2026-07-23 14:59:22 <@q5sys:matrix.org> !startmeeting
2026-07-23 14:59:24 <@meetbot:fedora.im> Meeting started at 2026-07-23 14:59:22 UTC
2026-07-23 14:59:25 <@meetbot:fedora.im> The Meeting name is 'Fedora Meeting 3'
2026-07-23 14:59:25 <@q5sys:matrix.org> !meetingname security-sig
2026-07-23 14:59:27 <@meetbot:fedora.im> The Meeting Name is now security-sig
2026-07-23 14:59:29 <@q5sys:matrix.org> !link Issue Location : https://forge.fedoraproject.org/security/tickets
2026-07-23 14:59:34 <@q5sys:matrix.org> !link Discourse security tagged topics :https://discussion.fedoraproject.org/tag/security
2026-07-23 14:59:45 <@thebeanogamer:fedora.im> !hi
2026-07-23 14:59:46 <@zodbot:fedora.im> Daniel Milnes: Daniel Milnes (thebeanogamer) - he / him / his
2026-07-23 14:59:47 <@q5sys:matrix.org> !info Open floor to discuss anything security related. (2026-07-23)
2026-07-23 14:59:52 <@q5sys:matrix.org> !info Next Meeting (2026-07-30
2026-07-23 14:59:57 <@q5sys:matrix.org> !info There are 7 open tickets in the main Security Forge: https://forge.fedoraproject.org/security/tickets/issues
2026-07-23 15:00:01 <@q5sys:matrix.org> !info There are 6 open tickets in the Security Docs Forge: https://forge.fedoraproject.org/security/docs/issues
2026-07-23 15:00:21 <@py0xc3:fedora.im> !hi
2026-07-23 15:00:23 <@zodbot:fedora.im> Chris (py0xc3): Christopher Klooz (py0xc3) - he / him / his
2026-07-23 15:00:33 <@q5sys:matrix.org> !topic Agenda: https://discussion.fedoraproject.org/t/agenda-for-the-security-sig-meeting-on-23rd-july-2026/197428
2026-07-23 15:00:40 <@decathorpe:fedora.im> !hi
2026-07-23 15:00:41 <@zodbot:fedora.im> Fabio Valentini 🌈: Fabio Valentini (decathorpe) - he / him / his
2026-07-23 15:00:45 <@salimma:fedora.im> !hi
2026-07-23 15:00:46 <@zodbot:fedora.im> Michel Lind ☘ UTC+1: Michel Lind (salimma) - he / him / his
2026-07-23 15:01:03 <@q5sys:matrix.org> Anything critical that anyone needs to mention at the top before we jump into the first topic?
2026-07-23 15:01:13 <@py0xc3:fedora.im> I'm here, but on unreliable Internet. So I might disappear :D 
2026-07-23 15:01:31 <@mfindra:matrix.org> hi
2026-07-23 15:01:35 <@rzhukov:matrix.org> !hi
2026-07-23 15:01:38 <@zodbot:fedora.im> No Fedora Accounts users have the @rzhukov:matrix.org Matrix Account defined
2026-07-23 15:02:04 <@jforbes:fedora.im> !hi
2026-07-23 15:02:05 <@zodbot:fedora.im> jforbes: Justin Forbes (jforbes) - he / him / his
2026-07-23 15:02:35 <@thebeanogamer:fedora.im> You'll need to set your matrix name on https://accounts.fedoraproject.org/user/rzhukov/settings/profile/
2026-07-23 15:02:56 <@q5sys:matrix.org> alright, nothing pressing it seems... first topic then.
2026-07-23 15:02:59 <@q5sys:matrix.org> !Topic #14 Review Fedora security documents to align with “Vulnerability and Incident Policy” CRA requirement https://forge.fedoraproject.org/security/tickets/issues/14
2026-07-23 15:03:22 <@py0xc3:fedora.im> I think topic needs to be lower case (?)
