OpenSSF Securing Critical Projects WG, 9 Mar 2023

Previous Meeting Next Meeting

⏯

youtube image

►

From YouTube: Securing Critical Projects WG (March 9, 2023)

Description

Agenda: https://docs.google.com/document/d/1MIXxadtWsaROpFcJnBtYnQPoyzTCIDhd0IGV8PIV0mQ/edit?usp=sharing

A

B

The meeting notes for this meeting are not open.

C

Hey Jonathan, oh, what do you mean they.

B

Are currently locked behind you can't access this. You can't even view them.

A

B

A

I can't even view them.

C

Can you double check here and now in this group Oh weird I.

B

Can access them now great?

B

um This is the March 9th meeting. Yes, yes, can we do do you guys do opens.

C

uh So we normally do but right now we're on our like schedule for doing the list, um so we wanted to spend the whole meeting on voting and consensus. Okay,.

B

Great I wanted to trash your schedule with the with it with a particular topic.

B

um The alpha omega project has a top 10 000 projects list that we're using to identify and use as a as a basis for reporting vulnerabilities to um and I'm working on, a specification under the open source security foundation for a policy called the um uh specification. It's the open source security Foundation compliant automated vulnerabilities fix campaign Define. What is a what is considered a an automated security vulnerability, fixed campaign that is compliant to a specific standard that has the open source security, Foundation seal of approval. One.

A

B

The lines in that is um mandatory private disclosure um that the top 10 vulnerable projects within the 10 000 critical, open source projects of some list, which I was discussing using the AO list, um but I thought that you guys have the 10 000 list. But apparently the 10 000 list is an AO list, not a not a you guys list um would be required to disclose to those private to those products privately as part of the specification and apparently I found out. That list is not owned by this group.

B

It's owned by the AO group and so I was discussing with scovetta saying. Do we want to take this AO list? That is what we consider the top 10 000 list and move it under this working group. Or do we want to consider and continue to own it as as an ale list, specifically.

C

Yeah I think that's a good topic.

B

A

B

um Yeah, so that's that's the current question, but you guys have things on your schedule as it is so.

C

Yeah, so you can um I was talking to Caleb Caleb had a question too about the the schedule. So, if you want put it, you know, send an email on the emailing list. We don't have much there and otherwise we can just add it to the next. The next meeting.

B

C

All right, the next meeting- that's open, yeah I, should say when.

B

Is the next meeting that will be open that doesn't.

C

It depends on how fast this goes right, so we have we we put set aside two meetings for updating the list and then a third meaning for finalizing it. I, don't know what that means, uh but yeah faster. We go the more the sooner we can get back to the.

B

So you're doing just top 10 that your top 100 projects.

C

We don't have a set number, but I think it's around there like right now. Our list is about 100, but we're looking to add some so so.

B

These are the top, so these are okay, so these are not most critical projects overall. These are this: the top 100-ish.

C

And I wouldn't say top either because uh we're not something not being on the list is not saying that it's not critical. It just hasn't been proposed and considered yet so interesting.

B

C

um Cool I see a few people here, thanks for for joining.

D

B

You've been you've had a influx of all of us because we were discussing this in our last meeting. I'm I'm.

D

Really interested and excited to be, you know joining so.

C

Yeah thanks for joining so yeah we'll um the meeting notes are the link to the meeting notes are in the uh calendar, invite um we'll go through some new faces and then um get to today's meeting, which is uh all about uh working on our V 1.1 list uh for the set of or list or set of critical projects, and we have a set of uh proposals and we're going to go through those one by one and reach consensus thanks everyone for joining, um but yeah new faces other than how to pronoun.

C

You mentioned it here, you're new.

E

I'm excited I I've been here in the past. Most of you know me, but I lead.

F

Thanks for joining Mike, Chris.

C

um Before we dive in I just wanted to do a quick update that this is uh the last Apec friendly meeting at this time, because daylight savings is changing. So in four weeks when we get to the new uh the next Apec friendly meeting time, it'll be the the old time that we had before daylight savings or back to Daylight Savings um yeah. So, let's dive in Amir did you have anything you wanted to say.

F

No I'm excited to dive in um I. Don't know if you wanted to share your screen. um Yeah.

