=== JanC_ is now known as JanC [14:30] o/ [14:30] good morning [14:31] c_paelzer is busy, I'll be running the meeting today [14:31] thanks slyon [14:31] #startmeeting Weekly Main Inclusion Requests status [14:31] Meeting started at 14:31:27 UTC. The chair is slyon. Information about MeetBot at https://wiki.ubuntu.com/meetingology [14:31] Available commands: action, commands, idea, info, link, nick [14:31] Ping for MIR meeting - didrocks joalif slyon sarnold c_paelzer jamespage [14:31] o/ [14:31] #topic current component mismatches [14:31] Mission: Identify required actions and spread the load among the teams [14:31] #link https://people.canonical.com/~ubuntu-archive/component-mismatches-proposed.svg [14:31] #link https://people.canonical.com/~ubuntu-archive/component-mismatches.svg [14:32] c-m is looking rather clean. except for nvidia-graphics-drivers-418-server [14:33] but this is a binary update which has been in restricted before, so I guess there's nothing to do for us, and it just needs promotion [14:33] I can't recall one of these things coming up before [14:33] hey [14:34] I assume it got dropped & auto-demoted... now a new upload moved to multiverse instead of restricted. I'd leave this to the AAs to sort out [14:34] will they automatically know it needs sorting out? or would a note in #ubuntu-release be appropriate? [14:35] It shows up in the AAs reports, so they should be aware [14:35] (e.g. c-m, which is an AA report) [14:35] #topic New MIRs [14:35] Mission: ensure to assign all incoming reviews for fast processing [14:35] #link https://bugs.launchpad.net/ubuntu/?field.searchtext=&orderby=-date_last_updated&field.status%3Alist=NEW&field.status%3Alist=CONFIRMED&assignee_option=none&field.assignee=&field.subscriber=ubuntu-mir [14:36] nothing \o/ (we took it all last week :)) [14:36] #topic Incomplete bugs / questions [14:36] Mission: Identify required actions and spread the load among the teams [14:36] #link https://bugs.launchpad.net/ubuntu/?field.searchtext=&orderby=-date_last_updated&field.status%3Alist=INCOMPLETE_WITH_RESPONSE&field.status%3Alist=INCOMPLETE_WITHOUT_RESPONSE&field.subscriber=ubuntu-mir [14:36] bug #1990655 : libgit2, http-parser [14:37] -ubottu:#ubuntu-meeting- Bug 1990655 in http-parser (Ubuntu) "MIR: libgit2, http-parser" [High, Incomplete] https://launchpad.net/bugs/1990655 [14:37] didrocks: I feel like this should be status: New instead of Incomplete? ^ [14:37] it is pending security review, but good from our POV [14:38] libgit2 is for sure, I only changed the assignee, resetting to New [14:38] thanks [14:38] what do we still need for http-parser? [14:39] comment #6 suggests just security review [14:39] i dont recall we wait for anything [14:39] yeah, seems to be the same to me, joalif didn’t have any remaining concerns? [14:39] joalif: if there's nothing else, could you change the status to "New" as well? [14:40] just a really minor recommended todo [14:40] but nothing else [14:40] joalif: ok sounds good! [14:40] sure [14:40] bug #1990582 => waiting for feedback/action from the reporter, nothing to do right now for us [14:40] -ubottu:#ubuntu-meeting- Bug 1990582 in thin (Ubuntu) "[MIR] Promote thin to main as a pcs dependency" [Undecided, Incomplete] https://launchpad.net/bugs/1990582 [14:41] that's all updates for today. [14:41] I assume the MIR reviews we assigned last week are slowly progressing (I handled 2/5 already) [14:41] #topic MIR related Security Review Queue [14:41] Mission: Check on progress, do deadlines seem doable? [14:41] #link https://bugs.launchpad.net/~ubuntu-security/+bugs?field.searchtext=%5BMIR%5D&assignee_option=choose&field.assignee=ubuntu-security&field.bug_reporter=&field.bug_commenter=&field.subscriber=ubuntu-mir [14:42] Internal link: [14:42] #link https://warthogs.atlassian.net/jira/software/c/projects/SEC/boards/594 [14:42] sarnold: can you give a brief update? [14:42] there's been no progress on the security reviews, other tasks have sucked all the oxygen out of the room [14:43] we're getting very close to the end-of-cycle. Do we have any misses that we need to notify people about? [14:43] I believe I did that last week [14:43] perfect, thanks! [14:44] well, not *perfect*, but .. :) [14:44] indeed :p [14:44] #topic Any other business? [14:44] i have a couple of questions [14:44] I'll miss next week's meeting, so I shall see you in prague :) [14:44] i'm reviewing ruby-ffi https://bugs.launchpad.net/ubuntu/+source/ruby-ffi/+bug/1990570 [14:44] -ubottu:#ubuntu-meeting- Launchpad bug 1990570 in ruby-ffi (Ubuntu) "[MIR] Promote ruby-ffi to main a pcs indirect dependency" [Undecided, New] [14:45] i noticed that it makes a ffi_c.so , should there be a symbols file for this ? [14:46] also security wise it's ok according to the list, this package provides a gem to programmatically load dynamic libraries [14:46] it depends if there are external consumer [14:46] do you think it would need a security review ? [14:46] (for the symbols file) [14:46] like, if the lib internal, only for the ruby binding? [14:47] i think it's for the ruby binding not external but i'll double check [14:48] I would then check for the practice of python C bindings [14:48] ok thanks! [14:48] I reviewed ruby-childprocess, which is making use of ruby-ffi for IPC. I requested security-review, because I feel passing random data between processes should be double checked, as it could crash/DoS those processes. sarnold what do you tihnk? [14:49] so I would lean towards requesting sec-review for ruby-ffi, too. [14:49] $ apt-file search /usr/lib/x86_64-linux-gnu/ruby/vendor_ruby/ | grep '\.so$' | wc -l [14:49] 167 [14:50] slyon: yes, I saw your review that's why i'm wondering for ruby-ffi at well, thanks [14:50] there might other examples in the ruby world, though if we're looking at the pythons because we think they're more likely to be done right.. [14:50] (that was my guess in getting inspired by python, because it’s not done for the other ruby projects I checked and I think it’s better to double cross) [14:50] but from the few python examples I found, it’s the same, no symbol file [14:51] I think if they are tests importing the final product (python or ruby) module, and exercising it, it’s good enough to ensure about the ABI stability regarding the runtime? [14:52] slyon: good question; I'm more inclined to say it depends upon the type of software architecture the library encourages -- oftentimes ipc is used for things that are logically one program and this is just a detail of shuffling bytes around, so there's no boundaries being crossed. but others are intended to provide generic client-server or peers-on-a-bus architecture (like dbus) and that would be [14:52] more important for a security review, I think [14:52] re symbols : it's not just tests in this case, in any case I look into it to see exactly how it's used and what happens with other rudy libs and python [14:53] sarnold: IIUC ruby-childprocess/-ffi is basically a module, which could be used to implement both types of architecture. [14:54] This gem aims at being a simple and reliable solution for controlling [14:54] external programs running in the background on any Ruby / OS combination. [14:54] hah, yeah, that does feel like a security review would fit [14:54] if I had a dollar for every time I saw unsafe child process handling.. [14:54] sarnold: haha, thanks for the confirmation! [14:55] thanks :D [14:55] joalif: does that answer your questions? [14:55] yup all covered! [14:55] thank you all! [14:55] do we have anything else? [14:55] nothing from me [14:56] alright, thank you all! [14:56] thanks slyon, all :) [14:57] looking forward to meeting you in prague! [14:57] #endmeeting [14:57] Meeting ended at 14:57:03 UTC. Minutes at https://ubottu.com/meetingology/logs/ubuntu-meeting/2022/ubuntu-meeting.2022-10-18-14.31.moin.txt [14:57] thanks slyon, all :) [14:59] thanks! See you in Prague [18:14] Good luck to all the candidates... each of you makes this community special [19:02] * vorlon waves [19:02] o/ [19:03] https://wiki.ubuntu.com/TechnicalBoardAgenda hasn't been updated, still shows next meeting in August with sil2100 chairing [19:05] who I don't know whether is planning to make it, given that it's release week [19:07] I don't have much to report. [19:08] Third party repo requirements is making good progress, but it's all internal in the sense of the things Canonicalers need to do to get it all implemented. [19:08] I hope to be able to report back in a few weeks with a more concrete plan in terms of progress. [19:09] sounds good [19:09] For requirements B, F1 and F2 in particular. [19:10] Eeek [19:10] I think I'm late [19:10] Sorry [19:10] o/ [19:11] sil2100: hi, are you willing to chair? (wiki says you're on for it but I don't know if the wiki is just out of date) [19:11] sil2100: https://paste.debian.net/1257514/ [19:13] I could chair, I guess, just to go formally if we have any new possible action items [19:13] like you, my head is in release space this week of course [19:14] Since I suppose the rest is just progress on the two issues [19:15] #startmeeting Ubuntu Technical Board [19:15] Meeting started at 19:15:26 UTC. The chair is sil2100. Information about MeetBot at https://wiki.ubuntu.com/meetingology [19:15] Available commands: action, commands, idea, info, link, nick [19:15] #topic Action review [19:15] I suppose no sense to go through all of those, I think we already said those are still in progress [19:15] Release makes it slower [19:16] #topic Check up on community bugs (standing item) [19:16] Okay, I see no new open bugs at least [19:17] #topic Scan the mailing list archive for anything we missed (standing item) [19:17] I suppose there's no new items [19:17] I guess one minor thing there since you're the two other Canonicalers on the TB [19:18] do either of you want to open an RT so I'm not a SPOF on the UES calendar? [19:18] I think the TB elections are for next month [19:18] On the topic of the calendar, vorlon I wonder if it's easier for you to just delete the existing recurring event and we can create a fresh one that we all can edit? [19:18] I don't mind filing an RT either, but I'm not clear on exactly what to ask for. [19:18] I'm not sure if that's better or worse than the status quo, where I have granted you edit access to the recurring event [19:19] rbasak: basically, edit access to the calendar that owns this event [19:19] which I think is better than changing it to be an event I personally own [19:19] Ah I can edit it [19:19] I just fixed the meeting location [19:20] Can we edit the dates as well? [19:20] as long as you do it in the context of this recurring event yes! [19:20] Do we need anything further then? [19:21] I think this is good enough to me [19:21] Okay, I think that's it for the ML items [19:21] #topic AOB [19:21] Anything else to discuss? [19:21] Nothing from me. Thanks! [19:23] thanks! [19:28] #endmeeting [19:28] Meeting ended at 19:28:19 UTC. Minutes at https://ubottu.com/meetingology/logs/ubuntu-meeting/2022/ubuntu-meeting.2022-10-18-19.15.moin.txt [19:28] THank you! And sorry for being late, I try to finish up things at home here to get back to the releasey stuff [23:47] Community Council Election: My vote completed - finally. Thanks to José's patience and guidance :D