#opendaylight-meeting: tsc

Meeting summary

1. Agenda Bashing & Roll Call (abhijitk, 16:58:39)
   1. abhijitk (abhijitk, 16:58:45)
   2. skitt (skitt, 17:01:21)
   3. jamoluhrsen (jamoluhrsen, 17:02:27)
   4. rovarga (rovarga, 17:04:59)
   5. Thanh Ha (zxiiro, 17:05:05)
   6. Prem #project coe (premsankar, 17:06:02)
   
   
2. ONAP and CII vulnerabilities (skitt, 17:07:17)
   1. shague (shague, 17:07:19)
   2. ONAP projects depend on CCSDK which depends on ODL (skitt, 17:09:10)
   3. ONAP representatives: Dan Timoney, Taka Cho, Pawel Pawlak (abhijitk, 17:09:25)
   4. ONAP projects need to list vulns in their repos, and some of them come from ODL (skitt, 17:09:28)
   5. ONAP's suggestion is to create a tiger team with ODL and ONAP representatives to discuss the issues and come up with an action plan (skitt, 17:11:49)
   6. on the ODL side, we need to know what version of ODL ONAP is using (skitt, 17:13:39)
   7. Oxygen SR4 fixed a number of issues, and is about to stop being supported (skitt, 17:13:56)
   8. quite a few of the issues reported are related to projects such as tsdr, sxp etc. which are self-managed or being removed (skitt, 17:14:41)
   9. so we also need to know how ONAP is assembled and what ODL projects ONAP needs (skitt, 17:15:03)
   10. ONAP Dublin is based on Fluorine SR1 (skitt, 17:15:12)
   11. ONAP pulls in the full Karaf tarball from ODL (skitt, 17:15:27)
   12. ONAP wonder what licensing impact it would have if ONAP rebuilds their own Karaf distribution (skitt, 17:15:52)
   13. rovarga points out that there is no issue in this regard, and fd.io rebuilds many ODL projects (skitt, 17:16:18)
   14. ONAP would need to check with LFN legal (skitt, 17:16:32)
   15. https://docs.opendaylight.org/en/latest/release-process/release-schedule.html (dfarrell07, 17:18:14)
   16. https://docs.opendaylight.org/en/latest/release-process/release-schedule.html ODL rel schedule (dfarrell07, 17:18:21)
   17. Fluorine has fewer projects than Oxygen so upgrading to Fluorine should reduce the security footprint (skitt, 17:19:26)
   18. re moving forward, rovarga suggests ONAP should switch to a minimal distribution with only their requirements, and then we can revisit the security impact of dependencies (skitt, 17:20:43)
   19. dfarrell07 points out that ONAP would benefit from participating more in the ODL communities they depend on (skitt, 17:24:15)
   20. ONAP asking for an ONAP-specific ODL build, so they can have a single ODL point of reference and use ODL CSIT (skitt, 17:24:49)
   21. dfarrell07 thinks ranked value of options is: 1. Get more involved in ODL, get the folks benefiting from ODL contributing back to ODL 2. Make sure you're closely following ODL release cycle to get the things we're fixing 3. Reduce exposure area with minimal distro. (dfarrell07, 17:28:09)
   22. Next steps are for ONAP to spec out MVP of what they need in a distro; for ONAP to figure out plan for contributing to ODL to keep it healthy in the long-term; be aware that some minimal benefit may come from even-more-closely following release train (dfarrell07, 17:34:39)
   
   
3. Sodium DDF (abhijitk, 17:35:50)
   1. https://wiki.opendaylight.org/view/Events:Sodium_Dev_Forum (abhijitk, 17:36:13)
   2. Sodium DDF planned in the Ericsson Santa Clara conference rooms on April 1 and 2 (abhijitk, 17:38:15)
   3. desperate plea for topic submissions (skitt, 17:41:03)
   4. the DDF will be open to external participants, but we need ODL contributors to submit topics (skitt, 17:41:30)
   
   
4. Releases (abhijitk, 17:42:05)
   1. Daniel De La Rosa and Ariel Adam working on the transition (abhijitk, 17:43:28)
   2. https://jenkins.opendaylight.org/releng/view/autorelease/job/autorelease-release-neon-mvn35-openjdk8/ autorelease is failing, last 7 in a row (dfarrell07, 17:54:42)

Action items

1. (none)

People present (lines said)

1. skitt (20)
2. abhijitk (19)
3. adetalhouet (12)
4. dfarrell07 (12)
5. odl_meetbot (4)
6. rovarga (3)
7. zxiiro (3)
8. shague (1)
9. LuisGomez (1)
10. premsankar (1)
11. jamoluhrsen (1)
12. lori_ (1)
13. CaseyLF (0)