add meeting notes 2023-07-26

Author: frasertweedale

meeting-notes/2023-07-26.md

@@ -0,0 +1,59 @@
+# SRT 2023-07-26
+
+## osv.dev
+
+- Hackage advisories are in production now
+- Version enumeration for Hackage and GHC was merged
+- Outstanding task: add examples to osv-schema
+    - Mihai has PR in the works
+
+## Update on handling embargoed stuff
+
+- Gathering contact points for downstream
+- Someone needs to connect the dots to send messages
+- Contact list needs to be committed somewhere
+    - Private contacts not be in the repo... so where?
+    - Stored encrypted version in the security-advisories repo?
+        - no
+    - Use HF bitwarden account? (access/modify via HF admin access)
+        - agreed
+
+## What should be part of the database format?
+
+- Repo data storage / semantics.  David has some concerns:
+    - Symlinks.  Doesn't work well on Windows?
+    - dates being stored in Git repo
+
+## Audit GHCup download practices
+
+- https://github.com/haskell/ghcup-hs/issues/858
+- FT's comments: https://github.com/haskell/ghcup-hs/issues/858#issuecomment-1639300092
+
+## Reserving HSEC IDs
+
+- It would be useful to be able to reserve an HSEC ID
+- FT will propose a way to do it (discuss it in a GH issue)
+
+## Any other known historical (or current) issues?
+
+- Pandoc
+    - https://nvd.nist.gov/vuln/detail/CVE-2023-38745
+    - https://nvd.nist.gov/vuln/detail/CVE-2023-35936
+
+## Action items
+ - Mihai
+     - Will follow up for project contacts for embargoed issues
+     - Look into GHCup #858
+ - Everyone
+     - Send David the email address used by your Bitwarden account
+       so it can be added to HF's organization.
+ - FT
+     - Documentation of repo structure, including symlinks
+     - Documentation about dates - that they are retieved from Git history
+         - full history required, not shallow clone
+     - Create GH issue to design HSEC ID reservation feature
+     - re Base readFloat, update bgamari that advisory exists
+     - ping pandoc folks, ask them to submit advisories
+ - someone
+     - Requirements/guidelines for dependency analysis tooling
+         - Start writing them down, commit to our repo