2026-04-02 14:14:17 <@salimma:fedora.im> !startmeeting Security SIG (2026-04-02)
2026-04-02 14:14:18 <@meetbot:fedora.im> Meeting started at 2026-04-02 14:14:17 UTC
2026-04-02 14:14:18 <@meetbot:fedora.im> The Meeting name is 'Security SIG (2026-04-02)'
2026-04-02 14:14:22 <@salimma:fedora.im> !meetingname security-sig
2026-04-02 14:14:22 <@meetbot:fedora.im> The Meeting Name is now security-sig
2026-04-02 14:14:29 <@thebeanogamer:fedora.im> !hi
2026-04-02 14:14:45 <@salimma:fedora.im> !topic Init process
2026-04-02 14:14:56 <@salimma:fedora.im> copying the fesco playbook, since we don't have one yet :P 
2026-04-02 14:14:56 <@py0xc3:fedora.im> !hello
2026-04-02 14:14:57 <@salimma:fedora.im> !hi
2026-04-02 14:14:57 <@zodbot:fedora.im> Christopher Klooz (py0xc3) - he / him / his
2026-04-02 14:14:57 <@zodbot:fedora.im> Michel Lind (salimma) - he / him / his
2026-04-02 14:14:59 <@decathorpe:fedora.im> !hi 
2026-04-02 14:15:01 <@zodbot:fedora.im> Fabio Valentini (decathorpe) - he / him / his
2026-04-02 14:15:06 <@thebeanogamer:fedora.im> !hi
2026-04-02 14:15:11 <@zodbot:fedora.im> Daniel Milnes (thebeanogamer) - he / him / his
2026-04-02 14:16:01 <@salimma:fedora.im> hello all! looks like last week we started by linking issues and topics, so I'll do that again
2026-04-02 14:16:05 <@salimma:fedora.im> !link Issue Location : https://forge.fedoraproject.org/security/tickets
2026-04-02 14:16:13 <@salimma:fedora.im> !link Discourse security tagged topics :https://discussion.fedoraproject.org/tag/security
2026-04-02 14:16:34 <@salimma:fedora.im> !link https://forge.fedoraproject.org/security/tickets/issues
2026-04-02 14:16:41 <@salimma:fedora.im> turns out tickets is the repo :P 
2026-04-02 14:16:54 <@salimma:fedora.im> Chris (py0xc3)want to take over?
2026-04-02 14:17:08 <@salimma:fedora.im> ! help (no space) will give a refresher of the commands
2026-04-02 14:17:39 <@py0xc3:fedora.im> I can, but not sure if the one still marked for meeting must be discussed. I expect it's known and was mentioned in the channel too. I should remove the "meeting" tag I think and give it some time. Most fedora-selinux-related repos are on github anyway, so that on itself is not a reason to move the repo to forge. I would wait some more time (I need to apply first to get sponsored as packager myself anyway), and if then some +1 came up and there is a chance of wider review or contribution to the repo or feedback over time, we can move it. Otherwise, it can also stay on GitHub. With just me + g5 the decision would feel a little "unilateral" :-)
2026-04-02 14:18:05 <@salimma:fedora.im> what, you're not a packager yet!
2026-04-02 14:18:16 <@salimma:fedora.im> there's at least two of us in this meeting that can help with that 
2026-04-02 14:18:18 <@py0xc3:fedora.im> Yeah, somehow it was not necessary so far :) 
2026-04-02 14:19:02 <@salimma:fedora.im> imho moving anything from github/gitlab is low priority-ish... now if we still have anything at Pagure, that one obviously needs to happen
2026-04-02 14:19:51 <@py0xc3:fedora.im> Indeed. But no, nothing on pagure. I developed that on github as it was easier to start. So I would leave the ticket open some time to see if it makes sense to move it to security in forge, if there is wider interest about it
2026-04-02 14:20:22 <@py0xc3:fedora.im> Not sure if there are questions that came up? Otherwise I might shift to Daniel Milnes about his tickets if there is something to be discussed (?)
