Materials and meeting notes for the ASWF Technical Advisory Council (TAC)
Home Page: https://tac.aswf.io
License: Creative Commons Attribution 4.0 International
This repo contains materials, meeting materials, and process documents for the Academy Software Foundation TAC.
The best way you can view these materials at https://tac.aswf.io. If you have any feedback or changes, please file a pull request or create an issue.
![dependabot[bot] avatar](https://avatars.githubusercontent.com/in/29110?v=4 "dependabot[bot]")
The goal is to shift meetings to using LFX Meeting Management, which enables a smoother experience, easier management, and better data tracking.
Update on transition:
Projects moved over:
CI Working Group
Digital Production Example Library (DPEL)
OpenAssetIO
OpenFX
OpenImageIO
Open Review Initiative
OpenVDB
Rez
USD Working Group
OpenColorIO
Rust WG
D&I Working Group
MaterialX
Open Shading Language (OSL)
OpenTimelineIO
RAW to ACES Utility
OpenEXR
OpenCue
In Progress:
None
TODO:
None
The purpose of the Zero Trust Working Group is to support ASWF projects that need to function in a Zero Trust operating environment. As workflows and assets move to the cloud, perimeter security is no longer adequate in many situations. New models, such as Zero Trust, are being used that require many clients and services to become security aware. For example, they may need to integrate with authentication and authorization services or to interoperate with logging, monitoring, or threat detection systems.
The aim of this working group is to assist ASWF projects in determining their zero trust security needs and to share best practices on implementation approaches.
Schedule for December and January:
OCIO, USD, and MaterialX leaders have been working on a proposal for a lightweight version of OCIO for use in rendering, texture, and material use cases. We are at the point where we would like to discuss and get feedback from the TAC. Here is the charter: https://docs.google.com/document/d/1eGLtOHY-hNKXdtBUJWQHK25WQcK2zjDJYkldmE6eZVY/edit?usp=sharing
We are seeking feedback from the TAC on the overall plan, and also for stakeholders to participate from member companies as needed.
5 minutes or less
CLOTributor is a tool from CNCF to help developers find ways to contribute to projects. Currently, CNCF, LF AI and Data, and CD Foundation projects have issues highlighted on the site.
We are adding all the ASWF Projects to this tool to help drive awareness of where help is needed within projects.
Projects wishing to have issues shown of theirs in CLOTributor need to:
5 minutes or less
Emily is arranging an Open Source Track at FMX 2024
Interest for participation
None
We are combining the previous member and maintainer survey into one stakeholder survey. This survey aims to get feedback on the ASWF programs and identify any areas of improvement.
Complete the survey at https://forms.gle/TVhc1UwTCj2qWUM48
This survey will go live 12/1 and close on 12/31. We will re-run the survey again in June 2024 and December 2024.
Annually we review and re-elect these roles...
Suggest making awareness of this 11/15, and discuss more on 11/29
Please submit your vote for if TAC meetings should be automatically recorded.
+1 - Yes
0 - Abstain
-1 - No
[Uniform Type Identifiers ](https://en.wikipedia.org/wiki/Uniform_Type_Identifier#:~:text=A%20Uniform%20Type%20Identifier%20(UTI,class%20or%20type%20of%20item.) akin to MIME types
We'd love to get any guidance from the TAC re: this. Should not take long.
None
Sponsorships: Here are the sponsorship opportunities for Open Source Forum, if you would like to proudly have your logo on display during the event. Several of the options are already pending, so don't wait too long.
Registration: The member code for registration is ASWFOSF24MEM, and it's for both in-person and virtual attendance. This event is FREE for all employees of member companies, so please share the link and code with your teams and co-workers. Register here.
The LF has published a policy regarding using Generative AI tools in development for hosted projects. See below...
https://www.linuxfoundation.org/legal/generative-ai
Awareness of the TAC.
5 minutes or less
Site/Registration is live: https://sites.google.com/view/aswfdevdays/home
Project Lead info / tasks: https://docs.google.com/document/d/1l6VTBRXZju4twJKW-PL_oymWEJTD1I3I7BtH4GY-KLk/edit?usp=sharing
Example Outreach Templates: https://docs.google.com/document/d/17zDTKW39wWHzN-NNZjzyy98BgYMxhFC38AOykWW2u5k/edit?usp=sharing
We have a proposal for a Zero Trust Working Group including participation commitments from several ASWF members. We want to update the TAC on the proposal so they can review it for subsequent approval.