2026-07-23 15:03:45 <@q5sys:matrix.org> !topic #14 Review Fedora security documents to align with “Vulnerability and Incident Policy” CRA requirement https://forge.fedoraproject.org/security/tickets/issues/14
2026-07-23 15:03:52 <@rzhukov:matrix.org> !hi
2026-07-23 15:03:55 <@zodbot:fedora.im> rzhukov: Roman Zhukov (rzhukov)
2026-07-23 15:04:57 <@thebeanogamer:fedora.im> So on this one I'd really like a steer from rzhukov. We _can_ try and plow through everything mentioned on that ticket, but some idea of priority would be nice
2026-07-23 15:05:24 <@rzhukov:matrix.org> Sec, typing
2026-07-23 15:06:34 <@rzhukov:matrix.org> This ticket ^^ started with simple Review existing docs against the Stewardship guidelines (see this first line item https://access.redhat.com/security/eu-cyber-resilience-act-stewardship-guidelines#:~:text=Cybersecurity%2C%20Vulnerability%20Management%20and%20Incident%20Response%20Policy)
2026-07-23 15:06:57 <@rzhukov:matrix.org> But I like how discussion involved into actually making a table
2026-07-23 15:07:12 <@rzhukov:matrix.org> with the entire lists of guidelines and doing gap analysysy
2026-07-23 15:07:51 <@rzhukov:matrix.org> So, I'd suggest step-by-step: 
2026-07-23 15:08:33 <@rzhukov:matrix.org> 1) For this ticket - do the docs gap analysys. I saw someone mentioned that infra, docs, other teams may be involved. So, would be looking for volunteer who can go ahead and investigate :) 
2026-07-23 15:09:28 <@rzhukov:matrix.org> 2. Create an artifact (e.g. .md) in one of the repos with the full table of Guidelines. If someone can point me out to the repo - I can make an initial MR
2026-07-23 15:09:35 <@rzhukov:matrix.org> wdyt?
2026-07-23 15:10:38 <@thebeanogamer:fedora.im> Do you mean create a document so we can collaborate on each point, or create a doc in the docs site that'll link to what we do on each point
2026-07-23 15:11:29 <@rzhukov:matrix.org> for #1 - I mean take the 6 items: 1) Secure development practices 2) Contact information for security questions, vulnerabilities and incidents reporting 3) Contact information of the project’s Steward (cra-steward@redhat.com) 4) The processes for vulnerability reporting, identification, remediation, patching, and coordinated disclosure (CVD). 5) The process for handling incidents for underlying infrastructure and tooling used 6) Intended support period for addressing vulnerabilities and the end-of-life process.
2026-07-23 15:11:54 <@rzhukov:matrix.org> and map them to existing Fedora docs. Where does not exist - suggest which doc will be the best to amend 
2026-07-23 15:13:16 <@rzhukov:matrix.org> For #2 - let start with the targeted repo where I can push an .md file with what I think would be a good tracking table so that we go over, do gap analysys and create issues for missing items
2026-07-23 15:13:33 <@q5sys:matrix.org> `map them to existing Fedora docs` I think some of those will just need to be created entlrey. If anything exists, it's probably going to be very outdated (on an old wiki or something no one bothers with anymore).
2026-07-23 15:14:12 <@q5sys:matrix.org> stale info has been a problem for years, and there's no easy fix since things are scattered around a half a dozen locations.
2026-07-23 15:14:53 <@salimma:fedora.im> RH is the CRA steward by default because there is no standalone Fedora legal entity, I assume?
2026-07-23 15:14:54 <@q5sys:matrix.org> What might be better long term... is to just decide as a team where we want the current info to reside... and focus on creating/improving what exists and create a single source of truth for 'current' cocs.
2026-07-23 15:15:15 <@rzhukov:matrix.org> ah, ok. then in this ticket (https://forge.fedoraproject.org/security/tickets/issues/14) we can propose what we think is the good approach for each of those 6 items
2026-07-23 15:15:26 <@salimma:fedora.im> or would it make sense to have a fedoraproject.org alias, even though right now it just forwards to the RH address?
