2025-11-25 17:02:25 <@zbyszek:fedora.im> !startmeeting FESCO (2025-11-25)

2025-11-25 17:02:26 <@meetbot:fedora.im> Meeting started at 2025-11-25 17:02:25 UTC
2025-11-25 17:02:26 <@meetbot:fedora.im> The Meeting name is 'FESCO (2025-11-25)'
2025-11-25 17:02:29 <@zbyszek:fedora.im> !meetingname fesco
2025-11-25 17:02:29 <@zbyszek:fedora.im> !group members fesco
2025-11-25 17:02:29 <@zbyszek:fedora.im> !topic Init Process
2025-11-25 17:02:30 <@meetbot:fedora.im> The Meeting Name is now fesco
2025-11-25 17:02:34 <@decathorpe:fedora.im> !hi
2025-11-25 17:02:36 <@zodbot:fedora.im> Fabio Valentini (decathorpe) - he / him / his
2025-11-25 17:02:37 <@fale:fale.io> !hi
2025-11-25 17:02:39 <@zodbot:fedora.im> Fabio Alessandro Locati (fale) - he / him / his
2025-11-25 17:02:43 <@conan_kudo:matrix.org> !hi
2025-11-25 17:02:43 <@zbyszek:fedora.im> !hi
2025-11-25 17:02:44 <@zodbot:fedora.im> Zbigniew Jędrzejewski-Szmek (zbyszek)
2025-11-25 17:02:46 <@zodbot:fedora.im> Neal Gompa (ngompa) - he / him / his
2025-11-25 17:03:41 <@zbyszek:fedora.im> Hmm, seems like we might be short today too.
2025-11-25 17:04:02 <@conan_kudo:matrix.org> this is US Thanksgiving week
2025-11-25 17:04:06 <@conan_kudo:matrix.org> so that might be why
2025-11-25 17:04:28 <@zbyszek:fedora.im> It's a holiday for you and you're here!
2025-11-25 17:04:39 <@conan_kudo:matrix.org> I almost wasn't
2025-11-25 17:05:19 <@salimma:fedora.im> !hi
2025-11-25 17:05:20 <@zodbot:fedora.im> Michel Lind (salimma) - he / him / his
2025-11-25 17:05:26 <@zbyszek:fedora.im> OK, we have quorum.
2025-11-25 17:06:34 <@zbyszek:fedora.im> Conan Kudo: there was a question about %buildrelease on the mailing list. You're probably the best person to answer that.
2025-11-25 17:06:59 <@conan_kudo:matrix.org> I'll answer there
2025-11-25 17:07:04 <@conan_kudo:matrix.org> the answer right now is "probably not"
2025-11-25 17:07:09 <@zbyszek:fedora.im> !topic #3496 Request to Authorize Removal of upstream source files from commit history for adobe-source-han-mono-fonts package
2025-11-25 17:07:09 <@zbyszek:fedora.im> !fesco 3496
2025-11-25 17:07:16 <@zbyszek:fedora.im> Yeah, thanks.
2025-11-25 17:07:27 <@decathorpe:fedora.im> !fesco 3496
2025-11-25 17:07:28 <@zodbot:fedora.im> ● **Opened:** 3 weeks ago by amedvede
2025-11-25 17:07:28 <@zodbot:fedora.im> ● **Last Updated:** 4 hours ago
2025-11-25 17:07:28 <@zodbot:fedora.im> 
2025-11-25 17:07:28 <@zodbot:fedora.im> **fesco #3496** (https://pagure.io/fesco/issue/3496):**Request to Authorize Removal of upstream source files from commit history for adobe-source-han-mono-fonts package**
2025-11-25 17:07:28 <@zodbot:fedora.im> ● **Assignee:** Not Assigned
2025-11-25 17:07:41 <@decathorpe:fedora.im> (the bot still doesn't like too many commands in one message) 
2025-11-25 17:07:57 <@zbyszek:fedora.im> !group members fesco
2025-11-25 17:07:59 <@zodbot:fedora.im> Members of fesco: Dave Cantrell, Fabio Valentini, Fabio Alessandro Locati, Tomáš Hrčka, Jef Spaleta, Kevin Fenzi, ngompa (@conan_kudo:matrix.org, @ngompa:fedora.im, @pharaoh_atem:opensuse.org, @ngompa:kde.org, @ngompa:almalinux.im), salimma (@michel-slm:matrix.org, @salimma:fedora.im), Stephen Gallagher, Zbigniew Jędrzejewski-Szmek
2025-11-25 17:08:02 <@zbyszek:fedora.im> Ah, shit, indeed.
2025-11-25 17:08:09 <@zbyszek:fedora.im> So the first topic wasn't set properly.
2025-11-25 17:08:14 <@zbyszek:fedora.im> Too late now.
2025-11-25 17:08:24 <@conan_kudo:matrix.org> 🤷
2025-11-25 17:08:55 <@zbyszek:fedora.im> I was tricked by the fact that it threw an error when I first pasted things, so I split it up, and when it didn't complain, I didn't look closely.
2025-11-25 17:08:58 <@decathorpe:fedora.im> the topic worked, the !group call didn't.
2025-11-25 17:09:25 <@zbyszek:fedora.im> In https://pagure.io/fesco/issue/3496#comment-993193, Stephen Gallagher made a proposal
2025-11-25 17:09:25 <@fale:fale.io> zodbot is feeling the holiday season as well, proabably
2025-11-25 17:09:42 <@decathorpe:fedora.im> anyway. what *is* the process for "we can't legally distribute this content" right now if it's not *this* process? ...
2025-11-25 17:09:49 <@zbyszek:fedora.im> > Revision of the git history for any other reason must be submitted as a FESCo ticket for consideration.
2025-11-25 17:09:49 <@zbyszek:fedora.im> >
2025-11-25 17:09:49 <@zbyszek:fedora.im> > Releng is empowered to follow its branch rewrite policy if one of the following conditions are met:
2025-11-25 17:09:49 <@zbyszek:fedora.im> >
2025-11-25 17:09:49 <@zbyszek:fedora.im> >    The checked-in file exceeds 1 MiB in size and is either a) unused or b) exists in (or is moved to) the lookaside cache.
