• Created by Unknown User (mjc), last updated by Unknown User (rgardler) on Jan 12, 2022 2 minute read

You are viewing an old version of this page. View the current version.

Compare with Current View Page History

« Previous Version 8 Next »

Possible initiatives and things we've discussed doing as part of the work for this meeting.  In no particular order

  • Make sure our users know what they should be doing to find out about updates, EOL, CVEs
  • Consider if projects that are not releasing regularly are really healthy.  Could they realistically respond to a security vulnerability in a reasonable time frame?
  • Have a better EOL policy with defined communication routes, policy for CVE in EOL releases.
  • Look again into SCR:CLR as a service to projects
  • Look at 2FA for Apache
  • Make sure we upgrade our CNA CVE process to JSON 5.0 to make use of the additional record data
  • Get involved with various OpenSSF initiatives
    • Is the training something we should promote to committers
    • How can we make the scorecard better for ASF projects
    • How can we make the critical projects list better for ASF projects
    • How does Alpha and/or Omega fit with ASF
    • Would sigstore be a future replacement for current signing policies
    • Look at SLSA/SBOM work
  • Minimize situations in which PMCs refuse contributions for anything other than strong technical reasons
    • Forking increases the attack area and complexity of fixes - projects should be governed such that the need to fork when using the code is minimized
    • Stop accepting forks as a necessary and acceptable outcome of PMC control of ASF projects - users cannot be expected to invest in a community if the gates to the PMC are closed
    • Focus on education such that PMCs can enable "constructive forking" in a controlled manner such that the forking community are supported in improving a projects architecture to minimize the need to fork
    • Educate ASF projects that the way to a healthy community is through the production of reusable components that enable contributions designed to enhance reuse in broader contexts so as to allow the pool of contributors to grow
    • Re-Affirm that ASF Projects are successful when the broadest possible community is engaged leading to more maintainers and more eyeballs on the shared code
  • Consider annual re-affirmation by PMCs towards Apache Way, with reminders of What It Is.
  • Consider ASF Blog Post: "How You Can Help" directed towards corporate users.
  • should have more complete policy around production of "builds" https://www.apache.org/legal/release-policy.html#compiled-packages
  • Spend Foundation resources (money) on creating messaging for community members, e.g.
    • Popularizing, re-affirming The Apache Way
    • Messaging to evangelize a "give back" culture among consumers
    • Presentations for community members to share with Colleagues on how to give back, how to handle Open Source contributions
    • Language for corporate lawyers to facilitate contributions by developers in their organization, what it means when a developer signs an ICLA (or is hired already having one on file), etc. 
  • No labels