Versions Compared

Old Version 5

changes.mady.by.user Unknown User (jim)

Saved on

compared with

New Version 6

changes.mady.by.user Unknown User (mjc)

Saved on

Key

  • This line was added.
  • This line was removed.
  • Formatting was changed.
Comment: convenience binaries

...

  • Make sure our users know what they should be doing to find out about updates, EOL, CVEs
  • Consider if projects that are not releasing regularly are really healthy.  Could they realistically respond to a security vulnerability in a reasonable time frame?
  • Have a better EOL policy with defined communication routes, policy for CVE in EOL releases.
  • Look again into SCR:CLR as a service to projects
  • Look at 2FA for Apache
  • Make sure we upgrade our CNA CVE process to JSON 5.0 to make use of the additional record data
  • Get involved with various OpenSSF initiatives
    • Is the training something we should promote to committers
    • How can we make the scorecard better for ASF projects
    • How can we make the critical projects list better for ASF projects
    • How does Alpha and/or Omega fit with ASF
    • Would sigstore be a future replacement for current signing policies
    • Look at SLSA/SBOM work
  • Minimize situations in which PMCs refuse contributions for anything other than strong technical reasons
    • Forking increases the attack area and complexity of fixes
    • Either stop accepting forks as a necessary and acceptable outcome of PMC control OR focus on enabling "constructive forking" in a controlled manner in which the forking community are welcomed and can continue to contribute to the core project
    • ASF projects should consist of components for reuse and should accept contributions designed to enhance that reuse in broader contexts so as to allow the pool of contributors to grow
    • ASF Projects should be encouraged to build modular solutions to enable more reuse of components in broader contexts while still enabling pluggable features for specific use cases
    • Re-Affirm that ASF Projects are successful when the community is optimized, not when the primary employer of PMC members is successful - this success leads to further success in the primary employer should one exist
  • Consider annual re-affirmation by PMCs towards Apache Way, with reminders of What It Is.
  • Consider ASF Blog Post: "How You Can Help" directed towards corporate users.
  • should have more complete policy around production of "builds" https://www.apache.org/legal/release-policy.html#compiled-packages