Tuesday, 2026-09-01

gouthamrfrickler: priteau: sent an email to openstack-discuss proposing the cleanup of the group.. the TC's been handling that repo05:19
opendevreviewIvan Anfimov proposed openstack/governance master: Update Zun release/security liaisons  https://review.opendev.org/c/openstack/governance/+/100250105:44
opendevreviewMerged openstack/governance master: Update Zun release/security liaisons  https://review.opendev.org/c/openstack/governance/+/100250106:02
priteauThank you gouthamr 09:40
cardoegouthamr: I wanna bring up point releases and OSSN. I haven't added it to the agenda and I know it's late.14:49
opendevreviewJeremy Stanley proposed openstack/governance master: Propose SECURITY.rst goal  https://review.opendev.org/c/openstack/governance/+/100269215:03
cardoefrickler: that ironic 35.0.2 you +2'd is part of ^ above.15:51
tkajinamone question. Do we accept a commit with Signed-off-by: <company name> ?16:22
tkajinamI mean a commit signed off by a person but a company16:22
gouthamrno16:22
tkajinamthis is where I found that https://review.opendev.org/c/openstack/ceilometer/+/100326916:22
gouthamrtkajinam: this is legal territory, but, only humans/individuals can use the DCO signed-off-by imv16:23
fungiit looks like some company created a shared account not for an individual? but without knowing more it's certainly possible that there's a person named "fivetime" with that e-mail address too16:23
gouthamryeah, could me an individual too? "fivetime <td@fivetime.ltd>"16:24
fungiright now we're assuming it's impossible that a person named "fivetime" wrote and proposed that change16:24
tkajinamI'm not sure if that ltd domain can be used by a person, not by a company16:25
fungigerrit makes sure that at least one signed-off-by matches the committer and, further, isn't configured to allow normal users to push changes for which they're not the committer16:25
tkajinambut I'll ask the author to clarify that16:25
gouthamrthat change also has "Co-Authored-by: Claude ..." ; that should be dropped as well.. 16:27
gouthamrWe use "Assisted-By" for this sorta thing16:27
fungifor completeness here, https://governance.openstack.org/tc/resolutions/20250520-replace-the-cla-with-dco-for-all-contributions.html passed by the tc last year refers to https://developercertificate.org/16:27
fungiby adding a `signed-off-by` trailer, the account holder/committer is asserting that the statement there is completely true16:28
tkajinamyeah16:29
fungii don't see where we have anything in writing that explicitly states a legal entity such as a corporation can't agree to and assert those things (through a representative), though i've heard it said fairly often that signed-off-by has to be applied by a person16:30
fungiit's a bit of a grey area16:30
* gouthamr gah, forgot the reminder to the reminder16:31
gouthamrtc-members: a gentle reminder that our weekly IRC meeting will be hosted here in ~29 minutes16:31
fungiif the tc wants to require the dco be asserted only by an individual "natural person" and not by a "legal person" such as an organization, it might be a good idea to make that clear somewhere16:31
gouthamrtc-members: agenda is here: https://wiki.openstack.org/wiki/Meetings/TechnicalCommittee16:31
fungi(in most jurisdictions i'm familiar with, an officer of a corporation can legally enter into a binding agreement on behalf of that organization, for example)16:32
gouthamrfungi: i'd hope the foundation can clarify this. it may be hard to meaningfully implement beyond someone maybe catching it in code review16:32
clarkbkernel docs say only humans can sign it fwiw16:32
dansmith++ for humans16:32
clarkbwhich I take to mean no legal entities or LLMs16:32
fungiyes, i think it can't hurt for us to say that somewhere, but an officer of a company agreeing to the dco is a person doing it16:32
clarkbfungi: right but they should sign it as a human then16:33
clarkbJohndoe@corpemail.com16:33
fungii agree, but we don't say that anywhere that i can find16:33
tkajinamthat's why I asked that question here, in fact.16:34
clarkbfwiw my read of the DCO itself is that you don't need to explicitly state it as its already there16:34
clarkbcorporations don't use first person pronouns16:35
tkajinamI'll ask the auther if a human name can be used there instead, but if that's rejected I may need some more official clarifications to find an official solution16:35
tkajinamI'll come back here in that case... hoping I don't need that16:35
fungii've also asked folks in openinfra foundation executive management16:36
tkajinamoh thanks.16:37
fungipart of why it's an odd situation is that the copyright on code written as a "work for hire" is held by the employer, a company, which is a vast majority of the code that makes it into openstack. with the dco we're asking someone whether they have the permission of the copyright holder, i.e. the company which employs them16:38
fungii'm not a lawyer, but i can certainly see an argument for the copyright holder asserting the dco16:39
fungialso there doesn't seem to be a website attached to that domain and i can't look up whois details for it either, so it's entirely possible it's the business name for a single-person consultancy or even just someone's personal vanity domain16:46
tkajinamfungi, yes. there are a few points needing clarification from both the author and foundation to find the right path, I think16:51
tkajinamthere are still number of items I'm still "guessing"16:51
gouthamr#startmeeting tc17:01
opendevmeetMeeting started Tue Sep  1 17:01:11 2026 UTC and is due to finish in 60 minutes.  The chair is gouthamr. Information about MeetBot at http://wiki.debian.org/MeetBot.17:01
opendevmeetUseful Commands: #action #agreed #help #info #idea #link #topic #startvote.17:01
opendevmeetThe meeting name has been set to 'tc'17:01
gouthamrWelcome to the weekly meeting of the OpenStack Technical Committee. A reminder that this meeting is held under the OpenInfra Code of Conduct available at https://openinfra.dev/legal/code-of-conduct.17:01
gouthamrToday's meeting agenda can be found at https://wiki.openstack.org/wiki/Meetings/TechnicalCommittee17:01
gouthamr#topic Roll Call17:01
spotz[m]o/17:02
cardoeo/17:02