C

Any of us could do it. Does anybody want to be the Scribe and share their screen.

F

I can be, I can do it. I can be at least one of them if anyone else would like to also pull it up and make updates. But let me share screen yeah.

C

And so I guess the first question is: we've got two lists: we've got our uh 1-0 list that we're going to consider for removals, and then we've got our candidates list to consider for additions. uh Any thoughts on which one we want to do. First.

A

um There you go.

F

Okay, um I think I have my screen up in the right place. Yeah.

C

It looks good okay,.

F

All right uh do you want to just dive in from uh from row two.

C

Yeah and so the way it works here is we want to just. Have anybody speak up with uh a yes or no, and maybe we can argue against or for it.

B

I'm gonna do top down or just start anywhere in the list. It's currently visible. It's.

C

Top down so we're going to discuss one at a time. So right now we're add Miner.

F

Add minor, so this was from Docker pull count data originally when it was recommended. I, don't know a ton about the project personally, but um I don't know if anyone else has thoughts.

E

So so so adminer is a closest of a database Management in a single PHP file. So an alternative to phpmyadmin.

E

um I'm shocked at the docker pull count that that's so High um like on the same category as like Amazon Linux,.

F

Yeah I mean that's a pretty big statistic. Just from the.

E

um But like, let me see.

E

I mean it was last touched in almost two years ago.

G

F

That might be uh in favor of maybe wanting to put some uh Spotlight on it with the putting it on the set.

E

Yeah I mean it's also a single developer project. um The other thing I are. We sure that that Docker pull count is correct.

D

C

A

E

No that's 100 million, plus.

E

I would I would vote to not call this one top hundred, because I feel like the likelihood- and this is just I- have data to support this, but I feel like the likelihood that governments, large organizations, critical infrastructure Etc would be using. This is um really small but smaller than a lot of the other ones. On the list.

D

E

Doesn't seem super satisfying, but.

C

Yeah so we're looking at like you know what would be the the blast radius right and if it's people doing single, you know single developer projects or small toy things, then I think it's a good um argument for.

G

Not not adding it yeah, okay,.

C

uh Do we have that idea here? Is that it is more, for you know, building a toy PHP site, or is this something that people could use on kind of big or more important deployments.

B

Key question here has.

A

B

Here been a PHP developer.

H

Does anyone want to admit okay.

B

Fine has anybody developed any PHP recently.

H

Not recently, okay.

B

I think that nobody in this group is is uh a currently um I. Don't know it seems, like the knowledge base of this group, does not sufficient to accurately assess this project.

C

Yeah I mean we do have to work with what we have. We can't say no for now, you know basically like we didn't have any evidence.

F

Yeah, but based off of Michael's description, I would say this. This could be a no for v1.1.

E

I mean I'm, also seeing just from the bugs, and the pull requests um like there just doesn't seem to be I, don't say any activity, but.

C

So one move consensus. No anybody disagree.

A

C

All right feel free to use uh emojis or whatever, as well all right, I, don't see any disagreement so move on.

D

F

um We have Alpine next.

E

I'll vote. Yes um Alpine is a core based package for countless other Docker containers. If that, if that goes goes sideways, um lots of things are on fire.

E

F

F

F

All right: next, we have Amazon Linux.

C

So um I'm gonna throw out a no here, uh I think that Amazon Linux, like you know, we have the Linux kernel um all the important packages in Linux. We would we would consider, but what? What I think? What listing the the distribution here would really be describing like the I, don't know what Amazon Linux is based like if it but like, is essentially describing like the RPM uh spec files and build systems for creating the distribution and um I.

C

Don't think those are I, don't even know if I didn't even see them on the GitHub page, like I, don't know where they were where they are I, don't know how much I could contribute to that and um uh no I'm getting some background noise from you.

C

um Yeah, so that's just my thoughts. Does that make sense.

H

Sounds good to me.

F

I'd say that makes sense, but another thought is when we think about blast radius. I think like if aw If, This Were, to take AWS down I mean how much of the web with that disrupt.

C

Again, I think, like the question is: what is this, you know? Is it something that's in the packaging and like? Is that even visible to us or to it? You know, is that even something that we that can be contributed to or um I.

