Hi all Can we have a refresh on this. https://github.com/cncf/sig-security/issues/538#issuecomment-785417458 I think we need to get grown up about security processes for our projects. Alexis

thanks Liz this is a *terrific resource* that costs lots of money & time, and it is useless if we don't make it public and prune out old stuff

I understand this is Beta I believe all of the CNCF community should have equal access.

I strongly disagree Chris, this is a great resource that all should be aware of. Now that we don’t have FPs, can we just publish the data? Please do not assume that end users will not run their own sc

thanks, how do I share these with the flux maintainers and community

Yes, please. To your general point -- I have a view that if Snyk (or similar) offers a free scanning service to CNCF projects, then the community should benefit. These are completely standard scanning

I see. Well, I'm not. This info should be open to all, without any barriers whatsoever

Thanks Chris It would be great if this data was readily accessible. I don't think packing into GH actions provides that, however useful it may be for other purposes

Hi all Has anyone looked at this? https://security.lfx.linuxfoundation.org/#/ How do we see project data? I wanted to take a look at flux. I had to create a login. Then, I had to "request" a view, whi

+1 big thank-you to outgoing TOC

if CNCF wants to help, then publish some guidelines. Or, people will just do their own thing.

IMO, everyone's using version numbers in different ways now. For example many projects go to 1.0 once they are feature complete, and hit production way before that. I think insisting on 1.0 for gradua

+1

+1, nb

Congrats Helm team!

I think it's important to listen to people who actually produce the software here. It is really really hard to sustain quality. Adding demands just hurts, doesn't help. That's why we are looking at br

Graduation is not meant to be some kind of super impossible bar. It should be pretty easy to go from successful Incubation to Graduation, provided social conditions are met. Let's not assume that all

Matt Thanks. A few quick comments (topline for speed). CNCF Incubation tests for production use and technical DD. It has a high bar. Graduation is oriented towards sustainability including some of the

"Projects struggling to get maintainers when the owning entity is unwilling to give up control to the community" This mostly does not happen. Although due to some bad actors, it can. Mostly projects a

I wish to note that it was @cra's idea. I just wrote about it and then talked about it a lot.