►
From YouTube: SLSA Biweekly (June 8, 2023)
Description
Meeting notes: https://docs.google.com/document/d/1JbJZxeZOWE7rxT24iEozX35LIUl_Yoqd-DeSm6309GA/
A
C
B
B
D
Everyone
I'm
Chad
with
GitHub
actions.
Gab
has
some
attendance
to
these
meetings
I
understand
before
but
I.
This
is
my
first
time
coming
into
any
of
it
coming
up
from
a
different
bunch
of
different
things
in
the
company
and
now
focusing
on
supply,
chain
security
and
so
interested
to
see.
What's
going
on,
welcome.
B
B
Okay,
cool
so
next
step
in
the
meeting.
We
normally
do
a
brief
round
of
updates
from
the
different
teams
working
on
salsa.
So
we
have
several
meetings
and
kind
of
working
groups
where
the
first
one
is
the
specification,
the
folks
working
on
the
crossback
and
there's
the
positioning
and
group
which
is
actually
operating
kind
of
at
the
next
tier
up
in
the
organizational
hierarchy
of
the
open
SF
for
the
supply
chain.
Integrity
working
group.
B
B
B
There's
a
proposal
from
Antonio
at
Google
to
move
to
change
the
way
we
kind
of
manage
the
project
in
terms
of
like
the
generated
spec,
how
I
guess,
published
and
also
like
the
git
operations,
and
how
we
perform
kind
of
revision,
control
of
the
spec.
Because
at
the
moment
we
have
multiple
redundant
copies
of
the
spec
for
each
version
that
we've
released
and
we
want
to
move
over
to
something
Branch
based.
B
B
But
ultimately
we
will
release
a
new
minor
version
of
the
respect
to
bumps
the
provenance
format
so
that
we
correctly
annotating
that
field,
which
is
the
annotations
field
in
a
resource
descriptor.
So
that
looks
fairly
detailed.
I
think
that's
it
from
the
spec
side,
though
Mike
or
trishank
might
have
something
else
to
add.
E
There's
a
lot
of
debate
on
on
exactly
what
are
some
of
the
next
things
we'll
be
working
on
from
the
perspective
of
like
the
various
tracks.
We're
still
looking
for
that
as
well.
So
if,
if
folks
are
interested,
feel
free
to
sort
of
open
up
a
GitHub
issue
on
that,
because
we're
definitely
interested
to
see
what
are
the
things
that
that
folks
really
want
to
focus
on,
because
there's
been
a
lot
of
discussion
about
a
source
track,
a
lot
of
discussion
about
bringing
back
something
like
a
salsa
level.
E
Four,
with
specifically
trying
to
make
certain
definitions
clearer,
because
one
of
the
reasons
why
we
had
for
folks
who
are
new
one
of
the
reasons
why
we
removed
salsa
level,
four
from
salsa
build
level.
Four
from
V1
was
not
because
we
wanted
to
make
things
less
secure
or
to
to
some
folks
have
have
opined
that
it's
you
know
to
to
satisfy
folks
who
who
are
selling
products
or
whatever
that
can't
hit
those
things.
They're
like
no.
E
No
it's
just
because
nobody
could
agree
on
what
really
some
of
the
definitions
were
and,
and
a
lot
of
folks
were
getting
very
confused
by
what
was
meant
by
hermeticity
and
what
was
meant
by
some
of
these
other
things.
So
we
decided
to
take
a
step
back
first
and
so
there's
interest
there
as
well.
There's
also
there
was
some
interest
around
two
other
things.
One
was
a
around,
maybe
being
a
bit
more
specific,
whether
either
in
the
build
track
or
as
a
separate
track
as
something
like
build
infrastructure.
E
So
for
folks
who
are
like
hey?
What
would
it?
Even
though
you
know
the
specification
doesn't
really
make
have
a
lot
of
details
on
how
you
should
be
securing
your
build?
You're.
Sorry,
your
control,
your
build
control
plane.
It
just
says
you
should
have
a
trusted.
Control
trusted
build
control
plane,
but
what
you
know
folks
are
asking
like
how
how
do
I
know
that
should
be
trusted.
E
What
are
the
things
I
could
do
to
secure
that
so
there's
something
around,
perhaps
a
built
infrastructure
track,
and
then
there
were
folks
who
were
saying
hey
right
now.