E

I would put Amazon Linux in the same kind of in the same category as WSL um like these are, while they they may have here open source. These are corporate projects, yeah.

E

I feel like I would put Android in the same category.

E

B

I struggle with this because at a certain point, any sustainable, open source project ends up being backed by an organization right because, if you're gonna spend, if you're not developers, spending their full-time developing that project, there needs to be developers that are paid by someone to do that work.

B

And so, if you do that, that, like you, know, immediately knocks out if you're, if you're going on the basis of it's got corporate backing that knocks out Android Gradle curl, um because that's curls being maintained by you, know a maintainer who is being paid by a company to maintain curl, like you know like that. I! Don't think that that's a good reason to disqualify a project.

G

E

uh I I agree, um but curl.

E

Dot net is while it is an open source project. It is primarily well I'm going to get in trouble by the lawyers. If I say this, um it is obvious to everyone which large corporation manages.net in in, like layman's terms, um should.net be on this list. I would also argue no for first, for the same reason that, like it's a it's a.

E

It is a product more than it is a project, a.

B

uh It satisfies it's open source. It's critical. It has a blast radius right, like yeah.

C

I would argue that both Android and net are critical and I. Think that Jonathan you're right, like I, don't think that um being primarily developed by one company should disqualify it. But I think this Amazon Linux is a different case here, like the the the the files and projects, and you know the the code that makes up a distribution I think that's not what somebody had in mind when they added this here.

C

I think that the distribution is like the packaging and the scripts and the build uh the decision of like which which to include and I don't I, don't know that that's an actual open source project.

C

um You know I I, I'm, saying no here, not because it's an Amazon product, but because the the distribution itself isn't a a thing that you know makes up whether it's critical or not, and also is something that is, uh that can be contributed to.

E

That makes sense to me so I.

G

Mean in looking at.

E

The repositories under GitHub slash, Amazon, Linux I'm, not I'm, not seeing like the giant repository of all things. Yeah.

C

E

B

The Linux there's the fork of Linux yeah.

C

They have a fork of the kernel and the kernel. You know the Upstream is critical.

F

Okay, um so then what was this consensus on Android.

A

C

Would say it is too yes.

A

A

F

Next, we have Apache httpd.

F

B

Popular or was at one point, the most popular HTTP server on the internet.

A

B

It's open source, I, I, think that qualifies yeah.

F

I think that's what.

E

It shows now: oh yeah, it's still 32 slightly behind the nginx yeah so and.

B

Also nginx should be on this list, which I'm presuming is under n.

F

Ope I'm pretty sure it is yeah yeah. um Next we have arm trusted firmware. This was from a GitHub issue that someone recommended.

F

I mean isn't this in like every like all Hardware, practically almost all the hardware in the world. That might be too much of a blanket statement, but it's ubiquitous I think arm chips.

E

Is it? Is it open source I mean I know the source is available freely, but is it actually open source.

D

I

And is this the firmware that people use.

C

Bsd3 closet says.

I

Okay, is this the firmware that anybody uses either Dave wheeler sorry I've been trying I'm trying to.

A

C

Able to do these.

I

At once, yikes.

I

B

How are you pulling that off two.

I

Meetings at once uh go to one then go to the other. I have no better assistant.

I

You know shoot shoot my shot and then run away before anybody can fire back.

I

All right, okay, uh the description actually answers my question: it runs on every Arm based Android device, wow.

C

I mean I think if we're gonna trust the um submitter, which I think we should um I would vote Yes.

I

I, don't have any different information and that answers we've just answered the two key questions. Is it OSS? Yes, is it widely used, at least according to this? Yes and frankly, I mean our I know that there are non-arm based Android devices, but the vast majority of Android, just by itself. That tells me billions of devices. We we care.

A

F

Another one from uh suggested from GitHub, okay,.

I

Yeah, but this one doesn't have a rationale in turn: I mean it's a description, but it's not a justification. There are many I mean you know. Many people have written small boot loaders. The question is: how widely is this used.

D

I

I, don't have good answers for that information.

C

uh The mailing list seems to be pretty busy.

I

Yeah, that's not.

C

No, they do patch over the mailing list.

E

It looks like it came from you boot V2 as it was derived from Doss. You boot.

