Date   

Re: [VOTE] In-toto for incubating

Brandon Lum
 

+1 nb


On Thu, Feb 17, 2022 at 3:54 PM Santiago Torres Arias <santiago@...> wrote:
Hi Richard.

> +0 binding
> Debian is not a company.

I'm somewhat sad to read this reaction, considering we're an open source
project that is *not* backed by a company (one of the few around here in
fact). Although there are other users/communities we work with, I wanted
to single out the long-standing work we've done with Debian dating back
to 2015.

> search[1] nor Debian Maintainer search[2]. In a section below, Debian
> was removed and replaced with "New York University". Not a blocker,
> but being a Debian Developer myself, I feel compelled to mention it.
> Debian packages[3][4] for in-toto are from 2021-03-12, skipping 1.1.0,
> 1.1.1, and the recent 1.2.0 releases[5].

Being a DD yourself, maybe you know Holger Levsen?

    https://github.com/orgs/in-toto/people/h01ger

He's been coaching us in doing the packaging for the Debian ecosystem,
including a transport for APT[1]. Which I believe is also used by
QubesOS.  It is also part of the reproducible builds project to check
cross-build reproducibility (see integration with rebuilderd).

    https://reproducible.seal.purdue.wtf/
    https://github.com/kpcyrd/rebuilderd

Naturally, it is hard for me to make a statement to what level Debian is
involved, without feeling like I'm putting words on people's mouths.
However, I do believe that members of the Debian community have always
been participating and helping us out (mostly as a part of a shared goal
of build reprodicubility, as it is crucial for software supply chain
security). Personally, I was surprised to see your positive attitude for
reproducible builds on another project's (which is good to see it
mentioned!) vote but glossed over the in-toto bits as part of the
effort (I'm don't bleieve there are other CNCF projects listed here):

    https://reproducible-builds.org/who/projects/

> Commit history graph[6] shows a distinct slowdown starting 2020. Does
> this mean the project has reached/is approaching feature completeness?

In a sense, yes, the Python implementation is being used in production,
so we are wary to do major overhauls. We have adopted the attitude to
use the golang implementation to test out new features and then port
them back to the python one.

I can also say that we had various degrees of developer turnover once
the pandemic started...

> Is the "every 3 months release cadence" starting with 1.2.0?

No, this has been a committment we've done and/or around version 1.0. We
have lagged a couple of times, I agree.


> Recent PRs were largely janitorial and/or from bots[7]. Along similar
> lines, the three example PRs[8][9][10] are dated middle of last year.
> ... [snip]
> I know from my own DDs that velocity can be deceiving, and that it can
> also be compensated by extremely wide adoption.

This is true, I'm not entirely in control on velocity. Overall, we get
high fluctuation on it, depending on how features get approved, new
integrations pop up, etc. I wish I had a better answer to this.

> Is there a timeframe for Future Plans & ITEs[11]?

Overall, yes. Not sure if you've seen the roadmap reviews. We have also
moved to a monthly community meeting time where we discuss ITE status
and vote to increase velocity. We're starting to see a lot of
implementations (e.g., witness) that are bringing up new features. As
usual, we're in a tightrope between ensuring everybody is heard in terms
of feature additions (so as to not overlap), and allow people to play
with things to see what works.

>  Yet, I do not currently get a strong feeling of high velocity nor of
>  very wide adoption. At the same time, I realize I am very late to the
>  game in this DD process. Having joined TOC just before a week of
>  illness makes me the late-comer with questions & vote. I explicitly
>  do not want to block anything with incomplete information.

> As such, my current vote is +0 as per above. Depending on answers, I
> would be happy to switch to +1.

I do appreciate your perspective. And I've be happy to answer questions
or rephrase answers as needed.

Cheers!
-Santiago


[1] https://packages.debian.org/sid/x32/utils/apt-transport-in-toto




On Thu, Feb 17, 2022 at 09:00:52PM +0100, Richard Hartmann wrote:


>







Re: [VOTE] In-toto for incubating

Ken Owens
 

+1 NB


On Thu, Feb 17, 2022 at 1:01 PM Melara, Marcela <marcela.melara@...> wrote:

+1 non-binding

 

 

Marcela Melara, PhD

Software Research Scientist

Intel Labs, Oregon

 

 


Re: [VOTE] In-toto for incubating

Santiago Torres Arias <santiago@...>
 

Hi Richard.