The
build
the
build
track
is
very
much
focused
on
Providence,
which,
in
our
blog
articles
and
so
on,
we
have
a
lot
of
stuff
around.
What's
the
word,
none
of
the
stuff
in
the
build
provenance
track
really
talks
about
the
build
itself,
so
salsa
can
definitely
still
build
malware.
The
problem
is
sorry,
the
thing
that
that's
also
really
gives
you
is.
E
You
know
that
right,
like
you,
have
the
details
of
how
it
was
built.
You
have
the
details
of
how
it
came
to
be
so
you
can't
have
somebody
have
lied
to
you
about
how
it
got
built.
No,
it
actually
got
built
inside
of
your
build
system
and
then,
while
also
sort
of
eliminating
a
lot
of
the
ways
that
somebody
would
potentially
break
future
builds
stuff
like
that.
E
So
so
that's
really
where
the
core
of
a
lot
of
the
salsa
stuff
is,
and
so
folks
have
been
asking
like
hey
what
are
things
from
the
end
user
side
that
perhaps
you
should
look
at
when
running
a
build
and
stuff
like
that
and
does
that
belong
in
the
same
track
and
and
that
sort
of
thing
so
there's
some
debates
about
those
things.
There's
actually
a
lot
of
GitHub
issues
under
the
salsa
GitHub
and
feel
free
to
kind
of
take
a
look
at
some
of
those.
B
The
notion
of
terminology
has
come
up
a
few
times
in
the
last
few
weeks,
as
you
mentioned,
and
I
think
we're
trending
towards
like
just
being
very
explicit
about
what
we
mean,
instead
of
using
terms
that
we
increasingly
recognize
both
within
salsa
and
then
in
the
broader
supply
chain.
Effort
is
like
I
love.
These
words
carry
a
lot
of
context
for
people
with
different
backgrounds,
so
maybe
we
should
just
avoid
them.
B
E
E
Right
is:
if
you're
in
the
compliance
world
at
a
station
means
one
thing:
if
you're
in
the
software
world
attestation
can
mean
another
thing:
if
you're
in
the
hardware
world
at
a
station
mean
something
specific
and
so
there's
a
lot
of
elements
there,
and
especially
when,
in
our
case,
we're
sort
of
combining
all
three
of
those
at
some
level,
it
can
cause
folks
to
get
very
confused.
Yeah.
B
I
think
that's
for
me.
That's
the
key
example
of
why
we
should
steer
away
from
defining
terms
and
just
avoiding
using
them,
because
we've
got
a
fairly
comprehensive
discussion
of
what
we
mean
by
an
attestation,
but
that
is
still
frequently
something
that
comes
up
because
the
term
is,
if
you
come
from
like
tpm-ish
trusted
Hardware
background
attestation
means
a
very
specific
thing
and
it
doesn't
matter
how
many
words
you
write
about
what
you
think
it
means
it
will
always
mean
that
thing
to
the
people.
B
F
Yeah
so
I
know
Jay
and
Bruno
and
might
have
probably
been
doing
most
of
the
work
while
I've
been
absent
for
some
of
the
things
recently
in
terms
of
deliverables,
we
were
able
to
at
a
higher
level
right,
there's
a
new
blog
for
salsa
Prescott
s2c2f
on
the
open,
ssf's
website.
Right.
It's
just
talking
about
the
supply
chain,
Integrity
working
group-
you
know
what
it's
about.
We
talk
about
this
also
one
that
oh
release
and
you
know
how
we
encourage
people
to
come
and
join
and
help
us.
F
There
has
been
a
new
meeting.
This
is
Sterling
tool
chain
meeting
which
I
gave
Rob
a
hard
time.
I'd,
say:
Rob,
you're
killing
me
I've
been
having
really
good
participation,
and
then
you
you
put
this
this
meeting
on
the
calendar,
so
that
meeting
is
now
conflicting
with
the
positioning
meeting.
So
there's
been
light
attendance
as
a
result,
so
I
need
to
create
a
new
Poll
for
new
meeting
times
to
move
the
positioning
meeting.
F
G
E
E
E
Integrity
I've,
given
a
couple
of
just
talks
recently
on
salsa
at
a
couple
of
smaller
sorts
of
devops
sort
of
related
events,
and
maybe
only
about
10
of
the
audience,
had
even
heard
of
supply
chain
security,
let
alone
salsa,
which
was
maybe
you
know
only
one
or
two
people
had
heard
of
salsa
before
so
I.