Not sure of the process here. We could do 5-10 minutes at one meeting, get TAC review and comments off line, and then bring back for approval.
TAC feedback on the proposed charter and subsequent TAC approval.
5 minutes or less
As proposed by Jonathan Stone on the #tac channel in the ASWF Slack.... ( https://academysoftwarefdn.slack.com/archives/CKB8RR3FT/p1695761680176419 )
Hello all!
John Mertic and I have been discussing the pros and cons of requiring Silver and Gold OpenSSF badges for ASWF project graduation, and this seems like a topic that is interesting enough to open up for broader discussion.
Based on our conversation so far, here are some of the reasons that we might consider changing our lifecycle rules, maintaining Silver and Gold badges as aspirational goals for all ASWF projects, but not using them as blockers for project graduation:
No ASWF project has ever achieved either a Silver or Gold badge, including the foundational computer graphics projects that launched with the ASWF itself.
Our most recent graduating projects were approved unanimously without achieving either a Silver or Gold badge.
Outside of the ASWF, none of the foundational OSS projects in computer graphics (e.g. PBRT, Mitsuba, Embree, OpenUSD, Filament) has ever achieved either a Silver or Gold badge, and there's no evidence that they're currently pursuing them. One potential reason for this is the disconnect between the focus of the Silver and Gold badges (security guarantees, statement and branch coverage), and the emphasis of computer graphics projects on visual parity and visual regression testing.
We'd be very interested in additional thoughts from this group, and this could be a good discussion topic for a future TAC meeting.
Discussion on how to proceed
At least 30 minutes
The content you are editing has changed. Please copy your edits and refresh the page.
This has been pushed live now - read more at https://tac.aswf.io/tools/resource_request
For now, any requests will be put on the TAC meeting agenda board and triaged into a meeting for review/approval. We can continue to refine the project as we go on.
Awareness
5 minutes or less
To help address some of the questions on security for projects and to help prepare them for a future security audit, we'd like to have some of our projects go through a security threat model analysis. An example of the output of this work can be seen at the link below...
https://ostif.org/wp-content/uploads/2023/11/Eclipse-Mosquitto-Threat-Model.pdf
Interest from a few projects to do this.
5 minutes or less
From email thread and @jfpanisset
My understanding of some of the steps required:
- We decided to only target GitHub Actions, since that's the where ASWF projects are moving towards, and to use OCIO as the initial project to deploy this. Support for GitHub Actions is being worked on currently in OCIO, but we will need this work to appear in the repo.
- We will be targeting AWS, and yes apparently it is now possible to have "sub accounts" under the overall LF releng AWS account, and to target any ASWF-specific AWS credits to that sub account.
- I think for now we can target only the OCIO nightly build out of the branch in which PRs have been merged, so we don't need to solve right away the issue of managing secrets / AWS credentials in PR forks. Of course there's still the possibility of a bad actor managing to obfuscate credential stealing code that makes it past the reviewers and gets merged into the OCIO repo, but that's a general problem that everyone has to deal with, not just us.
- Strict limits can be set on the ASWF AWS sub account to allow it to allocate a single GPU VM, and nothing else, we can raise these limits as our needs increase.
- Most importantly, currently the "on demand GPU VM allocation via GitHub Actions" code in https://github.com/jfpanisset/cloud_gpu_build_agent is not very robust, and in particular if the build fails, it will leave the GPU VM running and chewing up money. But that code can be improved along the way, it's not a bad idea to get GPU support going in a real world CI scenario as soon as possible.
Does that correspond to everyone's recollection of where we've ended up?
The Swift working group is dedicated to providing both Swift and C/C++ interoperability between each of these languages which allows the many existing libraries across the industry to be easily extended, safer, and easier to use. While additionally empowering all software development by easy adoption of industry software through harnessing the capabilities of the Swift package manager (SPM), which makes adding a library to other projects as simple as copying a library's link and pasting it into its package dependency section.
We have currently provided Swift support of Pixar's Universal Scene Description as a proof of concept, which currently supports both Linux and Apple's operating systems.
@resultBuilder.@jmertic Should the top level readme.md for the TAC repo include a link to the Netflify published version of the repo?
Also the initial commit added some metadata to the top of most of the markdown documents indicating their
position in the (directory) hierarchy, does this data get auto-generated, or do new documents need to add
this data explicitly?
If so we may want to document that process somewhere, and perhaps there should be a PR time check to make sure
the metadata is present?
