Create 2023-08-09.md

Author: david-christiansen

meeting-notes/2023-08-09.md

@@ -0,0 +1,71 @@
+# SRT meeting 2023-08-09
+
+[Previous meeting notes](https://github.com/haskell/security-advisories/blob/main/meeting-notes/2023-07-26.md)
+
+## Previous AIs:
+
+ - Mihai
+     - Will follow up for project contacts for embargoed issues
+     - Look into GHCup #858 -- still in progress
+ - Everyone
+     - Send David the email address used by your Bitwarden account
+       so it can be added to HF's organization.
+ - FT
+     - Documentation of repo structure, including symlinks
+     - Documentation about dates - that they are retieved from Git history
+         - full history required, not shallow clone
+     - Create GH issue to design HSEC ID reservation feature
+     - re Base readFloat, update bgamari that advisory exists
+     - ping pandoc folks, ask them to submit advisories
+ - someone
+     - Requirements/guidelines for dependency analysis tooling
+         - Start writing them down, commit to our repo
+
+## Pandoc 
+
+- New pandoc issue: https://github.com/jgm/pandoc/security/advisories/GHSA-xj5q-fv23-575g
+- Related issue: https://github.com/jgm/pandoc/issues/8584
+- Security section of manual: https://pandoc.org/MANUAL.html#a-note-on-security
+
+
+## Recording affected symbols
+
+- Tristan looking into it
+- Some doubts about how to record e.g. type class instances
+- GitHub issue we can use for discussion: https://github.com/haskell/security-advisories/issues/86 *"Leverage the declaration field to specify which function is affected"*
+
+
+## ID reservation
+
+- PR: https://github.com/haskell/security-advisories/pull/114
+- `hsec-tools reserve-id --assign --commit`
+- TODO: add diagnostic output e.g. "Reserved HSEC-YYYY-NNNN.md"
+
+
+## Publishing hsec-tools to hackage?
+
+- We should probably do it some time :)
+- Maybe extract OSV library first, and land the toml library change first
+
+## Purl parsing
+
+- [spec](https://github.com/package-url/purl-spec)
+- [Hackage](https://github.com/package-url/purl-spec/blob/master/PURL-TYPES.rst#hackage)
+- Casey started work on this
+- We should define and propose to haskell community a *profile* of Purl, in particular how to represent
+    - Package components (`lib`, `exe:<name>`, `lib:<name>`)
+    - Cabal flags (`[+-]<flag-name>`)
+    - There is a hackage namespace defined for Purl, but it does not suggest how to represent these data
+
+    
+## Action Items
+ - Bitwarden accounts?
+ - Mihai: 
+   - Progress on embargoed items
+   - Look into GHCup #858 -- still in progress
+ - Tristan: rebase the toml-parser PR#88
+
+ - David: Encourage Pandoc devs to test out our advisory process
+ - FT: Documentation of repo structure
+ - FT: Diagnostic output (created file XYZ)
+ - FT to publish PR for (currently WIP) enhancement to record package components in HSEC security-advisories