Think
there's
some
there's
a
lot
of
areas
where
we
can
maybe
help
spread
the
word
a
little
bit
because
we
might
be
so
you
know
some
of
us
might
be.
E
Thanks
sure,
so
a
couple
things
so
one
I
think
the
biggest
one
I
I
know
I
put
some
stuff
in
the
notes
there,
so
one
of
the
biggest
ones.
Well,
so
there's
some
interest
in
salsifying
Jenkins
so
like
what
are
the
things
that
you
know,
a
lot
of
folks
are
like
hey,
it's
great,
that
there's
all
this
stuff
coming
out
from
GitHub
actions
and
from
stuff
like
Fresca
for
for
that
uses,
tecton
and
tecton
chains,
and
all
that
good
stuff
and
there's
a
couple
other.
E
You
know
things
that
people
are
looking
at,
but
you
know
the
the
elephant
in
the
room
is
still
Jenkins
like
hey.
A
lot
of
folks
are
still
using
Jenkins.
What
are
the
things?
People
could
do
to
potentially
do
best
practices
on
there
and
I
think
that
I
have
created
a
document
I
linked
it
in
in
the
meeting
notes,
there
seemed
to
be
some
interest:
I
haven't
really
worked
with
Jenkins
and
I'm.
E
I
believe
a
few
folks
have
begun
to
do
an
APAC,
friendly
time
zone
meeting
on
salsa,
because
there's
actually
a
couple
of
folks
over
from
Japan
Australia
Singapore,
who
are
starting
to
actually
write
up
some
interesting
salsa
stuff
and,
in
particular
I
know,
there's
the
Oracle
team.
They
announced
a
tool
called
macaron,
which
is
in
the
slack
chat.
I,
don't
have
the
links
off
that
off
the
top
of
my
head,
but
it's
it's
a
tool
that
can
help
generate
reports
and
do
salsa
verification
looks
pretty
cool.
E
In
addition
to
that,
you
know.
We
also
want
to
have
more
participation
from
end
users,
so
folks,
who
are
like
hey
I
plan
to
consume
these
things,
I
want
to
generate
salsa
or
I
want
to
consume
salsa,
but
I'm
doing
X
and
I
can't
use
GitHub
actions
or
I'm
doing
or
I'm
trying
to
consume
the
salsa
attestations
from
GitHub
action.
So
what
do
I
do
with
this
at
a
station?
I
think
that
sort
of
thing
would
be
useful.
E
You
know
we're
looking
for
more
participation
there
and
for
folks
who
aren't
aware
of
the
meeting
it
happens
at
10
a.m:
Eastern
Time,
right
now
there
is
a
separate
meeting
that
I'm
not
exactly
sure
how
often
it
happens,
that's
in
APAC
time
zone
and
there's
some
debate
on
on
there's
some
stuff
there.
So
that's
those
two
things.
People
have
also
been
asking
about:
salsa
V1
Providence,
because
right
now
it
looks
like
I
think
all
the
tools
have
only
really
done.
E
Salsa
V
0.2,
a
few
tools
have
begun
to
do
the
work
to
be
source
of
E1
to
to
generate
salsa
V1,
but
none
of
it
is
there
yet
and
just
as
for
folks
who
are
are
I
know,
that's
still
confusing
for
a
lot
of
people,
but
you
can
be
salsa
V1,
you
could
still
be.
You
could
still
be
doing
salsa
V1
without
jittering.
It's
also
V1
specification.
E
The
salsa
V1
specification
is
just
a
better
way
of
you
know,
and
that
itself
is
its
own.
Can
of
worms
right
now
and
then
separately.
One
of
the
things
that
I've
been
working
on
and
it's
open
source
is
I've,
been
working
on
a
tool
called
Specter
Specter
is
a
tool
written
in
Rust
to
validate
stuff
like
salsa
documents
and
other
in
total,
attestations
and
s-bombs,
and
it
tries
to
do
so
by
being
very,
very
strict.
E
E
B
H
F
H
Yeah,
let
me
let
me
bring
you
the
the
link
to
the
election
process
that
you
have
been
discussing.
