uptane/uptane-standard

Approving the release of V.2.1.0

Closed this issue · 17 comments

jhdalek55 commented

The Uptane Standards group has set a release date for V.2.1.0 of May 15, 2023. To do so, we need the approval of a simple majority of active members. Your vote to approve can be posted here. If we do not receive enough votes prior to our Standards meeting on 5-9-23, a voice vote will be taken.

V.2.1.0 is a minor release containing no breaking changes. The changes it includes, which are detailed below, are largely wording clarifications. The most significant addition is referencing the Scudo option as an augmentation for supply chain security.

Specifically V.2.1.0 includes the following:

Added

  • A clearer definition of the term “conformant” as it applies to Uptane
  • A security policy that outlines how errata can be reported and how reports will be addressed.
  • A file stating that the Uptane Standard and Deployment Best Practices is licensed under Apache.
  • A mention of Scudo as an Uptane augmentation in the “Out of Scope” text in the Standard as a clarification of Uptane’s involvement in software supply chain security

Changed

  • The term “Uptane-compliant” to “Uptane-conformant” to clarify that the framework is a standard to follow rather than a regulation that must be adhered to.
  • Metadata distribution requirements for secondaries to allow more flexibility when there are no new downloads for a given ECU.
  • Relaxed the requirement that verification of Targets metadata be considered complete if the Directory repository indicates that there are no new targets.
  • Relaxed the requirement that the Director repository SHALL check the time sent in the ECU report to a SHOULD

Removed

  • All mentions of the Reference Implementation, which has now been clearly marked as obsolete.
  • The term “private key” to reduce confusion about the role of these keys.

If you approve this release, simply write the word "approve" as a comment in this thread.

pattivacek commented

Have we defined what an "active member" is? :) Do I still count? At any rate: approve.

jhdalek55 commented

We have defined it in broad terms as someone "who regularly appears at bimonthly meetings, or participates in the preparation or review of pull requests, or engages in discussion of issues on the mailing list threads." You have continued to do the second one, so I would count you as such.

mnm678 commented

I approve

jhdalek55 commented

We would appreciate comments and or your notes of approval by end of business today (6 p.m. EDT). Thanks.

iramcdonald commented

I approve

tkfu commented

approve

DaveNew02 commented

I approve

jhdalek55 commented

I approve

jhdalek55 commented

We need at least two more approvals before this can be released. Please review and respond.

iramcdonald commented
jhdalek55 commented

@trishankatdatadog @JustinCappos @plapczyn can we please get this finalized---or let us know what needs fixing we are now officially a month over our planned release date.

  • 👀1
JustinCappos commented

I approve

hexsecs commented

Approve

jhdalek55 commented

We have reached our simple majority of approvals and there have been no objections raised. Hence, V.2.1.0 is approved for release.

jhdalek55 commented

V.2.1.0 has been approved. Thus, this issue is closed.