2026-04-02 14:20:26 <@salimma:fedora.im> let's link the ticket for anyone who's not here who might want to comment
2026-04-02 14:21:01 <@salimma:fedora.im> !link https://forge.fedoraproject.org/security/tickets/issues/1
2026-04-02 14:21:01 <@thebeanogamer:fedora.im> On which note, I had a very quick pass over Pagure for anything directly security related. https://forge.fedoraproject.org/security/tickets/issues/3 was the only one that jumped out and I think that's best left with q5sys 
2026-04-02 14:21:23 <@salimma:fedora.im> !info those who want to weigh in on whether fedora-downstream-hardening should move to the Fedora Forge, please comment there
2026-04-02 14:21:39 <@py0xc3:fedora.im> I have to go over the commands etc in the next days to be prepared for the future ;)
2026-04-02 14:22:11 <@salimma:fedora.im> my problem is a bit of the opposite, I still remember some old zodbot iRC commands that have not been ported yet :)
2026-04-02 14:22:12 <@py0xc3:fedora.im> Didnt chair anything since I was in docs, years ago (and I think a different bot)
2026-04-02 14:22:34 <@salimma:fedora.im> yeah, the current bot is a rewrite
2026-04-02 14:23:05 <@salimma:fedora.im> is q5sysin both this SIG and the security lab? 
2026-04-02 14:23:14 <@py0xc3:fedora.im> Afaik yes
2026-04-02 14:23:21 <@py0xc3:fedora.im> But both are not related
2026-04-02 14:23:26 <@salimma:fedora.im> and yeah renaming might make sense
2026-04-02 14:24:03 <@py0xc3:fedora.im> What do you refer to? (a renaming issue came up in two tickets ^^)
2026-04-02 14:25:07 <@salimma:fedora.im> oh the ticket #3 about security lab naming being a bit misleading
2026-04-02 14:25:25 <@py0xc3:fedora.im> Ah yeah, indeed.
2026-04-02 14:25:59 <@py0xc3:fedora.im> Thus I admit I'm not sure who would be responsible to change that, except ask q5sys to consider it
2026-04-02 14:26:08 <@py0xc3:fedora.im> Not sure if he read that part
2026-04-02 14:26:49 <@salimma:fedora.im> he responded after that but maybe comment again about the renaming?
2026-04-02 14:27:00 <@py0xc3:fedora.im> yeah, i can add a post later about it 
2026-04-02 14:28:02 <@salimma:fedora.im> so yeah looking at other distros like Debian, 'security lab' could be mistaken for something like Tails instead of something like Kali :)
2026-04-02 14:28:07 <@salimma:fedora.im> I wonder if we can just reuse that name
2026-04-02 14:29:01 <@py0xc3:fedora.im> Yeah that was about my thought too. Given its purpose, pentesting sytems are often much worse configured in terms of user security, and thus achieve the opposite of what some users might would expect
2026-04-02 14:30:03 <@py0xc3:fedora.im> I would just add a post and reference it was discussed, and maybe leave it as incentive for the maintainers, then they can consider first if and what they want to use?
2026-04-02 14:31:38 <@salimma:fedora.im> right, it's not really for us to bikeshed
2026-04-02 14:32:07 <@py0xc3:fedora.im> I posted in the ticket
2026-04-02 14:33:05 <@py0xc3:fedora.im> Something about ticket #2 ?
2026-04-02 14:33:56 <@salimma:fedora.im> !link https://forge.fedoraproject.org/security/tickets/issues/2
2026-04-02 14:34:09 <@salimma:fedora.im> yeah ... the wiki is not great for anything that is collectively maintained
2026-04-02 14:34:22 <@salimma:fedora.im> something simple like how to run a meeting is fine, but something that needs review, boom
2026-04-02 14:34:38 <@salimma:fedora.im> i guess the questino is ... full docs, or quick docs. full docs is OK except antora is a bit janky
2026-04-02 14:34:45 <@salimma:fedora.im> *question
2026-04-02 14:34:46 <@thebeanogamer:fedora.im> Yeah so I've spent a little time on this. Think I understand how the docs.fp.o site gets built, but if we're going ahead with this then someone needs to create the repo on Forge as my permissions don't let me do that.
