 11 release, or through our proactive reviews, um, we provide those patches and notify you of this patch affects your website.
[00:06:31] Jeremy Andrews: Um, and you don't get notified by things that don't affect you. So it's not a lot of noise. It's not a lot of advertising. It's just the things that matter to you. Um, our other plan, uh, is the, the premium support plan. Um, and that one is the same patches. Um, again, everything is, is supported. The core you have installed, the contrib modules and the contrib themes you have installed.
[00:06:53] Jeremy Andrews: Um, but in addition, we provide a few hours a month to help you to install those patches [00:07:00] and, you know, to get you set up to properly test and make sure everything's working as you expect
[00:07:05] Michael Meyers: Your marketing team is genius, self service, premium support plan. You should give them a raise.
[00:07:13] Michael Meyers: Um, what about price points? Uh, what can we expect, uh, these to cost?
[00:07:19] Jeremy Andrews: Yep. The self service plan, um, is 149. 99 a month per site. Um, the premium support plan is 1, 499. 99 a month, uh, so it is more expensive if you want our help. Um, and there is a third option that I didn't really talk about, but if somebody has, you know, a lot of websites, and they want our support for those, we will do custom premium support plan pricing for them.
[00:07:47] Michael Meyers: The, uh, self service plan at 149. 99. Uh, does that have a volume discount as well?
[00:07:53] Jeremy Andrews: No. Umm, what we can provide though is, um, we can do [00:08:00] discounts for, you know, nonprofits and things like that, uh, education sites, and, and we will offer that and we'll put something formal on the website soon, uh, our interest in it is keeping Drupal 7 sites secure, um, and we want to make sure that people can afford it.
[00:08:15] Jeremy Andrews: At the same time, the costs can't go too low because we're paying people to, uh, you know, to put time every single week into, helping to upgrade the versions of PHP supported and other dependencies as well as backporting patches.
[00:08:30] Michael Meyers: Yeah, and to be responsive, right? We need to make sure that there's people allocated to this on a, you know, on a full time basis so that when an issue or need arises, They're dedicated in there to address it.
[00:08:42] Michael Meyers: Um, it also takes a tremendous amount of expertise, right? Um, Drupal security, people have been working on the Drupal security team for a really long time, release managers. A lot of the folks that are involved in this process are, you know, um, very expensive, very high demand type resources. And so, you [00:09:00] know, we, we very much want to make this a community effort.
[00:09:02] Michael Meyers: Um, but it is challenging, um, and I would say, you know, you don't have to pay us the 149. 99 a month to benefit necessarily, but the more people who pay us and the more that you can pay us, the longer it's going to enable us to create these patches for you, right? So at some point, I think we ran Drupal 6, you said, Jeremy, for a little over six years.
[00:09:21] Michael Meyers: We ran it, beyond the point where we're losing money on it, you know, um, Again as a community service, but at some point, you know the commercial market evaporates to the point where it's just not viable for us to deliver this service So if you are going to benefit from the patches It would be great if at the very least you could find a small way to contribute on that level. Um now You you install this module on your site It it monitors what you have and alerts you when an update is needed You Um, can I buy a license and then run this on all of my sites?
[00:09:55] Jeremy Andrews: Sort of.
[00:09:57] Jeremy Andrews: Um, so with, with your, uh, with [00:10:00] your license, you can install the, you can install one. You can install the module and one site can phone home. Um, which is to say that every 24 hours we take a snapshot of the modules you have enabled, the versions, just to make sure we have the latest information about your site.
[00:10:15] Jeremy Andrews: Um, you're not able to install the module on another site, with the same or different modules. However, if you have like the same modules on many, many different sites, you can share the patches, put it in one place, apply them everywhere, and that's fine. Um, what we consider a site, uh, is, is basically what everyone would consider a site, which is to say, you know, if your website is www. example. com, um, even though you have a dev site and a QA site, you know, those instances of it are, are not, they don't require separate licenses. Um, but if you had another website, whether it was a multi site or something else, um, that had a different database and a different URL, uh, that is actually a different Drupal installation, then that's like a different site that you would need to install the [00:11:00] module on.
[00:11:01] Michael Meyers: So if I had 10 sites and they're all the same, I can install and run it on one. And share the patches across all of them. But to the degree that my site's different, um, you only get notifications for the modules that are running on the system where you have the license for. So there is a downside in not running the module on a system that are, uh, slightly different.