2026-07-23 15:15:41 <@py0xc3:fedora.im> I think there is a council ticket about this. It is not obligated but encouraged.
2026-07-23 15:16:09 <@rzhukov:matrix.org> RH is the Steward for Fedora by current (veg) definition in the CRA and our understanding. 
2026-07-23 15:16:28 <@thebeanogamer:fedora.im> Seems like a reasonable starting point
2026-07-23 15:17:03 <@rzhukov:matrix.org> If someone can lead the charter, I'm of course happy to contribute/help/etc.
2026-07-23 15:17:24 <@py0xc3:fedora.im> https://forge.fedoraproject.org/council/tickets/issues/559
2026-07-23 15:17:26 <@salimma:fedora.im> "veg" ?
2026-07-23 15:19:14 <@rzhukov:matrix.org> Yes, because there are many interpretations who can, can not be and must be Steward and for what. Even within EU Comm there are different opinions. But I personally think it doesn't prevent us from doing reasonable things/improvements
2026-07-23 15:19:47 <@rzhukov:matrix.org> Moving on, I'll be willing to accept more support and contributions from other companies. We in fact discussed that already already at Flock with AWS and MS
2026-07-23 15:20:13 <@salimma:fedora.im> ah, sorry , I meant I am not sure what 'veg' means
2026-07-23 15:20:31 <@rzhukov:matrix.org> So far, we consider Red Hat as a "leading" Steward anyway :) Until somebody tells us the opposite...
2026-07-23 15:20:57 <@rzhukov:matrix.org> Ah, sure. Sorry. Veg = nobody really understands what it means xD 
2026-07-23 15:21:28 <@q5sys:matrix.org> veg = vague?
2026-07-23 15:21:51 <@rzhukov:matrix.org> pretty much
2026-07-23 15:22:07 <@py0xc3:fedora.im> I'm not sure if I like that we forward people in docs to RH without making clear for what. It remains very implicit. (Concerning the above comment to add "contact details of the steward").
2026-07-23 15:22:46 <@thebeanogamer:fedora.im> Right but in reality, Fedora and Red Hat are so tightly intertwined that this isn't the place to start with unpicking that
2026-07-23 15:23:00 <@py0xc3:fedora.im> Yeah, good point too
2026-07-23 15:23:02 <@rzhukov:matrix.org> 1 sec. Here is our security.md template and what we suggest to include into the docs: 
2026-07-23 15:23:17 <@salimma:fedora.im> yeah, that's why I was wondering if future-proofing by making that a new Fedora email would help. it does not matter right now, it might matter in the future
2026-07-23 15:23:18 <@q5sys:matrix.org> Where's your spirit of adventure? 🤣
2026-07-23 15:23:40 <@rzhukov:matrix.org> https://github.com/RedHatProductSecurity/CRA/blob/main/Templates/Security_MD_template.md
2026-07-23 15:23:53 <@rzhukov:matrix.org> So, this disclaimer is good enough to add: 
2026-07-23 15:23:54 <@rzhukov:matrix.org> This project is stewarded by Red Hat, Inc., an open source software steward as defined in Article 3(14) of the EU Cyber Resilience Act (Regulation 2024/2847). Contact: cra-steward@redhat.com
2026-07-23 15:23:54 <@rzhukov:matrix.org> Refer to Red Hat's security practices and vulnerability management policy for detailed information.
2026-07-23 15:23:54 <@rzhukov:matrix.org> 
2026-07-23 15:23:54 <@rzhukov:matrix.org> EU Cyber Resilience Act — Open Source Steward Statement
2026-07-23 15:24:10 <@rzhukov:matrix.org> This project is stewarded by Red Hat, Inc., an open source software steward as defined in Article 3(14) of the EU Cyber Resilience Act (Regulation 2024/2847). Contact: cra-steward@redhat.com
2026-07-23 15:24:10 <@rzhukov:matrix.org> 
2026-07-23 15:24:10 <@rzhukov:matrix.org> EU Cyber Resilience Act — Open Source Steward Statement
2026-07-23 15:24:20 <@py0xc3:fedora.im> +1 to that. I think getting one as forwarding shouldn't be hard
2026-07-23 15:25:06 <@rzhukov:matrix.org> So, it's to notify others (just in case) to direct all "legalish" questions to Red Hat, not to community. While we should keep actual "real" security docs and processes in Fedora.