2026-04-02 14:35:58 <@thebeanogamer:fedora.im> In terms of actual content, I've started a draft on how Fedora's signing pipeline works. I'd like to run it past Jeremy Cline before submitting the draft though (to make sure I've correctly understood the relationship between Robosignatory, Sigul, and Siguldry).
2026-04-02 14:36:08 <@salimma:fedora.im> since we have the 'security' group does that mean we can create as many repo as needed? (I've not admin-ed anything in forge, I know that it's more restricted than Pagure but I'm assuming it's just like gitlab)
2026-04-02 14:36:09 <@thebeanogamer:fedora.im> Hopefully finish that on this long weekend, maybe also do one on crypto policies if I get time
2026-04-02 14:36:47 <@jcline:fedora.im> I'm actually in the middle of writing a bunch of docs on that front (in part for the Flock talk I've got) but yeah happy to look through it
2026-04-02 14:37:18 <@thebeanogamer:fedora.im> I think we're in agreement that docs.fp.o is the future then
2026-04-02 14:37:21 <@py0xc3:fedora.im> yes
2026-04-02 14:38:22 <@py0xc3:fedora.im> Don't know off the cuff the list I submitted, already some time ago, but I'm forge owner, Fabio Valentini q5sys and I think one or two more.
2026-04-02 14:38:46 <@py0xc3:fedora.im> Don't know off the cuff the list I submitted, already some time ago, but I'm forge group owner, Fabio Valentini q5sys and I think one or two more.
2026-04-02 14:39:26 <@py0xc3:fedora.im> + siosm + nirik
2026-04-02 14:39:34 <@py0xc3:fedora.im> '+ siosm + nirik
2026-04-02 14:41:30 <@py0xc3:fedora.im> It has its own challenges (mostly entry barrier and time investment), but I guess its better than the wiki.
2026-04-02 14:41:50 <@py0xc3:fedora.im> Working with the team is at least straightforward. Communications works always very good with the Docs team
2026-04-02 14:42:17 <@py0xc3:fedora.im> When they have to switch the source of docs or so. I'm just working on that with them concerning the new rules of the Discourse.
2026-04-02 14:43:51 <@thebeanogamer:fedora.im> In that case then, let's pick someone to create the repo
2026-04-02 14:44:02 <@thebeanogamer:fedora.im> We can get some content into it so we understand the flow, then PR it to the real docs site
2026-04-02 14:44:04 <@py0xc3:fedora.im> If there is agreement to create a repo, I can do it
2026-04-02 14:44:28 <@thebeanogamer:fedora.im> We can get some content into it so we understand the flow, then PR it to the real docs site (the Ansible to tell it about the new repo)
2026-04-02 14:44:39 <@salimma:fedora.im> Sure, sounds good to me
2026-04-02 14:44:53 <@q5sys:matrix.org> Ah Europe rolled forward on time so now we're all off again...
2026-04-02 14:44:59 <@py0xc3:fedora.im> We have not really rules yet about how many +1 are necessary to have something approved. Not sure if it is useful to agree on a quorum or so ?
2026-04-02 14:45:12 <@py0xc3:fedora.im> London time :P
2026-04-02 14:45:17 <@q5sys:matrix.org> in trying to quickly catch up... I'm not in favor of renaming the Security Lab Spin... I'll post more info in the ticket.
2026-04-02 14:45:23 <@salimma:fedora.im> Could be useful to agree on procedures now rather than when something contentious comes up, yes
2026-04-02 14:45:31 <@q5sys:matrix.org> Michel Lind ☘ UTC+1 Yes I am in both SIGs.
2026-04-02 14:46:03 <@py0xc3:fedora.im> So before agreeing on more, might be useful what is a quorum? So how many +1 we need to have something approved?
2026-04-02 14:47:06 <@py0xc3:fedora.im> I guess given the active participants, at least if there is no -1, I guess more than 3 or maybe 4 +1 is not realistic?
