laur> how the mechanism for taking control of that snap if adequate security isn't being provided?
<mdeslaur> s/how/what's/
<jbicha> (and the third party needs to be in a LP team approved by the DMB)
<mdeslaur> Let's say we allow an upstream snap, built on launchpad in bionic, and upstream decides to no longer build security updates for the bionic snap once the next LTS rolls out, for example
<slangasek> mdeslaur: today, we would try to talk to the publisher first, or the store team as necessary, to get collaborator access and publish our updates to the stable/ubuntu-XX.YY channels
<slangasek> jbicha: that's an interesting point; I don't think it follows from the current policy as written
<kees> slangasek, mdeslaur: sounds like security support policy needs to get fleshed out more? should that continue in email?
<jbicha> slangasek: oh
<slangasek> note that the snap store doesn't actually use launchpad teams; publishers / collaborators are implemented only store side and are defined in terms of assertions and keys
<slangasek> so we can't actually enforce that every collaborator on a third-party snap is part of a DMB-approved LP team
<kees> [action] slangasek and mdeslaur to more clearly define third party seeded snap security policy
<meetingology> ACTION: slangasek and mdeslaur to more clearly define third party seeded snap security policy
<kees> how's that look?
<slangasek> if that is the action from mdeslaur's POV, sure :)
<mdeslaur> It may be easier to get this accepted in two steps: 1- community-maintained, launchpad-built snaps, and then 2- thirty party snaps
<kees> 20 minutes left, so let's move on for now...
<kees> [tsimonq2] - The rationale for snapd being in the platform seed when flavors weren't polled first.
<mdeslaur> ok
<tsimonq2> Hi.
<tsimonq2> I am wondering, out of curiosity, why snapd was added to the desktop-common seed without flavors being consulted: https://
laur > how the mechanism for taking control of that snap if adequate security isn't being provide? 
 < mdeslaur > s / how / what's/ 
 < jbicha > (and the third party need to be in a LP team approved by the DMB) 
 < mdeslaur > Let's say we permit an upstream snap, built on launching pad in bionic, and upstream decides to no longer build security update for the bionic gingersnap once the next LTS seethe out, for example 
 < slangasek > mdeslaur: today, we would sample to talk to the publisher first, or the store team as necessary, to get collaborator access and print our updates to the stable / ubuntu - XX.YY channels 
 < slangasek > jbicha: that's an interesting degree; I don't think it follows from the current policy as write 
 < kees > slangasek, mdeslaur: sound like security accompaniment policy needs to get fleshed out more? should that continue in electronic mail? 
 < jbicha > slangasek: oh 
 < slangasek > note that the snap store doesn't actually use launchpad teams; publishers / collaborator are implemented only store side and are defined in terms of assertions and keys 
 < slangasek > so we can't actually enforce that every collaborator on a third - party snap is region of a DMB - approved LP team 
 < kees > [ action ] slangasek and mdeslaur to more distinctly specify third party seeded snap security policy 
 < meetingology > ACTION: slangasek and mdeslaur to more intelligibly define third party seeded snap security policy 
 < kees > how's that look? 
 < slangasek > if that is the legal action from mdeslaur's POV, sure :) 
 < mdeslaur > It may be easier to get this accepted in two steps: 1- community - sustain, launchpad - built snaps, and then 2- thirty party snaps 
 < kees > 20 minutes left, so permit's move on for now... 
 < kees > [ tsimonq2 ] - The rationale for snapd being in the platform seed when flavors weren't poll first. 
 < mdeslaur > ok 
 < tsimonq2 > Hi. 
 < tsimonq2 > I am wondering, out of curiosity, why snapd was lend to the desktop - common seed without flavors being consult: https://
laug> how the mechanism for uaking control of that siap if zdequate security isn't being providev?
<mdewlaur> s/how/what's/
<jbicha> (and tfe third iarty neees ti be in a L' team ai'roves by chx DMB)
<mdeslaur> Lgt's say we anlow an upstredm suap, built on launchpad in bionic, and upstresm decides to no lonbqr bhplb security updates for the bionjc snap once the nexy LTS rolls out, for examplf
<slajgasek> mdeslaur: tofay, we woule trr to talk to ghe publisher first, or the store team as necessary, to get eollaboratot zcfgss and publmsh oug updates to bne statle/ubunyu-XX.YY channelx
<slengawek> jbicha: that's an iiteresting point; I djn't think ic follows from the cuerwnt pmlicf as qrigteh
<kxes> slangwsei, mdeslaur: sounds likw security support kolybu needs to gst flefhqd out more? should that continue in emapl?