I
put
I
think
that
everybody
has
access,
but
we
didn't
have
a
lot
of
discussion
since
the
last
time,
and
we
have
been
I
mean
two
fundamentals:
decisions.
One
is
the
number
of
steering
committee
members
that
you'll
be
elected
every
period
and
the
another
one
is
who
it's
qualified
to
vote.
I.
H
H
H
Yeah
yeah
sorry
go
ahead,
yeah
as
of
today,
I
think
that
it's
we're
toward
it.
If
the
the
point
that
it's
maybe
we
are
going
to
re-elect
the
whole
steering
committee
plus
a
number
of
new
candidates
to
go
to
everybody
that
wants
to
the
election,
that's
what
I'm
seeing
moving
toward
at
this
point.
But
of
course
we
have
all
agree.
E
E
We
do
say
that,
like
the
the
steering
committee
gets
to
vote
on
sort
of
overriding
certain
things
or
pushing
forward
certain
things,
I
think
it'd
be
worthwhile
to
kind
of
also
maybe
highlight
like
what
what
are
sort
of
the
the
responsibilities
as
well
as
powers
that
the
steering
committee
has
so
that
folks
knows
know
like,
like
other
than
just
sort
of
saying,
yeah
I'm,
a
I'm,
a
you
know,
I'm
a
a
normal
per.
You
know:
I'm
a
I'm,
a
big
contributor
to
salsa.
What
else
does
that
mean.
B
B
There's
a
certain
amount
documented
in
the
governance
repository
already,
but
I
think
one
of
the
reasons
why
people
are
uncertain
about
what
the
steering
committee
does
is
because
they
haven't
necessarily
needed
to
do
much
in
the
governance
of
the
project
so
far,
but
I
think
yeah
I
would
have
to
reread
the
governance
structure,
I
think
per
the
governing
stocks.
Some
of
the
stuff
the
steering
committee
does
is
arranging
meetings
like
this
and
kind
of
handling
the
the
broader
projects
outside
of
the
specific
working
groups
that
we
have
Melba.
F
Yeah
I
had
a
a
question
about.
You
know
how
big
the
steering
committee
should
be
relative
to
the
community
right
A
lot
of
times
the
people
that
actually
participate
and
are
actives.
They
are
on
the
steering
committee
and
then
there's
you
know,
maybe
one
or
two
that
kind
of
come
in
and
out.
So
if
everyone's
on
the
steering
commission
that
is
participating
that
kind
of
negates
the
the
point,
you
know
obviously
I'm
not
trying
to
shrink
the
committee
in
any
way
shape
or
form,
but
just
trying
to
think
about
that.
B
F
I
I
I
Now,
and
you
know
the
thing
that
I
find
a
bit
weird
is
that
we
basically
don't
see
what
the
steering
committee
does,
and
maybe
it
comes
down
to
what
was
said
earlier,
that
it
hasn't
done
much,
which
maybe
is
a
good
thing,
because
there
was
no
real
issues
they
felt
like
well,
but
but
I
think
you
know
we
ought
to
be
a
bit
more
transparent
and
I.
Don't
know
who
would
run
I,
don't
know
what
they
would
sign
up
for.
I
mean
you
know.
I
If
you
look
at
the
tag,
for
instance,
which
is
a
big
part
of
the
government
structure
in
open
ssf,
it's
fully
transparent
right.
It
has
meetings
that
are
minuted
and
all
that
you
know
when
the
calls
are
you
can
attend
them.
I,
don't
think
anything
like
this
is
happening
with
the
steering
committee
that
I
know
of
so
I
think
we
need
to
fix
this.
B
B
Really
legitimate
concert
and
and
welcome
some
new
ideas
around
that
as
we've
kind
of
intimated
but
I
was
just
stating
explicitly
like
the
the
active
members
of
the
steering
committee
are
people
who
are
active
in
the
broader
project,
and
so
it
can
be
difficult
to
draw
a
line
between
what
steering
committee
members
are
doing
versus
active
contributors
to
the
project
because
they
tend
to
be
the
same.
People.
B
I
Yeah,
that's
right,
I
mean
governing
board,
I
mean
it's
a
matter
of
your
level
of
of
membership
in
open
ssf.
If
you're
a
premium
member,
you
get
a
seat
on
the
board,
that's
all
it
takes,
so
it
will
grow
as
the
number
of
Premium
members
grows.