gouthamrnoted absence: m n a s i a d k a17:02
dansmitho/ (kinda)17:02
noonedeadpunko/17:03
gouthamrcourtesy-ping: frickler bauzas17:03
bauzaso/17:04
bauzasback from PTO folks17:04
gouthamrwelcome back17:05
gouthamrlet's get started17:05
gouthamr#topic Last week's action items17:05
gouthamrAC/APC active-core-reviewer election-tooling changes should have all merged, ty for your work there, fungi17:06
gouthamr#link https://review.opendev.org/q/hashtag:%22core-reviewers-as-ac-apc%22+(status:open%20OR%20status:merged) 17:06
gouthamrthe TC election is underway17:06
frickler\o17:06
gouthamrand will conclude at 23:45 UTC on Sep 16 202617:07
gouthamr#link https://governance.openstack.org/election/ 17:07
gouthamrif you haven't noticed a ballot email, log into civs and check please, because CIVS needs an opt-in for emails for the past few years17:07
gouthamr#link https://civs1.civs.us/cgi-bin/opt_in.pl (CIVS Opt-in) 17:08
gouthamri think the 2027.1 runtime update is on track17:10
gouthamr#link https://review.opendev.org/q/topic:%222027-1-testing-runtime%22 17:10
gouthamrnext week after the RC1 patches roll in, gmaan will unblock the rest of the changes17:11
gouthamrthe last action item i was tracking was regarding PTL appointments17:12
gouthamr#link https://review.opendev.org/c/openstack/governance/+/1002415 (Appoint PTLs to Glance/Skyline/Masakari for 2027.1) 17:13
gouthamrwe've gathered some +1s there, need a few more Roll-Call votes so we can close this out17:13
gouthamralright, that's a wrap for action items17:15
gouthamrwere you working on any and would like to share?17:16
gouthamr#topic Consistent project management17:17
gouthamr#link https://lists.openstack.org/archives/list/openstack-discuss@lists.openstack.org/message/KPLX44YX6VEAJT4SZ3T7CJ3K2U6HJUTZ/ ([tc][all] Proposal: require projects to document their path to (and standard for retaining) core status)17:18
cardoeSo it's been fairly quiet on this one.17:19
gouthamrcardoe brought this up here a couple of weeks ago, and it evolved into a good discussion. there are several angles to this, and the common denominator that i saw consensus on was that we need to document conventions/rules on how someone can become a project maintainer.. 17:19
cardoeI will say I joined the neutron team meeting this week and they discussed the topic and I felt like the discussion was positive.17:20
cardoeThey brought up some folks that were cores that hadn't been reviewing in a while and they had emailed them about their involvement without a reply.17:20
gouthamrhe does have a second item there regarding dropping cores, but we can try and get this first topic some more discussion to see if there are any thoughts17:20
cardoeAnd it lead back to what clarkb and I discussed after the last tc meeting that they felt it was a bit of a security concern that those folks were cores without reviews in a year and not replying.17:21
cardoeSo just sharing that as one project's "feedback"17:21
cardoeI can get something written up for the governance repo and propose it if that sounds like a good next step.17:22
gouthamri think its a good next step17:22
gouthamrcan you link us to the discussion?17:22
cardoeor the project-team-guide?17:22
spotz[m]Might also be a good discussion topic and working session for the PTG17:22
opendevreviewMerged openstack/governance master: Fix election script edits  https://review.opendev.org/c/openstack/governance/+/100240917:22
cardoehttps://meetings.opendev.org/irclogs/%23openstack-neutron/%23openstack-neutron.2026-09-01.log.html it really starts around 13:5317:23
cardoespotz[m]: sure that works as well17:23
gouthamrcardoe: you could try a cross project goal if you'd like to see documented process 17:24
gouthamrty for the link, i scrolled right past it :) 17:24
cardoeWhat repo would that be?17:25
gouthamrbut yeah, looks like a familiar problem: "contacted X to see about removing X from core team but have not had a response"17:25
gouthamrgovernance17:25
gouthamrcardoe: https://review.opendev.org/q/project:openstack/governance+(topic:goal-proposal+OR+hashtag:goal-proposal)17:26
cardoeokay yes that's what I was originally thinking.17:26
gouthamryou could add the project-team-guide content too, but a goal is a way for a champion or a group of people to work with project teams and get something done17:27
TheJuliaOne thought of caution, a documented process requires something/someone to execute the process17:27
TheJuliain other words, process without a report, or processes without a trigger are less meaningful.17:27
TheJuliaThey are great in principal and getting on the same page though, lets just not trap ourselves in that thought process, because it only then ends up being a starting point to iterate upon17:28
gouthamryeah, i think as you were discussing here, maybe project teams should discuss what inactivity means from a core reviewer and document it clearly. anyone from a core-reviewer team has permissions to add/remove core reviewers on gerrit.. but, traditionally, the PTL has done so in PTL-led teams17:29
TheJuliaYeah, setting that expectation would be an ideal outcome17:30
gouthamrso, maybe the "inactivity check" is a once-per-cycle check that someone does; or maybe more aggressively if the project chooses to.. either case, it'd be better than status quo17:31
TheJuliaWell, someone does is the challenge. It really needs to be like a monthly automated report or soemthing like that.17:31
TheJuliabut, that may be a longer term thing.17:31
gouthamrsince core reviewers are nominated with trust, ideally there's some communication when someone steps away. this process to dropping someone is purely an objective test if there's no communication17:32
TheJuliaGoing back to the security concern standpoint, I've had some folks express the same concern to me as of recent, so I think we're at a point where more eyes are on the topic which mirrors discussion so far17:32
TheJuliaLife does happen, the concern is if someone's account with rights gets compromised.17:33
* TheJulia misses Ilya17:33
TheJuliaAnyway, back to my other screen, thanks folks!17:33
gouthamrinserts obligatory: "we'd welcome you back with t-rex arms if you'd like" 17:33
TheJuliagouthamr: lol, that cheered me up after the sad thought, thanks!17:34
