Hi all, Topics we discussed today included an explanation of the CVE fix process, an evaluation of the OS recommendation documentation, a discussion on some options about releasing el8 packages for the upcoming quincy point release, and CEC election results. Here are the highlights from today's meeting: - Existing CVEs and fix/release process [Ernesto + Sage + Yaarit]: - Sage: Better to build things into the process instead of a hotfix (exception for serious situation) - Revising CVE reporting process to use github - https://docs.ceph.com/en/latest/security/process/ - [zdover] os-recommendations.rst possibly out of date -- who is the authority on which distros are supported? - add squid: centos 9 (AH), ubuntu 22 (AH), debian 12 (C) - Is Debian 12 supported in Reef? - i think so, based on https://download.ceph.com/debian-reef/dists/bookworm/ --[zdover again]: that was exactly the source upon which I based the question. So I think I have all the information I need. - [cbodley] should quincy release block on centos 8 or no? - Blocked on adding back a centos 8 builder to our matrix - Community members have managed to build packages- could we point to these? - CERN archives is another option - If we drop in packages/containers built outside of the usual upstream build process, how confident are we that these artifacts will be functionally identical to what we would have built ourselves? cf. the issues seen in the past with Debian/Ubuntu-channel builds. A build done by a community member might have different compilation options, directory paths, non-stock libraries etc. - Will meet later on this with Dan Mick - Election: - Results: https://vote.heliosvoting.org/helios/elections/e03494ce-e04c-41d0-bb05-ec5cc... - Governance Update: https://github.com/ceph/ceph/pull/60518 - https://pad.ceph.com/p/css-vote-2024q4 Thanks, Laura -- Laura Flores She/Her/Hers Software Engineer, Ceph Storage <https://ceph.io> Chicago, IL lflores@ibm.com | lflores@redhat.com <lflores@redhat.com> M: +17087388804