May 2019 - Idpy-board - lists3.sunet.se

Notes: idpy Board call, 9 January 2019

by hlflanagan＠sphericalcowgroup.com

Attendees: Heather, Roland, Christos, Ivan, Mike, Leif, Chris Action items: * Heather to draft the survey text re: Note Well (assuming the board votes in February to agree to using a Note Well rather than a formal CLA) * Ivan to update the Security Incident Response plan to indicate that issues will be logged and kept indefinitely * Heather to send out a calendar invite for TIIME and a doodle poll for the call after that. Notes: 1. Signing Board Participation agreement 2. * Still waiting on legal approval to do this (Mike). Can not make any formal decisions until this is done. 3. CLA or Note Well? 4. * Expect to handle existing contributors and new contributors differently. * o We can always ask all existing contributors if they think they had permission to contribute code via the note well (rather than sign a CLA). “Here is the Note Well we’re adopting for all future contributions. D you believe you have any problems accepting this? Do you believe you might not have been able to accept it for your previous contribution?" o If individuals don’t respond, may need to consider what to do otherwise. We will send the survey, send a reminder, then start trying for personal contacts. And if none of that works, we’ll consider what code they’ve submitted and determine if we can do it a different way. Some of their code might already have been redone so we aren’t as in an urgent a situation with regards to their contribution. * What about the JOT libraries? This shouldn’t be a problem since only Roland has contributed. The OIDF might want a CLA from Roland (that is a separate conversation). * Leif strongly in favor of a Note Well (see draft here: https://github.com/IdentityPython/Governance) rather than a traditional CLA. We want it to be easy for people to contribute; there is an expense when lawyers are brought in, and lawyers often don’t understand what we’re trying to do. 5. Commons Conservancy 6. * Christos has been discussing this within GEANT. GEANT does not have a final answer regarding IPR, but should have a final answer by the end of this week. They needed clarification that all the idpy material would remain in the open source domain. 7. TIIME? 8. * Roland and Mike will not be there; will dial them in from 4pm to 5pm CET (last hour of the developers meeting) * We should create an e-vote mechanism; perhaps launch at a meeting and let it extend for 3 days for people not able to attend. * Agenda: voting on CLA, Note Well text, IPR, possibly an update from the developers meeting, talk about how to use an intern 9. Adding new projects to idpy 10. * pyFF split - the JavaScript component on the front end does not fit into idpy; that component belongs with the RA21 governance group. The backend remains part of idpy. This kind of evolution, since it’s not entirely removing the project, a Board decision. Leif withdraws his request. * FYI https://github.com/IdentityPython/IdentityPython.github.io/wiki/Adding-and-… 11. Incident Response 12. * Ivan has created the incident-response list. Ivan will add the board members to this list, as well as some of the key developers for the various projects within idpy. * o This came up as result of the following almost-bad security issue: https://github.com/IdentityPython/pysaml2/issues/578 * There should be a page on the website re: how we recognize security research. (Some researchers contact developers expecting bug bounties. We can’t pay for this, but we can offer ‘payment’ in terms of recognition.) Look at SUNET’s website for an example. https://www.sunet.se/security-researcher-acknowledgments-for-sunet-services/ * o Heather to follow up on this and add it to the website. o Ivan to update (and Chris to review) the security incident response plan to be explicit that each item is logged and kept indefinitely in GitHub. 13. Next call - Heather to send out a doodle poll for end of February/beginning of March