I

The question is: what is widely used now, I'm, looking at an article by the new stack granted, it's 2020, not 2023, but I don't really find a I'm having trouble finding better sources.

I

um I mean it claims that uboot is by far and away the most common.

C

I

I I guess I would initially say. Probably do you boot first, if we do any boot any a Bootloader for an embedded by the way these are bootloaders for embedded systems, as opposed to say grub, which is a different thing, is Grub's already in our list right.

C

The distractions.

I

um Yeah I would say: I would want you boot first, just with the I mean granted. This is a positive information. uh You know I probably should be in the spreadsheet. Everybody else is looking out shouldn't I.

A

C

This is yeah. The same issue suggested you boot. It's it's going to be further down.

I

I

All right, I'm just going to type in whoops how come that's not typing in copy.

I

C

So I'm taking a look at the original issue and like bootloaders, is listed as a category like these things are important and the first two are you boot and Grub, and then it's this one. Third, so I would say: let's go I mean so I would just say. Let's vote I mean my vote is no I guess and then, if we get any more evidence that this is also like, that's why it uses the other two. Then we can reconsider.

E

G

Sounds right to me.

I

C

So consensus or anybody have any reason to say yes.

D

I I'll agree with no.

A

I

Right and you'll notice, I'm adding an actual justification I think we ought to try to do that. Yes,.

F

I

I realized we're recording this, but uh those are rather painful to hunt through.

F

G

I

Match I thought I commented on this: is that not I? Don't.

A

F

I

Is uh where are the oh here we go yeah uh I proposed yes, but the question is for why and basically I think. The primary thing I would worry about is both subversion of the project and ensuring that oh I can't easily see the text um uh let's see here and making sure that, if it handled when it handles malicious data, it won't cause problems.

I

um So there's some weird you know, so there are some um uh things that you can easily misuse and shell, but they're required by the standards and really not changeable. Now, uh like you have to double quote, you know, if you say Dollar Food for a variable reference, you have to put double quotes around it um or it might just suddenly start executing that's bad, but required by the language.

I

um On the other hand, if you put the double quotes around it and it ran some code anyway, just because it referenced it. That would be really really bad, so I think the answer is yes because of wide use, but the focus should be on those aspects, because if somebody just hands an arbitrary bash shell to somebody, um you know the fashion. The fact that bash can run code isn't a problem. That's the whole point.

E

Yep agreed, okay.

I

All right, so let me put that there I'm going to copy my own text well, unless I can, if I can yikes, why can't I do that.

I

F

Got you David.

I

All right, I, oh there, we go.

I

And you don't need my name there. I think this is that a group consensus.

F

When I first saw that David I thought you were trying to be like duh like, of course, this should be on.

G

F

And then I realized. It was your initials. Oh.

G

I

I, pretty much always use my middle initial uh when in anything written because there's too many David wheelers and it gets even worse with initials. So that is my attempt of being clear bit.

F

I

A

F

Yeah I mean worse password management solution.

I

um I think yes, I mean that's a I mean uh there are some other open source, uh password managers and obviously there are some proprietary ones, but if if LastPass has taught us anything, the answer is password managers matter.

D

I would strongly agree.

I

So how about can I say? Yes, uh LastPass has shown that pass. Word managers matter.

H

I'd also add that um I get the feeling that a lot of people moved off LastPass a bunch moved to bit Warden as well.

I

um Yeah yeah I think I think a lot of people move to either bit Warden or LastPass I think so. The short answer is yes, I think you're correct.

C

Any arguments against.

E

Warden, because bit Warden is like commercial open source so right it, but the the open source version is open source yeah.

B

There's no one's ours. Yes, there's open sourcing freely available in into perpetuity and will never be closed. Source perfect.

I

That's what they that's, what they're promising.

B

I

What you're paying for is a service if you run the service which is optional so but I think it's it's fair to say you know now I I think right now what we're arguing is. Are they critical, I think there's going to be a separate pass for you know if there's existing commercial support, if you know, there's we'll probably expect them to do the say, pay for an audit, uh but we can still contact them, for example, and say Hey, you know here's some things you can do. You know you know we.

I

We will I, think there's a separate pass for where funding goes. If funding goes somewhere and I'm assuming this, isn't it.

