Rust Programming Language Core Team, 22 Apr 2020

Previous Meeting Next Meeting

⏯

youtube image

►

From YouTube: Core Team Meeting 2020-04-22

Description

Core Team Meeting 2020-04-22

A

So hello and welcome to the public part of the core team meeting on 22nd of April to the 2020 and yeah. Let's get started and run down the triage list so staged RFC, Stacy design, whatever Nico.

B

I'm, your attorney yes, I was sorry. It's currently in RFC. The entry that defines project groups and natural neurology is currently pending FCP waiting for someone to give a final, no check. None of those people are in this meeting at the moment, so I won't Kerrang the rest of you. uh That's the current status update.

A

A

Well, I had upfront legal issues.

A

Discussion status has not changed because the we have discussed that mid-may would be the right time to to start the work on this so I'm going to make a little bit of a task, but over the next two weeks, so that we can start mid-may, and there is a question that came up around the issue of installer signing I have added that I've talked to Peter around noon today and it seems like the biggest issue around installer signing is who's going to hold the signing certificate like which legal entity will be on the signing certificate.

A

So, given that the issue is roughly five years old and we got complaints from antivirus vendors.

A

Is there anything locking any of the of the entities involved in rust in holding that certificate, at least for a while, until we confirm maybe another entity.

B

I can certainly raise the question.

C

Holding it offered, I've talked with like the Mozilla. What's it called signature, autograph of the autograph folks and like they were certainly okay with Mozilla doing the signing, and they like gave me Doc's as well for how all this works, which I forward it to the infer team. So it seems like overall Mozilla has been okay with, in the past, at least when asked they've been like yeah.

C

We can, if, if we're using Mozilla infrastructure to do the signing, we can use the keys because their infrastructure is presumably like they have some hardware setup and whatever so I I. Don't think they can just give us a key, but we can set something up with tasks cluster to do the signing.

A

In my opinion, I would actually rely on a organization with track record. Anyways I would not want to solve hosts signing key infrastructure, but this is something to be considered anyways, so yeah.

B

It seems like most a logical entity to do this right, I hope. The trademark answer for its just.

D

B

D

Like reckoning sunning infrastructure, we already have like for the GPG signature, so we already have our sofa sturdy infrastructure, which is not really great from a security point of view, but like yeah. The main question here is that if the project is fine with the Barney's been signed by Mozilla, since that's sort of noticeable like when you download the binary Justin Windows said it says, signed by Mozilla and so like like, the concern will be whether we like the best section of Mozilla being the one signing the binaries.

D

If the project's wants to be this separate from give the pillars and try to separate as much as possible from Mozilla, that's not a step in the right direction, but honestly I don't yet know exactly how I feel about this like I need to think about. It is a bit more.

C

I feel kind of like when it comes to executive, executable, signing it's, the owner of the cert is less of a like prominent thing and less of a problem, because it's mostly just like as long as any authorized company signs this it's fine and nobody really cares about who it is, but yeah I think we should be fine with this, and this is mostly temporary until, like we figure out how to fix all this. So.

B

May I ask a question: is there a technical hurdle or is it particularly the question of.

A

I've seen me a document that Manish there's an issue that Manish was mentioning so autograph needs, so we need some implementation on our side. Yes, Jia was this. There's a task list to do that. So just needs to be implemented, but yeah autograph.

C

Only runs via task cluster and they've got like IP y IP, whitelisting and stuff. Like that. Now we could expand that, but I think they don't want us to do that. Instead, what we can do is when we want to sign a binary. We can teach our infrastructure to kick off a task on task cluster. That does the last step, so we can like set up a little chain there, but.

D

I think, like that sounds a bit complex with our existing infrastructure, because, like I, want DS not to be signed by CI, but to be signed when we actually do a release in the promoter is binary and like yeah.

C

D

Wait step for getting the signature, because then we need to after out a graph signs it. We need to do our own GPG signature on file.

C

So what what machine runs this right now.

D

Lcs, which is a machine on our AWS capital, static at me, so like what leasing that single IP will be, so would it be okay,.

C

For that service to ping, to paying tasks cluster and get a signature.

A

And just like I think we're getting into like playing infrastructure discussions. Yeah.

C

Yeah like, but yet there are implementation issues, but I feel they're, not insurmountable. It's just annoying. Yes,.

D

Like the problem is twofold, one is getting a certificate and no and deciding which legal entity is going to have the name on the certificate and the other. One is just purely in fact, the infra question on how to implement signing with whatever solution which Rossum and that needs people to do. The work does.

A

Anyone have an issue for what Musa Dagh signing our installers until another intern entity that has enough credibility to sign. Rusts binaries comes up also just to be clear. This also includes the rust of binaries rust up. They like rust up actually being the bigger problem on Windows. It's also, it's definitely a severe problem on Windows, because the new Windows 10 message is highly highly hostile to actually clicking clicking through and installing this binary. So this that's a serious first, okay.

A

Anyone anyone raising any concerns if Mozilla ends up being the current assignee entity for our binaries.

A

Okay and I will check this off.

A

We can see the other thing next up. White papers, I have not been able to continue with us over the last week rust today. Okay,.

