Meeting started at 2026-07-16 14:59:46 UTC

The Meeting name is 'Fedora Meeting 3'

The Meeting Name is now security-sig

!hi

Chris (py0xc3): Christopher Klooz (py0xc3) - he / him / his

Hi folks, I have a hard stop at :30, but otherwise - looking forward to today's meeting 👍️

anyone have anything to get out there before we get into the agenda?

Wait a moment for others to arrive and then start with 1.1?

!hi

Michel Lind ☘ UTC+1 ⛱️: Michel Lind (salimma) - he / him / his

!hi

been on vacation until yesterday so I have not seen the agenda yet, sorry

Lukas Javorsky: Lukas Javorsky (ljavorsk) - he / him / his

!Hi folks, I have a hard stop at :30, but otherwise - looking forward to today's meeting 👍️

if rzhukov has a time limit maybe we should get to his first since he got bumped from last week

!hi folks, I have a hard stop at :30, but otherwise - looking forward to today's meeting 👍️

Sorry, I can only look up one username at a time

!hi

jforbes: Justin Forbes (jforbes) - he / him / his

!hi

No Fedora Accounts users have the @rzhukov:matrix.org Matrix Account defined

1.1 is his :)

ah I was thiniking #14 which is his ticket.

rzhukov: I think you have two topics. Which do you wanna start first?

Let's do 1.1

sounds good, take it away

both actually :)

Ok, for someone new and curious user here (like me) how can I be sure that Fedora is best-in-class in security? Does it even care?

My sleep schedule lately is proof that it cares!

Well :) I just don't know wWe can start with the end-user perspective. Say, what I get as an end-product artifacts -

Well :) We can start with the end-user perspective. Say, what I get as an end-product artifacts - how one can verify?

I think once the new prodsec scanner is up and running we'll be in a way better shape

right now I fear many maintainers ignore their CVE bugs because a lot of them are inaccurate

I mean I can speak of nerdy SDLC terms - do we have TM, Arch Review, SAST, SCA, etc. But would rather hear what are the security practices Fedora is most proud of

Is something security-related part of the Package review process? I believe that is a great starting point from which a lot of security concerns could be addressed. For anyone who don't know what Package Review is: https://docs.fedoraproject.org/en-US/package-maintainers/Package_Review_Process/

there are some that are security related I guess -- like ideally we want the latest version packaged (though it can be explained away), and compiler flags must be applied

including the hardening one

Building from source has a security relation. We don't have security reviews as openSuSE though. There was a project to change that some time ago as far as I remember, but I think its a lack of resources

including the hardening ones

Also, certain obligations, how to use what and when, contain security considerations

Obligated checks, etc.

Do you mean user guide?

packaging

or internal guides for dev?

ah, for packaging, gotcha

I am not sure that people were in the Hummingbird session at Flock, but one of the things they do is AI scanning of CVEs. If there is a fix already in Fedora, they build that fix and update that package. If there is not a fix already in Fedora, they grab one from upstream, etc. Then build and push that package *and* create an MR against the package in Fedora to fix that CVE.

Now, Hummingbird is only a subset of the package list, but it is a good start, and a list of fairly critical packages

They create MR only for Rawhide IIRC right?

* MR or PR, I assume, since apart from the kernel which uses a gitlab repo everything else is in Pagure

forge :P

I believe so, as that is the package set they are following. Still it should at least alert a maintainer that they should check stable too

Yes, PR now against dist-git I believe. Sorry, just used to the MR terminology for kernel

We know how maintainers like to proactively check all stable releases :D

But yeah better than nothing

Yeah, but you might think if they were poked, they might at least think about it.

https://fedoraproject.org/workstation/download/ - I like "we take security seriously"

One thing of interest, as Hummingbird catches its stride, we might be able to ask them to extend the scanner to cover all Fedora packages. Anything the automation can do would be done, and if automation can't do it (difficult backport, etc) it could at least file an issue alerting the maintainer.

is this separate from the reworked CVE scanner that ProdSec is working on? if so, can the two be combined?

So, Hummingbird is a good example of where users can actually see what exactly it means from security perspective (SLSA L3, SBOMs, all the scans that Konflux provides, etc.) - this info is available.

(the ones that have been demoed at FRCL meetings, I mean)

Michel Lind ☘ UTC+1: which ProdSec scanner do you mean?

Hummingbird is a little different in that it doesn't care about RHEL basically so it is only looking for CVEs in new packages

Prodsec scanner needs to do a lot more work

Is there documented coverage somewhere Hummingbird vs rest of packages?

the rewritten one that is no longer doing substring matching on component names

I believe someone shared the URL for the repo on github but I don't have it right in front of me

If you find it please send it to me

+1

this one? https://github.com/RedHatProductSecurity/trustshell

yes

I haven't spent a lot of time looking at the Hummingbird bits, but everything they have should be public as a Fedora project. If they don't have a specific package list, one could be inferred from what they ship

https://fedoraproject.org/wiki/Hummingbird looks like a package list is linked there

Aaah trustshell... well, not sure if this one will be used. We had quite a lot of problems with it

You know what, I might be asking obvious questions or otherwise things that I simply don't know yet but that exist :) So, let me rephrase - Can we (sometime offline, perhaps) go over this checklist: https://baseline.openssf.org/versions/2026-02-19-checklist.md with links/how we do it?

Well if you run 100 scanners you will have (not 100, but ~20-30) different results... I like Konflux because it's quite modular and can allow you to include whatever scans you waould like

looks like some of that checklist will require people actually familiar with CI/CD pipeline to chime in, because I don't think anybody outside the people working directly on that actually know

and some look like they apply more to traditional software development, not an integration project like Fedora

Identifying people that work on that and action to ask them is also a great outcome

I NTD, unfortunately, but I think what I'd suggest to do next is to try star working on this https://forge.fedoraproject.org/security/tickets/issues/14 as it's basically the list of security practices I was looking for. And OSPS ^^ (link above) as a nice comprehensive checklist

Apologies folks, you can continue with "my" second topic or skip it - as you prefer

you said yuo had to go at :30 , do you want to bump it to next week?

ok, we have theoretically two more topics, rzhukov 's second one, and actually not sure if there is much for the meeting concerning linux-distros?

I think he's gone, I think it was :30 sharp for him :)

Bump it to next week

It feels odd to discuss someone's ticket with them not around.

so I'd prefer to bump it

Ok, I keep it as first topic for next week then

+1

Needs to discuss linux-distros topic, open floor, or end?

If there's nothing to discuss for the linux-distros topic... and if no one else has anything else to bring up... we can just call the meeting here.

but if anyone has anything... by all means bring it up.

I guess so. Just raising awareness that some discussion took place in linux distros -> https://forge.fedoraproject.org/security/tickets/issues/13

But I see no need to have it discussed here atm.

(unless someone else has a point about it)

Dont wait! Call NOW! Phone lines are filling up, so hurry and secure your place... /end_infomercial_tv_advertisement 🤪

/me realizes he hadn't "watched" this repo so didn't get any notifications

Dont wait! Call NOW! Phone lines are filling up, so hurry and secure your place... /end_late_night_infomercial_tv_advertisement 🤪

I guess we can leave the discussion asynchronously in the ticket for now. Open floor?

open floor is fine... if anyone has anything to bring up

but its been a few min already and no one has jumped in with anything...

I figure I'll give it till :40 for someone to bring something up and if not I'll call it.

let's make an end at :40 when no one posts till then?

Ah, yeah, exactly :)

/queue suspense music.

10 seconds left! last chance!

Alright, thanks everybody. Have a good rest of your week and weekend.