I

I, don't know, maybe maybe we should have a separate column, for you know, has commercial support.

I

C

Who knows about 80k too?.

I

I do not. This is what I skipped I tried to answer for some, but I did not make an attempt to answer everything.

I

Firmware development for UEFI and Pi specs.

I

A long time ago, I was more in the embedded space, but it's been too long. My knowledge is due obsolete.

I

Is it possible for us to skip or we need more information, I guess.

D

I

Think we need more information about it. uh How widely it's used or do we not it doesn't matter it's an SDK. It's not the thing itself.

C

Yes, I propose that um we get come up with the yes or no here, and some knows you know are going to be things that can be reconsidered in a future version with more evidence or if we have more automation for pulling evidence.

C

I

I

I guess it's I guess the problem is it's unclear? How widely used and important it is. Is that part of the problem.

F

I

um It's unclear Whitely used. It is it's um okay,.

C

You know I think.

I

That's actually enough.

I

All right, uh I do know something about boring, SSL.

I

And it's that Googled actively discourages others from using it.

I

Which? Discouraging.

J

Is an understatement: yeah.

I

I I, don't remember what their wording is, but it's basically a we. We provide this, don't use it and I. Think that's enough to say no, just because you know usage is discouraged.

J

I

Wonder if it's even.

J

Except packages or anything yeah, it's there.

H

It may be that it's a prerequisite like a dependency of other open source projects, so it has to be public.

E

H

And and other I.

E

Would argue critical projects do take dependencies on boring, so I think ring in the rust ecosystem, which underlies Russell's? um If I were, if I'm not.

I

Oh I know Russell's re-implements I'm, pretty sure they don't use, boring SSL. They.

E

Use ring and I think ring uses boring if I I might be wrong. So for the record, if I'm wrong, I'm sorry.

I

um But okay I I mean um how's. This you may be right, but I don't think so. I mean this is a rust ring, boring SSL, yeah, I.

J

As we said, we can reconsider things, it sounds like we should say no and make progress. Yeah.

D

J

D

Is there a way to flag projects to be reconsidered.

C

uh I I, don't think we have that right now, but I mean we. We do have our column F here that we're recording, which is our our um uh reasoning, I, wouldn't assume automatically I, don't think we should just say no reconsider unless it's something that is essentially resubmitted by in in a future round with somebody that submits for with with more evidence so for here on, you know, um boring SSL, I, don't think we should say no, let's reconsider I think we should say no, unless um it's resubmitted with by a future.

C

um You know suggestion.

D

I

And you know what I uh it's a little bit of a struggle. I didn't do this research ahead of time, but it does look like uh darn it Mike's Michael's right. You know I'll I'll! Let you be right once Michael.

E

I'm Gonna Take It.

I

I am teasing, of course, I, uh but um in all seriousness, I wasn't aware of this I knew of ring, but I didn't know that it. You know you know I know of ring because of other tools that use ring, not that I've really looked at ring myself.

J

But isn't this the case that we should encourage ring to not be dependent upon boring SSL, as opposed to you know, creating more motivation for them to stay on something? That's deprecated.

C

It's not deprecated as you're saying. Well, it's an open source project. That says we don't intend to support clients, but people you can use it if you want and some people do, because maybe it's something that they would rather use and that's fine um I, don't think we can. We should.

A

C

Saying it's not critical, like I, don't think I should put it on our list.

J

um But that's why I'm saying is Google this discourages it. Then it seems like they're actively saying this should not be critical, it may be used, it may be a dependency, but.

C

That's different just because they say it isn't doesn't mean it is I mean if everybody in the world started using it tomorrow, then yeah.

J

But then somebody would probably Fork it and we wouldn't be boring.

C

Yeah exactly yeah.

I

Just all right, so so can we at least say there. There was significant debate, no matter, no matter what no matter. What I think you know, I think that's honest.

A

F

A

I

So how's this can I add that we may want to revisit this I think that's fair I mean that's true for anything, but I think this one in particular is contentious. We may revisit this in particular,.

I

Because, oh my God I, okay, all right.

I

Okay, I'm gonna, say similar things about. Can you make uh that I would about Bash.

I

You know Bastion canoe, make are both everywhere.