2026-04-02 14:47:30 <@q5sys:matrix.org> Since this team isn't "formalized" in anyway official way within the Fedora decision making process... or blessed by FESCO to make or demand changes... at most we're just agreeing that we're all on the same page to then to go whoever and ask them to do something.
2026-04-02 14:49:39 <@q5sys:matrix.org> We're a group of people with shared concerns and who are working together to make things more secure. Things that don't impact the project as a whole are fair game for us to handle... just as if any other group of people who are making things happen would do.  But any larger changes would need to still go through the formalized process.  
2026-04-02 14:49:39 <@q5sys:matrix.org> So for any larger changes, we can get out ducks in a row and then approach with a project change request after we've refined the idea enough internally.
2026-04-02 14:50:03 <@q5sys:matrix.org> So for any larger changes, we can get our ducks in a row and then approach with a project change request after we've refined the idea enough internally.
2026-04-02 14:50:03 <@q5sys:matrix.org> We're a group of people with shared concerns and who are working together to make things more secure. Things that don't impact the project as a whole are fair game for us to handle... just as if any other group of people who are making things happen would do.  But any larger changes would need to still go through the formalized process.  
2026-04-02 14:50:19 <@q5sys:matrix.org> Since this team isn't "formalized" in any official way within the Fedora decision making process... or blessed by FESCO to make or demand changes... at most we're just agreeing that we're all on the same page to then to go whoever and ask them to do something.
2026-04-02 14:51:10 <@salimma:fedora.im> I've never started a delegated team before - not sure if Fabio Valentiniknows how to do it - but I figure when needed we can probably make it happen
2026-04-02 14:51:29 <@salimma:fedora.im> without someone who can liaise with RH especially RH ProdSec though, I would advise against doing it prematurely
2026-04-02 14:51:38 <@q5sys:matrix.org> agreed
2026-04-02 14:51:42 <@q5sys:matrix.org> that's a ways off IMHO.
2026-04-02 14:52:20 <@q5sys:matrix.org> We'd need to show that the team can at least hold meetings for a year straight. Historically that's been a rare occurance. It seems to come and go as people get interested and then fall by the wayside again.
2026-04-02 14:52:44 <@q5sys:matrix.org> Last time I tried to start meetings up... for abotu 2 months people were active... then 4 months of it basically just being me staring at a non active channel.
2026-04-02 14:53:27 <@q5sys:matrix.org> So until we can show that we are serious in making consistent effort... most people are just going to think its just antoher 'flash in the pan', since that's what history shows.
2026-04-02 14:53:36 <@py0xc3:fedora.im> Not sure if caused this development, but I was just talking about if we want to agree on a quorum :) At the moment it can be blurred if and when to consider something approved if, e.g., just 1 or 2 are +1.
2026-04-02 14:54:32 <@py0xc3:fedora.im> I agree to the points that this is too premature to go into something formalized. Based on the initial elaboration we put in the wiki, a little also a derivation of the xzutils incident, this is mostly useful as place for knowledge creation & transfer, connecting those who might be not connected otherwise -> an additional channel with a clear scope.
2026-04-02 14:54:45 <@salimma:fedora.im> yeah, but I think q5sys was saying until we're a formal team quorum might be unnecessary. idk, I think we can do that part first
2026-04-02 14:55:02 <@py0xc3:fedora.im> To create an overlap of teams to trigger information flows within scope
2026-04-02 14:55:15 <@py0xc3:fedora.im> ok
2026-04-02 14:55:22 <@q5sys:matrix.org> yea that's a better way to explain it
2026-04-02 14:55:23 <@py0xc3:fedora.im> I don't insist :)
2026-04-02 14:55:37 <@salimma:fedora.im> so yeah. I guess just hte majority of all present during the init process should be fine for decision making, provided we're above the quorum threshold -- how many people normally show up?
2026-04-02 14:55:39 <@py0xc3:fedora.im> Ok, then, should I create a repo for Daniel Milnes approach?
2026-04-02 14:55:40 <@q5sys:matrix.org> What Michel says is a better way to explain it
2026-04-02 14:55:54 <@py0xc3:fedora.im> same page about his idea, so to speak?
