Meeting started at 2026-07-02 15:00:36 UTC

The Meeting name is 'Fedora Meeting 3'

!hi

Michel Lind ☘ UTC+1 ⏱️: Michel Lind (salimma) - he / him / his

!hi

Chris (py0xc3): Christopher Klooz (py0xc3) - he / him / his

The Meeting Name is now security-sig

!hi

Fabio Valentini 🌈: Fabio Valentini (decathorpe) - he / him / his

Hi folks, do we have a room for a quick intros?

is the topic now "next meeting" or "open floor"?

theoretically, 1.1 of the agenda :)

I wasn't sure if I should remove the meeting tag so I left it. I think we might just see how the agenda develops and if it serves its need. People can decide now in advance if the meeting is relevant for them and if they are needed.

If people want, it could be discussed if a quorum for decisions is to be introduced. At the moment, every 1-person-project could become a Security SIG project if no one objects. But given that only known and trusted contributors are SIG members, I see this not critical. So I leave it to others if there is need to discuss any of this...

I'm +1 but I'm biased since this is my idea :)

How can we join the Security SIG?

sorry, there should be room for introductions, I didn't want to ignore you

just confusion about what is now actually the current !topic

ups. didn't see the message. sure.

No probs, just let me know when there is a right moment :)

we can do a !topic Introductions next

Great!

Hi folks, first time here, I'd like to introduce myself. 👋 I'm Roman, Open Source Security Lead from Red Hat, contributor to open-source projects and old-nerdy security champion, largely in Linux Foundation/OpenSSF ecosystem. I might have met some of you at the fantastic Flock event last month in Prague, where we were doing the EU CRA workshop together with the Fedora community.

As we are all entering in the AI craziness and post-Mythos Era AND navigating the EU CRA (https://forge.fedoraproject.org/council/tickets/issues/559), together with a few colleagues of mine (Lukas, Michal, Anwesha, Jaroslav) I’d like to join the Fedora Security SIG to better understand the current challenges community is experiencing at the moment. My primary goal would be to understand what help might be needed (resources, tools, additional pair of eyes, brains, etc.) to make sure we implement the dev-centric, practical and meaningful security measures while reducing friction. I led security efforts for a few open source projects in the past, and I understand the pain developers experience. To be honest with you, I think we have the good momentum to make security (and yes, compliance, sic) right.

Long one, but I'm done, thx :)

LMK if/when we would like to dive into some specifics (maybe future meetings)

welcome!

should we do a round of introductions for others too?

welcome! and, yes, we should intro ourselves

let's make it official then

I am Justin, the Fedora kernel maintainer.

my other contributions are primarily related to Rust packaging and / or security related through my work handling security issues for the Rust SIG and my involvement with OpenPGP / Sequoia-PGP - and the "Adopt PURL" change proposal some of you have seen

my FAS is `decathorpe`, I am now a FESCo, Fedora Council, and Packaging Committe member

I'm Chris, currently mostly active in the Security SIG and the Moderation Team, indirectly also QA. Noteworthy amount of my time is maintaining the #kernel tag in ask.fedora and work with users to identify if they found bugs, do triage, and if so, work with upstream to fix kernel bugs, test patches, to relief our kernel team as far as possible :) Recently I was working with a vendor to get their devices Fedora Ready (which was mostly fixing kernel bugs and optimizing their firmware scripts for fedora). So one time stuff like that also makes much of my contribution times. Doing also some crypto stuff, but that "should" be now mostly integrated in the Security SIG :)

I'm Michel, on FESCo and the packaging committee in addition to this, and CentOS Hyperscale and Proposed Updates SIG (the latter is partially security focused so there's a strong overlap here)

I maintain too many packages, and so am interested in tooling that help reduce packaging toil and make it easier to make sure packages are properly maintained and secure

I'm the current dev of the webzfs, Lumina Desktop, and a bunch of other small projects. I also am the producer of the podcast 'BSDNow', and the DM Radio show 'Ask Noah Show' (Linux/sysadmin radio show) on KEQQ FM.

I worked in security a while ago, but these days I do less security and mostly do whatever needs doing.

I'm JT (fas = q5sys), Ive been an open source (Linux/FreeBSD) Dev for over two decades now. I'm the release maintainer for 5 Fedora Releases (Security-Lab, Jam, Games, Astronomy, Scientific Lab).

Looking forward to work with all of you :)

I can also introduce myself. My name is Lukas, working in Red Hat Product Security as an Incident Commander for the CRA. I've been also working as an Engineer within Red Hat so I have a lot of background in that as well (made it to Fedora Proven Packager and Fedora Packager Sponsor) so I can translate those pains to Prodsec to help ease the process hopefully.