2025-11-25 17:09:49 <@zbyszek:fedora.im> >    The checked-in file includes content whose redistribution status is either impermissible or indeterminate (including, but not limited to: an unacceptable license or patent-encumbered content)
2025-11-25 17:11:39 <@sgallagh:fedora.im> !hi
2025-11-25 17:11:40 <@zodbot:fedora.im> Stephen Gallagher (sgallagh) - he / him / his
2025-11-25 17:11:52 <@sgallagh:fedora.im> (I am only partially here. On my phone on PTO)
2025-11-25 17:11:53 <@decathorpe:fedora.im> nirik's comment makes it sound as if the process for removing legally problematic content is actually a different SOP, in which case I agree that removing point 2. from the proposal makes sense
2025-11-25 17:12:03 <@zbyszek:fedora.im> So I'd be inclined to merge this. If we think that something so egregious is in the history that this process is not enough, then we can have a separate discussion.
2025-11-25 17:12:17 <@decathorpe:fedora.im> that too.
2025-11-25 17:12:29 <@conan_kudo:matrix.org> fine with me
2025-11-25 17:12:32 <@conan_kudo:matrix.org> let's do it
2025-11-25 17:12:41 <@salimma:fedora.im> I guess it's fine
2025-11-25 17:12:52 <@salimma:fedora.im> did legal already weigh in on this?
2025-11-25 17:13:00 <@conan_kudo:matrix.org> they won't
2025-11-25 17:13:04 <@salimma:fedora.im> seems weird if we're the ones adjudicating legal claims
2025-11-25 17:13:10 <@zbyszek:fedora.im> OK, we have zbyszek, fale, sgallagh, decathorpe +1, kevin -1 in the ticket.
2025-11-25 17:13:11 <@conan_kudo:matrix.org> there's also not really a reason to, since the SOP for legal is different
2025-11-25 17:13:35 <@conan_kudo:matrix.org> (and the legal stuff is _usually_ how you get the badge)
2025-11-25 17:13:40 <@conan_kudo:matrix.org> (and the legal SOP is _usually_ how you get the badge)
2025-11-25 17:13:49 <@salimma:fedora.im> ugh, so be it then. I guess people who really want to can... download the SRPM from old releases?
2025-11-25 17:14:12 <@conan_kudo:matrix.org> usually if it's severe enough, we blow it out of the master mirror
2025-11-25 17:14:17 <@conan_kudo:matrix.org> it replicates the deletion everywhere
2025-11-25 17:14:32 <@sgallagh:fedora.im> My intent with how it was written is that whether or not it is permissible is decided elsewhere. 
2025-11-25 17:14:33 <@zbyszek:fedora.im> Stephen Gallagher: should we maybe extend the last sentence to say that a separate ticket should be opened if the SOP is not enough?
2025-11-25 17:14:52 <@sgallagh:fedora.im> Does it not already say that?
2025-11-25 17:15:29 <@zbyszek:fedora.im> No, it says "for other reason". But I mean more "in a different way".
2025-11-25 17:15:46 <@sgallagh:fedora.im> I don’t understand the distinction 
2025-11-25 17:16:32 <@decathorpe:fedora.im> the reason would be the same, but the outcome would be different (i.e. not only rewriting the existing branches and keeping copies as backups, but rewriting *period*)
2025-11-25 17:17:04 <@decathorpe:fedora.im> the reason would be the same, but the outcome would be different (i.e. not only rewriting the existing branches and keeping copies as backups, but rewriting _period_ without backups)
2025-11-25 17:17:30 <@zbyszek:fedora.im> The current proposal implies that there's one way to revise git history, and that is the branch rewrite policy of releng. And we here discuss when it is OK to invoke this without a FESCo vote. But problem with that is what Fabio wrote, that we want a different method to be used.
2025-11-25 17:17:48 <@sgallagh:fedora.im> Without public backups, maybe. Records retention laws might require us to keep private backups anyway
2025-11-25 17:18:36 <@zbyszek:fedora.im> Sure, but the whole point of the current SOP is to allow interested parties public access to full history. We might need/want a way which does not allow this.
2025-11-25 17:19:20 <@sgallagh:fedora.im> Ok, I see the distinction now. I’m not sure we need to state it though. 
2025-11-25 17:19:45 <@sgallagh:fedora.im> “File a ticket with FESCo” is the default expectation when an explicit rule doesn’t exist. 
2025-11-25 17:19:47 <@conan_kudo:matrix.org> we probably don't
2025-11-25 17:20:06 <@zbyszek:fedora.im> OK, so if that's the consensus, then folks who didn't vote yet please cast a vote.
2025-11-25 17:20:40 <@zbyszek:fedora.im> that's Michel Lind UTC and Conan Kudo if I'm reading the log correctly
2025-11-25 17:21:02 <@conan_kudo:matrix.org> just did +1 in the ticket
2025-11-25 17:21:14 <@salimma:fedora.im> I did +1 here I thought? ok, not explicitly, so +1
2025-11-25 17:21:43 <@zbyszek:fedora.im> Michel Lind UTC: "I guess it's fine" is not enough1
2025-11-25 17:21:49 <@zbyszek:fedora.im> Michel Lind UTC: "I guess it's fine" is not enough!
2025-11-25 17:22:39 <@zbyszek:fedora.im> Stephen Gallagher: typing?
2025-11-25 17:22:48 <@sgallagh:fedora.im> No?
2025-11-25 17:22:54 <@sgallagh:fedora.im> Matrix bug
2025-11-25 17:22:56 <@zbyszek:fedora.im> !agreed Proposal in https://pagure.io/fesco/issue/3496#comment-993193 is APPROVED (+6, 0, -1)
2025-11-25 17:23:18 <@zbyszek:fedora.im> !fesco 3512
2025-11-25 17:23:18 <@zbyszek:fedora.im> !topic #3512 Let's do something about ignored CVE bugs
2025-11-25 17:23:27 <@zbyszek:fedora.im> !fesco 3512
2025-11-25 17:23:29 <@zodbot:fedora.im> 
2025-11-25 17:23:29 <@zodbot:fedora.im> ● **Assignee:** Not Assigned
2025-11-25 17:23:29 <@zodbot:fedora.im> ● **Last Updated:** 5 hours ago
2025-11-25 17:23:29 <@zodbot:fedora.im> **fesco #3512** (https://pagure.io/fesco/issue/3512):**Let's do something about ignored CVE bugs**
2025-11-25 17:23:29 <@zodbot:fedora.im> ● **Opened:** 3 days ago by catanzaro
2025-11-25 17:23:34 <@zbyszek:fedora.im> This is annoying.