1 month, 2 weeks

4
4
0 0

Fwd: Re: IdentityPython Board approval to move ahead with Commons Conservancy

by hlflanagan＠sphericalcowgroup.com

Hola a todos, Michiel’s response re: license/copyright info in each file. Thanks! Heather ---------- Forwarded message ---------- From: Michiel Leenaars <michiel at nlnet.nl> Date: May 8, 2019, 8:15 AM -0700 To: Heather Flanagan <hlflanagan at sphericalcowgroup.com> Subject: Re: IdentityPython Board approval to move ahead with Commons Conservancy > Hi Heather, > > > Why does CC think having a single license file per project is > > insufficient? Our thought is that if we can avoid adding a header to > > every single file, that would be nice, esp. given we already have this > > info in the license file and we have the Note Well. > > this is not just our opinion, but something that is an industry and > community standard for legal compliance these days. When companies like > Siemens, Samsung or Honeywell use some code in one of the hundreds or > thousands of devices and systems in their product line, they need to be > able to provide the correct license and a download of the exact version. > This means machine readability too. > > To quote from https://reuse.software/practices/2.0/ : > > Scroll to the section "2. Include a copyright notice and license in each > file"... > > "Source code files are often reused across multiple projects, taken from > their origin and repurposed, or otherwise end up in repositories where > they are separate from its origin. You should therefore ensure that all > files in your project have a comment header that convey that file’s > copyright and license information: Who are the copyright holders and > under which license(s) do they release the file? > > It is highly recommended that you keep the format of these headers > consistent across your files. It is important, however, that you do not > remove any information from headers in files of which you are not the > sole author. > > You must convey the license information of your source code file in a > standardised way, so that computers can interpret it. You can do this > with an SPDX-License-Identifier tag followed by an SPDX expression > defined by the SPDX specifications." > > (the text goes on for a while after this, to clarify the point but this > is the basic gist of it) > > There is a nice Python tool to check: > > https://github.com/fsfe/reuse-tool > > I hope this makes sense > > > -- > Support NLnet, the open internet and open source with just 5 minutes of > your time. Make a difference today. Visit: > > https://nlnet.nl/help (English) > https://nlnet.nl/ayuda (Espanol) > > -- > Michiel Leenaars > Director of Strategy > > NLnet Foundation > Science Park 400 (Matrix 2) > 1098 XH Amsterdam > The Netherlands > > https://nlnet.nl > sip/xmpp: michiel [@t] nlnet.nl > > --------------- > 'If you want the Internet to grow strong, safe and free, > but you don't know how to help, contribute to NLNet: > they do know and care." > > Giorgio Maone, NoScript > > Interested what Richard Stallman, Karsten Nohl, Andy Tanenbaum and > many others have to say about what NLnet helped them do for you? > Feel your wallet tingling already? Check out: > > https://nlnet.nl/donating/quotes.html >

6 years, 6 months

2
1
0 0

Updating the idpy.org website, pyOIDC, and pyJWT

by hlflanagan＠sphericalcowgroup.com

Hola a todos! I’ve updated the idpy.org website with pointers to the idpy statues as held by the Commons Conservancy, as well as the pointer to how to add/remove projects (also officially recorded at CC). As I was doing this, I noticed the following: Other projects are still under consideration: • pyOIDC • pyJWT Should these be removed as being under consideration at this point, given the code now under OIDF’s care? Thanks! Heather

6 years, 6 months

2
3
0 0

Notes: idpy Board call, 7 May 2019

by hlflanagan＠sphericalcowgroup.com

Attendees: Roland, Mike, Heather, Leif, Chris, Christos, Ivan 0) Agenda bash 1) Governance status - Note Well approved 1 May 2019 Heather has sent a copy to the discuss list, and added a link to the idpy.org <http://idpy.org/> website. - MoU with OIDF - status Mike will ping the OIDF people - Commons Conservancy next steps Michiel of CC suggests doing more to make copyright attribution more blatant. Their best practice: https://commonsconservancy.org/faq/licenseinfo/ <https://commonsconservancy.org/faq/licenseinfo/> In general, good to have either ra single file in the root folder of a repository to capture the license and copyright for the whole project (and possibly the exceptions) or have something in each individual file. Right now, we have at least a license file in each repository. Satosa also has a notice file. Our response could be that we’ve considered that approach, but we have the Note Well and the license files now, and consider that enough. Action: Heather to ask CC why they think having a single license file per project is insufficient; if we can avoid adding a header to every single file, that would be nice, esp. given we already have this info in the license file. Action: Heather to post on the idpy.org <http://idpy.org/> website that we are now a project in Commons Conservancy. 2) Development Update (Ivan) Satosa concerns were raised by a member of the community. The board should talk about whether we have sufficient resources for this (and other) idpy projects to make them successful. See Ivan’s response to this particular concern here: https://lists.sunet.se/pipermail/idpy-board/2019-May/000057.html <https://lists.sunet.se/pipermail/idpy-board/2019-May/000057.html> Projects are always open to more volunteers, but there is a bottleneck in terms of having the big architecture picture in order to review and approve code. Suggest we take this back to the developers call about how to resolve. If there is a resource problem, is there a specific ask to the board? Is there a request for more resources? Need clarification. Worth noting that quite a number of PRs have been reviewed and accepted, so work has been happening. Suggest we ask the developers how often a release should happen, and who can help review the code. Developers had come up with a plan for releases and tagging, but need to finish merging open PRs to get to a steady baseline. https://github.com/IdentityPython/IdentityPython.github.io/wiki/Branching-a… <https://github.com/IdentityPython/IdentityPython.github.io/wiki/Branching-a…> If resources are needed, suggest using Hannah temporarily if that would be helpful. Need guidance on what skills are needed to move projects along if we’re going to find more resources. Ivan would appreciate help with documentation (e.g., use cases as collected at TIIME, ready-made docker or vagrant files where we can set up the flows for the use cases). The hardest part is keeping in mind the bigger picture against the changes people propose to the project design. For the developers call: more releases, or more stability? Action: Heather to send out a doodle poll to set up a idpy dev call for a time other than the normal Tuesday 14 May call. If there is a specific request for a particular kind of resource that comes out of the developers meeting, Heather will bring that back to the board. 3) Meeting at TNC19? Full idpy board will meet for drinks/dinner on Sunday evening. Schedule for after speakers reception. Heather to coordinate 4) AOB Regarding the number of projects listed in GitHub, there are three repositories for the federation work, but Roland works in just one. If those three repositories need to be reorganized, that’s up to the lead developer of the project. Just send an email to the list of the changes as an FYI.