gouthamrno really, code review and project maintenance is service, and people with the best intentions do this work... so if they have to step away, it's okay.. happens all the time, and the hope is the teams are sustainable to survive these sort of removals17:35
TheJuliawell said17:36
gouthamr++17:38
gouthamrno really, this is service, and its appreciated17:38
gouthamrgrr, line in copy-paste17:38
gouthamrany further thoughts here?17:38
fungiit's why core review activity is now counted officially as qualification for active reviewer status17:39
fungier, active contributor status i mean17:39
gouthamr++17:39
gouthamrif not, something from a similar vein: 17:40
gouthamr#link https://lists.openstack.org/archives/list/openstack-discuss@lists.openstack.org/thread/KLUURVAJWNJCNBOVYNX5CXZ3C2F4Y3ZU/ (Recommended approaches to improve contributor and maintainer experience)17:40
gouthamrwe can discuss this separately if warranted, some very cool ideas here17:40
gouthamrmharley[m]: are you around?17:42
gouthamrcardoe: do you need anything else to start on this proposal?17:42
mharley[m]Hey, have I been summoned? 😊17:43
cardoeNope. I'm good.17:43
gouthamrmharley[m]: i guess so, your topic is next17:43
gouthamrty cardoe 17:43
gouthamr#topic PQC Readiness community goal proposal (mharley)17:43
gouthamrmharley[m]: the floor is yours17:43
gouthamr#link https://review.opendev.org/c/openstack/governance/+/1001777 (Add PQC Readiness as a proposed community goal)17:43
mharley[m]Ops, I was not expecting to participate today.17:44
mharley[m]Anyway, no problem.17:44
mharley[m]So, the goal has been submitted. 17:45
mharley[m]It is organized in three milestones: the first one (2027.1) focuses on removing barriers that prevent PQC key exchange from working on platforms that already support it, like replacing deprecated SSL APIs and cleaning up hardcoded algorithm choices.17:45
mharley[m]The second one (2027.2) is about crypto agility for asymmetric operations in Barbican, Glance image signing, and Castellan.17:46
mharley[m]The third one (2028.1) targets end-to-end PQC for new deployments, once upstream libraries like pyca/cryptography ship ML-DSA and ML-KEM support.17:47
gouthamrthis "crypto agility" terminology is funny17:47
mharley[m]The pop-up team is driving the work and offering guidance to any project that wants to address their own findings. We are not asking projects to take on work; we are offering support and a reference point.17:47
fungithe industry has gone back and forth on the benefits and risks of cryptographic "agility"17:48
mharley[m]It might be, gouthamr, but the message here is one only:  to speed up post-quantum security whereas at the same time still keeping backwards compatibility. 17:48
fungi(several times already)17:48
fungimaking protocols more flexible in choosing alternative cryptographic primitives has itself been the source of many, many security vulnerabilities17:49
mharley[m]The risk exists regardless of the terminology and of some individuals’s convictions. That’s a fact. 😊17:49
mharley[m]s/s//17:49
fungimore systems have been compromised through broken implementations due to the added complexity than through people actually attacking the cryptography itself17:50
TheJuliamharley[m]: I think the issue you face is more perception management and context building.17:50
gouthamrack, no problem with making sure we don't pigeon-hole into specific implementations.. 17:52
mharley[m]That’s one of my concerns, fungi:  parts of the community insist on keeping using weak algorithms and methods for the sake of tradition of some questionable value. 17:52
fungiyes, i don't mind keeping updated to stronger cryptographic standards, but "agility" for its own sake adds complexity which is an increased attack surface for just bypassing the cryptographic protections entirely17:53
fungiclassic "downgrade attacks" are one of the more popular examples there17:54
TheJuliamharley[m]: Your making a huge generalization there which is not helpful to your cause. See perception management and context building comment from earlier. As an example, I've had folks push back because their regional standards body hasn't signed off on the "shiny new algorithm". 17:55
mharley[m]TheJulia: maybe, but the issue is not only mine. I think a bit more of acceptance than simple questioning would help a lot. 17:55
mharley[m]I’m not trying to push anything but it’s being a bit hard to communicate a message that should be simple. 🤔17:55
mharley[m]It’s not a buzzword. It’s a trend.17:55
fungithat's been my concern historically with the "fips" goal as well, usa nist is not as generally trusted worldwide as a lot of people living in the usa seem to assume17:56
TheJuliamharley[m]: you need to win hearts and minds, build consensus.17:56
gouthamrtrend/buzzword - same thing, is corporate-speak like "zero-trust". 17:56
gouthamrbut, no offense to you mharley[m] 17:56
gouthamrits just the weirdness of wanting to name something and sounding all-encompassing17:56
TheJuliafungi: and I think that is now on a direct path to "zero-trust" ;)17:57
fungiand many people, when they see usa nist pushing some particular angle, today suspect ulterior motives17:57
gouthamryes, my first comment on the goal would be that ^17:57
TheJuliafungi: yeah, that is some of the same push back I've gotten on some changes as well.17:57
fungiTheJulia: yes, i have "zero trust" in lattice cryptography, for example, and suspect that certain actors are promoting it because they know how to break it17:58
gouthamri think we've been burned by making recommendations from a single country sound like canon.. so, we could lighten that up a bit.. OpenStack is used globally, and we shouldn't sound like our security posture mirrors that of the US government17:58
gouthamrbut the meat of the goal itself, the flexibility of choice seems fine.. i don't have a technical pushback to offer there. ty for refining this and sharing the details here17:59
gouthamrthe timeline may be something that needs a wider discussion, perhaps on the change itself or with project teams17:59
gouthamrat the PTG17:59
mharley[m]Thanks, gouthamr. I’m glad you guys realize this is not about mharley, it’s about security. 18:00