[00:11:23] Michael Meyers: Um, but you're definitely welcome to share them across sites, um, if they're the same and you'll benefit from doing so.
[00:11:31] Jeremy Andrews: Yeah, the same way that Drupal is GPL 2 plus, the patches will also be, so we will be releasing them as open source and you can share them, but to state again, you know, it's important that people are paying for these patches and they continue to exist.
[00:11:48] Michael Meyers: Now, if I come along and I buy a premium support plan, um, that comes with a couple hours a month, three hours a month. Uh, for the Tag1 Team to help, uh, my [00:12:00] team with questions to get up and running with the patches. Tag1 can install them for me. Um, but there are some requirements that my organization needs to have in place.
[00:12:10] Michael Meyers: Right. Some basics, you know, most sites already have these. Um, can you give us a quick rundown? Uh, if an organization wants premium support, what are the base requirements they need to have in place in order for us to provide that support?
[00:12:23] Jeremy Andrews: Hopefully none of these are surprises to anybody. Um, cause they are important.
[00:12:28] Jeremy Andrews: Uh, first and foremost, the website needs to be properly managed with source control. Um, you know, we don't want you manually applying patches on production websites. Uh, it needs to use proper source control. There has to be databases, uh, you know, recent databases that you're testing of the database. If something goes wrong, which of course we try to avoid, it's critical that it's possible to, to back out.
[00:12:53] Jeremy Andrews: So that's important. Um, and you need at least a, uh, a testing environment, so it can be, you know, [00:13:00] dev QA, whatever you want to call it. Um, but we want to install the patches and test them somewhere prior to it going into production and affecting the live website. Um, those, those three are, you know, the most critical requirements for, for being able to use the service.
[00:13:17] Michael Meyers: And I remember with, with Drupal 6, um, you know, a fair number of organizations came to us and especially on the smaller end of the scale, didn't necessarily meet these requirements, um, you know, oftentimes the easiest thing to do was to migrate them to a hosting provider, a platform like Pantheon or something that had development staging backups, all of these things bundled into a pretty convenient and expensive monthly plan.
[00:13:40] Michael Meyers: Um, Um, we can certainly help you do it internally, but again, it tends to be easier to just migrate your system. Um, if I remember correctly, almost, you know, we can't give any guarantees because every system is unique and a bit of a black box, but I don't think, it was extremely rare that it took more than 10 hours.
[00:13:57] Michael Meyers: Um, and so, you know, we offer a [00:14:00] 3, 000 setup fee, a one time fee for organizations that don't meet these requirements. Uh, to help them get up and running so that moving forward they will. And, you know, as you mentioned, like, this is kind of really critical, fundamental stuff that every organization should have in place to begin with.
[00:14:17] Michael Meyers: So, you know, you really shouldn't be operating a website without this and you'll benefit from doing it as well. Um,
[00:14:25] Jeremy Andrews: I missed one, uh, requirement that probably is worth calling out. Um, the patches will be against the latest version of Drupal Core, and it will be against the latest version of, you know, contrib released modules and themes.
[00:14:40] Jeremy Andrews: Um, so it will be necessary for your website, not only to have source control and backups and, you know, multiple environments, but you also need to be upgraded to the latest. Um, and, and that's, if, if you're, if you have a service like D7ES, you really want to be anyways, because most of like the latest releases are fixing security issues or [00:15:00] getting you up to date with the latest dependencies.
[00:15:02] Jeremy Andrews: Um, but. You can't simply apply these to an old version and expect them to work. We're not going to be back porting to every single release of Drupal. You have to be on the latest version.
[00:15:14] Michael Meyers: So when an, um, an update, a compatibility update, a security release comes out, I'm running the module. I get notified.
[00:15:24] Michael Meyers: Um, what happens like how does that work
[00:15:29] Jeremy Andrews: Depends on which plan you have? Um, if you're the self serve You you receive an email and says here's the patch and and then you run with it Um, and and if you have the technical expertise or the team Uh, you can apply the patch do all the things that we would do for you. Um, if you're paying for the premium team the premium support package Um, Um, then, you know, we'll proactively reach out and, and coordinate applying that patch, testing it with you, making sure it works and allowing you to then deploy it.
[00:15:58] Jeremy Andrews: Uh, but in all, in all [00:16:00] cases, it's, it's pretty straightforward. You know, it's, it can be as simple as either applying a patch or even just extracting a tar ball or a, or a, you know, a zip archive over the top of the existing code base, commit it and push it to production.
