Attendees & Representation (default sort: member first name)

TAC Members and Project representatives should mark their attendance below 

• Community:

Agenda

• We will start by mentioning the project's Antitrust Policy, which you can find linked from the LF and project websites. The policy is important where multiple companies, including potential industry competitors, are participating in meetings. Please review and if you have any questions, please contact your company legal counsel. Members of the LF may contact Andrew Updegrove at the firm Gesmer Updegrove LLP, which provides legal counsel to the LF.
  • Antitrust Policy
• Roll Call
• Check Action Items & Topic Requests
• General Topics
  • 2024 Priorities
  • Security discussion
    • Create an LFN security scrum of scrums
      • Purpose: educate LFN projects on the LFN security guidelines
      • Frequency of meeting: monthly for first 6 months; quarterly after that
      • Governance: update Tony Hansen's ONAP OpenSSF dashboard to include all LFN projects; require all LFN projects to fill out OpenSSF report
      • Future: back up attestation with testing
    • LFN support of security
      • LFN provides static application security testing (SAST) and software composition analysis (SCA) tools and onboarding support for project
      • LFN pipelines create vulnerability reports to accompany each release: list vulnerabilities in project created code and known CVEs in 3rd party packages
      • Future: LFN tooling creates Jira ticket per code vulnerability and package vulnerability
    • LFN release certification
      • Add suffix to the release indicating lifecycle phase of the project and release
        • Example: name-version-incubation, name-version-sandbox
        • LFN TAC approves of version suffix
      • Provide bug report as part of release notes (fixed and open)
  • CNF Conformance 
• Any Other Topics

Action items

Minutes

Topic 1

• Comments

Topic 2

• Comments