2026-04-02 14:56:01 <@salimma:fedora.im> yeah, I feel like it's been ... what... 15+ mins and nobody objected
2026-04-02 14:56:21 <@thebeanogamer:fedora.im> I love democracy 
2026-04-02 14:56:31 <@py0xc3:fedora.im> ok. then I create one. Daniel Milnes can you add a post in the ticket and trigger me? Let me know the name I should use for the repo
2026-04-02 14:56:32 <@q5sys:matrix.org> and obviously we cant make a decision for other peoples work. :)  No matter how many of us agree on it. At most we can just approach and make recommendations.
2026-04-02 14:56:43 <@salimma:fedora.im> well, yes, indeed
2026-04-02 14:56:52 <@py0xc3:fedora.im> sure
2026-04-02 14:57:09 <@q5sys:matrix.org> What repo does Daniel Milnes want?
2026-04-02 14:57:32 <@thebeanogamer:fedora.im> Docs site (for issue #2 )
2026-04-02 14:58:06 <@q5sys:matrix.org> 👍
2026-04-02 14:58:19 <@q5sys:matrix.org> no objections from me on that one.
2026-04-02 14:58:37 <@thebeanogamer:fedora.im> Ok I'll stick an update on the ticket. We can close the ticket once the repo is in place and make tickets on the repo for pages to create etc.
2026-04-02 14:58:53 <@py0xc3:fedora.im> Sounds good.
2026-04-02 15:00:24 <@py0xc3:fedora.im> Anything else to discuss? Some new xzutils fun case or so? :D
2026-04-02 15:00:46 <@thebeanogamer:fedora.im> Other than getting depressed about npm supply chain attacks, nothing from me
2026-04-02 15:01:10 <@py0xc3:fedora.im> I'm sure we can find more to get depressed :)
2026-04-02 15:01:38 <@q5sys:matrix.org> What time are we going to use next week?
2026-04-02 15:01:50 <@py0xc3:fedora.im> I would stick with London time?
2026-04-02 15:01:59 <@thebeanogamer:fedora.im> 3pm Europe/London works for me
2026-04-02 15:02:16 <@q5sys:matrix.org> I have meetings from 10-1030 ET and 12-1 ET... which is why I went with 11A ET... but with time zone shuffling with hours shifting I'm not sure what that works out to all you guys.
2026-04-02 15:02:46 <@q5sys:matrix.org> saldy businesses on the East Coast of the US dont change thier timing based on UTC... they keep local time. haha
2026-04-02 15:02:51 <@thebeanogamer:fedora.im> My schedule is a mess, pick a time and I'll make it work (preferably something within Europe/London's awake hours)
2026-04-02 15:03:10 <@salimma:fedora.im> regardless of whether we pick US Eastern or London, some of us will have an offset a few weeks a year I think
2026-04-02 15:03:25 <@salimma:fedora.im> this year is probably worse than normal, I think it's three weeks apart (probably since March has 5 Sundays?)
2026-04-02 15:03:46 <@salimma:fedora.im> yeah I'm also on London time. happily my mornings are a mess so afternoons are ok
2026-04-02 15:04:07 <@q5sys:matrix.org> yea, it'll happen every once in a while. I'm just trying to figure out when most of us are available.
2026-04-02 15:04:26 <@q5sys:matrix.org> I just happen to sit down early for this meeting to see that you had already started it.
2026-04-02 15:05:33 <@q5sys:matrix.org> I guess we need to check to see what the time of the infra meeting is with the time shift.
2026-04-02 15:05:44 <@q5sys:matrix.org> They were an hour after us.
2026-04-02 15:06:08 <@q5sys:matrix.org> But I dont see any complaints from them saying we're hogging their time...
2026-04-02 15:06:20 <@q5sys:matrix.org> They were an hour after we ended.
2026-04-02 15:06:34 <@py0xc3:fedora.im> If I get it right, the preferences are currently either as it was today or +1 hour. I guess both is ok for me.
