CTI TAC Meeting Notes 2023-11-29

CTI TAC Meeting Notes 2023-11-29

[Carlos O'Donell]

CTI TAC Meeting Notes 2023-11-29

Present:
 * Carlos O'Donell
 * Joseph Myers
 * Konstantin Ryabitsev (LF IT)
 * Bennett Pursell (OpenSSF)
 * Ian Kelling (FSF)
 * Siddhesh Poyarekar
 * David Edelsohn
 * Adrianne Marcum (OpenSSF)
    
Agenda:
 * Previous meeting AI: Create cti.toolchain.dev and document what we have and what we know for the community to have a place to review documents.
 * Since the last meeting we have registered various domain names.
 * Someone has registered typos and pointed them at sourceware.org.
 * Need to reach out to the rest of overseers to see if this is intentional or a mistake.
 * The following domains are transferred and being managed by LF IT
  * toolchains.dev
  * Typo-squatted toolchain.dev pointed at sourceware.org (needs review)
  * coretoolchain.dev (recommended by LF IT and registered)
  * Typo-squatted coretoolchain.org (needs review)
  * coretools.dev
 * Carlos: Ian, Has the FSF registered any domaints to prevent typo-squatting?
 * Ian: I'm not aware of any registrations regarding CTI, but all FSF registered domains will show that the FSF is the owner, the organization doesn't hide the registration.
 * AI: Carlos to reach out to overseers to clarify if they have registered any typo-squatted domains.
 * TAC question: Which domain do we use?
  * toolchains.dev (unfortuante typo-squatted toolchain.dev) (+1 Sid, +1 Joseph, +1 David, -1 Carlos)
  * coretoolchain.dev (+1 Sid, +1 Joseph, +1 David, +1 Carlos)
  * coretools.dev (-1 Sid, +1 Joseph, +1 David, -1 Carlos)
 * Consensus is around "coretoolchain.dev" for "cti.coretoolchain.dev" documentation.
 * Konstantin: Primary infra up and running in OpenStack host. Montreal area. Small VM currently. Gitolite for documentation. Gitolite server is up. Need a procedure for who gets access.
 * Carlos: I can call Konstantin and authenticate myself and send my key to him.
 * Konstantin: Let me hash out the procedure and I will send it to the CTI TAC list for approval.
 * Konstantin: We can setup the trusted key points in another meeting.
 * AI: Konstantin to send the authentication procedure to the TAC list.
 * Carlos: Any objections to "tac.coretoolchain.dev"? Noting no objections.
 * Carlos: During the glibc steward review it was raised by Alexandre Oliva that he objected to using CTI services, but Joseph Myers and I felt that all we needed to meet was https://www.gnu.org/software/repo-criteria.en.html
 * Konstantin: The LF IT meets B and some more, so maybe B+.
 * Joseph: Alexandre seemed to assess the hosting on his own criteria and that is not in line with the GNU Project recommendations which are the Ethical Repository hosting criteria.
 * Carlos: Ian, do you know if the criteria will be changed in the short term?
 * Ian: There is going to be an update but it does not likely change any of the hosting decision being made with CTI and glibc. Can join the discussion on the criteria via repo-criteria-discuss@gnu.org.
 * Carlos: Konstantin, How do you host larger files?
 * Konstantin: No easy solution. For a couple of files you can hand them to us.
 * Konstantin: A peertube channel might be an option. A permanent seed might be needed.
 * Carlos: We can point at the FSF hosted conversation for the talks we gave there.
 * Ian Kelling confirmed they will continue to be hosted.
 * Konstantin: Would you want to use fastly? A caching service is convenient.
 * David: This goes back to my earlier comment, does Fastly change the criteria from B to C?
 * Carlos: I would recommend "No" and then discuss with the community.
 * Siddhesh: For the current traffic "No" is fine.
 * Joseph: Don't need to discuss this until we get to hosting releases.
 * Carlos: I will add the OpenSSF (Bennett, Adrianne) as "consulted" when we draft the docs for the services being provided, likewise LF IT will be "consulted" on the docs.
 * David: No further topics.
 * Ian: No further topics. Thank you.
 * Joseph: Nothing more before. Other than sorting out the next meeting.
 * Siddhesh: Nothing more. Thanks.
 * Carlos: Proposing the next meeting be the 31st of January 2024, with all other agenda items carried by email.
 * Carlos: Any pressing meetings between now and January 31st?
 * Adrianne: We have a weekly lowdown in OpenSSF to share out progress, so we can be more verbose in those channel. Bi-weekly update goes to the governing board to share progerss.
 * AI: Carlos to talk with the TAC to share something through the OpenSSF chanels to the TAC and GB.
 * Carlos: Any objection to cancel the December meeting and carrying items by email? No objections.

-- 
Cheers,
Carlos.

Re: CTI TAC Meeting Notes 2023-11-29

[Carlos O'Donell]

On 11/29/23 11:56, Carlos O'Donell wrote:
>  * AI: Carlos to reach out to overseers to clarify if they have registered any typo-squatted domains.

I filed this infrastructure bug to check with the rest of overseers:
https://sourceware.org/bugzilla/show_bug.cgi?id=31098

-- 
Cheers,
Carlos.