2026-07-23 15:25:57 <@decathorpe:fedora.im> so ... into *which* docs? 
2026-07-23 15:26:02 <@thebeanogamer:fedora.im> This seems like a good starting point. The exact destination for those reports feels like it leads into the second topic for this meeting (where do reports from the linux-distros list go)
2026-07-23 15:26:12 <@thebeanogamer:fedora.im> Security, surely?
2026-07-23 15:26:14 <@jforbes:fedora.im> I mean until we get a Fedora Legal SIG :)
2026-07-23 15:26:19 <@q5sys:matrix.org> that question just keeps coming around doesn't it?
2026-07-23 15:26:42 <@decathorpe:fedora.im> so ... forge/security/docs ? :) 
2026-07-23 15:26:42 <@decathorpe:fedora.im> I mean, I agree, just Security docs
2026-07-23 15:27:06 <@thebeanogamer:fedora.im> That's where I'd put it
2026-07-23 15:27:16 <@q5sys:matrix.org> I would say for the mean time... we just start using https://forge.fedoraproject.org/security/docs  If we come up with a better idea in the future we can move them later.
2026-07-23 15:27:43 <@q5sys:matrix.org> no point holding up writing things due to going round and round about where to save them.
2026-07-23 15:27:47 <@mfindra:matrix.org> https://forge.stg.fedoraproject.org/Rainbows-and-Unicorns/issue_creation_test/src/branch/main/security.md
2026-07-23 15:28:01 <@py0xc3:fedora.im> There will be in the end two docs. One about the team in the team docs, one about security topics. The latter might get its own badge on the main page. I like the idea Daniel Milnes added earlier about how to distinguish them, as that might be realistic to keep on the long term and still not destroying SEO.
2026-07-23 15:28:29 <@py0xc3:fedora.im> Though not sure if that is already relevant at this stage (?)
2026-07-23 15:28:36 <@mfindra:matrix.org> security.md example from thrcka
2026-07-23 15:28:46 <@thebeanogamer:fedora.im> Strong plus one
2026-07-23 15:30:24 <@salimma:fedora.im> yeah, we can move things later, let's just not make perfect be the enemy of good 
2026-07-23 15:30:42 <@salimma:fedora.im> 'where to put things' is really hard to figure out *until* things are writtten anyway, because right now we have only vague ideas
2026-07-23 15:31:13 <@thebeanogamer:fedora.im> So the only thing we really need to answer then is "Where do the reports go"
2026-07-23 15:31:25 <@thebeanogamer:fedora.im> To which I'm tempted to say "Bugzilla email, similar to the linux-distros one"
2026-07-23 15:31:55 <@py0xc3:fedora.im> Docs-authoring teams once managed to get Fedora out of every search engine first page even for most search queries involving the term Fedora Linux. At the same time, pages were undiscovereable even by the docs team when asked despite them being embedded in the community. My point is not that it is wrong what we do now, but just "hey writing and publishing is always good" is not always the case. It's more complex than that ;)
2026-07-23 15:32:10 <@decathorpe:fedora.im> private mailing list should be an OK temporary solution, until we have private tickets in forgejo.
2026-07-23 15:32:16 <@q5sys:matrix.org> trying to look at it as a lay person... it would seem people would think they would create them under 'tickets' based on the wording of the two repos.
2026-07-23 15:32:34 <@decathorpe:fedora.im> though somebody will need to deal with spam moderation on that list.
2026-07-23 15:32:36 <@salimma:fedora.im> I missed RHCL yesterday due to a scheduling snafu, I wonder if they did talk about bugzilla or not.
2026-07-23 15:32:49 <@salimma:fedora.im> I wanted to flag that hey the Security SIG is now using it in lieu of any better place for embargoed discussions
2026-07-23 15:32:49 <@decathorpe:fedora.im> shouldn't have - bugzilla topic is scheduled for later.
