Table of Contents

Date

Oct 24, 2017

Agenda

Attendees

Actions items from previous meetings

Add new action items here.

Meeting notes

The members reviewed the Linux Foundation's template open source request form and discussed which items were relevant to their processes.

A common process discussed is that open source components are reviewed once upon importation to internal repositories (e.g. Artifactory). Requests are made via a ticketing system like Jira. Developers aren't required to provide much information in their requests. The open source review board become the de facto owners of the open source components after approval, so it's incombent on them to do appropriate dilligence. The information stored about each component includes: owner, whether approval is for production or non-production (i.e. distributed or hosted) use, and any vulnerability information. There is then a less rigorous approval process for version updates. OSRB tracks where packages are deployed geographically because that impacts regulatory concerns. There was agreement that it would be useful to collect information on which clients are affected by each components, for security notification purposes.