FWIW I think you would both be welcome as Fedora security-sig members

adding you should be straightforward if there are no objections (just somebody with the necessary powers pushing a few buttons)

+1 -> we have three people here with the powers :)

wait, 4 xD

hey, I;ve already intorduced myself in the antoher channel but copying here: I'll be working with you (and @Lukas Javorsky) on CRA and other Product Security–related topics. I've been working in Product Security for a while now, so if you have any questions, don't hesitate to ask.

+1 to adding more members to the SIG!

I'll go once again to fit into after the intros were tagged :D

Hi folks, first time here, I'd like to introduce myself. 👋 I'm Roman, Open Source Security Lead from Red Hat, contributor to open-source projects and old-nerdy security champion, largely in Linux Foundation/OpenSSF ecosystem. I might have met some of you at the fantastic Flock event last month in Prague, where we were doing the EU CRA workshop together with the Fedora community. Happy to join the group and help as much as I can

so I think the only thing we'd need to know are your usernames in the fedora accounts system (if they're not the same as your matrix handle)

ljavorsk

rzhukov The Red Hat structure is kinda crazy to anyone not on the inside. Are you a direct report to Vincent? I can never figure out the hierarchy. haha (you dont have to answer if you dont want to, You can ignore me being nosy. haha)

😂 sure, I'm actually part of Open Source Office which is part of Global Engineering which means peers to Vincent's Products Security org.

it's turtles all the way down :P

rzhukovdo I remember correctly from your CRA presentation at FRCL that you're based in Ireland?

I should visit that office sometime, I'm in Dublin

added - you should show up as member at https://forge.fedoraproject.org/security after you log in I think

Thank you :)

Yes, you got it right! Sure, will be happy to either host you in our office or to grab a coffee/beer otherwise in the city center

Vincent is a cool. I've interviewed him for the radio show the past few years at Summit. I might have to bug John Terrill to get an interview with you sometime in the future. haha

m-findra

No probs, John is the right person to get PR blessings, yes 😁

likewise if you want to visit Dublin

ok, I think the memberships should be sorted out. a login (or log-out and log-back-in) should have you show up as members on https://forge.fedoraproject.org/security

TIL we can use dashes in FAS names :)

I might come back to then at some time :P

I still meant to rename mine but I'm scared it will break something

I might come back to that at some time :P

I created mfindra account on wrong email that doesnt exist :D

We actually can do both 😁. We rent a space in WeWork just right besides Temple Bar

do we want to continue with the topics from the meeting agenda? or move that to after open floor?

Fine with both. there is nothing urgent I think.

Ok with intros out of the way and everyone added to the SIG that needs to be added (Thanks Fabio Valentini 🌈 ) The next topic would be our discussion around https://forge.fedoraproject.org/security/tickets/issues/10 which seems to me to be mostly handled. We'll be publishing the agenda every week now; anyone can show up that wants to show up. If there's nothing to discuss or anything pressing, the meeting time will be an 'open office hours' meeting

I think the agenda serves well to let people know in advance if a meeting is relevant for them and if they are needed. The remaining question is actually only if a quorum is to be introduced.

yeah, making office hours if there's no topics on the agends sounds good ot me

(if others agree with the first ^^)

I think quorum makes sense esp, we can just tweak the threshold as we go along

there are now 13 members, not sure how many people will actually regularly show up to meetings though. so maybe start low with the quorum limit, or wait and see how attendance at meetings turns out?

Start with 3-4?

yeah, making office hours if there's no topics on the agenda sounds good to me (just realized I can't spell today)

Also it's holliday season, probably a lot of us will be somewhere at the beach this time :D

+1 for publishing agenda in advance. I was actually looking for it before joining today :) And it'd be nice to flag something like [decision required] to collect rsvps

yeah 3 or 4 should be OK to start with, adjusting later is always possible

I think 3-4 is a reasonable number to start with. Shall we use that number only as meeting quorum or generally as min. for decisions? (e.g., also for tickets etc?)

I tend to like both tbh :)

I think it would make sense for formal decisions, but if meetings turn into informal office hours anway I don't think we need a lower limit for those.

office hours meetings wouldnt be taking votes

that too.

most they would be doing would be creating tickets

moar tickets!

so... accumulating work for the next quorum meeting. I see ;)

so to summarize (correct me if I got something wrong):

- Meeting Agenda is sent out in advance, if no topics, meeting turns into open-floor / office hours.

- Formal decisions require votes from at least three SIG members

sounds good to me 👍️

+1

+1

+1

<del>sounds good to me 👍️</del> +1

+1

let's use those fancy bot features when they're there 😁

I think that concludes this topic?

think so

Chris (py0xc3): want to move on to the Docs topic?

