• Created by Unknown User (mjc), last updated by Unknown User (jim) on Jan 11, 2022 2 minute read

You are viewing an old version of this page. View the current version.

Compare with Current View Page History

« Previous Version 5 Next »

Possible initiatives and things we've discussed doing as part of the work for this meeting.  In no particular order

  • Make sure our users know what they should be doing to find out about updates, EOL, CVEs
  • Consider if projects that are not releasing regularly are really healthy.  Could they realistically respond to a security vulnerability in a reasonable time frame?
  • Have a better EOL policy with defined communication routes, policy for CVE in EOL releases.
  • Look again into SCR:CLR as a service to projects
  • Look at 2FA for Apache
  • Make sure we upgrade our CNA CVE process to JSON 5.0 to make use of the additional record data
  • Get involved with various OpenSSF initiatives
    • Is the training something we should promote to committers
    • How can we make the scorecard better for ASF projects
    • How can we make the critical projects list better for ASF projects
    • How does Alpha and/or Omega fit with ASF
    • Would sigstore be a future replacement for current signing policies
    • Look at SLSA/SBOM work
  • Minimize situations in which PMCs refuse contributions for anything other than strong technical reasons
    • Forking increases the attack area and complexity of fixes
    • Either stop accepting forks as a necessary and acceptable outcome of PMC control OR focus on enabling "constructive forking" in a controlled manner in which the forking community are welcomed and can continue to contribute to the core project
    • ASF projects should consist of components for reuse and should accept contributions designed to enhance that reuse in broader contexts so as to allow the pool of contributors to grow
    • ASF Projects should be encouraged to build modular solutions to enable more reuse of components in broader contexts while still enabling pluggable features for specific use cases
    • Re-Affirm that ASF Projects are successful when the community is optimized, not when the primary employer of PMC members is successful - this success leads to further success in the primary employer should one exist
  • Consider annual re-affirmation by PMCs towards Apache Way, with reminders of What It Is.
  • Consider ASF Blog Post: "How You Can Help" directed towards corporate users.
  • No labels