CTI TAC Meeting Notes 2025-04-30

CTI TAC Meeting Notes 2025-04-30

Present:
      * Carlos O'Donell
      * Joseph Myers
      * Kris Borchers (OpenSSF)
      * Siddhesh Poyarekar
      
Regrets:
      * David Edelsohn
      
Agenda:
  * GNU Toolchain secure software development life-cycle https://sourceware.org/glibc/wiki/CTI
  * glibc Secure Software development life-cycle https://sourceware.org/glibc/wiki/CTI/Policy/glibc
  * Siddhesh: We should explore all possibilities around funding any position that would further improve the projects.
  * Joseph: Can we persuade the community to improve security regardless of where it is hosted?
  * Carlos: Forge for Fedora might eventually move Forgejo forward with usability.
  * Carlos: LF IT is talking in public about using proof of work on connections, and Sourceware adopted this strategy.
  * Carlos will post to libc-alpha with policy documents for glibc, not talking about where it will be hosted, but talking about our security requirement as a project.

Next steps:
   * AI: Carlos to get dates to send to Kris for a meeting with Steve.
   * AI: Carlos to publish the top-level and glibc level analysis to libc-alpha.
   * Sid to still review OpenSSF best practices badge gold and silver for hardware requirements.

-- 
Cheers,
Carlos.