+0 binding
Debian is not a company.
I'm somewhat sad to read this reaction, considering we're an open source
project that is *not* backed by a company (one of the few around here in
fact). Although there are other users/communities we work with, I wanted
to single out the long-standing work we've done with Debian dating back
to 2015.

search[1] nor Debian Maintainer search[2]. In a section below, Debian
was removed and replaced with "New York University". Not a blocker,
but being a Debian Developer myself, I feel compelled to mention it.
Debian packages[3][4] for in-toto are from 2021-03-12, skipping 1.1.0,
1.1.1, and the recent 1.2.0 releases[5].
Being a DD yourself, maybe you know Holger Levsen?

https://github.com/orgs/in-toto/people/h01ger

He's been coaching us in doing the packaging for the Debian ecosystem,
including a transport for APT[1]. Which I believe is also used by
QubesOS. It is also part of the reproducible builds project to check
cross-build reproducibility (see integration with rebuilderd).

https://reproducible.seal.purdue.wtf/
https://github.com/kpcyrd/rebuilderd

Naturally, it is hard for me to make a statement to what level Debian is
involved, without feeling like I'm putting words on people's mouths.
However, I do believe that members of the Debian community have always
been participating and helping us out (mostly as a part of a shared goal
of build reprodicubility, as it is crucial for software supply chain
security). Personally, I was surprised to see your positive attitude for
reproducible builds on another project's (which is good to see it
mentioned!) vote but glossed over the in-toto bits as part of the
effort (I'm don't bleieve there are other CNCF projects listed here):

https://reproducible-builds.org/who/projects/

Commit history graph[6] shows a distinct slowdown starting 2020. Does
this mean the project has reached/is approaching feature completeness?
In a sense, yes, the Python implementation is being used in production,
so we are wary to do major overhauls. We have adopted the attitude to
use the golang implementation to test out new features and then port
them back to the python one.

I can also say that we had various degrees of developer turnover once
the pandemic started...

Is the "every 3 months release cadence" starting with 1.2.0?
No, this has been a committment we've done and/or around version 1.0. We
have lagged a couple of times, I agree.


Recent PRs were largely janitorial and/or from bots[7]. Along similar
lines, the three example PRs[8][9][10] are dated middle of last year.
... [snip]
I know from my own DDs that velocity can be deceiving, and that it can
also be compensated by extremely wide adoption.
This is true, I'm not entirely in control on velocity. Overall, we get
high fluctuation on it, depending on how features get approved, new
integrations pop up, etc. I wish I had a better answer to this.

Is there a timeframe for Future Plans & ITEs[11]?
Overall, yes. Not sure if you've seen the roadmap reviews. We have also
moved to a monthly community meeting time where we discuss ITE status
and vote to increase velocity. We're starting to see a lot of
implementations (e.g., witness) that are bringing up new features. As
usual, we're in a tightrope between ensuring everybody is heard in terms
of feature additions (so as to not overlap), and allow people to play
with things to see what works.

Yet, I do not currently get a strong feeling of high velocity nor of
very wide adoption. At the same time, I realize I am very late to the
game in this DD process. Having joined TOC just before a week of
illness makes me the late-comer with questions & vote. I explicitly
do not want to block anything with incomplete information.
As such, my current vote is +0 as per above. Depending on answers, I
would be happy to switch to +1.
I do appreciate your perspective. And I've be happy to answer questions
or rephrase answers as needed.

Cheers!
-Santiago


[1] https://packages.debian.org/sid/x32/utils/apt-transport-in-toto




On Thu, Feb 17, 2022 at 09:00:52PM +0100, Richard Hartmann wrote:



Re: [VOTE] In-toto for incubating

Richard Hartmann
 

+0 binding

Still getting up to speed for TOC, sorry. Some questions:

Debian is not a company. I couldn't find Lukas on Debian Developer
search[1] nor Debian Maintainer search[2]. In a section below, Debian
was removed and replaced with "New York University". Not a blocker,
but being a Debian Developer myself, I feel compelled to mention it.
Debian packages[3][4] for in-toto are from 2021-03-12, skipping 1.1.0,
1.1.1, and the recent 1.2.0 releases[5].

Commit history graph[6] shows a distinct slowdown starting 2020. Does
this mean the project has reached/is approaching feature completeness?

Is the "every 3 months release cadence" starting with 1.2.0?

Recent PRs were largely janitorial and/or from bots[7]. Along similar
lines, the three example PRs[8][9][10] are dated middle of last year.

Is there a timeframe for Future Plans & ITEs[11]?


I know from my own DDs that velocity can be deceiving, and that it can
also be compensated by extremely wide adoption. Yet, I do not
currently get a strong feeling of high velocity nor of very wide
adoption. At the same time, I realize I am very late to the game in
this DD process. Having joined TOC just before a week of illness makes
me the late-comer with questions & vote. I explicitly do not want to
block anything with incomplete information.


