09/05/2024 - Delivery Meeting Minutes

[damienjburks]

Date

09/05/2024 - 11:30 ET / 16:30 UK

• Join Zoom Meeting
• Meeting ID: 930 1013 8669
• Passcode: 432980
• Copy this meeting to your calendar
• Find your local number

Meeting notices

• FINOS Project leads are responsible for observing the FINOS guidelines for running project meetings. Project maintainers can find additional resources in the FINOS Maintainers Cheatsheet.
• All participants in FINOS project meetings are subject to the LF Antitrust Policy, the FINOS Community Code of Conduct and all other FINOS policies.
• FINOS meetings involve participation by industry competitors, and it is the intention of FINOS and the Linux Foundation to conduct all of its activities in accordance with applicable antitrust and competition laws. It is therefore extremely important that attendees adhere to meeting agendas, and be aware of, and not participate in, any activities that are prohibited under applicable US state, federal or foreign antitrust and competition laws. Please contact legal@finos.org with any questions.
• FINOS project meetings may be recorded for use solely by the FINOS team for administration purposes. In very limited instances, and with explicit approval, recordings may be made more widely available.

Agenda

• [x] Convene & roll call (5mins)
• [x] Display FINOS Antitrust Policy summary slide
• [x] Review Meeting Notices (see above)
• [x] Approve past meeting minutes
• [x] Project board walkthrough
• [x] ...
• [x] AOB, Q&A & Adjourn (5mins)

Untracked attendees

• Fullname, Affiliation, (optional) GitHub username
• ...

[robmoffat]

Rob Moffat / FINOS 🍝

[eddie-knight]

:wave: :shipit: Eddie Knight / Sonatype

[emili910]

Emil Ivanov - Deloitte USA

[psmulovics]

Peter Smulovics / Morgan Stanley

[damienjburks]

https://github.com/finos/common-cloud-controls/discussions/336 - would love to get some input on this from all who were present. Will send an email in the AM to the delivery WG distro.

Also, I will have the mtg minutes out by Monday morning around 9AM CST.

[damienjburks]

Better late than never. Uploaded the transcript to this issue: Below is the summary....

GMT20240905-153042_Recording.transcript.txt

Attendee List:

• Damien Burks (FINOS CCC - 2)
• Eddie Knight
• Emil Ivanov
• Rob Moffat
• Sonali Mendis (Scott Logic)
• Peter Smulovics

---

Meeting Objective:

To discuss updates on the delivery process for the working group's project, specifically related to automating YAML files for controls and threats, and to address concerns related to release strategies and versioning.

---

Agenda Overview:

1. Welcome and attendance capture.
2. Discussion on the progress of automating YAML files.
3. Update on the release strategy and versioning using Calver.
4. Contributions to tasks related to YAML files and control catalogs.
5. Open discussion for feedback and questions.

---

Detailed Discussion Points:

1. Welcome and Attendance:

• Damien Burks welcomed everyone and reminded attendees to input their names into the chat for attendance purposes.

2. Automation of YAML Files:

• Damien Burks provided an update on the transition from Markdown to YAML files for managing controls and threats, emphasizing the focus on automating processes to format and deliver content.
• The new approach aims to improve the efficiency of automation and ease of handling the growing complexity of controls and threats catalogs.

3. Project Updates:

• Damien Burks mentioned that the project is maturing, moving away from Markdown to YAML for greater automation. The goal is to automate the delivery process, including formatting, controls, and release management.
• The group discussed the need to create and assign tasks to ensure the automation processes are in place.

4. Release Strategy and Versioning:

• The team agreed on using Calver (Calendar Versioning) for the release strategy rather than Semver. This allows for more frequent releases without concerns for backward compatibility.
• Monthly releases are planned, with controls, threats, and other catalogs being versioned appropriately.

5. Clarifying Contributions:

• Emil Ivanov sought clarity on how to contribute and understand the delivery process. Damien Burks outlined the high-level mission and explained that tasks for contributions were still being created.

6. Addressing Questions on Common Features and Releases:

• Sonali Mendis raised a concern regarding potential discrepancies between releases when using the same feature ID with different wording in YAML files across releases.
• Damien Burks reassured that because each release is treated independently, any changes to descriptions or IDs will be part of the respective release without affecting previous ones.

7. Common Features, Controls, and Threats:

• The group discussed how to manage common features, controls, and threats within YAML files.
• Sonali Mendis suggested separating the common features, controls, and threats into distinct YAML files to avoid confusion and prevent errors during merges.
• The team agreed that separating these files would make future maintenance easier, especially as the number of controls grows.

8. Closing Remarks:

• The team decided to split the common files into separate YAML files for better maintainability.
• Eddie Knight will make the necessary changes and update the group accordingly.

---

Action Items:

1. Damien Burks to create and assign tasks for automating the YAML file process.
2. Eddie Knight to split the common YAML files (features, threats, and controls) into separate files for easier management.
3. Damien Burks to follow up with Emil on contributions and provide resources for Go development.

---

Additional Notes:

• Peter Smulovics emphasized the importance of updating the .gitignore to avoid accidental check-ins of generated Markdown files.
• The team is adopting Golang as the primary language for the automation processes.
• There will be monthly mass releases of all artifacts using Calver, and updates will be broadcast to stakeholders by the Communications Group.