2025-11-25 17:23:45 <@decathorpe:fedora.im> looks like everyone is just fed up with low quality of the reports? :D
2025-11-25 17:24:04 <@decathorpe:fedora.im> making the exercise of "count how many open security issues we have" kind of pointless 
2025-11-25 17:24:40 <@zbyszek:fedora.im> Can we get the RH team that files the bugs involved in the discussion?
2025-11-25 17:24:41 <@conan_kudo:matrix.org> I don't want to talk about this topic
2025-11-25 17:24:47 <@conan_kudo:matrix.org> because it's just depressing and annoying
2025-11-25 17:24:50 <@zbyszek:fedora.im> Because that seems to be where the problem starts…
2025-11-25 17:24:52 <@conan_kudo:matrix.org> and we can't do anything about the bugs
2025-11-25 17:24:52 <@fale:fale.io> I think it would be a rational thing to ask for if maintainers were paid to maintain the packages. I do not think it can be a reasoable request for volunteers
2025-11-25 17:25:20 <@conan_kudo:matrix.org> if Fedora had a way to pay maintainers, that would be cool... :)
2025-11-25 17:25:52 <@salimma:fedora.im> I asked for that in the ticket
2025-11-25 17:26:13 <@zbyszek:fedora.im> Yes, that's where I got the idea ;)
2025-11-25 17:26:14 <@salimma:fedora.im> because I replied once to the person who ran it after he tried to do the non-responsive maintainer process on me
2025-11-25 17:26:18 <@salimma:fedora.im> and then nothing changed
2025-11-25 17:26:29 <@sgallagh:fedora.im> These tickets are a large part of what burned me out for Node packaging. 
2025-11-25 17:26:43 <@conan_kudo:matrix.org> I'm nearing the deep end for some things because of it
2025-11-25 17:26:48 <@conan_kudo:matrix.org> and that new website is super not helping
2025-11-25 17:26:52 <@salimma:fedora.im> oh even if maintainers are paid, e.g. if something like this happens at work I think the team that spams other teams will get in trouble
2025-11-25 17:26:53 <@sgallagh:fedora.im> For a while, I was just closing them all as WONTFIX in protest
2025-11-25 17:26:56 <@salimma:fedora.im> for wasting valuable time
2025-11-25 17:27:05 <@decathorpe:fedora.im> I don't think we'd lose much of substance if those ticket stopped getting filed tomorrow. And that's not a great state for things to be in
2025-11-25 17:27:31 <@salimma:fedora.im> yeah it got worse over time. it used to at least have guides for setting severity on the submitted update. now it doesn't. and no detail unless you click to the linked bug
2025-11-25 17:27:52 <@salimma:fedora.im> I definitely want an opt out so e.g. some of my packages should never ever get nodejs bugs ever
2025-11-25 17:28:11 <@salimma:fedora.im> (they should scan compiled artifacts and not just the source RPMs)
2025-11-25 17:28:12 <@conan_kudo:matrix.org> I kind of don't want anymore ffmpeg security bugs
2025-11-25 17:28:17 <@conan_kudo:matrix.org> because of how many wrong ones I get
2025-11-25 17:28:23 <@conan_kudo:matrix.org> I'm practically flooded with them
2025-11-25 17:28:51 <@decathorpe:fedora.im> yeah doesn't help that tickets are filed for security issues that *have already been addressed* (sometimes years ago)
2025-11-25 17:28:54 <@bookwar:fedora.im> Should we get Jef Spaleta  involved? We can at least have a discussion about the accepted severity level for this process
2025-11-25 17:29:16 <@zbyszek:fedora.im> That'd be great. Is Jef Spaleta listening?
2025-11-25 17:30:00 <@decathorpe:fedora.im> probably not ... let's move that to the ticket and move on?
2025-11-25 17:30:40 <@fale:fale.io> I think those are two different issues: even if the CVE reports would be awesome quality, I think it would still be not reasonable for a volunteer maintainer to act on those CVE in 6 weeks or be tagged as unresponsive
2025-11-25 17:31:09 <@zbyszek:fedora.im> OK, and what about stuff like "QtWebKit is full of hundreds of known CVEs. Please remove this package as soon as possible"?
2025-11-25 17:31:19 <@zbyszek:fedora.im> !bug 1711519
2025-11-25 17:31:20 <@zodbot:fedora.im> RHBZ#1711519 (https://bugzilla.redhat.com/1711519): [qtwebkit]: QtWebKit is full of hundreds of known CVEs. Please remove this package as soon as possible
2025-11-25 17:32:04 <@bookwar:fedora.im> I would separate the topics of whether this bug even needs to be filed, from whose responsibility is to resolve it and under which SLA
2025-11-25 17:32:11 <@salimma:fedora.im> I mean, I think the web is a mistake so sure, but that will mean we don't produce a usable distro
2025-11-25 17:32:19 <@bookwar:fedora.im> If we don't solve the first, the second is not worth trying to be solved
2025-11-25 17:32:48 <@salimma:fedora.im> so if some security team takes security really seriously and expects an SLA, how about this
2025-11-25 17:33:14 <@salimma:fedora.im> if they produce a working PR, the maintainer should merge it or ... we already have a fast-track non-responsive process to get the PR merged 
2025-11-25 17:33:25 <@conan_kudo:matrix.org> Fedora KDE SIG has been trying to strip out qt5-qtwebkit deps in our chain for some time, but this is for qt4-qtwebkit... I don't even know wtf is going on there
2025-11-25 17:33:35 <@salimma:fedora.im> or security team members can apply for proven packager status, that's a reasonable request if they have a track record
2025-11-25 17:34:00 <@decathorpe:fedora.im> > security team members
2025-11-25 17:34:00 <@decathorpe:fedora.im> 
2025-11-25 17:34:00 <@decathorpe:fedora.im> first step would be to define this group
2025-11-25 17:34:12 <@decathorpe:fedora.im> because I don't think it exists
2025-11-25 17:34:22 <@conan_kudo:matrix.org> it doesn't
2025-11-25 17:34:41 <@conan_kudo:matrix.org> there used to be one a long time ago, but it's been defunct for many years
2025-11-25 17:34:55 <@zbyszek:fedora.im> I don't think we need to define the group. Privileges in Fedora are attached to people, so a person can just start working on this. We don't need a group.