As such, my current vote is +0 as per above. Depending on answers, I
would be happy to switch to +1.


Best,
Richard

[1] https://db.debian.org/
[2] https://nm.debian.org/public/findperson/
[3] https://qa.debian.org/developer.php?login=lukas.puehringer%40nyu.edu
[4] https://tracker.debian.org/pkg/in-toto
[5] https://github.com/in-toto/in-toto/tags
[6] https://github.com/in-toto/in-toto/graphs/contributors
[7] https://github.com/in-toto/in-toto/pulls?q=is%3Apr
[8] https://github.com/in-toto/in-toto/pull/462
[9] https://github.com/in-toto/in-toto/pull/456
[10] https://github.com/in-toto/in-toto/pull/466
[11] https://docs.google.com/document/d/1zoOdI_xygcY3Ta1LzTFfAjW8vhvR6lcAqQRlzYNo91k/edit#heading=h.hdo9ytubuszq


Re: [VOTE] Official vote for Knative for inclusion

Richard Hartmann
 

+1 binding


Re: [VOTE] Official vote for Knative for inclusion

Maulik Shyani
 

+1 nb

On Thu, Feb 17, 2022 at 11:01 AM <naisingh@...> wrote:
+1 non-binding







Re: [VOTE] Official vote for Knative for inclusion

naisingh@...
 

+1 non-binding


Re: [VOTE] Official vote for Knative for inclusion

naisingh@...
 

+1 non-binding


[VOTE] In-toto for incubating

Melara, Marcela <marcela.melara@...>
 

+1 non-binding

 

 

Marcela Melara, PhD

Software Research Scientist

Intel Labs, Oregon

 

 


Re: [VOTE] Kubevirt for inclusion

Erin Boyd
 

+1 binding

On Wed, Feb 16, 2022 at 12:03 PM Amye Scavarda Perrin <ascavarda@...> wrote:
Kubevirt has applied to move to the incubation level.

PR: https://github.com/cncf/toc/pull/715

DD doc: https://docs.google.com/document/d/1L1JG9IVja7j5cV5c1mxutctGPpL3ihz5nW1S1w4zvS4/edit

Alena Prokharchyk is the TOC sponsor for this project, has called for public comment and has approved a call for a public vote. (https://lists.cncf.io/g/cncf-toc/message/6563)

Please vote (+1/0/-1) by replying to this thread.

Remember that the TOC has binding votes only, but we do appreciate non-binding votes from the community as a sign of support!

--
Amye Scavarda Perrin | Director of Developer Programs, CNCF | amye@...



--

Erin A. Boyd

Distinguished Engineer, OCTO

Red Hat

eboyd@...   


Re: [VOTE] Kubevirt for inclusion

Herve LECLERC
 

+1 non-binding


Re: [VOTE] Official vote for Knative for inclusion

Karena Angell
 

+1 non-binding


Re: [VOTE] Kubevirt for inclusion

Karena Angell
 

+1! non-binding


Re: [VOTE] Kubevirt for inclusion

Philippe Robin
 

+1 NB

 

Best regards,

Philippe

 

From: cncf-toc@... <cncf-toc@...> On Behalf Of Amye Scavarda Perrin via lists.cncf.io
Sent: 16 February 2022 19:00
To: CNCF TOC <cncf-toc@...>
Subject: [cncf-toc] [VOTE] Kubevirt for inclusion

 

Kubevirt has applied to move to the incubation level.

PR: https://github.com/cncf/toc/pull/715

DD doc: https://docs.google.com/document/d/1L1JG9IVja7j5cV5c1mxutctGPpL3ihz5nW1S1w4zvS4/edit


Alena Prokharchyk is the TOC sponsor for this project, has called for public comment and has approved a call for a public vote. (https://lists.cncf.io/g/cncf-toc/message/6563)

Please vote (+1/0/-1) by replying to this thread.

Remember that the TOC has binding votes only, but we do appreciate non-binding votes from the community as a sign of support!

 

--

Amye Scavarda Perrin | Director of Developer Programs, CNCF | amye@...

IMPORTANT NOTICE: The contents of this email and any attachments are confidential and may also be privileged. If you are not the intended recipient, please notify the sender immediately and do not disclose the contents to any other person, use it for any purpose, or store or copy the information in any medium. Thank you.


