Build team meeting Agenda for 3/28/2019 - CVE Correction Bugs - working now on these bugs with Erich - right now 2 CVEs are straightforward - perl - keepalive - systemd package is more work than anticipated - this package is modified; we have patches - the patches need to be rebased - they must not be fuzzy - need to make sure we don't touch the fix - if we do, Victor can creates test to ensure the CVE correction is still valid - testing the new packages - test the package itself - no for keepalive or perl - maybe for systemd if we impact the CVE correction - next: talk to Ada and run a sanity - CVE Scanning for ISO - Memo: - working on putting this in the pipeline - more challenging than anticipated - installation is a challenge - 75% done - automated scans – next steps - automation of the output - publish on a web server - further actions - replication of the setup in the open - wiki - jenkins scripts - CVE Scanning for the Containers - Option 1: use Clair - Create a harbor registry that pulled docker images from dockerHub - run clair scans (give some results immediately - Victor will play with this and review the results - enhance clair with Irene's changes - Option #2 vuls - Victor will compare results - Multi layer build requirements discussion https://etherpad.openstack.org/p/stx-build-requirements - 3 options were discussed 1/ Evolving the current build to augment the build avoidance capabilities 2/ Creating a new layered build 3/ Create a new atomic element build (proposed by Victor) - next steps are to flush out these options and propose a path forward - need Scott for this discussion to ensure we have SME /KenY