Skip to content

Commit 1804a47

Browse files
thibaultduponchellethibaultduponchelle
authored
Merge pull request #192 from robrwo/rrwo/meeting-minutes-2025-09-17
Add draft minutes from 2025-09-17 meeting
2 parents 9ff3913 + 0d57efc commit 1804a47

File tree

2 files changed

+133
-0
lines changed

2 files changed

+133
-0
lines changed

‎meetings/README.md‎

Lines changed: 38 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -40,6 +40,7 @@ Meeting minutes [currently under review](https://github.com/CPAN-Security/securi
4040
* [2025-05-21](cpansec-minutes-2025-05-21.md)
4141
* [2025-06-04](cpansec-minutes-2025-06-04.md)
4242
* [2025-06-18](cpansec-minutes-2025-06-18.md)
43+
* [2025-09-17](cpansec-minutes-2025-09-17.md)
4344

4445
* [2025-12-11](cpansec-minutes-2025-12-11.md)
4546

@@ -75,3 +76,40 @@ Meeting minutes [currently under review](https://github.com/CPAN-Security/securi
7576
- Sub-items without checkboxes are summaries or notes to the previous item
7677
- Items without checkboxes or @names are for information or finding volunteers
7778
- [ ] Create tickets items are around for too long, or no-one volunteers
79+
80+
### Tasks
81+
- [ ] @name - **Tasks that need to happen** after the meeting get an empty checkbox and the @name of the person leading the work (possibly with helpers);
82+
- Relevant information can be added as sub-items
83+
- [ ] @name - Tasks in sub-items are sub-tasks, and have a @name associated
84+
- [ ] @name - **Tasks that weren't completed** until this meeting have their checkbox remain unfilled, so we remember to find out again during the next meeting if the task is done
85+
- [x] @sjn - **Tasks that are completed** get their checkbox filled with an `X`
86+
- [x] Tasks without a @name associated need to get a @name, so we don't leave tasks lying around unadressed
87+
- If none volunteer, we create a ticket in the appropriate project; The checkbox is filled with an `X`, and therby scheduled for deletion (see below)
88+
- Alternatively, note that voluteers are needed, and *leave the item checkbox empty*
89+
90+
### Topics
91+
- [ ] @name - **Topics that need to be discussed** during the meeting get an empty checkbox and the @name of the person leading the discussion (possibly with others)
92+
- Topics can have additional relevant information added as sub-items
93+
- [ ] @name - **Topics that weren't discussed** during a meeting have their checkbox remain unfilled, so we remember to discuss them during the next meeting
94+
- [x] @name - **Topics that have been discussed** get sub-items added with key points and decisions, and their checkbox filled with an `X`
95+
- @name - Items without a checkbox are for information only. Keep it brief, and have key points added as sub-items. The @name shares the information
96+
- Sub-items without a name or checkbox contain key points, or additional information to the previous points
97+
- [ ] @name - Sub-items like these can have tasks and topics too, just as above
98+
- [x] **Topics without a @name associated**, get a @name associated.
99+
- If none volunteer, the topic isn't important enough; Make a ticket or not; Fill the checkbox with an `X`, so it is scheduled for deletion.
100+
- Alternatively, leave the item checkbox empty, and note that volunteers are needed
101+
102+
### Events
103+
- [ ] **Events in the future** have an empty checkbox
104+
- Add the @names of who is likely to attend, so they may submit/prepare talks, coordinate, etc.
105+
- [x] **Events in the past** get their checkbox filled with an `X`
106+
- Add a few key learnings from attendees, if relevant!
107+
- [x] **Events that nobody is likely to attend** get their checkbox filled with an `X`
108+
109+
### When creating the Minutes
110+
- [x] When creating the minutes, utems with filled checkboxes remain as-is. Do NOT delete!
111+
- [X] _This item is done, so record it in the minutes as-is_
112+
113+
### When creating the Agenda
114+
- [x] When a NEW agenda is created from the previous meeting minutes, items with filled checkboxes are deleted: they aren't relevant any more!
115+
- [X] _~~This item is done, so we delete ut when preparing the next meeting agenda~~_