2025-11-25 17:35:21 <@conan_kudo:matrix.org> we also have no Fedora representatives for the linux-distros@ list either
2025-11-25 17:35:28 <@zbyszek:fedora.im> Anyway, looking at the #1711519, I think we should put the foot down and drop it for F44.
2025-11-25 17:35:39 <@conan_kudo:matrix.org> I'm fine with that
2025-11-25 17:35:43 <@zbyszek:fedora.im> it → the package
2025-11-25 17:35:54 <@conan_kudo:matrix.org> I literally could not possibly care less about qt4-qtwebkit
2025-11-25 17:36:01 <@decathorpe:fedora.im> having a SIG that acts as an intermediary between CVE / Red Hat and the bug tracker would be worthwhile though I think 
2025-11-25 17:36:19 <@conan_kudo:matrix.org> and it would open the door for external representation for the security handling
2025-11-25 17:36:26 <@conan_kudo:matrix.org> which, again, we don't have
2025-11-25 17:36:32 <@bookwar:fedora.im> Well, if we had CVE issues filed for Fedora reliably, so that the number of open CVEs would actually mean anything, we could then use that number to start conversation about security team, funding, need for resources and so on.
2025-11-25 17:36:42 <@salimma:fedora.im> there is talk of resurrecting the security SIG. I don't think it ever got off the ground
2025-11-25 17:36:59 <@conan_kudo:matrix.org> bookwar: have you seen the cve website that was made?
2025-11-25 17:37:04 <@salimma:fedora.im> bookwarwould the first step be to *stop* filing the current CVEs
2025-11-25 17:37:09 <@conan_kudo:matrix.org> I'm unhappy it exists, but it's now a thing
2025-11-25 17:37:22 <@salimma:fedora.im> Conan Kudolink?
2025-11-25 17:37:24 <@zbyszek:fedora.im> I haven't seen the site. Can somebody post a link?
2025-11-25 17:37:31 <@conan_kudo:matrix.org> !link https://fedoracve.org
2025-11-25 17:37:35 <@bookwar:fedora.im> I haven't
2025-11-25 17:38:06 <@conan_kudo:matrix.org> I was informed of its existence this morning
2025-11-25 17:38:16 <@salimma:fedora.im> (as noted in the ticket, we tried looking at our CVEs in EPSco and people get discouraged by the false positives after a while - I think we fixed a bunch of the real CVEs in the first few weeks, then ... we drowned in false positives)
2025-11-25 17:38:36 <@salimma:fedora.im> this uses the Fedora logo etc. so... this is an official site?
2025-11-25 17:38:42 <@salimma:fedora.im> or it's presenting itself as such
2025-11-25 17:38:42 <@conan_kudo:matrix.org> I don't know
2025-11-25 17:38:50 <@conan_kudo:matrix.org> I'm the only non-Red Hatter who was emailed about the site
2025-11-25 17:39:19 <@decathorpe:fedora.im> lol it 1) doesn't say who's running the site, and 2) it says the site is open source but it doesn't link to the sources 🙃
2025-11-25 17:39:20 <@bookwar:fedora.im> "Fedora CVE Dashboard is an independent, community-driven project. We are not affiliated with, endorsed by, or sponsored by Red Hat, Inc., The MITRE Corporation, or any other trademark holders mentioned above. "
2025-11-25 17:39:22 <@zbyszek:fedora.im> > Fedora CVE Dashboard is an independent, community-driven project. We are not affiliated with, endorsed by, or sponsored by Red Hat, Inc., The MITRE Corporation, or any other trademark holders mentioned above. 
2025-11-25 17:39:24 <@conan_kudo:matrix.org> and it's being run by Red Hatters
2025-11-25 17:39:43 <@zbyszek:fedora.im> bookwar :)
2025-11-25 17:39:45 <@conan_kudo:matrix.org> so overall, I'm unhappy about it
2025-11-25 17:40:11 <@bookwar:fedora.im> I am a redhatter, it doesn't mean i get any info about it. Looks like someones personal project so far.
2025-11-25 17:40:13 <@zbyszek:fedora.im> Is using the logo allowed by the policy?
2025-11-25 17:40:17 <@conan_kudo:matrix.org> no
2025-11-25 17:40:32 <@bookwar:fedora.im> Not a bad project, but needs someone to show up and talk about the goal the tools , the approach and so on
2025-11-25 17:40:37 <@zbyszek:fedora.im> I think the website is nice.
2025-11-25 17:41:00 <@salimma:fedora.im> if this is done without trademark approval... idk, sounds like something that could be problematic
2025-11-25 17:41:09 <@salimma:fedora.im> should we raise this with legal :P
2025-11-25 17:41:28 <@zbyszek:fedora.im> Yeah, I think we should, based on the general principle of protecting the logo.
2025-11-25 17:41:34 <@salimma:fedora.im> I don't object to something like this existing if done responsibly. given the trash that is the CVE reports now this seems dangerous
2025-11-25 17:41:53 <@salimma:fedora.im> ok who wants to take the bullet and email legal?
2025-11-25 17:41:59 <@bookwar:fedora.im> I don't think we need to fight against the site. It is just analytics, and a good one. I'd rather invite the person who created it, to talk to us, and to discuss next steps.
2025-11-25 17:42:15 <@decathorpe:fedora.im> at least right now it would probably be food for people who want to post misleading youtube videos about how Fedora has thousands of open security bugs 
2025-11-25 17:42:26 <@zbyszek:fedora.im> bookwar: yes
2025-11-25 17:42:42 <@salimma:fedora.im> intention is one thing. that they broke trademark laws and intentionally or not make us look really bad because the data is garbage...
2025-11-25 17:42:46 <@conan_kudo:matrix.org> I would have preferred they not launch the site, have the code public, and talk to us first
2025-11-25 17:42:53 <@zbyszek:fedora.im> Well, we do have thousands of CVEs open. So the website is not the problem.
2025-11-25 17:43:03 <@decathorpe:fedora.im> do we? 
