-
Notifications
You must be signed in to change notification settings - Fork 122
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
doc: add meeting minutes 2023-04-13 (#969)
Related: #961 ----------- Co-authored-by: RafaelGSS <[email protected]>
- Loading branch information
1 parent
6d54935
commit 9454a25
Showing
1 changed file
with
82 additions
and
0 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,82 @@ | ||
| # Node.js Security WorkGroup Meeting 2023-04-27 | ||
|
|
||
| ## Links | ||
|
|
||
| * **Recording**: https://www.youtube.com/watch?v=6lpxKOL-PwQ&ab_channel=node.js | ||
| * **GitHub Issue**: https://github.com/nodejs/security-wg/issues/961 | ||
|
|
||
|
|
||
| ## Present | ||
|
|
||
| * Ulises Gascon: @ulisesGascon | ||
| * Marco Ippolito: @marco-ippolito | ||
| * Yagiz Nizipli: @anonrig | ||
| * Michael Dawson: @mhdawson | ||
| * Rafael Gonzaga: @RafaelGSS | ||
|
|
||
| ## Agenda | ||
|
|
||
| ## Announcements | ||
|
|
||
| *Extracted from **security-wg-agenda** labelled issues and pull requests from the **nodejs org** prior to the meeting. | ||
|
|
||
| - [x] Vulnerability Review - https://github.com/nodejs/nodejs-dependency-vuln-assessments/issues | ||
| * We’ll drop v14 support and include Node.js v20 to this action | ||
| * There is a new OpenSSL low vulnerability | ||
|
|
||
| - [x] OpenSSF Scorecard Monitor Review - https://github.com/nodejs/security-wg/pull/965 | ||
| * Binary artifacts need to support whitelisting for the test fixtures case | ||
| * New visualization tool in place, next release will include commit hash reference (immutability) | ||
| * Many changes happened in Node.js but the total impact in the repo is -0.3 points | ||
| * Ulises will invite the Scorecard maintainers to the next meetings to provide them feedback and share with the WG the next iteration planned with the scoring system | ||
| * Ulises will include the link to the StepSecurity Beta Dashboard in the report for Node.js Org | ||
|
|
||
| ### nodejs/security-wg | ||
|
|
||
| * Initiative for CII-Best-Practices for Nodejs Projects [#953](https://github.com/nodejs/security-wg/issues/953) | ||
| * good discussion/sharing of existing answers - https://bestpractices.coreinfrastructure.org/en/projects/29#all | ||
| * We’ll review all the three PR async | ||
| * The entry-level might need a single adjustment (code static analysis), the rest looks good | ||
| * Ulises will lead the initiative. | ||
| * The documents will be relocated to the Node repository as soon as it is ready | ||
|
|
||
| * Assessment against best practices (OpenSSF Scorecards ...) [#859](https://github.com/nodejs/security-wg/issues/859) | ||
| * No news | ||
|
|
||
| * Scorecard Review [#937](https://github.com/nodejs/security-wg/issues/937) | ||
| * closed | ||
|
|
||
| * Improve Node.js Scorecard [#929](https://github.com/nodejs/security-wg/issues/929) | ||
| * Published the updates in the issue | ||
|
|
||
| * Permission Model - Roadmap [#898](https://github.com/nodejs/security-wg/issues/898) | ||
| * Possible some work on the relative paths in the C++ side next week | ||
|
|
||
| * Improve SecurityWG Scorecard [#884](https://github.com/nodejs/security-wg/issues/884) | ||
| * Published the updates in the issue | ||
| * It will great to have some community support for Fuzzing | ||
|
|
||
| * Automate security release process [#860](https://github.com/nodejs/security-wg/issues/860) | ||
| * We are discussing it internally at Node.js TSC to get someone to work on this | ||
|
|
||
| * Discussion about policy-integrity integration on Windows [#856](https://github.com/nodejs/security-wg/issues/856) | ||
| * PR created https://github.com/nodejs/node/pull/47609 | ||
|
|
||
| * Automate updates of all dependencies [#828](https://github.com/nodejs/security-wg/issues/828) | ||
| * The initiative is almost done. | ||
| * Marco will work in the documentation in details for this process | ||
| * Marco will start a discussion to backporting this process to other Node.js versions | ||
| * Marco requested access to the Github Action team | ||
| * It will be require to review if any dependency is missing from the list | ||
|
|
||
| ## Q&A, Other | ||
|
|
||
| * Yagiz Nizipli will be in parental leave. He want to ensure that Ada can keep doing releases in cases that any urgent/security release is needed. We agreed to promote the Ada related issues in Node to the fastrack when needed. | ||
|
|
||
|
|
||
| ## Upcoming Meetings | ||
|
|
||
| * **Node.js Project Calendar**: <https://nodejs.org/calendar> | ||
|
|
||
| Click `+GoogleCalendar` at the bottom right to add to your own Google calendar. | ||
|
|