[ac] Identifying VMT members and moderation of embargo-notice ML
Now that community PR#39 has merged and https://github.com/kata-containers/community/blob/master/VMT/VMT.md officially exists, it would be good to have the Kata Containers Architecture Committee properly delegate the functions described there to an initial small team of trusted volunteers from the Kata Containers community. This delegation should then be followed by some durable reference publication (perhaps within the above document) of a list of their names, contact addresses and OpenPGP public key fingerprints both to act as a fallback reporting channel in cases where Launchpad bug filing is undesired by the reporter and also to make it possible for the public at large to verify signed notices originating from these individuals. A corresponding item has been added to the 2018-11-05 AC call agenda. The reason I'm raising this is, in part, because the embargo-notice ML Anne set up (which is intended for advance distribution of vulnerability fixes to downstream stakeholders of Kata software) is still only moderated by OSF staff at the moment. Ideally, the task of moderating this list would be handed off to the Kata Containers Vulnerability Management Team so that it serves as a final cross-check of each others' embargoed pre-KCSA notices to downstream stakeholders. If the AC wishes I'm willing to also participate as a list admin/moderator of last resort, in case there are emergency technical issues with management of the ML itself (as a longstanding member of the OpenStack project VMT I help run the corresponding mailing list it uses, so am well-versed in these matters). It would also be good to ensure that the LP project https://launchpad.net/katacontainers.io (used both for private reporting of suspected security vulnerabilities and also formal requests to become subscribers of the embargo-notice ML) is shared with the Kata Containers VMT so that they can perform the functions outlined in their published process. I'm happy to assist the AC with making those configuration changes if desired. -- Jeremy Stanley
On 2018-10-30 16:34:41 +0000 (+0000), Jeremy Stanley wrote: [...]
the embargo-notice ML Anne set up (which is intended for advance distribution of vulnerability fixes to downstream stakeholders of Kata software) is still only moderated by OSF staff at the moment. Ideally, the task of moderating this list would be handed off to the Kata Containers Vulnerability Management Team so that it serves as a final cross-check of each others' embargoed pre-KCSA notices to downstream stakeholders. If the AC wishes I'm willing to also participate as a list admin/moderator of last resort, in case there are emergency technical issues with management of the ML itself (as a longstanding member of the OpenStack project VMT I help run the corresponding mailing list it uses, so am well-versed in these matters).
Following decisions in the 2018-11-05 AC meeting, I have set the current AC members listed at https://github.com/kata-containers/community#architecture-committee as owners of the embargo-notice list until such time as they are able to delegate the related duties. I have also added myself and kept Thierry as backup list owners in case our assistance with list configuration is required. I removed the other OSF staff from the owner and moderator fields.
It would also be good to ensure that the LP project https://launchpad.net/katacontainers.io (used both for private reporting of suspected security vulnerabilities and also formal requests to become subscribers of the embargo-notice ML) is shared with the Kata Containers VMT so that they can perform the functions outlined in their published process. I'm happy to assist the AC with making those configuration changes if desired.
After gaining administrator rights from Anne (thanks!) to the https://launchpad.net/~kata-containers/+members team which maintains that project, I deactivated her account and elevated all the current AC members to administrators as well so they can maintain it going forward. I left myself and an administrator for now but will happily demote or even deactivate my account if desired. I also left Thierry's account active in case you want two OSF staff as backup administrators to help with LP project configuration. I further left Julio Montes's administrator account there for now until I can get confirmation as to how the AC wishes to proceed in that regard (i.e., whether he will be a seed member of the VMT). I also removed the explicit "all" grant to Anne's account under https://launchpad.net/katacontainers.io/+sharing so that only the kata-containers (AC) team mentioned above has access to all private and private security bug reports from this point on. I'll follow up with details on any more actions after the 2018-11-28 conference call Claire has arranged with the AC. -- Jeremy Stanley
participants (1)
-
Jeremy Stanley