TheJuliaBut to the point, the key is to build shared vision. Security means different things to different people.18:01
mharley[m]It’s a vast topic, indeed.18:02
gouthamr++ maybe some of this can be security guidelines in security.openstack.org.. i'd invite you to take that route for new projects/features18:03
mharley[m]Yep, I’ll take the advice.18:03
gouthamralright, we're past the hour18:03
gouthamrcan't get to the standing topics today18:04
gouthamrbut let's stop here, ty mharley[m] 18:04
gouthamris there anything else for the minutes today?18:04
gouthamrfungi mentioned some health concerns that the release team identified for a couple of tacker team deliverables, we can follow up async; and, frickler/priteau observed that we need to fix the "service-types-authority" core list: https://lists.openstack.org/archives/list/openstack-discuss@lists.openstack.org/thread/UNBVEOMWMNAWZBQ5EHCCJCSTPF256JGT/18:05
gouthamrtty about both of those in the next meeting perhaps, or in between if we get a chance. 18:06
gouthamrthank you all for attending18:06
gouthamr#endmeeting18:06
opendevmeetMeeting ended Tue Sep  1 18:06:25 2026 UTC.  Information about MeetBot at http://wiki.debian.org/MeetBot . (v 0.1.4)18:06
opendevmeetMinutes:        https://meetings.opendev.org/meetings/tc/2026/tc.2026-09-01-17.01.html18:06
opendevmeetMinutes (text): https://meetings.opendev.org/meetings/tc/2026/tc.2026-09-01-17.01.txt18:06
opendevmeetLog:            https://meetings.opendev.org/meetings/tc/2026/tc.2026-09-01-17.01.log.html18:06
spotz[m]Thanks all18:06
mharley[m]YW, gouthamr. Appreciate the opportunity. 18:07
gouthamrdansmith: cardoe bauzas: can you RC +1 https://review.opendev.org/c/openstack/governance/+/100241518:55
opendevreviewIvan Anfimov proposed openstack/project-team-guide master: Fix typo  https://review.opendev.org/c/openstack/project-team-guide/+/100336519:34
opendevreviewIvan Anfimov proposed openstack/project-team-guide master: Fix typo  https://review.opendev.org/c/openstack/project-team-guide/+/100336519:36
opendevreviewMerged openstack/project-team-guide master: Fix typo  https://review.opendev.org/c/openstack/project-team-guide/+/100336519:54
cardoeAlright so another conversation I wanted to have is about release tags.20:27
* fungi perks up20:28
cardoeI started in the ironic channel. So I'll use the example I used there.20:28
cardoehttps://security.openstack.org/ossa/OSSA-2026-017.html20:28
cardoeIronic: >=17.0.0 <26.1.7, >=27.0.0 <29.0.6, >=30.0.0 <32.0.2, >=33.0.0 <35.0.2 is translated by GitHub security DB into https://github.com/advisories/GHSA-jrh2-f5jc-xpgr20:29
cardoeEven NIST https://nvd.nist.gov/vuln/detail/cve-2026-4644720:29
fungican you explain what's wrong with it?20:29
cardoeSo 35.0.2, 32.0.2, 29.06 don't exist20:30
cardoeThose btw correspond to OpenStack 2026.1, 2025.2, and 2025.120:31
fungiand20:31
cardoeIt's a public perception thing.20:31
fungican you solve the problem of predicting what the fixed version will be in advance?20:31
cardoeA number of tools attempt to pattern match against requirements.txt and pyproject.toml20:31
cardoeWell the security advisory was published June 3rd.20:32
fungiyes, though it was communicated to downstream stakeholders in mid-may20:32
gouthamrcardoe: its good hygiene to get those releases tagged.. JayF mentioned (and i read on #openstack-ironic too) that ironic folks deliberately held off releases to cover a bunch of security fixes in the same releases20:33
gouthamrmaybe do it now? :) better late than never20:33
cardoeA number of security auditing tools still flag an unreleased value.20:33
cardoegouthamr: yeah I've requested it.20:33
gouthamr++ perfect, i've been doing it for all repos with OSSAs other than ironic.. 20:33
gouthamror nudging people to.. 20:34
cardoegouthamr: I'll cut to the end point. But there's a lot of work for humans here and it's quite repetitive and manual.20:34
cardoeSo I looking to suggest some addition to the bot for proposing releases.20:34
fungii can't tell if your concern is that we've specified upper bounds that end up not being actual versions that are tagged and never exist, or that teams aren't getting backports merged and tagged in a timely fashion after the advisory is published20:34
cardoefungi: the patches live in stable/2026.1 for example20:34
fungiso clarification appreciated20:34
gouthamrcardoe: https://review.opendev.org/c/openstack/agentic-workflows/+/99513620:34
cardoeBut folks aren't running pbr against repos.20:35
fungii'm not sure what it means to run pbr against a repo20:35
cardoeEspecially when they're using audit tools from companies.20:35
fungilet's rewind. what is your proposal?20:35
fungii'm having trouble untangling your actual concern20:35
cardoeWe need to make release tags near the time of the announcement being published.20:35
cardoeI don't want to put that work on humans.20:36
fungiokay, i'm not sure how we can do that if the changes they would tag don't merge right away, so that needs to be solved first20:36
gouthamrby announcement, you mean OSSA or OSSN?20:36
cardoeOSSA20:37
gouthamrif yes, i agree with fungi.. we have problems getting fixes merged in many projects on the day of the announcement20:37
fungithe current process relies on "eventual consistency" since we don't have project managers to coordinate advisory publication, core reviewers, ci/cd and release requests20:37
fungithey're all handled independently by disaggregated groups of community participants20:37
cardoeI was going to suggest something like a header "Release: patch"20:38
cardoeAnd when that commit landed in a stable/<blah> branch the bot could auto-propose a patch bump.20:39
fungithe vmt asks teams to please prioritize reviewing the fixes once they're pushed to gerrit and to keep an eye on them to make sure they merge, and to reach out to me or others if the need ci to prioritize certain changes because of backlogs20:39
fungionce the release request is proposed, the release team will need a ptl or release liaison to acknowledge the request as well, so there's still a team representative in the loop even if we auto-propose release patches, just be aware20:40
fungiit potentially saves a step though, sure20:40
* gouthamr does the deed for OSSA-2026-03720:40