I

And I think it's fair to say that if someone subverts it um or it can't handle malicious data when it's when you give it the correct now, the malicious data argument probably doesn't really apply, but I do think the subversion does.

I

And you can see my text.

A

I

You buy the argument, I mean you, don't have to all right, so I'm going to copy my text in and if everybody agrees great and you don't have to.

J

Well, I mean it.

J

The question: is this, isn't about the security threat? Necessarily? Is this a critical project I think that bash and gnu making almost are critical dependencies in the open source software ecosystem. So right now, foreign.

J

Ers will feel very cut out.

I

I mean I think in the end we decide what we decide: um I I I'm not going to recuse myself, but I will note that many years ago I did write a couple lines of code to uh tweak a new make um and so I and I actually know um some of the gnu folks, not person, not very personally, just by email, but I mean it's a couple years back, I think and I use it occasionally, uh but I don't think that's a reason to recuse.

B

um uh Does anybody read trusting Trust I think that it I think that that you know in summer I mean I know the trusting trust is a little bit exaggerated in terms of its capabilities and but I think that, given that it is the underlying infrastructure for compilingual and all operating system or most of Linux operating systems, it's probably a.

I

Right right and that that's why I mentioned I would worry about malicious subversion of it by the way just I um I know some people already know, but my PhD dissertation is specifically about countering the trusting trust attack. So if you.

A

I

Nightly re, if you want some nighttime reading, I can I can point you to a document which, unlike most PhD dissertations, I, actually tried to make it readable. So.

E

C

Right so David, you made a comment here on this one that uh can you explain the reasoning here like do you have any um evidence that it's as widely used or just saying that it's also a build system for a make tool.

I

I'm sorry for gnu makes specifically.

C

Yeah Mason.

I

Oh um I, don't have like uh okay um I, think gnu make is used by far far more often than Mason is. If there's no other reason, then make has been around for decades longer. Okay, um but I, but um informally I've encountered enough uses of both ninja and Mason. To believe that there is significant use. I don't have a full-on study of it, so this is purely what is it? The uh the plural of anecdote is, uh is knowledge or something like that so I mean it's anecdotal.

I

It's not a serious study, but I've encountered it often enough to think huh there are people who use this thing. I, don't know how to do a quick survey of that says.

C

It can be installed through IP. Do we have pipi to download data.

I

Okay, here is a short list: okay, they themselves post a list of users. Now some of them are pretty obscure, but qemu is certainly not obscure.

I

um uh You know, Nautilus certainly I mean if you're running, gnome you're running Nautilus. You got Mesa. So if you're running any 3D you're running that um ksh pretty widely used shell, um so here's what I'm going to do I'm going to post in ours. You know their list of users.

I

Wait it's hard to beat gnu make in terms of just your usage, but I think that's easy enough to justify it. But that's my opinion. What are the others like.

I

All right, I've included at least an argument for it, but others.

D

I could just chime in that's an impressive looking list, as you mentioned,.

C

C

Uptake I would I would suggest no, because it's still it's not widely used enough um I'm. Just comparing the download counts between Mason and like a popular python, Library.

I

Yeah, I, don't think that's that's really the right measure there, because um me, if you do, if only if you download it uh but they're the one I mean this. The the challenge here is: it ends up being used to build a lot of other things. If that makes any sense, yeah.

C

But is it a lot or not I.

I

C

A question system.

I

That's I mean G screen, you know things like gstreamer and gtk. um If you use a gnome system, which is the default on almost all the lyrics just goes. That means you're using this software and you're, using that Builder.

C

I mean that's a desktop right.

I

Yes, well, no, it's it's really, not it's whatever! It's the it's a GUI interface! That's used for desktop and servers.

J

What is the cost of saying? Yes,.

H

It also includes system D, like an xorg. If you want the.

E

The cost the cost of hitting yes here is that the 101st item won't be looked at. Is the risk that that we're bumping something else off that should be on the list that isn't.

J

I mean, but this isn't a guarantee that it's going to be. You know that we're going to fund the openness so I just want to make right. Yeah I'm, not just saying that you know put in everything but I'm, saying that you know saying that it's critical doesn't mean that that you know that if there's any commitment from the open, ssf or anybody in this group that this is something worth uh funding right, so funding supporting any other way. Then you.