But
when
it
comes
to
the
tax
size,
I
mean
you
know,
to
be
fair.
I
think
there
have
been
people
pushing
back
on
the
idea.
I
Typically,
the
the
the
the
argument
that
I'm
aware
of
are
in
favor
of
increasing
has
to
do
with
having
better
representation
of
everything
that
goes
on
within
open
ssf,
all
the
different
groups
and
members
and
and
increasing
diversity.
If
you
will
and
and
the
cons
is
concerns
that
it
may
become
a
body
that
has
hard
time
reaching
consensus,
because
the
more
people,
the
more
voices
you
get,
the
harder
possibly
it
is
to
get
to
to
a
decision,
I
mean
I,
actually
think
this
is
mostly
a
falsehood.
I
E
Think
you
know,
with
with
an
understanding
that
we
wanted
to
make
sure
that
the
folks
who
were
showing
up
to
these
meetings
got.
You
know
a
bit
of
a
a
bigger
say,
because
one
of
the
things
that
is
still
fairly
common
right
in
in
any
open
source
meeting
is
is,
since
all
these
meetings
are
open.
It's
very
easy
for
somebody
to
let's
say
just
come
in
once:
every
you
know
three
four
months
and
potentially
derail
stuff
by
you
know
like
even
if
they
they're
well-meaning,
it's
like
hey.
J
J
I
agree
that
so
I
think
I
think
part
partly
to
answer
Bruno's
questions
and
Melba's.
Questions,
too,
is
that
maybe
this
is
what
we
need
to
decide
before
we
solidify
the
election
process
is
to
clarify
what
we
expect
from
the
next
steering
committee.
I.
Think
that's
important
to
really
before
we
hold
an
election
at
all,
so.
B
We
had
some
good
suggestions
around
like
what
what
we
would
want,
what
properties
moved
on
and
from
the
steering
committee
with
transparency
and
being
active
and
things
and
I
think
for
the
most
part,
the
current
steering
committee
are
very
active
participants
in
the
community
like
we
have
all,
but
two
of
them
on
this
call,
and
one
of
those
two
is
very
active
in
the
project.
Otherwise,.
B
C
E
So
I
I,
don't
want
to
volunteer
on
this.
I
have
too
much
going
on
right
now,
but
actually
one
question
I
did
want
to
bring
up
is,
is
I,
think
it's
probably
worthwhile
just
and
and
Arno
you
might
have
the
info
here
of,
like
as
when
we
originally
created
the
salsa
steering
committee
whatever
it
was,
was
it
two
years
ago,
something
like
that?
We,
the
governance
or
the
open
SF,
was
also
not
fully
solidified
either.
E
I
Yeah,
so
I
can
answer
that
there
is
no
rules
there,
so
we're
pretty
much
free
to
do
what
we
want.
I
I.
There
is
the
point
of
you
know
like
if
we
have
an
election
who
gets
to
vote,
he's
actually
a
broader
issue
which
doesn't
pertain
only
to
the
election
of
the
steering
committee
right.
We
have
seen
it
in
other
working
groups
where
you
know
an
issue
comes
up.
I
I
The
attack
wants
to
tackle-
and
this
is
probably
something
I
would
expect-
will
come
up
with
some
Rule
and
that
will
be,
you
know,
broadly
applicable
to
everybody,
but
that's
about
it
for
now
and
when
it
comes
to
the
actual
steering
committee,
it's
up
to
every
working
group
to
Define
what
they
do
and
until
that
changes
and
the
tag
says
no
we're
going
to
put
some
standard
steering
community
garden
structure
that
everybody
has
to
follow.
I
think
here
we
can
do
what
we
want.
B
F
B
F
A
D
I
Know
for
that
matter,
I,
don't
think
we
necessarily
need
those
during
Community
to
have
actual
meetings.
I.
Definitely
you
know
I
wouldn't
be
pushing
for
this,
but
there's
got
to
have
been
some
communication
and
I
think
it
would
be
good
for
the
existing
steering
committee
to
have
a
look
at
the
text
and
see
whether
it
captures
at
least
what's
being
done.
That
has
been
necessary.