fungiwould you want the automation to wait for all the backports to merge and then combine them into a single release request, or propose them one at a time as they merge?20:41
cardoeI dunno. Just floating an idea out here.20:41
cardoeYou wanna know where all this came from?20:41
cardoeMy kids are in Boy Scouts. I went along on the last camp out.20:42
cardoeAnother dad works for GitHub on their security product.20:42
fungiusually the human proposing them groups them into a single release request, but sometimes an older branch has trouble with some unexpected test bitrot for example20:42
cardoeWe got to talking about software at one point.20:42
cardoeWe somehow got to OpenStack and he mentioned how it shows up in the GitHub vulnerability DB.20:43
cardoeAnother dad is his company's software security person.20:43
fungiso under current practice there's a human judgement call to balance putting more workload on the release team vs getting things that can be released done sooner20:43
* gouthamr https://review.opendev.org/c/openstack/releases/+/1003379 - gtema, PTAL20:43
cardoeThey use OpenStack somewhere. He complained how OpenStack always fails all security audit tool stuff and he has to get exceptions.20:43
cardoeSo my sample size is 2 random adults in the world complaining about the perception of OpenStack and security.20:44
clarkbfwiw this is a common issue with distros like debian (because they backport fixes and don't pull the latet relaese)20:44
fungineat that github is using openstack, i had never heard that but i know some people who would love to hear more ;)20:44
cardoeSo it just got me thinking that it was a bad perception for us to have as a project.20:44
clarkbif you look on quay it complains about all the debian images for this reason20:44
fungii don't think we have a bad perception as a project, if anything we are often cited as an example of doing this the right way20:45
cardoefungi: GitHub isn't. He works on GitHub's security tooling product they sell.20:45
cardoeThe other dad works for a NASA contractor.20:45
fungiand our process has been reused by lots of other projects and enshrined in popular recommended practices20:45
cardoealright well nevermind then20:46
fungiwe were a pioneer of transparency in vulnerability handling for community-developed open source20:46
fungithat's not to say that we're perfect and i'm happy to entertain improvements, but chesterton's fence and all20:46
* gouthamr is not opposed to some automation to propose releases automatically20:47
fungithe processes we follow have been slowly evolved over the past 16 years and most of what's there is for a very good reason, so first it helps to understand the reason something is done before recommending it be changed20:47
clarkbAnyway I bring up the distro patching problem because maybe if the audit tools have solved it for them (unlike quay) perhaps there is a solution there?20:47
clarkbI guess the distros do bump their specific versions with a suffix indicating the distro patch level which is probably what audit tools look at?20:48
cardoeMaybe?20:48
clarkbwhich sin't helpful here if the problem is the release is missing int he first place20:49
cardoeI don't use any of them and don't have access to them.20:49
fungibut yes, this is the reason our advisories link to the changes in gerrit rather than telling people to install a particular release, because we acknowledge that releases may lag behind the announcement by an unpredictable amount of time20:49
cardoeI do personally use https://docs.renovatebot.com/ and it uses version source catalogs / DBs.20:49
cardoeAnd they've got stuff like a docker registry and pypi registery as a source of info.20:50
cardoeI suspect that's what these other tools are doing similarly.20:50
fungiauto-proposing release requests is not a bad idea per se, but as always the devil is in the details (like for example the batching dilemma i mentioned), and it doesn't necessarily speed things up since the usual delays are getting the changes merged at all, and getting the ptl or release liaison involved in the release request (whether they propose it or merely acknowledge it)20:50
cardoeI'm just using renovate to propose new version bumps.20:50
cardoeAll I'm bringing is a data point to the table and looking to discuss it with a wider audience if there's any value in the data.20:52
cardoeIn some of my own stuff I've got a requirements.txt which has ironic==35.0.1 pinned20:53
cardoeCause that's what renovate bumped it to.20:53
cardoeIf that had any kind of auditing for like clarkb pointed out of quay then it would probably show up as vulnerable.20:54
cardoeIt's just a GitHub Action to utilize some of the code to run tests so it's w/e.20:54
cardoeWhat I don't want to do is add more manual work to humans though.20:56
fungiyes, historically we expected distribution package maintainers to backport the patches we publish to their maintained packages, and considered users who don't rely on a curated distribution to be maintaining their own de facto distribution (because realistically they are)20:56
funginaively installing openstack from pypi isn't "safe" and if you jump in your time machine and go back about 10 years we intentionally didn't publish service releases to pypi because of that20:58
fungiwe started putting them on pypi as a convenience for our own testing20:58
TheJuliaso, from a $0.02 perpsective, on a stable branch, we should seek to just drive towards an engagement doesn't explicitly require a bunch of humans because perceptions are important and humans can easily not notice and other's can gain damaging perceptions20:58
fungiwe'll have to drop testing to achieve that, but i'm not entirely opposed to the idea20:59
fungiright now, final testing of backports is usually the primary delay, especially on older maintained branches20:59
TheJuliaI'm not sure what you mean by testing to achieve that because it also seems feasible. I guess I'm just trying to get people accustomed to the idea what humans shouldn't be in the middle of all things.21:00
TheJuliaReasonable gates/controls makes a ton of sense and all, but milage may vary21:00
fungimost of it is babysitting stable branch testing to make sure the fix doesn't merge with an unnoticed regression21:00