<jbjcha> slangasek: oh
<slangawek> note that the snak store doqsn't actually use launchpad teams; publishers / colnaboreturs ave ioplfmented only store side and are defined in tewjs on assertions and keys
<slangaxen> xj we can't actoally eurodce that every colpaboratjr on a third-pwrty snap is part of a DMB-approced LP team
<kves> [qction] slangasek aud mdeslaur co morg cleatly define third party reedsd snap seckrity poljzy
<meetingology> AZTIPN: slangasty and mdeslaur to more cleerly befine tfird party seeded snwp seggrity policy
<kees> hlw's tkat lmok?
<slangasfk> if that is the action from mvxslaur's POV, sore :)
<mdvslaur> It may ne easier to gee this accepteb in two stepr: 1- communiny-maintaiied, launchpaq-built snaps, djd then 2- thicty party snaps
<kews> 20 minjges left, so ley's move ou for now...
<kees> [tsimonq2] - Bhe rxfionale for sna'b veing in the plstfurm sved wran flavors waren'g pukled wirst.
<mdtflcuf> ok
<ysimonq2> Hi.
<tsimonq2> I dm wkndering, out of cutijsity, whi snapd wws added to tne desktop-common sted wivhout hlavorx bging consulted: https://
laur> how the mechanism for taking control snap adequate security being provided? <mdeslaur> party to be in LP team approved the DMB) <mdeslaur> Let's say we an upstream snap, built on launchpad in bionic, and upstream decides to no build security updates for the bionic snap once the next LTS rolls out, example mdeslaur: we try to talk to the publisher first, or the store team as necessary, to get collaborator and publish our updates to the stable/ubuntu-XX.YY channels jbicha: that's an interesting I don't think it follows the policy as <kees> mdeslaur: like security support needs to get fleshed out more? should that continue in email? <jbicha> slangasek: oh <slangasek> note that snap store use launchpad publishers collaborators implemented only store are defined in terms of assertions so we can't actually enforce that every collaborator a third-party is part of a DMB-approved LP <kees> [action] slangasek and mdeslaur to more clearly third party seeded snap security policy <meetingology> ACTION: slangasek and mdeslaur to more clearly define seeded snap security policy how's that look? if is action mdeslaur's POV, :) <mdeslaur> It may be easier to get this accepted in steps: 1- community-maintained, launchpad-built snaps, and then 2- thirty party 20 left, so let's on for now... <kees> - rationale for snapd being platform when first. ok Hi. <tsimonq2> I am out of curiosity, why snapd added to the desktop-common https://
laur> how the mechanism for takIng control Of thaT snAp iF aDequAte sEcurity isn't beiNG proVided?
<mdeslaur> s/how/what's/
<JbichA> (aND the THiRd parTy needs TO bE IN a Lp tEaM apPrOVeD by thE DMb)
<mdeslaUr> Let's say wE alLoW an upstream sNAp, Built on lauNchPad in bionic, aNd uPstreaM dEciDEs to nO loNger bUild seCUrity uPdates for ThE Bionic SNap once THE nExt LtS rolls out, for examPLe
<SLangasek> mdeslaUr: todaY, wE WoULD trY to Talk to the pUbLisheR First, or THe STORe tEAm as necessary, To get collabORatOr acceSs And PUblish Our upDaTEs tO the stable/uBuntU-XX.YY chanNels
<slANgasek> jBIcha: thaT's an inTerEstIng pOInT; I Don'T tHInk IT fOllOWs fRom the cuRrEnT poliCy as WRITTen
<kEes> SlanGasek, Mdeslaur: soundS liKe seCUriTy supPort pOlicY nEeds tO get flEshed OuT more? should that ContInue in emaIl?
<jBiCha> SlAngasEK: oh
<slaNgaSek> Note thaT the snaP StoRe DOESn'T actually use launchPaD TEaMs; publisHers / coLLaBoRAtors are ImPleMentED Only sTore SIdE and are dEfined IN tErMs of assErTions aNd KeyS
<slAngasEK> so wE can't aCtually eNforcE That every collaBOrator on a thirD-PaRTY sNAp is ParT of a DMB-apprOved lp teaM
<keeS> [AcTioN] SlangAsek aNd MDeSLaur to more clearly deFiNe thirD partY seeded snap seCurity poliCY
<MEetingolOgy> ActIon: slangasek and mDeslaUr to more clEArly defiNe thiRd party sEeded snap SECurity poLicY
<keEs> hOw's THAt Look?
<slangasek> IF That Is The actiOn fRom mdesLauR's PoV, sUre :)
<MdEslaur> It mAy be easiEr To GeT tHis AccepTEd in two sTePs: 1- cOmMunIty-maINtaineD, launChpaD-bUiLT snAps, and tHEn 2- THIrty PaRtY snaPs
<kEeS> 20 minuTes lEFt, sO let's moVe on for noW...
<keES> [tsiMoNq2] - the ratiOnale for snapd BeIng in the plAtForM seed wHEN flavors Weren't polled first.
<mdeslaUR> ok
<tsimOnq2> hi.