I
A
E
E
A
bunch
is
just
that
last
Point,
the
making
decisions
when
Community
consensus
can't
cannot
be
reached,
which
I
think
we've
only
ever
had
to
do
a
couple
of
times
where
we
saw
that
there
was
a
contentious
issue
about
the
definition
of
something
and
the
steering
committee
kind
of
came
in
and
said
Yep.
This
seems
like
the
most
reasonable
solution
and
we
voted
on
it
and
I
think
that
also
only
happened.
A
handful
of
times.
I
E
But
yeah
so
on
on
that
end,
I
will
say,
and
maybe
we
just
make
it
clearer,
I
I
agree
with
you.
The
only
time
that's
ever
happened
is
we
took
the
vote
and
recorded
it
in
a
GitHub
issue
or
inside
of
the
Google
Doc,
so
we
always
recorded
it
somewhere
and
and
I
think,
but
I
think
making
that
clearer
to
your
point
is
is
so
that
folks
know
where
to
look
for
records
of
those
votes
as
opposed
to
go
fishing,
for
it
is,
is
really
important.
B
It's
all
about
the
minority
voting
has
all
been
done
on
GitHub
and
there
just
haven't
been
many
of
them
and
there's
multiple
positives
involved
at
this
point,
like
I
I'm.
Looking
at
the
list
here
and
seeing
like
collectively
reviewing
and
revising
the
roadmap
on
a
buying
your
basis,
I
mean
we.
We
have
collectively
reviews
them
revised
roadmap,
but
it
hasn't
been
on
a
buying
your
basis
because
we're
not
delivered
what
we
set
out
in
the
previous
roadmap
in
in
that
kind
of
initial
projection
of
I'm
drinking.
J
I
Yeah,
by
the
way,
it's
a
probability
statement
but
a
proposal,
but
you
know
you
could
you
could
also
entertain
the
idea
of
not
having
a
steering
committee?
If
it's
not,
you
know
we
could
rely
on
having
well,
we
have
people
who
are
involved,
and
this
is
the
community.
That's
this
making
those
decisions.
Do
you
actually
need
a
steering
committee?
You
know
my
experience,
I'll
be
open
about.
I
This
is,
like
you
know,
companies
when
they
go
open
collaboration,
style,
they'll,
fear,
they're
going
to
lose
control,
but
the
reality
is
the
control
is
within
the
or
in
the
hands
of
the
people
who
are
actively
engaged.
If
you
actively
engage
you
have,
you
have
at
least
some
amount
of
control
and
you
don't
need
to
have
special
powers
in
a
steering
could
be
that
says?
I
Well,
it
doesn't
matter
if
there's
if
it
doesn't
go
the
way
we
want
at
the
steering
committee
we
can
always
you
know,
shift
things
the
way
we
want
so
I'm
just
you
know
there
may
be
valid
reasons,
but
if
you
get
guys
felt
like
well,
we
haven't
had
much
to
do.
Maybe
we
don't
need
it,
that's
that
should
be,
at
least
in
people's
mind.
E
You
know
contribution
from
like
a
contributor
letter
standpoint,
so
you
know
it
helps
them
in
their
careers
and
and
a
lot
of
their
their
personal
growth
as
well,
which
once
again,
it's
slightly
tangential
to
the
steering
committee
thing.
But
I
do
think
that
at
least
some
level
of
like
providing
you
know
more
of
that
incentive.
Even
if
it's
just
a
badge
of
honor
for
some
folks
is
something
that
I
know.
Some
people
appreciate
as
a
way
of
like
seeing
that
their
contributions
are
are
well
known
or
whatever
yeah.
So.
B
I
I
worked
in
the
show,
but
that's
the
notion
of
the
contributor
letter,
I
think
and
as
I
understand
it
there's
been
a
proposal
to
have
kind
of
a
high
level
one
in
the
open
SF
projects
to
adopt,
as
they
see
fit.
I
haven't
reviewed
it
personally,
but
I
think
it
would
be
worthwhile
for
us
to
look
at
that
and
see
how
we
can
Foster
our
contributors.
I
Tell
me
when
you
want
to
move
on,
but
you
know
what
Mike
just
said
is
very
relevant.
I
mean
I
think
it
is
true
that
people
need
to
get
recognition
and
it's
often
helpful
to
justify
the
time
they
spend
to
the
employer
on
an
activity
like
this,
so
I
totally
I'm
familiar
with
this
and
I
I
acknowledge
it.