cardoeYeah I don't really think we need human sign off for these release tags to be made.21:00
clarkbyou can push the patch the stable branch but if it doesn't pass testing then you need humans in the loop to either fix that or make a judgement that it can be overridden21:00
TheJuliafungi: do you mean additional human stable branch testing? or automated?21:01
cardoeclarkb: sure but if it passes tests and it has a magical header like "Release: patch". We could do X.Y.Z+1 automatically when that patch lands in the stable branch.21:01
TheJuliaagree completely21:01
fungithe automated stable branch testing is often finicky on older stable branches due to bitrot21:01
TheJuliaYes, but those can be managed21:02
fungiand also sometimes the developers have just flat out forgotten to include an additional patch they relied on in one of their backports21:02
TheJuliaI guess maybe whatever drives the releases should ensure no CI job config changes occur, so maybe a little more nuanced21:02
fungiby "those can be managed" you mean without human intervention?21:02
TheJulia(just so someone can't somehow shove something in which turns off testing and etc21:02
TheJuliafungi: should be managed as part of normal care and feeding, i.e. fixing those jobs is disjointed from, for example, a security issue being backported and landed21:03
TheJuliaat least, ideally.21:03
fungii'm just saying right now there are humans in the loop at these steps precisely because eliminating them leads to problems. obviously fewer problems would be a great goal to work toward, but don't we already try to prioritize eliminating problems?21:03
clarkbI think we proved that ideal is impossible sometime in 201321:03
clarkbwe set up email notifications so people could get alerts when periodic jobs fail and fix them and literally no one paid attention and things only got fixed when trying to make some other change21:04
clarkb(less testing as fungi mentioned is probably a more reliable path if that is something we want to accomplish)21:05
fungithough the reason for that is people have trained themselves to ignore e-mail. what we need is to collect everyone's phone numbers so we can send them text messages21:05
fungii don't actually keep my cell phone on me most of the time, but i've heard a lot of other people do21:06
TheJuliafungi: but, what is basically being advocated for is post merge releasing or post-merge automatic release on stable branches as opposed to "hey, human, remember todo that"21:06
TheJuliaor "hey, human, oh.... your on leave... oh"21:07
fungiyes, i'm not against adding some post or promote job to openstack projects that proposes release requests, though i noted some of the choices an implementation is going to have to make when someone has time to start buildingit21:07
TheJuliayup21:08
fungii don't personally have time to create that without stopping doing other things that need to be done, but if someone else is excited to make it them i'm in favor of giving it a try21:08
fungiit eliminates one step for humans, but it's just one step out of many others21:08
fungiwe're still going to need humans to push the security fixes to gerrit, to review/approve them, to make sure they actually successfully run the test gauntlet and merge, then to acknowledge(ptl or liaison)/review(release manager)/approve the release request21:10
TheJuliayeah, but to my point, people being able to land and then remembering to cut a release is disjointed because we've not made humans nor are they motivated by downstreams to cut new upstream releases21:11
cardoefungi: I'll write it21:12
fungianother consideration is that, especially lately, we're not only batching up releases from multiple stable branches but also batching up fixes from multiple security advisories into a release, in order to not have to constantly adjust the predicted fixed version numbers in published advisories21:12
TheJuliathey are motivated to get the thing in place so they can proceed to their next step in their long list of things to do21:12
cardoeI just wanted to bring it up at a project wide level because I think it'd be useful for all to have.21:12
fungithe keystone advisory linked as an example was one of multiple keystone advisories published the same day, so we'd want them to have the same fixed versions21:13
TheJuliaI think it might be safe if we have some sort of automatic "x amount of time has passed" thing, then it makes it pretty easy to know what the next patch level release would be21:13
fungier, i guess the linked example was an ironic advisory, the one gouthamr proposed the releases for was keystone21:13
cardoeI use GitHub labels for this stuff. Someone sends me a PR on a Rust crate or a PyPi project and I might label it "backport" or I'll label it "release:minor". If I've labeled it "backport" then it'll automatically try to backport it to each of my stable branches and automatically cut a release from those stable branches when I merge their PR. If I've labeled it "release:minor" then it'll bump the minor version and cut a release.21:14
fungiyes, i think it has the potential to be a time-saver, but just to be clear the reason it doesn't exist as automation already has nothing to do with nobody thinking of it, rather that it's not as logistically simple a problem to solve as it sounds like21:15
fungicardoe: right, pbr supports that same sort of labeling, though it's done in commit message trailers instead of pr labels21:15
cardoeYes. I've seen it. Hence why I proposed using the commit message body the same way and having the bot propose them.21:16
fungibut you can signal minor or major version increases automatically in the commit message that way, and some projects do rely on that21:16
fungian approach like constraints proposals use may solve some of the batching problems, by continuously pushing new patchsets to an existing change as long as there's one open, and starting a new change if there isn't one yet21:17
gouthamri like batching mainly to avoid regressions releasing things out of order21:18
fungiyeah, i think as long as you design it to be at least idempotent and at most additive then it can batch successfully, with a batch being concluded by approving the change and getting it to merge21:20