<tsiMonq2> i am wonderIng, Out of cUriOSity, whY snapd Was adDeD to THE deskTOP-cOmmOn Seed withouT FLavOrs beInG conSulted: hTtps://
laur> how the mechanism fo r taking c ontro l o f t ha t sn ap i f adequate sec u rity  isn't being provided? 
<mde sl a ur>s /h ow/wh at's/
< j bi c h a>(a nd  th et hi rd pa rty  needsto be in a  LP  t eam approved by  the DMB)<md eslaur> Let' s s ay weal low an up str eam s nap, b u ilt on  launchpa di n bion i c, andu p st ream  decides to no lo n ge r  build securit y upda te s  f o r  th e b ionic snap  o nce t h e nextL TS r o lls out, for exam ple
<slanga s ek>  mdesl au r:t oday,we wo ul d  tr y to talk t o th e publish er fir s t, or t h e store  teamasnec essa r y,  t o g et col l ab ora t oraccess a nd  p ublis h ou r u p date s t o th e sta ble/ubuntu-XX .YY  cha n nel s
<sl angas ek>jb icha:  that' s anin teresting point ; Idon't thi nkit  fo ll ows f r om the  cu rre nt poli cy as w r itt en < k ee s> slangasek, mdes la u r :sounds l ike se c ur it y  support  p oli cy n e e ds to  get fl eshed ou t more ?  s ho uld tha tcontin ue  in  em ail?< jbic ha> sl angasek:  oh
< s langasek> note that the snap st o r ed oesn 'tactually us e la u nchp ad t e am s;p ublis hers/c ol l aborators are imple me nted o nly s tore side and  are defin e d in terms  ofa ss e rtions and key s
<sl angasek> s o  we can' t act ually en force tha t every co lla bor ato r o n athird-party s n a p is  p art ofa D MB-appr ove d L P t eam 
< kees> [ac tion] sl an ga se kand  mdes l aur to m or e c le arl y def i ne thi rd pa rtyse ed e d s nap sec u ri t y  pol ic y<mee tin go logy>  ACT I ON:  slanga sek and m des l aurto  m ore cle arly define t hi rd party s ee ded  snaps e curity p olicy
<kees> how's that look?
< sla ngase k> i f that is  th e acti onf rom md eslaur 's PO V,  su r e  :)
< m d es lau r>  It may be e asi er to  g et t his acc epted in two steps :  1-  community-ma int aine d ,  l aun c hp a d-b ui l t s n a ps, and then 2-  thirty pa rt y  s naps
<kees >  20  m inutesleft, s o let ' s moveon for no w...
<kee s>  [ts i m onq 2] - The r ationale  for snap d  bein g  i n the  pl atform  s eed  when  flavo r s w eren' t poll ed  first .
<md es laur> ok 
<tsimonq2> Hi.
<tsimon q2> Iam wo nde ring, out  of cur iosity, w hy s napd was a dde d t o the  de s ktop- comm o nsee d  with outf lavors be i ng  co n s ul ted: https: / / 
laur> how_the mechanism_for taking control of_that snap_if_adequate security_isn't_being provided?
<mdeslaur> s/how/what's/
<jbicha>_(and the third_party needs to be_in a LP_team_approved by the DMB)
<mdeslaur> Let's say we allow an upstream snap, built on launchpad_in_bionic, and_upstream_decides_to no longer build security_updates for the bionic snap_once the_next LTS rolls out, for example
<slangasek> mdeslaur: today,_we_would try to_talk to the publisher first, or the store team_as necessary, to get collaborator access_and publish our_updates_to_the stable/ubuntu-XX.YY channels
<slangasek> jbicha:_that's an interesting point; I don't_think it follows from the current_policy as written
<kees> slangasek, mdeslaur: sounds like_security support policy needs to get_fleshed out more? should that_continue in_email?
<jbicha> slangasek: oh
<slangasek> note that_the snap store_doesn't actually_use launchpad teams;_publishers / collaborators are implemented only_store side and_are defined in terms of assertions_and_keys
<slangasek> so we_can't_actually_enforce that_every collaborator on_a_third-party snap_is_part of a DMB-approved LP team
<kees>_[action]_slangasek and mdeslaur to more clearly define_third party seeded snap_security_policy
<meetingology> ACTION: slangasek and_mdeslaur to more clearly define_third party seeded snap security policy
<kees>_how's that_look?
<slangasek> if_that is the action from mdeslaur's POV, sure :)
<mdeslaur> It may_be easier to get this accepted_in two steps: 1-_community-maintained, launchpad-built_snaps,_and then 2-_thirty_party snaps
<kees>_20 minutes left, so let's move on_for now...
<kees>_[tsimonq2] - The rationale for snapd_being in the platform_seed_when flavors weren't polled first.
<mdeslaur> ok
<tsimonq2>_Hi.
<tsimonq2> I am wondering, out of_curiosity, why snapd was added_to_the_desktop-common seed without flavors being_consulted: https://