[00:16:13] Michael Meyers: When the Tag1 Team discovers a vulnerability or, you know, a requirement for an update, um, What is the process and timing for that? How, you know, when are these released, you know, is Tag1 offering some sort of, uh, service level agreement in SLA?
[00:16:31] Jeremy Andrews: Yeah, it's, it's, um, it's a difficult one to answer because there's different ways that patches are going to become available.
[00:16:38] Jeremy Andrews: Um, but when we did Drupal 6 LTS, which was the Drupal 6 version of extended support, um, whenever there were security issues That were released for, you know, Drupal 8, Drupal 9, Drupal 10, affecting Drupal 6. Um, we would release them typically within five minutes of them being announced publicly. Um, because, you know, there's coordination [00:17:00] behind the scenes.
[00:17:01] Jeremy Andrews: We'll never release them before they're available, though, for all versions, and the existing, you know, live version of Drupal. Um, in other cases, there's going to be proactive work done, you know, reviewing the code bases and in particular upgrading them to make sure they work with, you know, a still supported version of PHP and in doing that, we may find security vulnerabilities and therefore release patches.
[00:17:25] Jeremy Andrews: Um, we would never release a patch without first coordinating with Drupal Security Team to see, does this affect Drupal 11 or 10 or 9 or any other of the versions of Drupal that are active out there and, and coordinate and take as long as it takes to make sure we have a solution in place everywhere, uh, before we would roll out the patches.
[00:17:44] Jeremy Andrews: Um, but you know, the end, the end goal and the end result is that everybody's able to apply the patches at the same time.
[00:17:52] Michael Meyers: Yeah. It's a really interesting point. Like, um, It's surprising when we did D6 LTS long term support that, you know, a vulnerability in [00:18:00] Drupal 6 might also be a vulnerability in, you know, 7, 8, 9. And so, yeah, again, the coordination, we couldn't just fix it and release it, you know, it had to be coordinated with, you know, the Security Team and the releases of all the other platforms or we would expose them. Um, to a serious vulnerability and, and, and vice versa, you know, uh, more common was that, uh, vulnerability was discovered in a, in a more, uh, modern, newer version of Drupal.
[00:18:25] Michael Meyers: That happened to also apply to, you know, the ES version in this case, 7. Uh, and we had to go back and fix it. And so the idea that we would offer an SLA, you know, it's, it sounds great in theory, you know, and our, you know, our, you know, our efforts are to get them out there as quick as possible. Uh, but there are third parties, um, that are involved in this process that have to be involved in this process that, you know, you know, we can only move so fast to say the Security team and they are generally very good.
[00:18:53] Michael Meyers: Uh, but, you know, I think it's great to be really up front with everybody. Uh, you know, we will, you know, put, processes in [00:19:00] place. We will commit to timelines, but ultimately, you know, we're going to have to work with and run around the, the community and the way the security team works in general.
[00:19:10] Michael Meyers: So, Tag1 Drupal 7 Extended Support covers All of the contributed modules that my organization is using, all of the core modules my organization is using, and all of the contributed themes that my organization is using. Um, What if I have a, you know, a funky module? What if I have a module that's like, you know, a sandbox module or something that, you know, that's, that's really esoteric, something uncommon.
[00:19:39] Michael Meyers: Um, does Tag1D7ES cover those as well?
[00:19:44] Jeremy Andrews: Yeah, as long as it's an open source release, we're able to review the code base. Um, that said,
[00:19:50] Jeremy Andrews: we want there to be a official release for the module. Um, like that is the preference that there has been a release. And in all cases, it has to be the latest release that [00:20:00] we're going to create the patch for. So if you're vulnerable and you have an older release, you'll have to first upgrade and then apply the patch.
[00:20:07] Jeremy Andrews: Um, we generally are not supporting like sandbox only modules or devel release. However, when we did Drupal 6 LTS for six plus years, uh, we found that there were cases where it, it, you know, a module was big, like it was important. It was fundamental to a website and it never had an official release. It only had a sandbox, only had a devel.
[00:20:29] Jeremy Andrews: And so on a case by case basis, we did in fact support them. And absolutely, we'll do the same in D7 ES. Um, you know, you, you'd have to. If we found an issue, we would have a conversation about it to make sure it was a good fit for that. Um, and then yes, we could also support that. Um, the only other caveat is, you know, we're not saying all Drupal 7 modules are supported.