2025-11-25 17:43:12 <@salimma:fedora.im> we don't know
2025-11-25 17:43:23 <@conan_kudo:matrix.org> the site is public, the code is private, and they surprised us with an 8:30am launch
2025-11-25 17:43:24 <@decathorpe:fedora.im> given the dumpster fire quality of the cve reports, I don't think we can tell 
2025-11-25 17:43:41 <@salimma:fedora.im> I will note that just this week I stumbled upon open bugs that should have been closed because the maintainers who made updates didn't link the bugzilla
2025-11-25 17:43:45 <@zbyszek:fedora.im> We have 6613 bugzillas that match "CVE"
2025-11-25 17:43:53 <@conan_kudo:matrix.org> I don't even know how they are collecting the bugs
2025-11-25 17:43:54 <@bookwar:fedora.im> Right. I don't really like the fight against the person who brought the data as the only outcome of this conversation :)
2025-11-25 17:44:05 <@decathorpe:fedora.im> which means exactly *nothing* :)
2025-11-25 17:44:49 <@zbyszek:fedora.im> bookwar: so my intention certainly wasn't to fight against the person. Nevertheless, they should not use the Fedora logo for a 3rd party site. This just creates confusion.
2025-11-25 17:45:21 <@bookwar:fedora.im> It's a data point. We can try to interpret that data point, but we should not fight against it being a data point.
2025-11-25 17:45:30 <@zbyszek:fedora.im> Especially that the domain name has "fedora" and ".org" in the name.
2025-11-25 17:45:36 <@conan_kudo:matrix.org> it's a low quality datapoint
2025-11-25 17:45:42 <@conan_kudo:matrix.org> which is worse than no datapoint
2025-11-25 17:46:07 <@zbyszek:fedora.im> Anyhoo, what do we do here?
2025-11-25 17:46:08 <@bookwar:fedora.im> let's not repeat that fedoracommunity disaster which we had couple of years ago though
2025-11-25 17:46:24 <@conan_kudo:matrix.org> ... we owned that domain though, that was a different mess
2025-11-25 17:46:50 <@zbyszek:fedora.im> We've been 20+ minutes on the topic.
2025-11-25 17:47:07 <@zbyszek:fedora.im> We have the original ticket (about bugzilla) and then the discussion about the site.
2025-11-25 17:47:12 <@zbyszek:fedora.im> Anew proposals for action?
2025-11-25 17:47:20 <@zbyszek:fedora.im> *Any proposal for action?
2025-11-25 17:47:36 <@conan_kudo:matrix.org> can any RHer here bring someone from ProdSec to us to discuss things?
2025-11-25 17:47:57 <@conan_kudo:matrix.org> I think that's the only meaningful action item for right now
2025-11-25 17:48:08 <@conan_kudo:matrix.org> (well, and figuring out the trademark thing)
2025-11-25 17:48:17 <@conan_kudo:matrix.org> (well, and figuring out the trademark thing for the  fedoracve website)
2025-11-25 17:48:20 <@decathorpe:fedora.im> let's !action jef 
2025-11-25 17:48:22 <@conan_kudo:matrix.org> (well, and figuring out the trademark thing for the fedoracve website)
2025-11-25 17:48:33 <@conan_kudo:matrix.org> ... will Jef Spaleta be able to do it?
2025-11-25 17:48:43 <@conan_kudo:matrix.org> we can technically do that, but it doesn't mean it'll be done
2025-11-25 17:48:47 <@davdunc:fedora.im> maybe just ask the owner/maintainer to apply for official trademark use? 
2025-11-25 17:49:03 <@conan_kudo:matrix.org> I can go ahead and reply to them accordingly about the trademark thing
2025-11-25 17:49:09 <@davdunc:fedora.im> then have the discussion in context. 
2025-11-25 17:49:18 <@conan_kudo:matrix.org> but the prodsec thing is out of my realm of capability
2025-11-25 17:49:52 <@zbyszek:fedora.im> !action Conan Kudo to talk to the fedoracve.org owner/maintainers about trademark use
2025-11-25 17:50:31 <@zbyszek:fedora.im> !action Jef Spaleta to talk to RH ProdSec about the quality and procedures for CVE filing
2025-11-25 17:50:47 <@zbyszek:fedora.im> Good?
2025-11-25 17:51:09 <@zbyszek:fedora.im> If no objection, I'll move to the next issue.
2025-11-25 17:51:19 <@salimma:fedora.im> someone needs to talk to Jef though right
2025-11-25 17:51:24 <@salimma:fedora.im> but otherwise yes
2025-11-25 17:51:30 <@zbyszek:fedora.im> Yeah, I'll CC him on the summary.
2025-11-25 17:51:33 <@zbyszek:fedora.im> !fesco 3507
2025-11-25 17:51:33 <@zbyszek:fedora.im> !topic #3507 FESCo election policy which prioritizes first timers
2025-11-25 17:51:41 <@zbyszek:fedora.im> !fesco 3507
2025-11-25 17:51:42 <@zodbot:fedora.im> ● **Last Updated:** 4 hours ago
2025-11-25 17:51:42 <@zodbot:fedora.im> ● **Assignee:** Not Assigned
2025-11-25 17:51:42 <@zodbot:fedora.im> ● **Opened:** 5 days ago by bookwar
2025-11-25 17:51:42 <@zodbot:fedora.im> 
2025-11-25 17:51:42 <@zodbot:fedora.im> **fesco #3507** (https://pagure.io/fesco/issue/3507):**FESCo election policy which prioritizes first timers**
2025-11-25 17:51:58 <@conan_kudo:matrix.org> (FYI, that website will go viral once we post this minutes)
2025-11-25 17:52:04 <@conan_kudo:matrix.org> (FYI, that website will go viral once we post this meeting minutes)
2025-11-25 17:52:13 <@decathorpe:fedora.im> ***fun*** 
2025-11-25 17:52:55 <@salimma:fedora.im> Streisand effect? :P
2025-11-25 17:52:55 <@zbyszek:fedora.im> bookwar: I think the issue you raise is valid.
2025-11-25 17:54:21 <@decathorpe:fedora.im> I still think that having a "junior" member is a bad way to address this 
2025-11-25 17:54:56 <@decathorpe:fedora.im> I'd rather see limits like "not allowed to run if it would be your 3rd consecutive term"
2025-11-25 17:55:53 <@salimma:fedora.im> yeah
2025-11-25 17:56:06 <@salimma:fedora.im> 2 on, at least one off seems reasonable
2025-11-25 17:56:30 <@davdunc:fedora.im> I would think we could all use the break after two.
2025-11-25 17:56:33 <@bookwar:fedora.im> I do not like term limits , because I think setting them means making a rather risky bet on the expectations from the community, and it may lead to disaster in case it doesn't work. The approach I suggest is much safer and less disruptive, even if we will have a complete stranger somehow appearing in FESCo for one season.