2026-07-23 15:33:04 <@py0xc3:fedora.im> 100%
2026-07-23 15:33:06 <@salimma:fedora.im> ah ok, so it was really open discussions, I thought initially that was next week
2026-07-23 15:33:11 <@thebeanogamer:fedora.im> I think this is the same as the linux-distros reports though in that we need somewhere private and Forgejo can't do that toda
2026-07-23 15:33:14 <@decathorpe:fedora.im> yes, but that doesn't support private tickets (for security reports) yet.
2026-07-23 15:33:14 <@thebeanogamer:fedora.im> I think this is the same as the linux-distros reports though in that we need somewhere private and Forgejo can't do that today
2026-07-23 15:33:39 <@thebeanogamer:fedora.im> So yeah Bugzilla or mailing list, and personally I'm a sucker for a good ticketing platform
2026-07-23 15:33:58 <@q5sys:matrix.org> Does forge allow templates? We could make the first line of filing a ticket be a warning about no private tickets.
2026-07-23 15:34:07 <@q5sys:matrix.org> Does forge allow issue templates? We could make the first line of filing a ticket be a warning about no private tickets.
2026-07-23 15:34:10 <@thebeanogamer:fedora.im> Indeed it does
2026-07-23 15:34:41 <@decathorpe:fedora.im> yup
2026-07-23 15:35:04 <@rzhukov:matrix.org> Question: do you wanna go with reviewing/amending existing Fedora docs (listed https://forge.fedoraproject.org/security/tickets/issues/14) having 6 guidelines items in mind OR do you want to start something from scratch from those 6 guideline items (e.g. 1) Unified Vulnerability and Incident Policy; 2) Secure Dev Practices; .....)? 
2026-07-23 15:35:57 <@thebeanogamer:fedora.im> Don't think Forgejo supports sub-tasks, so I'd be tempted to say ticket per item
2026-07-23 15:36:02 <@thebeanogamer:fedora.im> So they can be worked on seperately
2026-07-23 15:36:06 <@thebeanogamer:fedora.im> But maybe I've spent too long on Jira
2026-07-23 15:36:07 <@decathorpe:fedora.im> I'm pretty sure they'll all be "we need to write this from scratch" anyway so yeah 
2026-07-23 15:36:10 <@q5sys:matrix.org> Even if we do plan to direct people to bugzilla, we should still put something in place in the tickets docs for people that end up doing a drive-by because they didn't see where they should go.
2026-07-23 15:36:33 <@thebeanogamer:fedora.im> I think you can also have an issue template that's actually a link, so that can funnel people to the right page
2026-07-23 15:37:00 <@rzhukov:matrix.org> (I have "voice/video" meetings all day, but this text one is something stand out - I need a break after it indeed 🤣)
2026-07-23 15:37:21 <@decathorpe:fedora.im> yeah ...
2026-07-23 15:37:36 <@decathorpe:fedora.im> so what I'm kind of missing is what are the actual action items now? 
2026-07-23 15:37:45 <@q5sys:matrix.org> but we dont want to direct ALL tickets to a link. haha
2026-07-23 15:37:54 <@py0xc3:fedora.im> The sacrifice for transparency and discoverability, but yes, I know what you mean :) 
2026-07-23 15:37:59 <@q5sys:matrix.org> but we dont want to direct ALL tickets to a link. haha  so we'll probably need a few templates
2026-07-23 15:39:04 <@salimma:fedora.im> I generally find text meetings easier to deal with, but yeah, I wonder if some of these questions could probably be dealt better async
2026-07-23 15:39:18 <@thebeanogamer:fedora.im> * Create a Forgejo ticket for each of the 6 items
2026-07-23 15:39:18 <@thebeanogamer:fedora.im> * Close #14 as complete
2026-07-23 15:39:18 <@thebeanogamer:fedora.im> In my eyes:
2026-07-23 15:39:18 <@thebeanogamer:fedora.im> * Draft PR for the docs site with that SECURITY.md
2026-07-23 15:39:18 <@thebeanogamer:fedora.im> * Create a new list/bugzilla component for security vulnerability reports
2026-07-23 15:39:24 <@salimma:fedora.im> in tickets, that is
2026-07-23 15:40:05 <@decathorpe:fedora.im> yeah that sounds very sensible
2026-07-23 15:40:29 <@decathorpe:fedora.im> need to pandoc -i SECURITY.md -o SECURITY.adoc .... because ✨️ antora ✨️
2026-07-23 15:40:42 <@thebeanogamer:fedora.im> I was going to do it by hand, that's way too sensible
2026-07-23 15:41:12 <@rzhukov:matrix.org> (text meeting are tolls for non-native English speaker, but anyway...)
