|
| 1 | +--- |
| 2 | +layout: single |
| 3 | +toc: true |
| 4 | +meeting_time: 2026-02-19 16:00 UTC |
| 5 | +title: CPANSec bi-weekly minutes |
| 6 | +--- |
| 7 | + |
| 8 | +## Agenda |
| 9 | + |
| 10 | +- 2026-02-19 @ 16:00 UTC. |
| 11 | + |
| 12 | +## Attending |
| 13 | + |
| 14 | +- @sjn, @stigtsp, @robrwo, @timlegge |
| 15 | + |
| 16 | +- Regrets @leont |
| 17 | + |
| 18 | +## Minutes |
| 19 | + |
| 20 | +- @stigtsp |
| 21 | + - CVE workflow |
| 22 | + - Working on alternative workflow tools for CVE based on YAML that is easier to use than Vulnogram |
| 23 | + - Allows possible bulk updates |
| 24 | + |
| 25 | + - @sjn @robrwo |
| 26 | + - Questions about posting links to CVEs in Mastodon, BlueSky etc. |
| 27 | + - There is no RSS available for the CVE announcement list |
| 28 | + - @sjn suggests a custom emitter that produces content suitable for manual cut&paste (max 280 chars) for now. API auto-posting can come later |
| 29 | + |
| 30 | + - @timlegge |
| 31 | + - Suggests that a copy of published CVEs should be kept in a public git repo |
| 32 | + - This should be a file copy, not clone of CNA repo, with sanity checks to ensure CVEs public |
| 33 | + - @robrwo notes that we host patches from CNA repo on CPANSec website, and could host CVEs there as well |
| 34 | + - @stigtsp MITRE has a public git repo, so this may be unnecessary |
| 35 | + |
| 36 | + - @robrwo |
| 37 | + - Working on CVE Workflow documentation |
| 38 | + - CVE "style guide" that could be incorporated into @stigtsp's cna tool |
| 39 | + |
| 40 | +- @timlegge |
| 41 | + - OpenSSF Vulnerability Disclosure WG |
| 42 | + - AI slop is leading to many groups getting rid of bug bounties |
| 43 | + - WG is working on best practices to deal with slop |
| 44 | + - WG working on a survey of maintainers |
| 45 | + - time that users spend on open source projects? |
| 46 | + - are they paid for working on open source? |
| 47 | + - can they deal with AI reports? |
| 48 | + |
| 49 | +- Discussions of vulnerabilties |
| 50 | + - Details omitted from agenda. |
| 51 | + |
| 52 | + - @sjn |
| 53 | + - Suggested improving vulnerability disclosure process with time, phases and well-publiched steps. |
| 54 | + |
| 55 | + - @robrwo |
| 56 | + - Experimental triage repo unused, should be deleted @stiptsp |
| 57 | + - Give triage list members access to the CNA repo, and use that for issue tracking |
| 58 | + - Create a kanban |
| 59 | + |
| 60 | +- @sjn |
| 61 | + - Perl Toolchain Summit (PTS) |
| 62 | + - Focusing on EU Cyber Resiliance Act (CRA) steward organisation |
| 63 | + - Need to decide what the org looks like and set it up so it can be formally created |
| 64 | + - CPANSec would be a member, but separate from the stweard org |
| 65 | + - We have funding (via TPRF's budget) that we can choose to use to help fund a third room at PTS |
| 66 | + - we have to get the EU CRA to work for CPAN, we *have* to update the META spec to fully update the dependency graph. |
| 67 | + - @sjn calls for volunteers! This is critically important. |
| 68 | + |
| 69 | +- @stigtsp |
| 70 | + - CPAN pURLs |
| 71 | + - Spec does not support selector use case we need for CVEs (author/version constraints) |
| 72 | + - Work in process |
| 73 | + - @sjn calls for volunteers to finish the work ASAP. |
| 74 | + |
| 75 | +- @sjn |
| 76 | + - TPRF has dedicated part of their budget to CPANSec |
| 77 | + - @stiptsp |
| 78 | + - Suggestion for sending message to the cpansec discussion mailing list with a short budget |
| 79 | + - Goal: put together a formal decision-making process for CPANSec |
| 80 | + |
| 81 | +- @robrwo |
| 82 | + - We need tools for accessing community documentation (license, security policy, etc) |
| 83 | + - Meta spec/tools for downloading and showing these documents |
| 84 | + - Possible PTS project |
| 85 | + |
| 86 | +- @stigstp |
| 87 | + - Demo of `cna` tool https://github.com/CPAN-Security/cna-tool |
0 commit comments