2025-11-25 17:56:47 <@conan_kudo:matrix.org> it also won't work for us
2025-11-25 17:56:52 <@fale:fale.io> I also think that consecutive terms limits is way better than junior members
2025-11-25 17:56:54 <@conan_kudo:matrix.org> for the same reason it causes problems for openSUSE
2025-11-25 17:57:08 <@zbyszek:fedora.im> Conan Kudo: what won't work?
2025-11-25 17:57:12 <@conan_kudo:matrix.org> term limits
2025-11-25 17:57:17 <@bookwar:fedora.im>  On the other hand, if FESCo itself will continue to refer to my proposal as a "pity seat" or a "junior" or whatever, then the proposal will not work even if we approve it. So for me the question is mostly do I have a chance to change your minds or not. :)
2025-11-25 17:57:18 <@salimma:fedora.im> we're not saying someone can't serve again, just that they need to take a break first
2025-11-25 17:57:26 <@davdunc:fedora.im> bookwar: you raise a very good point. 
2025-11-25 17:57:41 <@conan_kudo:matrix.org> yeah, but it doesn't work, because the underlying problem is people don't feel comfortable to stand up in the first place
2025-11-25 17:57:58 <@salimma:fedora.im> I suggested in the ticket that for the transition, we don't make the entire fesco incumbents force-retire but phase it in gradually
2025-11-25 17:58:10 <@decathorpe:fedora.im> for the past few election cycles, there have always been more candidates than seats - so I don't think this would be a problem 
2025-11-25 17:58:32 <@fale:fale.io> this time around we have at least 3 new participants... but it is true we can not assume that there will always be people ready to propose themselves
2025-11-25 17:58:54 <@conan_kudo:matrix.org> I like bookwar's idea of a bucket of ranked voting
2025-11-25 17:58:59 <@salimma:fedora.im> the alternative I thought of but hesitate to suggest is to say the first-timer seat is only available if there are competitive candidates (for some measure of competitiveness)
2025-11-25 17:59:00 <@decathorpe:fedora.im> let's assume there's not enough candidates, then we could just drop the term limit
2025-11-25 17:59:00 <@conan_kudo:matrix.org> not necessarily calling them junior
2025-11-25 17:59:17 <@salimma:fedora.im> e.g. if there's only one first-timer in the race, and they didn't win outright, they can't use that to get a safety seat
2025-11-25 17:59:20 <@bookwar:fedora.im> The thing is - we should not just have a process, we should have a call for new folks that we want them here.
2025-11-25 17:59:34 <@bookwar:fedora.im> It is part technical, part marketing thing
2025-11-25 17:59:55 <@conan_kudo:matrix.org> having at least one seat that have a weight for new people each cycle
2025-11-25 18:00:06 <@conan_kudo:matrix.org> having at least one seat that has a weight for new people each cycle
2025-11-25 18:00:09 <@davdunc:fedora.im> I see that support in most every election already honestly. 
2025-11-25 18:00:11 <@salimma:fedora.im> what ranked voting? we don't really have ranked voting yet right?
2025-11-25 18:00:21 <@salimma:fedora.im> I'd love ranked voting rather than approval voting
2025-11-25 18:00:27 <@conan_kudo:matrix.org> our system is ranked voting
2025-11-25 18:00:37 <@conan_kudo:matrix.org> our system is RCV
2025-11-25 18:00:43 <@zbyszek:fedora.im> bookwar: I was no looking at the fesco voting results. The problem I see is that the ranked results are very stable. E.g. if you compare F42, F40, F38, the highest three positions are fairly stable, and some movements starts below that.
2025-11-25 18:01:04 <@conan_kudo:matrix.org> but bookwar proposes that we extend it by having a weight where one seat prefers the highest ranked new person
2025-11-25 18:01:28 <@decathorpe:fedora.im> that still smells iffy to me 
2025-11-25 18:02:14 <@zbyszek:fedora.im> Yeah, but that would would always kick out on of the people who are above the threshold, and those are actually most often the people who haven't been long on fesco or are completely new.
2025-11-25 18:02:19 <@davdunc:fedora.im> it formalizes something that i think we already encourage and that seems, beneficial to me. 
2025-11-25 18:02:46 <@zbyszek:fedora.im> In that regard, I think term limits would be better, because it'd introduce a shuffle among all positions.
2025-11-25 18:02:57 <@salimma:fedora.im> right. so making the most senior person retire temporarily is better. though if they come back they might knock out the new-ish member again
2025-11-25 18:03:55 <@zbyszek:fedora.im> I think the term limit seniority currently is Kevin, Stephen, Zbyszek. 
2025-11-25 18:04:03 <@davdunc:fedora.im> I think that the limit does also identify a good way to mitigate burnout as well, but it wasn't the original idea. 
2025-11-25 18:04:10 <@conan_kudo:matrix.org> I also would be in favor of just adding more slots to increase the range
2025-11-25 18:04:31 <@conan_kudo:matrix.org> but that could lengthen our meetings and make quorum more difficult
2025-11-25 18:04:31 <@zbyszek:fedora.im> Yeah, before every election I wonder if it's time to not run again… A break would probably be good.
2025-11-25 18:04:49 <@decathorpe:fedora.im> I took a break for 6 months a while ago, it was nice
2025-11-25 18:05:23 <@zbyszek:fedora.im> I would be -0 / -1 to adding more folks. We have trouble reaching quorum already, and full meetings are rare.
2025-11-25 18:05:57 <@salimma:fedora.im> it also makes scheduling more difficult (it's difficult enough as it is, I have a permanent conflict with an important internal meeting now that DST is over)
2025-11-25 18:07:03 <@bookwar:fedora.im> I do the similar thing for Council elections each time, and it bothers me that I have to do that decision during the nomination time based on personalities of folks in the queue for the upcoming election. This feels weird, personal, and way too involved. So one of the goals was to free myself from that personal choice, where I do not to question - should I free my seat for a newcomer, rather I should ask - do I still have the energy to run myself. The newcomer will get their seat anyway independently from me.
2025-11-25 18:08:09 <@bookwar:fedora.im> I haven't proposed the simular policy for Council because Council has only two elected seats and much bigger trouble with finding possible candidates. FESCo does seem like safer environment for this to try.