6 years, 6 months

1
0
0 0

Fwd: for the IdPy board

by hlflanagan＠sphericalcowgroup.com

> Begin forwarded message: > > From: Ivan Kanakarakis <ivan.kanak at gmail.com> > Subject: Re: for the IdPy board > Date: May 7, 2019 at 8:06:12 AM PDT > To: Heather Flanagan <hlflanagan at sphericalcowgroup.com> > Cc: Scott Koranda <skoranda at gmail.com>, Leif Johansson <leifj at sunet.se> > > Hi everyone, > > > On Tue, 7 May 2019 at 15:07, Heather Flanagan > <hlflanagan at sphericalcowgroup.com> wrote: >> >> Thank you for the feedback, Scott. There is a board meeting later this morning; I will make sure to bring this up then. >> >> Thanks! Heather >> On May 7, 2019, 4:00 AM -0700, Scott Koranda <skoranda at gmail.com>, wrote: >> >> Hi, >> >> It has been almost two years since there was a SATOSA release, and there >> are a number of PRs that have been holding. >> >> Everybody is busy, so I do not know what I expect the board to do, but I >> think the board should at least chat to see if there are any structural >> or other changes that could be made to help SATOSA mature faster. >> >> I really want (need) SATOSA to succeed, so please take this request in >> the positive and forward looking spirit in which I intend it. >> > > The plan is to fix pysaml2#579 and pysaml2#597, then revert SATOSA > bd4303abfc9220dd6b701a23fc522adadbad10b1 and have a new release :) > The reason for this is that I don't want to have those options in > SATOSA and then remove them (a breaking change on an official > release). > > https://github.com/IdentityPython/pysaml2/issues/579 > https://github.com/IdentityPython/pysaml2/pull/597 > https://github.com/IdentityPython/SATOSA/commit/bd4303abfc9220dd6b701a23fc5… > > This needs some work, but I think the hard part is done. I need to > cleanup the modifications I have locally, and make sure the changes > work fine. > > > Cheers, > > -- > Ivan c00kiemon5ter Kanakarakis >:3

6 years, 6 months

1
0
0 0

Fwd: for the IdPy board

by hlflanagan＠sphericalcowgroup.com

Feedback from a community member for us to discuss today. Thanks! Heather ---------- Forwarded message ---------- From: Scott Koranda <skoranda at gmail.com> Date: May 7, 2019, 4:00 AM -0700 To: Heather Flanagan <hlflanagan at sphericalcowgroup.com>, Ivan Kanakarakis <ivan.kanak at gmail.com>, Leif Johansson <leifj at sunet.se> Subject: for the IdPy board > Hi, > > It has been almost two years since there was a SATOSA release, and there > are a number of PRs that have been holding. > > Everybody is busy, so I do not know what I expect the board to do, but I > think the board should at least chat to see if there are any structural > or other changes that could be made to help SATOSA mature faster. > > I really want (need) SATOSA to succeed, so please take this request in > the positive and forward looking spirit in which I intend it. > > Thanks much, > > Scott K

6 years, 6 months

1
0
0 0

Agenda & Reminder: idpy Board call, 7 May 2019

by hlflanagan＠sphericalcowgroup.com

Agenda: 0) Agenda bash 1) Governance status - Note Well approved 1 May 2019 - MoU with OIDF - status? - Commons Conservancy next steps 2) Development Update (Ivan) 3) Meeting at TNC19? 4) AOB ---- BlueJeans info: Meeting URL https://bluejeans.com/471426075?src=join_info Meeting ID 471 426 075 Want to dial in from a phone? Dial one of the following numbers: +1.408.740.7256 (US (San Jose)) +1.408.317.9253 (US (Primary, San Jose)) (see all numbers - https://www.bluejeans.com/premium-numbers) Enter the meeting ID and passcode followed by # Thanks! Heather

6 years, 6 months

1
1
0 0

2025

2024

2023

2022

2021

2020

2019

2018

Idpy-board May 2019