2026-07-23 15:41:14 <@decathorpe:fedora.im> I mean you do you but I can for the life of me not commit asciidoc syntax to my head 
2026-07-23 15:41:34 <@decathorpe:fedora.im> oh yeah. it's sometimes difficult for me as a German native speaker too ... 
2026-07-23 15:41:44 <@thebeanogamer:fedora.im> Intellij has a lint rule for "You've written markdown syntax in an asciidoc file" and I rely on it heavily 
2026-07-23 15:42:39 <@rzhukov:matrix.org> Let me see if I get it. You want to create 1 Security.md file to include all 6 items into it OR create 6 (or maybe less) news doc incorporating those items OR both of those actions?
2026-07-23 15:43:18 <@decathorpe:fedora.im> that probably depends on how much content there will be for each of those points? if it's just one sentence, then separate documents doesn't make much sense to me IMO 
2026-07-23 15:43:38 <@salimma:fedora.im> fair, funnily most of us are likely non native speakers here? I know I'm not. On FESCo it's probably majority non native speakers too
2026-07-23 15:43:54 <@q5sys:matrix.org> although its easier to translate text afterwords rather than a video recording
2026-07-23 15:44:38 <@salimma:fedora.im> right, "AI transcriptions" are also not friendly to non-native speakers
2026-07-23 15:45:22 <@salimma:fedora.im> but anyway... let's not derail before I go into a spiel about how horrible it is to see a lot of blurry faces in a meeting room across VC and not knowing who any of the speakers are
2026-07-23 15:45:54 <@rzhukov:matrix.org> (I'd agree, but my transcript parser using locally hosted model does a pretty good job actually for most of the time from the audio stream.  Not to mention if you enable native captions recording in the video call itself)
2026-07-23 15:48:08 <@rzhukov:matrix.org> that's the main point. I'd suggest the docs are not "formal" docs, but actually helpful. That's why I'm suggesting these different options - we may reuse existing docs, but if there is no "appetite" to go with full review, perhaps a few sentences into 1 single .md file would be perfect. We would need short and concise security.md files anyway to push to repos
2026-07-23 15:48:49 <@thebeanogamer:fedora.im> Have you got any other projects which have adopted that template, so we can get a feel for what should go in the placeholders?
2026-07-23 15:49:01 <@rzhukov:matrix.org> security.md = minimal info how to report, contacts, etc. Actual docs = elaboration on the full process, practices, etc.   
2026-07-23 15:49:07 <@rzhukov:matrix.org> Sure, sec
2026-07-23 15:49:34 <@rzhukov:matrix.org> Actually, have a look at the table https://access.redhat.com/security/eu-cyber-resilience-act-stewardship-guidelines#:~:text=Cybersecurity%2C%20Vulnerability%20Management%20and%20Incident%20Response%20Policy
2026-07-23 15:49:54 <@rzhukov:matrix.org> there are links in the third column to those examples. 
2026-07-23 15:50:03 <@decathorpe:fedora.im> or would this need to go into *every* dist-git repo too?
2026-07-23 15:50:03 <@decathorpe:fedora.im> 
2026-07-23 15:50:03 <@decathorpe:fedora.im> 
2026-07-23 15:50:03 <@decathorpe:fedora.im> so which repos would we be talking about here?