2025-11-25 18:08:20 <@decathorpe:fedora.im> hey we're looking at improving representation on fesco so that it's not always the same 8 people, here's three options we're thinking about:
2025-11-25 18:08:20 <@decathorpe:fedora.im> 1. reserving one seat for a candidate who runs for election for the first time 
2025-11-25 18:08:20 <@decathorpe:fedora.im> 2. limiting number of consecutive terms for fesco members"
2025-11-25 18:08:20 <@decathorpe:fedora.im> 
2025-11-25 18:08:20 <@decathorpe:fedora.im> because I don't think we're going to find a solution here today 
2025-11-25 18:08:20 <@decathorpe:fedora.im> what about posting something on the discussion site to the effect of "
2025-11-25 18:08:20 <@decathorpe:fedora.im> 
2025-11-25 18:08:20 <@decathorpe:fedora.im> 
2025-11-25 18:08:38 <@decathorpe:fedora.im> sorry, off-by-one-error. counting is hard
2025-11-25 18:08:57 <@conan_kudo:matrix.org> sure
2025-11-25 18:09:22 <@conan_kudo:matrix.org> keep in mind that one seat reservation each cycle means two new people each year, so that's an important note
2025-11-25 18:09:53 <@bookwar:fedora.im> Also add "3. Other ideas" and that sounds good to me.
2025-11-25 18:10:22 <@zbyszek:fedora.im> !action Fabio Valentini will post to fedora-devel and/or discussion.fpo with the ideas for discussion
2025-11-25 18:10:51 <@decathorpe:fedora.im> ha ok, I got volunteezed
2025-11-25 18:11:04 <@zbyszek:fedora.im> Right, you made a proposal
2025-11-25 18:11:11 <@salimma:fedora.im> I'd suggest putting the recommendation we prefer first on the list, but yes, eitehr way we should involve the list
2025-11-25 18:12:08 <@zbyszek:fedora.im> Yeah, I think we need a wider discussion. The problem with a limit on consecutive terms would immediate kick out all of fesco. We might want to stagger how that is introduced.
2025-11-25 18:12:10 <@decathorpe:fedora.im> ha ok, I got volunteered
2025-11-25 18:12:19 <@decathorpe:fedora.im> true
2025-11-25 18:12:48 <@decathorpe:fedora.im> "if it affects more than 2 current members, this is limited to the 2 longest-serving members" or something to that effect, maybe.
2025-11-25 18:13:04 <@zbyszek:fedora.im> please include that in the mail ;)
2025-11-25 18:13:07 <@salimma:fedora.im> 2 longest-serving members unless others volunteer
2025-11-25 18:13:12 <@fale:fale.io> this addendum makes sense, even more for the beginning
2025-11-25 18:13:13 <@zbyszek:fedora.im> Yep.
2025-11-25 18:13:25 <@decathorpe:fedora.im> +1
2025-11-25 18:13:36 <@zbyszek:fedora.im> !topic #3506 Change: BtrfsBootForCloud
2025-11-25 18:13:40 <@zbyszek:fedora.im> !fesco 3506
2025-11-25 18:13:41 <@zodbot:fedora.im> ● **Assignee:** ngompa
2025-11-25 18:13:41 <@zodbot:fedora.im> ● **Last Updated:** an hour ago
2025-11-25 18:13:41 <@zodbot:fedora.im> ● **Opened:** 6 days ago by alking
2025-11-25 18:13:41 <@zodbot:fedora.im> 
2025-11-25 18:13:41 <@zodbot:fedora.im> **fesco #3506** (https://pagure.io/fesco/issue/3506):**Change: BtrfsBootForCloud**
2025-11-25 18:14:05 <@zbyszek:fedora.im> bookwar: thank you for coming and the discussion
2025-11-25 18:14:14 <@decathorpe:fedora.im> +1 no notes approved move on? 
2025-11-25 18:14:34 <@decathorpe:fedora.im> (sorry, getting hungry) 
2025-11-25 18:15:02 <@zbyszek:fedora.im> Fabio Valentini: I don't understand
2025-11-25 18:15:15 <@zbyszek:fedora.im> davdunc: thank you for coming
2025-11-25 18:15:37 <@davdunc:fedora.im> zbyszek: I only wish I was here more frequently. 
2025-11-25 18:15:49 <@davdunc:fedora.im> *were* 
2025-11-25 18:16:16 <@jcline:fedora.im> FWIW I'm also here
2025-11-25 18:16:30 <@decathorpe:fedora.im> it's a long meeting, I'm hungry, and I want to move on ;)
2025-11-25 18:16:37 <@zbyszek:fedora.im> Jeremy Cline: thank you for being involved in the discussion too ;)
2025-11-25 18:17:27 <@zbyszek:fedora.im> Fabio Valentini: the current tally is (+1, 0, -1). Unless you mean something else…
2025-11-25 18:18:28 <@decathorpe:fedora.im> no, I mean: hurry up, man :P
2025-11-25 18:18:32 <@zbyszek:fedora.im> After reading Neal's latest comment, the listed goal can be achieved quite a bit more cheaply with much easier methods.
2025-11-25 18:18:34 <@salimma:fedora.im> so I was waiting to hear of David Duncan's usecases before voting
2025-11-25 18:18:57 <@salimma:fedora.im> but I am also curious how the BLS was updated and who get to decide on the new standard
2025-11-25 18:18:59 <@zbyszek:fedora.im> So was I, but I didn't want this to get autoapproved…
2025-11-25 18:19:08 <@davdunc:fedora.im> I want to use the btrfs-send for differential updates in digital twins. 
2025-11-25 18:19:30 <@salimma:fedora.im> "digital twins"?
2025-11-25 18:19:43 <@salimma:fedora.im> I was about to throw a procedural -1 :)
2025-11-25 18:20:07 <@davdunc:fedora.im> Michel Lind UTC: think shadow devices or devices that are updated infrequently,  think edge. 
2025-11-25 18:20:25 <@salimma:fedora.im> ah gotcha, so they periodically get synced
2025-11-25 18:20:42 <@conan_kudo:matrix.org> and authenticated btrfs data is easy to verify for synchronization
2025-11-25 18:21:02 <@salimma:fedora.im> so - similar use case to Fedora workstation too, where you can't get a complete snapshot unless /boot is also a btrfs subvolume?
2025-11-25 18:21:03 <@davdunc:fedora.im> specifically, yes. 
2025-11-25 18:21:11 <@conan_kudo:matrix.org> yes
2025-11-25 18:21:36 <@davdunc:fedora.im> trained models and related service volumes.
