CTI TAC Meeting Notes 2024-07-31

​CTI TAC Meeting Notes 2024-07-31

Present:
 * Carlos O'Donell
 * Konstantin Ryabitsev (LF IT)
 * Bennet Pursell (OpenSSF)
 * Joseph Myers
 * Nick Clifton
 * Siddhesh Poyarekar
 * David Edelsohn
 
Agenda:
 * Updates on glibc developers discussion around the SOW and migration.
  * https://sourceware.org/glibc/wiki/CTI
  * Clarify the how and why?
  * Siddhesh: Key concern around communication to the community? How often? How we communicate our progress?
  * Carlos: Certainly, yeah, monthly updates?
  * Siddhesh: Yes, mirror the meeting minutes?
  * Siddhesh: As far as CTI is concerned, the project stewards too, are quiet, and it doesn't help that they aren't vocal.
  * Carlos: AI: I'll ask Maxim, and Ryan, and others to make comments. Likewise reach out to senior developers looking for public statements of support.
  * AI: Mirror meeting minutes to libc-alpha on a monthly basis.
 * Carlos: Also I'll note that I don't want to ask specific teams to change they way they communicate. I will not dictate how teams want to communicate. But I will engage more on the mailing list if they need.
 * David: I agree with that.
 * Siddhesh: We want more vocal support from the stewards.
 * David: This has been the achilles heel of the project, that we are very technical, but not about being active in a mission around the projects.
 * Nick: Does the project need to move all of the services to CTI?
 * Siddhesh: I don't think binutils or glibc have scalability issues, but security and isolation, particularly git, it makes absolute sense to move them over and not replicate. Like having an official git repo at CTI and a mirror at Sourceware.
 * Siddhesh: git and patchwork are both really core services for access and auditing.
 * Carlos: Yes, git and patchwork are core.
 * Siddhesh: My personal preference is to have everything in one place.
 * Carlos: I agree.
 * David: Note again that we've always had corporate sponsorship.
 * Nick: The migration can be piecemeal if necessary.
 * David: Within the projects individual services can be migrated, and within the GNU Toolchain project, individual projects can be migrated.
 * Joseph: We should be thinking of the "community" those people actively working on glibc, equal partners, and working with them and understanding the security requirements better. First understanding what the issues are. And then only given the understanding going from there to the corresponding hosting requirements. I haven't seen any direct improvements to meet these concerns since 2022.
 * Joseph: I have another problem with Sourceware, which is social engineering of the changes requested to change Sourceware services.
 * Carlos: Yes, not just sysadmin requests, but also approval of account access, and volunteer approval are things that need a process.
 * Carlos: How does LF IT handle this?
 * Konstantin: Signed emails, trusted, verifiable, and any requests are reviewed by the team.
 * Siddhesh: We do have informal channels, but do we have specific examples?
 * Joseph: I don't have examples of social engineering, but I have examples where one person requested a change without review of this with the GCC developers.
 * David: We are still operating in a "trust" based manner for a 35 year old project, and that's not entirely practical right now.  
 * Carlos: Can we publish the CTI sponsorship agreement?
 * Bennett: Yes, there are public samples.
 * Carlos: OK, so I have an AI to update the CTI one and publish it?
 * Siddhesh: One of the concerns that was raised, was a fear that the TAC does not have enough influence to move things forward in the CTI project.
 * David: We had addressed this concern in the town hall.
 * Siddhesh: We probably need to update the CTI docs to add that information.
 * Carlos: Bennett, Who do I reach out to to get a PDF of the sponsorship agreement?
 * Bennett: AI: Who do I reach out do?
 * Updates on OpenSSF TAC presentation from CTI.
  * Presented on July 23rd to the OpenSSF TAC.
  * Paul Eggert came to the meeting and talked with Carlos.
 * Bennett: SOW, need to huddle with him. Are you going to review the SOW with the FSF?
 * Carlos: Yes, possibly, 
 * Updates on FSF position regarding CTI.
 * Bennet: What AIs do we have?
 * Carlos: I'll email out the minutes, and a distinct email with AIs that we have from this meeting.

-- 
Cheers,
Carlos.