I

Know right, I think that but I think Michael's right. Basically, you don't want to just say yes, because yeah.

A

I

But but you know, I I think it's. It's met the bar because I'm looking at things like gnome and x, windows.

G

I

And so on and that's I mean: we've got millions of users.

J

I think there's some that have multiple the support, multiple build systems so I'm, not certain that being on the list, means that that's the only builds but yeah I agree.

I

Yeah I mean postgres is on there. So if you'd like to store data in a database with po that uses postgres.

J

But but that's what I'm saying is I: don't think that Mesa is the only build system. I mean I. Don't I think that it's one of build systems of postgres supports and that organ, so I don't want to I. Don't think we should look at this is that? Okay, if Mason didn't exist, that you couldn't build the project, I think I think you're, it's it's a it's a a union, not an internet I think that they're it's a more white Weyland, can build without I.

J

Think postgres supports C maker maker out there, so I mean they're multiple, build systems that many of these projects I mean bzip 2 doesn't require Mason. For example, it's supported.

J

You know like you, can go to node.js and there's a here's: how to build node.js with Ninja here's how to build node.js with Mason here's how to build it. It's one of many! So yeah! Don't don't look at this as it as a strict requirement.

I

That's interesting all.

D

I

Me add that to the little notes here, because, uh but that said it's not necessarily uh required in many cases.

J

I

So yeah build systems.

J

How to interpret that list of users? Yes, the broadest most encompassing list of potential.

I

Users right, which is different from gnu, make I.

A

Mean if you're using.

I

A new make it's highly unlikely that you'll work without canoe make.

I

You know yes, I realize.

J

It depends if you're using a new make extension, but yes, I mean you cannot use BSD, make or AIX maker others. Yes, if you're using a key to make extension, you are up a creek, yes and.

I

As someone who has written many many make files I try to write portable make files I rarely succeed pretty soon, okay, uh if you've ever I've, actually interacted with the posix folks. So if you've ever, you know, talk to me later about the agonies of trying to stick within posix mate, so um yeah, uh that's interesting, all right! That makes it more complicated and now I, you know, I was looking at that listens going oh yeah I've heard about it. Look at that long list, and huh that makes us more complicated decision.

J

Yeah I mean I, don't know of a project, a major project where Mason is a strict dependency. Nor ninja is a strict dependency.

J

But I don't know every project, but I mean it's. It's definitely. You know it has its follower. There are people who to whom Mason appeals their people to the ninja appeals and they will prefer that for their projects. Yes,.

C

I think the consideration here is not you know, is it a strict dependency, but um is it the default build or is it the most used builds for that for that maybe critical uh like postgres critical database or software project? So you know if Mason were subverted. Would that mean that you know the attackers would then be able to subvert postgres builds.

A

C

Builds or bills that go into different distributions, that kind of stuff.

E

You know I I was leaning against this, but I think he just convinced me, because, because of the the place in the pipeline, the build is the last opportunity to well. Maybe this one, uh the build would be a great place to insert malware. So if Mason was compromised to insert malware into everything that it bills, then it just goes. Downstream I think in general, build technology should get kind of a bump up in criticality over, like the world usage numbers.

C

I think that's true, but the question is: is it built? Is it used and for any and for what like yeah? Is it used for just yeah.

J

I mean, for example, you go to the you know: postgres GitHub and there's build and there's a new make. File.In I mean also, yes, you you know it's and it's uh you know the Nissan build system was updated yesterday and the new make file is I mean so, like you know, they both are actively maintained for postgres, but it's not the only way to build postgres meeting Mason.

B

I don't know if I'm gonna be able to make it to the next meeting. Can I there's two on here that I can speak authoritatively on. Does that? Do you mind jumping order in order to accommodate that.

F

I

Go ahead: okay, I found some data by the way on on use on required, use um the.

B

Two that I can speak authoritatively on are Gradle and Maven. um Both are built tools both are used about. 30 of the Java ecosystem is the build infrastructure.

B

um I used to work for grade, also I'm, partially biased, but Gradle um used is used as the primary build tool for the or for 50 of the Java ecosystem. 99 of the of all Android apps use Gradle to build build them. It's the uh the tool of choice to build Android apps um in Java, um yeah, build tools, uh and then Maven is used to build the other 50 of the Java ecosystem. That's not being used to build maven, yes, or it's not being used by Gradle.