Re: [VOTE] Kubevirt for inclusion

Oleg Nenashev
 

+1 non-binding

On Thu, Feb 17, 2022 at 10:34 AM Ricardo Rocha <ricardo.rocha@...> wrote:
+1 binding

On Thu, Feb 17, 2022 at 09:46:34AM +0100, Dave Zolotusky via lists.cncf.io wrote:
> +1 binding
>
> On Thu, Feb 17, 2022 at 9:25 AM saiyam pathak <Saiyam911@...> wrote:
>
> > +1 nb
> >
> > On Thu, 17 Feb 2022 at 1:52 PM, Liz Rice <liz@...> wrote:
> >
> >> +1 nb
> >>
> >>
> >>
> >> On Thu, 17 Feb 2022 at 05:08, Divya Mohan <divya.mohan0209@...>
> >> wrote:
> >>
> >>> +1 non binding
> >>>
> >>> Regards,
> >>> Divya
> >>>
> >>> On Thu, Feb 17, 2022 at 12:30 AM Amye Scavarda Perrin <
> >>> ascavarda@...> wrote:
> >>>
> >>>> Kubevirt has applied to move to the incubation level.
> >>>>
> >>>> PR: https://github.com/cncf/toc/pull/715
> >>>>
> >>>> DD doc:
> >>>> https://docs.google.com/document/d/1L1JG9IVja7j5cV5c1mxutctGPpL3ihz5nW1S1w4zvS4/edit
> >>>>
> >>>> Alena Prokharchyk is the TOC sponsor for this project, has called for
> >>>> public comment and has approved a call for a public vote. (
> >>>> https://lists.cncf.io/g/cncf-toc/message/6563)
> >>>>
> >>>> Please vote (+1/0/-1) by replying to this thread.
> >>>>
> >>>> Remember that the TOC has binding votes only, but we do appreciate
> >>>> non-binding votes from the community as a sign of support!
> >>>>
> >>>> --
> >>>> Amye Scavarda Perrin | Director of Developer Programs, CNCF |
> >>>> amye@...
> >>>>
> >>>>
> >>>
> >>> --
> >>> Best regards,
> >>> Divya Mohan
> >>> (https://linktr.ee/divyamohan)
> >>>
> >>> --
> > CNCF Ambassador
> > <https://saiyampathak.com/youtube>
> > <https://www.linkedin.com/in/saiyampathak/>
> > <https://twitter.com/saiyampathak>
> >
> >
> >
>
> --
> ~Dave
>
>
>
>
>






Re: [VOTE] Kubevirt for inclusion

Ricardo Rocha
 

+1 binding

On Thu, Feb 17, 2022 at 09:46:34AM +0100, Dave Zolotusky via lists.cncf.io wrote:
+1 binding

On Thu, Feb 17, 2022 at 9:25 AM saiyam pathak <Saiyam911@gmail.com> wrote:

+1 nb

On Thu, 17 Feb 2022 at 1:52 PM, Liz Rice <liz@lizrice.com> wrote:

+1 nb



On Thu, 17 Feb 2022 at 05:08, Divya Mohan <divya.mohan0209@gmail.com>
wrote:

+1 non binding

Regards,
Divya

On Thu, Feb 17, 2022 at 12:30 AM Amye Scavarda Perrin <
ascavarda@linuxfoundation.org> wrote:

Kubevirt has applied to move to the incubation level.

PR: https://github.com/cncf/toc/pull/715

DD doc:
https://docs.google.com/document/d/1L1JG9IVja7j5cV5c1mxutctGPpL3ihz5nW1S1w4zvS4/edit

Alena Prokharchyk is the TOC sponsor for this project, has called for
public comment and has approved a call for a public vote. (
https://lists.cncf.io/g/cncf-toc/message/6563)

Please vote (+1/0/-1) by replying to this thread.

Remember that the TOC has binding votes only, but we do appreciate
non-binding votes from the community as a sign of support!

--
Amye Scavarda Perrin | Director of Developer Programs, CNCF |
amye@linuxfoundation.org

--
Best regards,
Divya Mohan
(https://linktr.ee/divyamohan)

--
CNCF Ambassador
<https://saiyampathak.com/youtube>
<https://www.linkedin.com/in/saiyampathak/>
<https://twitter.com/saiyampathak>


--
~Dave





Re: [VOTE] Kubevirt for inclusion

Dave Zolotusky
 

+1 binding

On Thu, Feb 17, 2022 at 9:25 AM saiyam pathak <Saiyam911@...> wrote:
+1 nb

On Thu, 17 Feb 2022 at 1:52 PM, Liz Rice <liz@...> wrote:
+1 nb



On Thu, 17 Feb 2022 at 05:08, Divya Mohan <divya.mohan0209@...> wrote:
+1 non binding

Regards,
Divya

On Thu, Feb 17, 2022 at 12:30 AM Amye Scavarda Perrin <ascavarda@...> wrote:
Kubevirt has applied to move to the incubation level.

