*Note: This summary is AI-generated but has been validated by at least one of the attendants.*

### Key Discussion Points

*   **Secure Development Practices in Fedora:**
    *   The discussion started with a question about how Fedora demonstrates its commitment to security for a new user.
    *   The existing Package Review Process includes some security aspects, like ensuring the latest versions are used and applying hardening compiler flags. However, Fedora lacks formal security reviews like openSUSE, mainly due to resource constraints.
    *   The "Hummingbird" project was highlighted. It uses AI to scan for CVEs in a critical subset of Rawhide packages, automatically applies fixes, and creates pull requests. There is potential to expand this scanner to cover all Fedora packages.
    *   The group discussed the difference between the Hummingbird scanner and the new ProdSec CVE scanner (`trustshell`), with some noting that `trustshell` has had issues.
    *   It was suggested to use the OpenSSF Baseline checklist to formally document Fedora's security practices, though it was acknowledged that this would require input from teams managing the CI/CD pipeline.

*   **`linux-distros` Mailing List Discussion:**
    *   Awareness was raised about a discussion regarding the `linux-distros` mailing list, with a link to the ticket: `https://forge.fedoraproject.org/security/tickets/issues/13`.
    *   The group agreed to continue this discussion asynchronously in the ticket.

### Action Items

*   **rzhukov's ticket:** `rzhukov`'s second agenda item/ticket will be bumped to be the first topic of the next meeting (2026-07-23), as he had to leave early.
*   **Document Security Practices:** Continue work on ticket #14 (`https://forge.fedoraproject.org/security/tickets/issues/14`) to document Fedora's security practices, using the OpenSSF Baseline checklist as a reference.
*   **Identify CI/CD Experts:** Identify and consult with individuals familiar with Fedora's CI/CD pipeline to help complete the OpenSSF checklist.