10/03/2024 - Delivery Meeting Minutes

[damienjburks]

Date

10/03/2024 - 11:30 ET / 16:30 UK

• Join Zoom Meeting
• Meeting ID: 930 1013 8669
• Passcode: 432980
• Copy this meeting to your calendar
• Find your local number

Meeting notices

• FINOS Project leads are responsible for observing the FINOS guidelines for running project meetings. Project maintainers can find additional resources in the FINOS Maintainers Cheatsheet.
• All participants in FINOS project meetings are subject to the LF Antitrust Policy, the FINOS Community Code of Conduct and all other FINOS policies.
• FINOS meetings involve participation by industry competitors, and it is the intention of FINOS and the Linux Foundation to conduct all of its activities in accordance with applicable antitrust and competition laws. It is therefore extremely important that attendees adhere to meeting agendas, and be aware of, and not participate in, any activities that are prohibited under applicable US state, federal or foreign antitrust and competition laws. Please contact legal@finos.org with any questions.
• FINOS project meetings may be recorded for use solely by the FINOS team for administration purposes. In very limited instances, and with explicit approval, recordings may be made more widely available.

Agenda

• [x] Convene & roll call (5mins)
• [x] Display FINOS Antitrust Policy summary slide
• [x] Review Meeting Notices (see above)
• [x] Approve past meeting minutes
• [x] Project board walkthrough
• [x] Release Candidate Discussion - https://github.com/finos/common-cloud-controls/pull/445
• [x] AOB, Q&A & Adjourn (5mins)

Untracked attendees

• Fullname, Affiliation, (optional) GitHub username
• ...

[ma-reddy]

Mahesh Adulla / Independent

[damienjburks]

Eddie Knight / Sonatype

[damienjburks]

Damien Burks / Citi

[damienjburks]

Meeting Minutes

Attendee List:

1. Damien Burks - Facilitator
2. Mahesh Adulla - Participant
3. Eddie Knight - Participant

Meeting Objective:

To review updates on the delivery working group's progress, specifically regarding the automation of metadata and the release process for cloud control projects, as well as to discuss contributions and further steps.

Agenda Overview:

1. Introduction of participants and background
2. Review of previous meeting's minutes
3. Discussion of current progress on the cloud control project
4. Review of release process, contributors, and change logs
5. General feedback and wrap-up

Detailed Discussion Points:

• Introductions:

  • Damien Burks opened the meeting with introductions and welcomed new participant Mahesh Adulla.
  • Mahesh Adulla explained his role as a consultant in financial services, focusing on cloud migrations and enablement, and expressed interest in contributing to the working group's goals.

• Review of Previous Meeting:

  • Damien Burks reviewed the minutes of the last meeting held on the 19th, noting key discussions around the MITRE Attack Framework integration, building out automation, and structuring controls for security engineers.
  • Action items from the last meeting involved enhancing schemas and documentation and automating threat mappings.

• Progress Update:

  • Damien Burks shared progress regarding the automation of metadata updates for cloud control projects, particularly focusing on the object storage service.
  • He demonstrated how the project is generating change logs and aggregating contributions for release candidates using a command-line tool.

• Clarifications from Participants:

  • Mahesh Adulla requested to keep discussions at a high-level, emphasizing his focus on program management rather than technical coding details.
  • Eddie Knight provided additional context on the next steps for the release pipeline, including generating release candidates for various cloud services like VPCs and Generative AI.
  • The group discussed the roadmap for official releases of the control catalogs in January 2024.

• Release Pipeline and Contributions:

  • Damien Burks explained the current release process for creating candidates, including metadata management and contributions tracking.
  • Discussion on automating the process further and ensuring a clean change log, highlighting only changes between versions.

• Additional Feedback and Decisions:

  • Eddie Knight and Damien Burks discussed handling contributors' logos in the release documentation. The decision was to include logos for all-time contributors, while listing current contributors by name in each version.
  • Eddie Knight noted a minor issue in the repository related to taxonomy file spacing, which was resolved during the meeting.

Additional Notes/Observations:

• The group is preparing for a January 2024 release of official cloud control catalogs, hoping to incorporate feedback from a community-based review board.
• The readiness of other working groups, such as the AI Readiness Special Interest Group, will contribute research that will be ingested into the control catalogs.

Action Items:

1. Damien Burks will proceed with PR approvals and finalize the release candidate for object storage service.
2. Damien Burks to gather and integrate SVG logos for all contributors into the release documents.
3. Eddie Knight to decouple hardcoded references from the object storage service in the repository.

The meeting concluded with plans for follow-up meetings and additional sessions to ensure progress toward the January release goal.

End of Minutes