F

Do we have any.

F

D

F

Disagree with uh Jonathan.

I

A

I

Adding Gradle makes sense: um okay, I'm going back I'm I'm, basically doing my quick Google Foo for I agree with you. Anecdotes are not the same as real data, um so I found an interesting post of analysis from 2021, saying that, specifically for Fedora, uh look, uh comparing it to cmake, escorts or Mason. uh Mason is now required by 30 of their packages, but I'm trying to figure out this 30 of all packages are 30 percent of yeah. It's only 30 of those require C make s-cons or Mason a Maison.

I

In other words, among those three um it's 30 but I know. Cmake is a huge use.

G

I

The number of package that build require Mason grew to almost what 600 hundred.

I

600. all right so.

E

I'm, sorry, one less data point: if uh on GitHub, if you search for the count of files called uh Mason dot, build which I'm assuming is the most obvious indicator that using Mason uh it's about 70 000. uh If you look for make file, it's 3.7 million right and was a cmake list, dot text is that is that the cmake.

E

So it's an order of magnitude less than make, but I I I'm, okay, keeping it like I'm, okay, either way.

I

Yeah I think no matter, what can you make and C make our far far more common yeah? uh Basically, um you know uh the articles that I have. There says that 600 packages of Fedora depend on it.

I

If we have Mason, we really have to add ninja by the way, because Mason generates file for Ninja but uh yeah. This is a close call.

C

Yeah I think it's close call too I mean I I I'd support it either way, I mean I, would lean I would lean no, but I mean I would be okay like if we see more and more usage. If we see that it's like an upward trajectory, maybe that's a good reasoning.

I

I think there's something of an upward trajectory, but it's it's not like dominant, it's not like, say either cmake or or uh make files which granted once you create a make. Once you create a build system, it's a pain in the butt to change.

I

So there's there's a sunk cost as well.

I

I mean I'm; okay with no. For now we can change later.

C

Anybody else somebody.

F

A

F

E

D

I think it is compelling to know that that it's just one of the options and it's not absolutely necessary.

I

Other build tool how's this lots of debate for now other build tools are far more common and in many cases Mason and Ninja. Mason is an option, not a requirement.

I

Okay, I think ninja goes for the same reason.

C

So we're good on Mason and ninja. You want to call here for the for the day, um I.

F

A

F

C

We've got a lot more to do so we might be doing this for three meetings.

C

I

Know what that's actually kind of what I was expecting.

J

Yeah, the last thing is I mean: do we do we want to guess the next meeting do a quick run through of things that we think are just. Do it like a straw poll of, what's not contentious, to just sort of get that out of the way and then focus on the ones that actually have some disagreement, or do we want to sort of randomly hit those when.

E

You could create like 10 columns and assign everybody a column, and then you just tick off the one. Yes, no and then, if 100 of people all say yes or no, then we don't really need to debate.

I

Yep, that's how we did the first version and I think the notion was to to not do it that way, but I, actually after trying to muck with comments, I think I'd prefer the columns I.

G

Have now done it, the other way I have now determined why I don't want to do it that way, anymore.

F

Yeah but I'd say if any are just kind of absolute yeses. um They can um be noted ahead of time, and you know unless there's something we didn't consider. You know those can pretty much automatically go through and then, like David said we can focus on the ones that might be a little more contentious.

C

Yeah I'd say: go in and drop a comment on anything that looks obvious and that once we get to it in the meeting, we can just hit yes or no and then keep moving on as quick as possible. What.

I

Do you think about the proposal of making more columns for different people so that we can quickly eyeball agreement disagreements.

I

And I can put my name.

C

All right, we can have a David.

I

Cohn David's column.

J

C

J

Two David columns. Excuse me: that's right.

I

F

J

Ude all right, let's, despite whatever things, yeah David, wheeler and I, are not the same person.

I

Yeah I will note that there's another David wheeler who does a lot of pearl things. So and that's not me so.

C

It was great to see everybody thanks for showing up. This could turn out and hope to see you all next time.

F

J

Thank you Jeff. Thank you. Everybody thanks. Bye have a good afternoon.

D

A