B

We're done here there's a ball of post-its out I. Think there was a nice analysis that I would recommend you all take. A look at I would be interested we're done with sort of publishing the results. What we are not done with, perhaps is thinking through what they mean, so one thing I been contemplating the idea. Of course. Maybe if people are interested like those who want to, we could have a time to go over the results and think about what they need, what they might say for what we ought to prioritize and so forth.

B

I, don't know that there's any dramatic lessons in there I think the main things that caught my eye, you know, first of all, arrest. Analyzer has been really successful.

B

It's interesting to look at some of the the prominence of embedded. A few things sort of were surprisingly embedded shows up in its more prominent than I might have expected. Apparently, interoperability with our is highly desirable. I'd still care I still find that very surprising, but uh and the other main thing that stuck out was that there's a finding that people don't feel productive in rust.

B

There's a certain set of people who, even after years, do not wind up feeling productive in rust and I would like to know more about why that is like I can make guesses. But already just on my small sample people, I asked they came up with a few different answers, so I like, for example, some people mentioned IDE sport which I hadn't, expected and others language, of course, complexity and other things.

B

So maybe it's interesting to try to suss out more details, but I'm not sure how we would do that beyond asking questions or running surveys. Enough I, don't know. Okay,.

A

I also think this is useful, especially as some of the results were surprising, also embedded came out very high on the field.

A

The other thing that I found interesting is that, on all the focus points that we had last year, we saw like the line scoot towards improvement like this is getting better, doesn't getting worse. It's getting better, which I think is a good message and the.

B

Addition was highly successful in terms of adoption. There's there's some really good success measures in there, or at least positive.

B

A

To try to organize a.

B

Walkthrough of it really just to talk.

A

Yeah anyone want to I can organize a walkthrough I think.

B

um So Nell did all the work on writing. The blog post and Aaron also worked pretty closely on it and power. I, wonder I, don't know that has to like I think. Maybe we should we should include them. We.

A

Should definitely include them, I was just talking about organizing I. Think that should be in a meeting for, for anyone on the object is interested. I think that should not be banned to working groups with a summary that ends up in the like for the whole project. I think.

B

It would make sense to make an open meeting. I. Think part of my point was I. Think we don't like if people here, a busy I think you could find someone like now might organize it or Aaron could talk to them.

A

Okay, let's check this box governance working group.

B

There's no major update beyond the. We should probably just merge this with stage or C's. Is it kind of a I feel like every time we do this I I say one thing and then I feel like I have to say it again.

A

Update, essentially doubt governor's working group is working, then we can just check this off if there's nothing to track and the governor's working group is active, I think we should only track on specific issues that I.

C

Need to drop off I'm like basically falling asleep I'm gonna yeah. Let ping me if you'd need something.

A

B

A

Fall asleep on stream. Thank you.

A

Target a policy RFC and.

B

So I brought this up before I think this is said. Some revision like Elsa stars and I I, talked to Josh about doing that. But I don't think it's been done.

A

Designated liaison to move the body go, oh.

B

D

Did you wanna talk, origin yeah? Basically, we have like.

D

We have some teams, especially the could say, a team that semi-regularly needs to getting getting to contact with a lawyer to get legal advice and, at the moment that's a bit chaotic because, as far as I understand the Mafia lawyers only want to talk with muscle employees and I like there is a bit of a communicate like it's, not clear where we should with who we should communicate and things or not, and so the idea that me Anna, quad, the while something in private, is to designate a person does project that's responsible for them.

D

Angling communications I, like.

B

To specifically a Mozilla employee, so I can elaborate a little there's, essentially there's a there's if, if they communicate with employees, those communications are covered under attorney-client privilege if they communicate to non-employees than they are not, and so they would prefer to do like deliberations and so forth, while covered under privilege. So they want an employer. I think that that's reasonable make sense, um but I could be me, but then I kind of have a lot of things on my plate.

B

So I was suggesting well, maybe Mel might cover it didn't Pietro felt like it would make more sense to well that it sort of it would be nice to have somewhere in this is the person that you go talk to you if you want to reach out to a mozilla lawyers, they'll manage it for you, okay. I.

A

Think that makes sense.

A

My view- and this would be that in that case the RUS team at Missoula some point, someone yeah, and that would be that would be the job of the worst team at Mozilla and they can appoint someone. That's.

B

Roughly, what we wanted to or what I was proposing, I think Joe.

A

B

Proposing but but.

A

B

A

In general, you discuss this and find the person best on the other side. Instead of us yeah.

D

And I like Anna yeah, that was to create a sort of palette repository when well team were team. Members could open an issue and, and then the day Liam would forward the request most illegal in the flight back when there is a consensus or if you want to and all this via mail I, don't know what I think I think up to the person being, the liaison was the way they feel more comfortable. I was.

B

Gonna say that sounds like a good thing for them to figure out I.

A

Think it's a good idea to have a some kind of trackable internal record on this.

A

A

So that conclusively public part of the meeting anything to add any other issues that people want race.

D

B

Just to be clear, roughly result will I rest human below will determine a liaison right. We roughly resolved. We will determine a liaison and yeah I, don't know if we I don't think we it's.

A

Fine, that's good, let's check, let's track that for as long as we have an appointed someone.

B

Kristen, we could also be like Manish.

D

At slightly preferred working member, because that way, if there is an issue that require that is private, we can about getting.

A

B

Popping around remote discussion.

A

Then now I'm going to stop this recording.