TheJuliaAnd to be clear, we're taling about perception management and relatively making sure something does happen, not immediate tack it along and get it shipped into pypi ASAP21:20
TheJuliaI think, cardoe has been just trying to see if there was interest/thoughts in alignment because that would help push back the negative perception which can result from forgetting to do an upstream only activity21:21
cardoeI was sitting in the woods without technology and reading a book... well dang it... it was an e-ink reader so I did have technology...21:22
TheJuliaDOH!21:23
TheJulia:)21:23
TheJuliaso, you were reading and then what happened?!?21:23
cardoeOne of the other dads walked by with a GitHub hoodie. It had his username down the back of the sleeve and something else.21:24
* TheJulia assumes there is background story somewhere here21:24
cardoeHis son is new and so we don't really know him.21:24
gouthamrfellow dad came and said "you look weird out here with your technology in the woods, you must work on OpenStack"21:24
cardoeAnd another dad sitting near by who also is a dev made a comment to me like "look whose trying to swing some nerd gang signs" or something cheesy21:25
cardoeAnd engaged him21:25
cardoeAnd I was keeping to myself when it was "yeah Doug's the open source guy"21:26
gouthamrits a good world when the github hoodie dad wasn't called that :D 21:27
cardoeSo the town I live in has a lot of engineer-y types per capita21:27
cardoeAnd we have a lot of gov't stuff.21:27
gouthamrsorry, flame war 21:27
cardoeI know the govvies love to talk software supply chain risk management21:27
cardoeand open source is the either poster child or the bad kid on the street from that stand point depending on which side of the turf war you live on.21:28
cardoeThere's team "zomg they let any old rando commit something and it could have evil backdoors that wake up years later"21:28
cardoeAnd there's team "open source is fully auditable and visible"21:29
cardoeObviously I'm on the pro open source side here.21:29
cardoeI was just trying to read my book. I hadn't read The Three-Body Problem yet.21:30
gouthamr:D enigmas of our convictions21:31
clarkbtwo of my neighbors work IT/tech for credit unions21:32
clarkbI think that world is even more removed from open source than the government21:32
cardoeGitHub dad was showing what he worked or to now a group of dads cause somehow Boy Scouts has a bunch of software dads in it in my area now. And since open source is a turf war thing and I had said I currently am pretty heavily involved in OpenStack for "what open source stuff to you work on"21:32
cardoeHe searched up OpenStack in their security thingy21:33
TheJuliaclarkb: my wife used to work for a bank, apparently they had an actual rule about no minor versions being 0 as ever being permitted to being deployed in production.21:33
TheJuliacardoe: let me guess, their tool based upon pypi and tags to determine if a fix had actually been "released" ?21:33
cardoeThis is when another dad who is team open source is scary evil chimed in saying that he does security audit stuff for NASA and they're constantly having to get security exception stuff for OpenStack.21:34
cardoeI just wanted to read my book.21:34
TheJuliaoh my21:34
cardoeBut I did want to at least share the experience/perception with other folks involved in OpenStack.21:34
TheJuliaunrelated question, was the book good?21:35
cardoeTheJulia: yeah a bit confusing at first but it's really solid. Different take on things.21:35
cardoeTheJulia: So I've done a little bit of digging. And I've even asked our internal security folks.21:36
cardoeSo NIST advisories for OpenStack actually scrape git tags from our repos.21:36
TheJuliaoh, heh21:36
TheJuliathat would do it then21:37
cardoeSo the govvie got me some further info.21:37
clarkbone of them works for the credit union I use which in mid june removed my ability to transfer money directly to family member accounts at the same institution due to a new restriction on only allowing transfers between accounts you own. So guess who got a new joint account recently... Anyway apparently every other country has figured out money transfers but ours or something21:37
cardoeThe Mitre CVE is created from our OSSA21:38
cardoeNVD (National Vulnerability Database) has augmented the record21:38
cardoehttps://nvd.nist.gov/vuln/detail/cve-2026-4644721:38
cardoeAll I asked the dads at the camp out was to give me an example and he asked me which area and I told him ironic21:39
cardoehttps://security.openstack.org/ossa/OSSA-2026-017.html is what he picked21:39
cardoeWhich is what that CVE is21:39
clarkbcardoe: and I guess the underlying issue is NASA patches by pulling the code down and rebuilding container images or whatever, but because the version on the tin isn't bumped to match the advisory the audit toolfails21:40
cardoeclarkb: Yeah that's my guess.21:40
cardoeI'm not saying there's a magical fix here.21:41
TheJuliaI talked to what's his name... last year, and I think that is exactly what he said they were doing21:41
cardoeyeah I cannot remember his name either. He works at Wallops.21:41
TheJuliayeah21:41
cardoeOne of the dads I talked to worked for a local contractor that does the security auditing of Wallops systems.21:42
cardoeAnyway the take away I had was "huh I bet if we had a tag that would make this go away"21:42
cardoeAnd then GitHub apparently uses PyPi as a source21:42
cardoehttps://github.com/advisories/GHSA-jrh2-f5jc-xpgr21:43
cardoeI've already submitted a few PRs to GitHub's DB to correct some things about OpenStack which are incorrect.21:43
cardoeI saw fungi post https://review.opendev.org/c/openstack/governance/+/100269221:44
cardoewhose title is "Propose SECURITY.rst goal"21:44
cardoeSo I just figured I'd mention this convo.21:44
cardoeclarkb: I don't know why money transfers are so damn hard here either. It's annoying.21:45
clarkbquick someone say SBOM (in theory this is the proper solution to this problem?)21:45
cardoeI've heard that way too many times.21:45
clarkbrather than auditing a derivative value like a version number audit  the actual contents of the thing21:45