PR: https://github.com/cncf/toc/pull/715

DD doc: https://docs.google.com/document/d/1L1JG9IVja7j5cV5c1mxutctGPpL3ihz5nW1S1w4zvS4/edit

Alena Prokharchyk is the TOC sponsor for this project, has called for public comment and has approved a call for a public vote. (https://lists.cncf.io/g/cncf-toc/message/6563)

Please vote (+1/0/-1) by replying to this thread.

Remember that the TOC has binding votes only, but we do appreciate non-binding votes from the community as a sign of support!

--
Amye Scavarda Perrin | Director of Developer Programs, CNCF | amye@...



--
Best regards,
Divya Mohan

--
CNCF Ambassador



--
~Dave


Re: [VOTE] Kubevirt for inclusion

saiyam pathak
 

+1 nb

On Thu, 17 Feb 2022 at 1:52 PM, Liz Rice <liz@...> wrote:
+1 nb



On Thu, 17 Feb 2022 at 05:08, Divya Mohan <divya.mohan0209@...> wrote:
+1 non binding

Regards,
Divya

On Thu, Feb 17, 2022 at 12:30 AM Amye Scavarda Perrin <ascavarda@...> wrote:
Kubevirt has applied to move to the incubation level.

PR: https://github.com/cncf/toc/pull/715

DD doc: https://docs.google.com/document/d/1L1JG9IVja7j5cV5c1mxutctGPpL3ihz5nW1S1w4zvS4/edit

Alena Prokharchyk is the TOC sponsor for this project, has called for public comment and has approved a call for a public vote. (https://lists.cncf.io/g/cncf-toc/message/6563)

Please vote (+1/0/-1) by replying to this thread.

Remember that the TOC has binding votes only, but we do appreciate non-binding votes from the community as a sign of support!

--
Amye Scavarda Perrin | Director of Developer Programs, CNCF | amye@...



--
Best regards,
Divya Mohan

--
CNCF Ambassador


Re: [VOTE] Kubevirt for inclusion

Liz Rice
 

+1 nb



On Thu, 17 Feb 2022 at 05:08, Divya Mohan <divya.mohan0209@...> wrote:
+1 non binding

Regards,
Divya

On Thu, Feb 17, 2022 at 12:30 AM Amye Scavarda Perrin <ascavarda@...> wrote:
Kubevirt has applied to move to the incubation level.

PR: https://github.com/cncf/toc/pull/715

DD doc: https://docs.google.com/document/d/1L1JG9IVja7j5cV5c1mxutctGPpL3ihz5nW1S1w4zvS4/edit

Alena Prokharchyk is the TOC sponsor for this project, has called for public comment and has approved a call for a public vote. (https://lists.cncf.io/g/cncf-toc/message/6563)

Please vote (+1/0/-1) by replying to this thread.

Remember that the TOC has binding votes only, but we do appreciate non-binding votes from the community as a sign of support!

--
Amye Scavarda Perrin | Director of Developer Programs, CNCF | amye@...



--
Best regards,
Divya Mohan


Re: [VOTE] Official vote for Knative for inclusion

Aparna Sinha
 

+1 non-binding.

On Wed, Feb 16, 2022 at 9:10 PM Divya Mohan <divya.mohan0209@...> wrote:
+1 non binding

Regards,
Divya

On Thu, Feb 17, 2022 at 2:02 AM Kevin Lynch via lists.cncf.io <klynch=squarespace.com@...> wrote:
+1 non-binding!

On Mon, Feb 14, 2022 at 11:02 AM Amye Scavarda Perrin <ascavarda@...> wrote:
Knative has applied for inclusion at the incubation level.
PR: https://github.com/cncf/toc/pull/762
Due Diligence doc: https://docs.google.com/document/d/1qPMyIBZ1tBk6WpEMPuLtTrjA6lvbrQ7DvCZb22S0llo/edit?usp=sharing

Davanum Srinivas is the TOC sponsor for this project, has called for public comment and has approved a call for a public vote. (https://lists.cncf.io/g/cncf-toc/message/6551)

Please vote (+1/0/-1) by replying to this thread.

Remember that the TOC has binding votes only, but we do appreciate non-binding votes from the community as a sign of support!

--
Amye Scavarda Perrin | Director of Developer Programs, CNCF | amye@...



--
Best regards,
Divya Mohan

341 - 360 of 7034