2026-07-23 15:50:03 <@decathorpe:fedora.im> > We would need short and concise security.md files anyway to push to repos
2026-07-23 15:50:03 <@decathorpe:fedora.im> stuff hosted on forge.fedoraproject.org?
2026-07-23 15:50:16 <@rzhukov:matrix.org> But if you're asking for "Red Hatty" one - here it is: https://github.com/stackrox/stackrox?tab=security-ov-file
2026-07-23 15:50:24 <@thebeanogamer:fedora.im> Ah cool, based on https://github.com/uxlfoundation/oneDNN?tab=security-ov-file I think we could get the simple version into one doc and link out to bigger ones as requeed
2026-07-23 15:50:48 <@thebeanogamer:fedora.im> I think you could put this on the docs site, in the same way we don't have a LICENSE.md in every repo
2026-07-23 15:50:56 <@rzhukov:matrix.org> I don't think it'd go to every repo, to be honest. If we can identify "the core" it'd be great.
2026-07-23 15:51:58 <@rzhukov:matrix.org> The main point in short security.md files is discoverability. People (and now agents) kind of expected to find these artifacts to report about vuln 
2026-07-23 15:52:45 <@thebeanogamer:fedora.im> I've had a backlog item to put a security.txt on the public sites
2026-07-23 15:52:59 <@thebeanogamer:fedora.im> So that could point at the docs with the security.md
2026-07-23 15:53:08 <@thebeanogamer:fedora.im> Maybe also a link directly to it on the main site
2026-07-23 15:55:06 <@decathorpe:fedora.im> anyway I have another meeting in 5 minutes, gotta go
2026-07-23 15:55:11 <@rzhukov:matrix.org> (not that I have a huge vote here 🤣) I agree with all actions, but the first one. May I suggest to not close this ticket yet, but instead propose/write how these new/rewritten policy docs may look like? Or create a new ticket for this work item :) 
2026-07-23 15:55:42 <@thebeanogamer:fedora.im> Sure, let's use the current one to document a plan
2026-07-23 15:56:28 <@q5sys:matrix.org> The current ticket is probably the best place to continue to discuss it.
2026-07-23 15:56:50 <@q5sys:matrix.org> I dont think we'll resolve everything in the next 3 minutes. haha
2026-07-23 15:57:24 <@thebeanogamer:fedora.im> Yeah maybe let's leave it there rather than trying to cram in the other topic
2026-07-23 15:57:33 <@thebeanogamer:fedora.im> And we can fan the actions out on Forge
2026-07-23 15:57:39 <@rzhukov:matrix.org> And for other items (beyond policy) - we can create another ticket or repo with a table/gap anal
2026-07-23 15:57:43 <@jforbes:fedora.im> Sounds reasonable
2026-07-23 15:57:55 <@q5sys:matrix.org> yea we'll bump Linux-distros discussion | https://forge.fedoraproject.org/security/tickets/issues/13 to the top of the next meeting, if there's time next week we can return to this topic to discuss ideas over this past week.
2026-07-23 15:57:59 <@rzhukov:matrix.org> sounds great, thanks folks, have a good one!
2026-07-23 15:58:31 <@salimma:fedora.im> thanks all!
2026-07-23 15:58:44 <@py0xc3:fedora.im> Do we need that? I left it because I wasn't sure if people want to discuss it, given the attention it got.
2026-07-23 15:58:48 <@q5sys:matrix.org> Have a great rest of your week and relaxing weekend.
2026-07-23 15:59:02 <@py0xc3:fedora.im> But it doesn't hurt, so either way fine I guess
2026-07-23 15:59:10 <@q5sys:matrix.org> we can at least see if there's further comment, if not, we can move on.
2026-07-23 15:59:39 <@py0xc3:fedora.im> Yeah makes sense
2026-07-23 15:59:45 <@py0xc3:fedora.im> See you around, thanks everybody :) 
2026-07-23 15:59:54 <@q5sys:matrix.org> !endmeeting