cardoeAnyway... with the release of keystoneauth and openstacksdk recently it's shown me how manual the release process really is.21:46
cardoeHow much human involvement is needed.21:46
cardoeAnd to TheJulia's point I just thought hmmm maybe the intersection here is to automate this away.21:46
TheJuliato be fair, this is not the first thing today I've responded to with "that relies upon humans doing a thing" and suggested automating or removing the expectation of the overloaded human remembering to do the thing. :)21:48
clarkbas a counter point releases may be one of the most important things to keep humans in the loop on?21:49
clarkbthe ability to easily ship releases has created many supply chain issues in recent months21:49
TheJuliaexcept, then we must ensure we ship regardless to not forget21:52
clarkbright, it comes down to priorities and where we think the value for our time chips is most efficiently spent21:53
TheJuliaAn argument can be made to only do this on stable branches, and following the backporting rules should always ideally be spotted or identified as a delta21:53
TheJuliaso reviewers are still key, they are still engaged, its more so "post-review/post-merge"21:54
TheJuliayup21:54
cardoeMy suggestion is only for the stable branches21:56
cardoeWhen the patch successfully lands on a stable branch, we auto create the release for it.21:56
cardoeAnd the patch has to be flagged with a commit header as such.21:56
clarkbright but anyone can add a commit header21:57
cardoeThe person that +W'd it needs to check for that.21:57
TheJuliabut not anyone can just workflow21:57
clarkbso if reviewers don't catch that21:57
cardoeUnless we can have another gerrit clickable for only -core folks.21:57
clarkbyup its a new thing reviewers would need to both be aware of and know to cheeck on every commit merged to stable branches21:57
clarkbso we're shifting the "make a release patch" as an explicit step to "make sure that the commit header doesn't accidentally make a broken release or worse" step21:58
TheJuliaIt could also make sense for reviewers to manage21:58
TheJuliafor example "If I know I've got 3 patches about to land, I only want the last patch to do the needful, then I have the commit message tags set appropriately"21:58
cardoeExactly why we need some kind of control.21:59
TheJuliathat makes a lot of sense to me then21:59
cardoeI'm happy to draft a change.22:00
cardoeclarkb: if you've got a suggestion for a trigger mechanism that's not a commit header that'd be cool.22:00
cardoeor if the answer is a commit header... any suggestions?22:01
clarkbI don't have any great ideas. In opendev we write changes that go to production, but that is always a property of the commit itself and not the commit message22:01
clarkbupdating a container image for example22:01
clarkbits possible that something like that would be more eye catching to reviewers. But then you're "polluting" what would otherwise be a clean backport patch22:03
cardoeWell I was thinking the header could land in master and just no-op.22:04
cardoeBut that could de-sensitize people.22:04
TheJuliaWell, truthfully, If I'm doing it, and the code only looks at stable, then I'd just stack it all up upfront and let it automatically do it's thing upon merger22:04
clarkbya that is the upside to the commit message it probably keeps your commits cleaner for that reason22:04
TheJuliain the stable branches22:04
cardoeSo maybe the header "Stable-Release: patch"?22:05
cardoeor "Stable-Release: yes"?22:05
cardoe"Stable-Release: get-to-the-chopper"22:05
TheJuliaheh22:05
gouthamrhttps://review.opendev.org/c/openstack/releases/+/1003379 only took about a minute to verify fixes and write up.. we could just run a cron against OSSNs and OSSAs to do this externally22:05
cardoeIt's after 5pm and I'm talking security and releases... I'm justified in being a little squirrelly22:05
clarkbgouthamr: that would also handle the batching22:05
clarkbgouthamr: once a day we gather up all the outstanding things and batch them?22:05
gouthamryeah22:06
gouthamrrather than rely on a human to put the commit message annotation in the right place :) 22:06
clarkband that patterns fits with translations and requirements updatse and so on22:10
fungicardoe: another problem we've been having is that getting cve ids assigned in a timely manner is hit-and-miss, there have been a lot of discussions among the vmt and adjacent on options there, but just to say you can't assume there will even necessarily be a cve id initially associated with our advisories22:26
fungimaybe somebody else has said that, i'm only halfway caught up on dinner scrollback22:26
fungiclarkb: an sbom really only helps if the software in question is being embedded in something else that's distributed (e.g. what software versions are in this container image, what library versions this binary artifact was built from, et cetera)22:28
fungiif you're in an ecosystem that focuses a lot on releasing binary artifacts or vendoring/embedding some software inside other software, an sbom is pretty handy22:29
clarkbright I'm somewhat assuming that the audit system is flagging and artifact like that22:29
fungifor a project that releases source code, it's less useful upstream, but downstream may want to add an sbom to describe what they did with your software22:29
fungiif we're back to stable release auto-proposals, i think it would be fine to have a job that runs in post to refresh an open release request for that deliverable each time another patch lands to any stable branch, then rely on a ptl or release liaison to come by and +1 indicating "yes we want to release our branches in the described state now"22:32
fungicardoe: clarkb: to the point about "fixed versions" and distributions, debian just announced their fixed packages for CVE-2026-80182, CVE-2026-80183, and CVE-2026-80184 which are bundled in a keystone package with a version number of 2:27.0.0-3+deb13u5 whereas 27.0.3 is the upstream version for those fixes22:48
fungiso any security scanner on debian stable is going to see keystone 27.0.0 even though the vulnerabilities are patched22:49

Generated by irclog2html.py 4.1.0 by Marius Gedminas - find it at https://mg.pov.lt/irclog2html/!