Yeah sure. Could be quick too.

→ This contains the underlying question if it is a “Security Docs” or “Security SIG Docs”

That came up when I evaluated where to put the hardening docs in the changed situation. Quick Docs or Security Docs. It raises this question. I thought its worth to be raised once to see if everyone is on the same page. I have no strong opinion about it, but I tend to emphasize our docs as Security **SIG** Docs, to avoid they develop like so many Docs in the structures of Fedora when created/maintained by 1 (a reason for the problematic reputation of Fedora Docs).

Counter-question: Who *would* maintain Security non-SIG Docs?

That's the problem :) So far discussions considered "is it security? if so, put it to our docs". That might lead to us integrating all related Docs over time. And it could be questioned if we can maintain all that.

Counter-question: Are the docs that are currently in the quick docs better maintained? ;)

if its related to security in general in Fedora == Security Docs.

if its realted to the SIG itself == Security SIG Docs

My take:

No they ain't. Which is a reason for their reputation :) I would prefer we take another approach. So taking only Docs that are maintained more reliably by the team, not only individuals, or no one at all (which is often the result at some time when it starts with 1 )

As to who would maintain Security Docs... who wants to volunteer. lol

So there are 3 types of docs?

1) Security Docs

3) Quick Docs

2) Security SIG Docs

That's it :) I would leave that in the quick docs, unless what we can maintain. So taking another approach.

the question we have a docs repo, but not yet really decided which of the two approaches this shall be :D

I wonder what would actually be categorized as "Security SIG Docs"?

No, more. But relevant here are so far Quick Docs and Security Docs. The latter is not yet decided which of the two in discussion it is :)

I meant it not too literal. I meant Security Docs in the sense of the Security SIG reliably maintains this, its not just more Security Docs that get orphaned. We have that already in Quic kDocs :)

Okay so the Security Docs and Security SIG Docs are the same

yeah. because so far I only see one thing relevant to document about the Security SIG itself - the meeting agenda / quorum thing we decided earlier

I was confused if these two are separete

I was confused if these two are separate

Yeah, we have to decide what it means :) It's quite new.

Does it include things like "Security policy"?

What is "Quick Docs" We have no repo for that... as far as Im aware.

So personally, I would not put everything in Security Docs just because it has a security relation. But only what we can maintain even if one is no longer available or so.

Maybe this is controversial, but security-related content in the Quick Docs that isn't maintained should be just dropped, and the things we *do* want to maintain can be transferred to "our" Security Docs

+1

But dropping anything is the Docs responsibility. Some has been dropped some time ago. But they aim to keep stuff as long as possible and emphasize more on adding times that indicate users if that might be up to date, as many no longer rely on the content anyway

so times = timestamps

again... what is `Quick Docs`? Can anyone point me to where in the Fedora Infra that exists.

it won't hurt to ask them to drop things that are no longer accurate

I didn't like it, but otherwise, much of the Docs would be gone tbh :)

I have been a part of Fedora for well over a decade... I've never head of 'Quick Docs' before this meeting.

https://docs.fedoraproject.org/en-US/quick-docs/

Its the biggest of our Docs repos I think :)

the sources are now here: https://forge.fedoraproject.org/docs/quick-docs

The most used article is how to upgrade Fedora for long :D

I wish in hindsight everything we have is pagure

asciidoc is not actually worse but it's one more syntax to learn

https://docs.fedoraproject.org/en-US/security/ -> not yet. It's quite new and not much contained yet

do we actually *have* a "security policy"?

This will be something we would like help with

The Security policies are obligatory for the CRA Steward

Oh joy... another location for documentation to become stale. 🤣

Oh yeah 😎

I have a meeting I have to step into. Someone else will need to close out this meeting.

Yeah, we can get that done :)

yeah, this is why I suggested to drop things **or** take responsibility for them and update them

Shall we procrastinate this topic to next week or a ticket? Seems more to discuss than I thought

I'm not sure we get Docs convincved :)

But I would be +1

we can try

I did once, the timestamps and some deletions of "extremes" were the result.

because I'm not sure *more* documentation is always better if it's just going to be stale or wrong ...

But the problem is, if we radically would do that, much of the Docs just is dropped at all

You do not need to convince me :)

And that was the work of lobbying for over a year :)

🤷‍♂️

maybe the regulatory banhammer is a better convincing tool.

anyway I think the timeslot for this meeting is now up?

let's continue this discussion in #security:fedoraproject.org

yeah, we can do. I would leave this topic for next week and discuss it in between?

sounds good

see you around 👋