2025-11-25 18:21:53 <@zbyszek:fedora.im> davdunc: I think we have the wrong format for such discussion here. A long format it needed.  But in short: replication of systems always needs to be *not* copy some things, e.g. machine-id, random-numbers, other state. So some "smarts" as to what is copied always need to be implemented. Extending those smarts to copy a kernel into the right place at the right moment is necessary for other reasons too. So I don't think this use case is a convincing reason to do the proposed change.
2025-11-25 18:22:22 <@conan_kudo:matrix.org> at the same time, your reason isn't exactly a good justification either
2025-11-25 18:22:34 <@conan_kudo:matrix.org> we have already another variant of the cloud image that does maxi-ESP with UKIs
2025-11-25 18:22:36 <@davdunc:fedora.im> zbyszek: of course. 
2025-11-25 18:23:09 <@salimma:fedora.im> how about a middle ground?
2025-11-25 18:23:18 <@conan_kudo:matrix.org> and I'm not interested in chasing down all the providers again about the bugs related to large ESPs
2025-11-25 18:23:23 <@salimma:fedora.im> make this a new variant that has btrfs on /boot, in addition to the current layout
2025-11-25 18:23:26 <@salimma:fedora.im> *layouts
2025-11-25 18:23:36 <@salimma:fedora.im> if it turns out to be the most popular then the users have spoken
2025-11-25 18:23:41 <@conan_kudo:matrix.org> I mean... we _can_, but why? the existing one uses ext4
2025-11-25 18:24:03 <@salimma:fedora.im> if it unblocks this discussion
2025-11-25 18:24:13 <@zbyszek:fedora.im> Did you see my answer to this question in the discussion thread?
2025-11-25 18:24:30 <@conan_kudo:matrix.org> so we'd be doubling all the images for cloud then
2025-11-25 18:24:33 <@salimma:fedora.im> rechecking. it's been a long day
2025-11-25 18:24:54 <@davdunc:fedora.im> yes. I don't see the failure in having them both and I imaging that there won't be a compelling reason to mix them when given a choice. 
2025-11-25 18:25:05 <@davdunc:fedora.im> imaging*
2025-11-25 18:25:15 <@jcline:fedora.im> Just make it the generic cloud image? Replicating a GCP image with its agent and all that to somewhere else doesn't make sense to me.
2025-11-25 18:25:48 <@conan_kudo:matrix.org> tbh, if we did that, I'd probably make the ext4 boot one the singular one like we did the UEFI-UKI one
2025-11-25 18:25:59 <@conan_kudo:matrix.org> rather than the btrfs boot one
2025-11-25 18:26:07 <@davdunc:fedora.im> I could go for that Jeremy Cline 
2025-11-25 18:26:20 <@zbyszek:fedora.im> I think there's a cost to having multiple partitioning layouts. We have lots of trouble just doing QA on the ones we have. If we make another one, if we spend enough time to make it work, users will probably use it. But that's not a good test. We should figure out what we need, how to achieve it most simply, and not duplicate work.
2025-11-25 18:26:22 <@decathorpe:fedora.im> sorry, I really need to drop off now. I explicitly *don't* volunteer to run next week's meeting btw 
2025-11-25 18:26:25 <@conan_kudo:matrix.org> the reason we don't have flavors for UEFI-UKI is because the drivers aren't there and there's no support model for custom instance types
2025-11-25 18:26:29 <@jcline:fedora.im> And to clarify, I mean just make a generic cloud image variant with it
2025-11-25 18:26:30 <@salimma:fedora.im> I guess what it does not answer is, "who are the current maintainers" but we can continue that on Discourse
2025-11-25 18:26:44 <@jcline:fedora.im> I don't think it makes sense but at least it doesn't impact me
2025-11-25 18:27:35 <@salimma:fedora.im> I have a hard stop soon too
2025-11-25 18:27:52 <@salimma:fedora.im> if we can't conclude this today can we continue elsewhere? it probably was brought up prematurely anyway
2025-11-25 18:27:58 <@salimma:fedora.im> and unfortunately all the topics today ran long
2025-11-25 18:28:13 <@zbyszek:fedora.im> Yeah, I think further discussion would be good.
2025-11-25 18:28:51 <@zbyszek:fedora.im> davdunc: do you want to post a more detailed description of your use case in the bug? I think it's useful to have concrete usecase to discuss.
2025-11-25 18:29:22 <@davdunc:fedora.im> i will do that zbyszek 
2025-11-25 18:29:41 <@zodbot:fedora.im> salimma gave a cookie to davdunc. They now have 45 cookies, 1 of which were obtained in the Fedora 43 release cycle
2025-11-25 18:29:52 <@zbyszek:fedora.im> davdunc++ thanks
2025-11-25 18:29:55 <@zodbot:fedora.im> zbyszek gave a cookie to davdunc. They now have 46 cookies, 2 of which were obtained in the Fedora 43 release cycle
2025-11-25 18:30:27 <@zbyszek:fedora.im> !action davdunc to post a use case
2025-11-25 18:30:32 <@zodbot:fedora.im> fale gave a cookie to davdunc. They now have 47 cookies, 3 of which were obtained in the Fedora 43 release cycle
2025-11-25 18:30:46 <@zbyszek:fedora.im> !topic Next week's chair
2025-11-25 18:31:14 <@zbyszek:fedora.im> I closed like 8 tickets when preparing the agenda today, so I'm ready to take a break.
2025-11-25 18:31:24 <@zbyszek:fedora.im> A volunteer is needed.
2025-11-25 18:32:42 <@fale:fale.io> I recently did it, but if there are no takers, I can do it next week
2025-11-25 18:32:56 <@salimma:fedora.im> I can't chair until the meeting conflict is resolved
2025-11-25 18:33:05 <@zbyszek:fedora.im> !action @fale will chair next meeting
2025-11-25 18:33:14 <@salimma:fedora.im> so hopefully either the work meeting moves, or this meeting moves after the next election
2025-11-25 18:33:22 <@zbyszek:fedora.im> Fale: thanks
2025-11-25 18:33:28 <@zbyszek:fedora.im> !topic Open Floor
2025-11-25 18:33:50 <@zbyszek:fedora.im> If there's nothing, I'll close in a minute.
2025-11-25 18:34:36 <@zbyszek:fedora.im> !endmeeting