‎meetings/cpansec-minutes-2025-09-17.md‎

Lines changed: 95 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,95 @@
1+
---
2+
layout: page
3+
toc: true
4+
meeting_time: 2025-08-20 16:00 UTC
5+
title: CPANSec bi-weekly minutes
6+
---
7+
8+
[TOC]
9+
10+
## Agenda & Meeting Details 2025-09-17
11+
12+
## 17:30 UTC - Pre-meeting socializing
13+
- Socializing & getting up to speed before the meeting starts properly
14+
- Discuss organizing projects, swimlanes and issues (...)
15+
- Check and resolve technical (A/V) issues before the meeting starts
16+
- Come as you are!
17+
18+
## 18:00 UTC - Meeting start
19+
20+
### Welcome
21+
- Meeting chair:
22+
- Meeting scribe:
23+
24+
### Attendees, absents & regrets
25+
- Attendees @robrwo, @sjn
26+
- Partly attending @leon
27+
- Regrets @timlegge @tib
28+
29+
### Approve previous meeting minutes
30+
31+
## Agenda
32+
33+
### Current matters & Ongoing vulnerabilities
34+
- JSON::XS and related vulns patched, coordinated releases
35+
36+
#### PAUSE
37+
- [x] @tib Completed the 2 hardening fixes (already said on July meeting) on PAUSE, chased admins: they said they will merge and deploy soon
38+
- [x] @tib Pentesting PAUSE: completed all things around forms (upload, create user, etc…). No vulnerability found
39+
- [ ] @robrwo PAUSE rules update stalled
40+
41+
### New method of generating agenda
42+
- https://github.com/orgs/CPAN-Security/projects/12 "For discussion" column
43+
- evolving, need to think if Tasks to make this easier
44+
- Needs issues from other projects/repos
45+
46+
### Separate meetings for projects/teams?
47+
48+
### CPAN Modules with vulnerable vendored (bundled/embedded) dependencies
49+
- @robrwo stalled
50+
51+
### security.metacpan.org website
52+
- [Header and teaser images for news and blog posts](https://github.com/CPAN-Security/security.metacpan.org/pull/186)
53+
- Other blog posts
54+
55+
### CPAN::Meta v3 and SBOM
56+
- https://github.com/CPAN-Security/perl-SBOM-Examples
57+
- metadata is not usually installed
58+
- @sjn suggests raising issue for CPAN::Meta spec for Toolchain Gang
59+
- help CPAN maints create source SBOMs and make it easier for build tools
60+
like cpan/cpanminus etc can output SBOMs or use a tool too
61+
- @sjn explained different types of SBOMs (source v build)
62+
63+
### Document CNA Workflow
64+
- @robrwo
65+
66+
### Security policies
67+
68+
#### Address blockers to adding security policies
69+
- https://github.com/CPAN-Security/security.metacpan.org/issues/189 @robwo
70+
- Desire for a simpler, tiny policy
71+
- Dual-life modules
72+
- Projects with multiple maintainers who cannot agree
73+
- @tobyink had mentioned to @robrwo that people may not see separate doc vs inside POD
74+
- @leon considers this a feature: force users to see latest document
75+
- [need tools to extract metadata and show users community documentation](https://github.com/CPAN-Security/security.metacpan.org/issues/190)
76+
- but needs metadata saved somewhere on install
77+
- we need to limit scope: this is a security policy
78+
- @sjn points out that users are interested in the *promises* from a policy
79+
- @leon points out that we don't really know what authors actually need
80+
- @robrwo to elaborate on these issues, perhaps create sub-issues, and communicate with P5P about dual-life
81+
82+
#### Add Support and Security Considerations sections
83+
- https://github.com/CPAN-Security/security.metacpan.org/issues/174
84+
- More SBOM-friendly. Mainly reorganising.
85+
- @robrwo has been separately thinking about relation of module POD to Security Policies
86+
- Need to document various "community health" documents and recommended POD sections
87+
88+
#### Popular modules without sec policies
89+
- https://github.com/CPAN-Security/security.metacpan.org/issues/165
90+
- @robrwo requested 100+ dists add policieS, about 15% added them
91+
- stalled
92+
93+
### Social Media
94+
- @sjn
95+
- CVE announcements should have short versions but fits into 180 chars as an output and auto-published on bluesky/masto/reddit/perlmonks

0 commit comments

Comments
 (0)