John has been working with our LFX Security team and OpenEXR on a solution so that C/C++ projects can be included in the Synk scans in LFX Security. See the issue below.
AcademySoftwareFoundation/openexr#1608
We'd like other project leads to try this out in their projects if this is a blocker for them.
5 minutes or less
Intel has volunteered a resource to do security reviews for our hosted projects, though they requested to have an additional member provide a resource in addition so there is a balanced view.
Seeing if a member company would have such a resource.
5 minutes or less
Review calculated COCOMO models for hosted projects; get TAC feedback
As discussed on TAC meeting of 29-Jul-2020, @jmertic could you update the sample CLA and guidance to reflect the preference for the Apache CLA going forward?
We launched a new swag store at Open Source Days!
Seeing that there is already a Slack thread, Let's capture some feedback in the store in this ticket to make it a bit more structured. Thanks for all your feedback.
OpenLensIO is a community dedicated to enhancing interoperability in lens distortion modelling for media production. It formulates a set of standard mathematical models for lenses targeting their application in media production and presents open-source reference implementations for the providers and consumers of lens metadata.
If it's not already on your calendar, Open Source Forum 2024 will take place on Thursday, February 22, at the Petersen Automotive Museum in LA (and virtually).
Everything you need to know (at least for now) is in very succinct bullets below. Please read through them and pass along to others however you see fit. Shout, or quietly email, with any questions.
-Emily
Program Committee: Nominations are due by Friday, December 15. Program Committee members review the talk submissions and decide what makes it into the agenda! We are looking for a diverse mix of people on the committee, you do not need to be technical. Nominate yourself or someone else here.
Talk Submissions: The Call for Presentations (CFP) for Open Source Forum is now open! Talks need to be submitted by Thursday, December 21. It doesn't need to be related to a Foundation production, it just needs to be relevant to open source. Bonus points if it's related to AI, ML, virtual production or includes production examples. Please share with your teams and anyone else who might be interested in submitting. Application is here. You can also send me the name of someone you think would be fantastic to give a talk, and I'll reach out to them.
Sponsorships: Here are the sponsorship opportunities for Open Source Forum, if you would like to proudly have your logo on display during the event. Several of the options are already pending, so don't wait too long.
Registration: The member code for registration is ASWFOSF24MEM, and it's for both in-person and virtual attendance. This event is FREE for all employees of member companies, so please share the link and code with your teams and co-workers. Register here.
The Python Imaging Library adds image processing capabilities to your Python interpreter. This library provides extensive file format support, an efficient internal representation, and fairly powerful image processing capabilities. The core image library is designed for fast access to data stored in a few basic pixel formats. It should provide a solid foundation for a general image processing tool.
N/A
Adopted
To explain this I'll cite this blog entry, in which Cary Phillips said:
"Before the ASWF was established, the responsibility for fixing bugs and addressing security issues was resting solely on ILM. Now that responsibility is shouldered by people throughout the industry which is a much better position to be in."
Currently a 4-person team funded by Tidelift is responsible for fixing Pillow bugs and addressing security issues. The current funding is insufficient and so therefore the long term viability of Pillow has not been secured. Insomuch as the ASWF cares about the entire VFX Reference Platform, even small projects, our missions are aligned! EDIT: this request is not exclusively about $$$, although $$$ would help. It's more about trying to get folks to care about and appreciate Pillow's role in the ecosystem. 🙏
https://github.com/python-pillow/Pillow
The core team includes myself (fork author and project leader), Eric Soroos, Hugo van Kemenade, Andrew Murray. In addition to the core team we have ~400 other contributors.
Image-sig back in the day, but now-a-days GitHub Discussions
https://github.com/python-pillow/Pillow/issues
We're retiring our Twitter and moving to Mastodon.
No, unless you count the Python trademark.
We have a new system for adding agenda items. We will demo it.
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
An Open Source Machine Learning Framework for Everyone
Django
The Web framework for perfectionists with deadlines.
Laravel
A PHP framework for web artisans
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
Some thing interesting about web. New door for the world.
A server is a program made to process requests and deliver data to clients.
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
Some thing interesting about visualization, use data art
Some thing interesting about game, make everyone happy.
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
Microsoft
Open source projects and samples from Microsoft.
Google
Google ❤️ Open Source for everyone.
Alibaba
Alibaba Open Source for everyone
D3
Data-Driven Documents codes.
Tencent
China tencent open source team.