[00:20:53] Jeremy Andrews: We're saying all, Drupal 7 modules and themes are supported that are installed, actively installed by our [00:21:00] paying customers. And those are the ones that, you know, have the module installed that show up in the list of modules that we will, we will be supporting. We will not be publishing that list. Um, but the patches would come out based on, you know, as, as, as necessary.
[00:21:16] Michael Meyers: It's a really important distinction. All the modules used by our, uh, the organizations that are working with us will be covered, but not 100 percent of the contrib. Yeah. Uh, what about, uh, commitment? I sign up for, uh, the Tag1D7ES service, uh, do I need to sign a one year, two year contract? Um, you know, uh, you know, is there a lock in?
[00:21:38] Michael Meyers: How does this work?
[00:21:40] Jeremy Andrews: It's, it's month by month. Um, there's no commitment necessary. Uh, you, you pay the month in advance. So if you buy one month and you cancel, you can get all the, you know, the modules that already exist that affect your site, and you can cancel, and that's fine. Uh, in, in many cases, people were hesitant to sign up with the D6 program because they were migrating off.
[00:21:59] Jeremy Andrews: They had [00:22:00] three months to go. You know, it works out great. You sign up for three months. And then if your migration takes longer, if it takes six months, nine months, twelve months, uh, You just stay signed up as long as you want. In some cases, customers want, um, a commitment from us that we're going to be around longer.
[00:22:16] Jeremy Andrews: So we do offer an annual plan, same price. You don't save any money. Um, but it basically says, this is our guarantee to you that yes, you pay us for this year. And we will continue to provide Tag1 D7 ES for the full next 12 months.
[00:22:31] Michael Meyers: Awesome. Yeah, I hope people see, you know, we're trying very much to do this, uh, in large part as a community service.
[00:22:37] Michael Meyers: This is not a, you know, big moneymaker, even at the supported level. Um, you know, this is very much us trying to enable the community to continue to run Drupal 7 as long as they need. And, um, you know, no commitment, no lock in, unless you want to lock us into that, that one year contract. Um, well, Jeremy, I really appreciate you giving us the rundown on, uh, [00:23:00] Tag1 Drupal 7 Extended Support.
[00:23:01] Michael Meyers: Thank you. Um, if folks want to sign up, um, where do they go? How do they do it?
[00:23:08] Jeremy Andrews: Our website said d7es. tag1. com. Um, that stands for Drupal 7 extended support. So d7es. tag1. com. Um, and on that website, uh, there's a form to fill out. Um, once you fill it out, um, we actually won't start taking money until January after Drupal 7 goes end of life.
[00:23:27] Jeremy Andrews: Um, but the directions are there for the module that you have to install and to get you all set up. Um, it's worth jumping on if you want, um, the enterprise support offering, uh, because it might take some time between now and January to get your site up to date, get backups in place, you know, those kinds of things that are requirements for the program.
[00:23:49] Michael Meyers: Test everything out. Definitely. Um, you should not wait until January to, uh, provide us with your information and, and, and let us know that you want to use this service. Definitely plan ahead, it [00:24:00] doesn't take too much effort to get up and running and to test things out, um, but avoid the rush. Awesome.
[00:24:07] Michael Meyers: We'll really appreciate the rundown. We'll put the links in the show notes for the various things that we mentioned, in particular the d7es. tag1. com website. To the folks who are listening, please help us get the word out about Drupal 7 Extended Support. There's been a lot of confusion in the community, a lot of back and forth.
[00:24:26] Michael Meyers: The program was canceled three times and it was said it was never going to happen. Uh, and now we're back. Um, and a lot of people don't know that at Tag1, uh, D7ES is an option. And, um, it's really important that folks know they can continue to run on the platform, that they don't have to migrate unless they absolutely want to or need to.
[00:24:45] Michael Meyers: Um, so please share this talk out, upvote, subscribe, you know, to catch, uh, more updates. You can check out our past talks at tag1.com/ttt. That's three T's for Tag1 TeamTalks. And as always, we'd love your input and [00:25:00] feedback. Uh, if you have any questions about the topic today or suggestions for things you'd like to see us cover on Extended Support or other topics in general, . You can email us at ttt@tag1. That's TAG, the number one. com.
[00:25:15] Michael Meyers: Jeremy, again, thank you so much for joining us and everyone who tuned in. Thank you too. Take care.