But
in
fact
we
have
another
level
of
control
right,
which
is
the
maintainer
status,
and
so
in
a
sense
when
we
talk
about
you
know
what,
if
there's
a
big
issue?
I
B
Yeah
I
think
we
even
have
an
issue
for
that
in
the
governance
repository
that
we
need
to
bet
the
document
who
our
maintainers
are
because
the
the
kind
of
the
moniker
of
a
maintainers
in
most
open
source
projects
is
the
people
who
review
and
merge
code,
but
in
salsa
and
other
communities
we
have
a
lot
more
leadership
roles,
that
kind
of
fit
their
responsibilities
and
and
the
recognition
of
being
a
maintainer
without
necessarily
doing
that
kind
of
review
and
Hands-On
get
surgery.
So
that
would
be
I
agree.
B
F
I
can't
raise
my
hand
when
I'm
hearing
in
the
screen,
so
I
I
had
a
question
along
the
lines
of
the
maintainers
right
because
reading
this
and
might
be
reading
it
wrong,
it
seems
like
a
maintenance,
cannot
be
a
steering
committee.
Member
cannot
be
a
maintainer
I
I
could
be
reading
that
wrong
and
if
that's
the
case
and
I
think
we,
we
will
have
to
take
a
look
at
okay
who
who
are
the
maintainers
versus
steering
committee
members,
because
the
steering
committee
seems
more
leadership
right
less.
You
know
Hands-On
PR's
right.
F
Yes,
they
can
do
it,
but
that's
the
way.
It
seems
right,
there's
contributors
and
then
there's
the
leaders
of
the
contributors
and
then
there's
the
leaders
of
the
maintainers
that
are
the
leaders
of
the
contributors
right.
So
it
seems
almost
like
a
hierarchy,
and
so
I
would
expect
that
the
steering
committee
members
are
are
less
less
day-to-day
and
more
on
I,
don't
want
to
say
operations.
F
C
B
C
B
Maybe
we
don't
need
a
steering
committee.
Maybe
we
just
need
a
better
like
document
and
recognize
the
different
leadership
roles
in
the
community
and
that
larger
set
of
Leaders
with
diverse
representation
skills
could
be.
You
know
sufficient
to
replace
the
steering
committee
Concepts,
really
interesting.
Questions
I.
B
Think
we've
had
a
bunch
of
great
discussion,
I'm
conscious
of
the
fact
that
we've
only
got
a
few
minutes
left
and
we
we
don't
have
a
I,
don't
think
we
have
a
direct
plan
of
action
for
next
steps,
so
I
think
we
should
focus
on
that
like
a
nutrition
suggested.
Maybe
the
steering
committee
that
exists
today
should
kind
of
take
ownership
of
of
this
definition.
B
C
I
I
Not
one
project
is
really
three
different
projects,
and
so
you
cannot
have
maintainers
across
all
these
projects,
so
they
actually
need
some
kind
of
body
that
does
the
coordination
of
across
all
these
different
projects,
and
the
steering
committee
fits
well
that
role
I,
don't
know
that
we
have
that
first
salsa,
but
you
know
I'm
not
against
this
Turing
committee
I'm
not
trying
to
kill
it.
Don't
get
me
wrong,
I
think
if
there
is
some
value
to
it,
let's
keep
it,
but
we
should
better
Define
it
so
Trisha.
Thank
you
for
volunteering.
I
E
You
one
thing:
I
want
to
just
throw
out
there,
because
I
I
think
this
was
also
one
of
the
original
reasons
why
we've
had
discussed
something
like
a
steering
committee
was
less
about
that.
The
because
we've
seen
this
in
other
open
source
projects
a
little
bit
is
we
didn't
want
to
have.
What
had
to
have
happen
is,
and
it's
part
of
the
who's
allowed
to
vote
problem.
B
B
B
Okay,
cool
lots
of
great
discussion
thanks
everyone,
and
thanks
trishank
for
volunteering,
to
take
this
to
take
this
forward.
Yeah
I'll,
happily
bunch
of
you.
Collaborate
on
that
and
I'll
see
it
when
you
share
it
with
a
broader
Community.
So
yeah
thanks
everyone
for
your
time
today
and
for
the
it's
a
good
discussion
and
see
you
in
the
next
meeting
in
a
month's
time.