2026-04-02 15:06:52 <@thebeanogamer:fedora.im> 4pm Europe/London works for me
2026-04-02 15:08:12 <@q5sys:matrix.org> Michel Lind ☘ UTC+1 you able to do 11a ET?  IDK where you are located these days.
2026-04-02 15:08:27 <@q5sys:matrix.org> Michel Lind ☘ UTC+1 you able to do 11a ET?  IDK where you are located these days. (+1 hour from todays start time)
2026-04-02 15:08:38 <@py0xc3:fedora.im> 11a ET was 8 minutes ago, right? (spares me the calculator ^^)
2026-04-02 15:08:49 <@q5sys:matrix.org> yup, 8 min ago
2026-04-02 15:09:02 <@py0xc3:fedora.im> If that is agreed, I would update the wiki
2026-04-02 15:09:15 <@py0xc3:fedora.im> Fabio Valentini: how about you?
2026-04-02 15:10:25 <@decathorpe:fedora.im> that should be fine 
2026-04-02 15:10:49 <@salimma:fedora.im> yeah 11 am is fine too
2026-04-02 15:10:54 <@salimma:fedora.im> sorry, was checking something else
2026-04-02 15:11:03 <@decathorpe:fedora.im> somewhere between two of my regular meetings (one of which uses Europe/Germany the other is FPC which is ... US/Eastern?)
2026-04-02 15:11:09 <@salimma:fedora.im> I have FPC at 12 pm ET 
2026-04-02 15:11:32 <@q5sys:matrix.org> Normally this meeting is only 15-30 min, so that shouldnt be an issue
2026-04-02 15:11:53 <@q5sys:matrix.org> I think my late joining is what dragged this one on... you guys seemed to be kinda wrapping up before i popped in.
2026-04-02 15:12:44 <@py0xc3:fedora.im> I update the wiki then to 1600 BST, 1700 GER/SWISS, 1500 UTC/GMT, 11ET :D We might reconsider how to go ahead before the next time zone change, but I add a comment about it. We have some time until the next change :)
2026-04-02 15:13:28 <@q5sys:matrix.org> we can discuss it in a ticket too... gives more people the ability to view and comment.  Meeting times will always be more restrictive.
2026-04-02 15:14:05 <@decathorpe:fedora.im> fine with me. post a ticket with suggestions and we can ack/nack them
2026-04-02 15:14:16 <@py0xc3:fedora.im> Do you create one q5? 
2026-04-02 15:14:25 <@py0xc3:fedora.im> Or shall I?
2026-04-02 15:14:34 <@py0xc3:fedora.im> I can do, I have a few minutes left anyway
2026-04-02 15:14:47 <@q5sys:matrix.org> I can create it... or you can...
2026-04-02 15:14:57 <@q5sys:matrix.org> its not a race. haha
2026-04-02 15:15:22 <@q5sys:matrix.org> I need to create a ticket for the security-lab forge so I'll be there shortly anyway
2026-04-02 15:15:24 <@py0xc3:fedora.im> We can make it one :P But yeah, don't care, I can create it now and then I post it in the channel. I wait then with updating the wiki and leave it with the ticket.
2026-04-02 15:15:38 <@q5sys:matrix.org> so I can handle it... if you want to enjoy the rest of your life today. haha
2026-04-02 15:15:54 <@py0xc3:fedora.im> 😂Ok, then feel free to create one 😂
2026-04-02 15:16:04 <@q5sys:matrix.org> wilco
2026-04-02 15:16:04 <@py0xc3:fedora.im> I do not yet update the wiki then
2026-04-02 15:16:34 <@py0xc3:fedora.im> We juts have to ensure to not cause confusion for the next week ^^
2026-04-02 15:16:48 <@thebeanogamer:fedora.im> I think we're all done then, back to booking a conference trip so I feel better about spending Flock house-sitting
2026-04-02 15:17:06 <@py0xc3:fedora.im> Sounds good. I guess no other points?
2026-04-02 15:20:33 <@py0xc3:fedora.im> Let's see if I remember correctly (and if I can do it when I didn't start the meeting :P)
2026-04-02 15:20:37 <@py0xc3:fedora.im> !endmeeting