Project members update

[Jakuje]

I started this discussion in email last week that the current list of maintainers and core members is no longer up-to-date, making some of the arrangements complicated (for example assigning correct people to the confidential security reports on github) but for the sake of transparency, I am starting an public discussion about this topic, but would like to hear opinions mostly from @OpenSC/core, but also from anyone else who would like to point out some valid reasons for not doing these changes or if I missed somebody.

From the current list of @OpenSC/opensc-maintainers :

• I see that @szikora is not much active over last ~10 years. Would it make sense to remove him from the maintainers (or do you use your role in some other way that I do not see?)
• On the other hand, I see @popovec quite active in all contributions, reviews and discussions over last years so I would be proposing to add him to this group (indeed only if you are interested!).
• My last proposal would be to add @xhanulik. She extended the fuzzing of the OpenSC over the last years, but touched several other areas including huge improvement of the support for IDPrime cards. I would like her to take over some work I do these days
• There are also @metsma and @hhonkanen having fewer contributions, but still quite consistent over the last years, but mostly in their area of expertise.

Mostly based on the following report: https://github.com/OpenSC/OpenSC/graphs/contributors

[frankmorgner]

I agree to the suggestions, given there are no objections from the people mentioned.

[popovec]

As long as it means for me to continue what I have been doing so far, ie. track issues, contribute to fixing them and add new features, so of course I agree. At the same time, I also agree with the other proposed people.

[Jakuje]

I do not think we have any formal responsibilities defined so what you describe basically matches what we do. But in addition, we do releases and we have access to embargoed issues and merge requests where another pair of eyes is always helpful. We can also add you to coverity scan (I see you are there already) and oss-fuzz reports if you would be interested. That are also lists somewhere else that needs to be re-checked:

https://github.com/google/oss-fuzz/blob/master/projects/opensc/project.yaml

[popovec]

Of course, I am also interested in reports from oss-fuzz. And I fully understand that in the case of security problems, it is necessary not to publish anything that would allow the security problem to be exploited until the given problem is solved.

[Jakuje]

Adding Peter to the oss-fuzz here: google/oss-fuzz#11392

[frankmorgner]

With more members on the board, I hope, we can accept/review pull requests more quickly. Better branch protection rules should then also be possible.

[LudovicRousseau]

No objections on my side. It is often a good idea to embark active people.
I was not very active on OpenSC in the last years.

I also propose to add @Jakuje to @OpenSC/core just in case the other core members "disappear".
I don't know why we have @OpenSC/core and @OpenSC/maintainers as they both have the "Admin" role.

[frankmorgner]

please check again, you should now be admin

[Jakuje]

Thank you. Now I see there much more options.

[frankmorgner]

Core/Maintainers seem to serve the same purpose. I've checked "Settings > Collaborators and Teams" for every repository in the OpenSC organizaition and Core/Maintainers were present as Admin everywhere except in tokend (Maintainers was missing). So I think the group Maintainers is superfluous and can be removed. This then also avoids the possible confusion with XXX maintainers, who all have "write" access instead of admin rights.

[Jakuje]

Thanks. I invited @xhanulik and @popovec for now to OpenSC maintainers.

Next step would be probably removing the Maintainers group if there will be no strong voices against.

I would like also to remove the JenkinsForOpenSC and configure the organization to require everyone to have 2FA enabled (I see it is now everyone except for this user -- is it used for anything now? Do somebody have access to that? I see .fr domain in the bio so my guess would be @LudovicRousseau).

[Jakuje]

Just enabled the requirement for 2FA for everyone. I think it should not affect anyone, but just noting it here as it was discussed.

[metsma]

No objections on my side.

[Jakuje]

Sent invite today (sorry for a delay)

[hhonkanen]

No objections on my side.

[Jakuje]

@metsma @hhonkanen in case you are interested in oss-fuzz and coverity scan reports on master, please, send me your mails (either here or to my mail). The only limitation is that oss-fuzz requires gmail account to access all the functionality and it will be in the public oss-fuzz repository.

For access to the opensc maintainers, either request the access on https://github.com/orgs/OpenSC/teams/opensc-maintainers or wait for the invitation,

[Jakuje]

Sent invite now. Sorry for a delay.

[xhanulik]

No objections, either.

[LudovicRousseau]

I would like also to remove the JenkinsForOpenSC and configure the organization to require everyone to have 2FA enabled (I see it is now everyone except for this user -- is it used for anything now? Do somebody have access to that? I see .fr domain in the bio so my guess would be @LudovicRousseau).

JenkinsForOpenSC was used by @viktorTarasov for its opensc.fr/jenkins service. See #595 (comment)
I think we can remove this account now.

[Jakuje]

This was removed too.

[Jakuje]

I think all of the items in this discussion were resolved so closing now. Thank you.