<!-- SPDX-License-Identifier: CC-BY-4.0 -->
<!-- Copyright Contributors to the OpenColorIO Project. -->

March 18, 2019

Host: Michael Dolan

Rotating Secretary: Doug Walker

Attendees:
  * [ ] Mark Boorer (_TSC_) - Industrial Light & Magic
  * [ ] Sean Cooper (_TSC_) - DNEG
  * [X] Michael Dolan (_TSC Chair_) - Sony Pictures Imageworks
  * [X] Larry Gritz (_TSC_) - Sony Pictures Imageworks
  * [X] Thanh Ha - Academy Software Foundation / Linux Foundation
  * [X] Patrick Hodoul (_TSC_) - Autodesk
  * [X] John Mertic - Academy Software Foundation / Linux Foundation
  * [X] Carl Rand (_TSC_) - Foundry
  * [X] Doug Walker (_TSC Chief Architect_) - Autodesk
  * [X] Kevin Wheatley (_TSC_) - Framestore
  * [X] Bernard Lefebvre - Autodesk
  * [X] Jim Houston - consultant

# **OCIO TSC Meeting Notes**

* Copyright for OCIO Configs repo
    - Repo currently does not have copyright notices, should address before aswf move.
    - Group believes all contributions were made under the same terms as the main repo.
    - John will provide notice, Michael volunteered to add.

* CII Badge -- Security
    - Chair asked if anyone had expertise and could help.  No volunteers.
        - John: This is a common problem with many projects.
    - We will add this to the list of items we are looking for contributors to help with.
    - John suggested to move our checklist to the official CII site rather than having it in our own repo.
    - Volunteers to help with that are welcome.  ;)
    - What tools are available to help detect security issues?  Suggested areas to check?
        - Larry: Fuzz test configs
        - Kevin: Using problematic lib calls, unsafe path handling (e.g. ../..), fuzz test env vars.
    - Carl: Some users need to protect LUTs as trade-secret.
        - Larry: Should have a private means for users to report bugs.
        - Michael: Need that for reporting security issues too.
    - Any recommendations from LF regarding what to add to CI?
        - Thanh: Some options are Nexus IQ, WhiteSource for security, Sonar Qube for static.
        - Thanh is doing some investigation for TAC, we will follow closely for recommendations.
    - John provide the following link: https://github.com/coreinfrastructure/best-practices-badge/blob/main/doc/security.md
    - Chair asked John if we were moving too slowly, John: no.

* 1.1.1 Release
    - Michael: There are two PRs waiting, please review and approve.  Anything else to add?
        - Patrick: Update version in cmake?
    - Michael will create a draft for people to check.
    - Side-benefit is this will update website with new email reflector addresses.

* Pixel Format PR #699
    - Doug and Patrick provided overview.
    - Micheal: Are we deprecating 14 and 32-bit integer support?
        - Doug: No, there were enums but no support in OCIO v1.
        - Once the foundation is in place, others will be able to add additional formats, if desired.
    - Will be more detailed discussion at next v2 working group meeting (probably next week).

* Labeling GitHub issues for people to contribute
    - Michael: "Good first issue" is often used but doesn't seem most appropriate for some.
        - Some issues require serious dev work but don't require OCIO-specific knowledge.
        - Larry, Patrick concur.
    - John: Advised adopting common practices to make it easier for new contributors.
    - John: Check out new LF "Community Bridge" initiative.
    - People are asked to suggest label name to use for issues we'd like help with.

* Pruning GitHub issue list
    - Chair: We have 170 open issues, many old ones, let's try to see if any should be closed.

* Email list migration
    - Original Google Group lists shut down date is today.
    - John will migrate existing archives as mbox file today (may take some time to show up).
    - Chair will ask Sean/Mark to shut down the old groups.
        - WBN if anyone that tries to post will get email with new list coordinates.

* Other items
    - Patrick: Some small PRs will merge this week #693, #694, #696, last call for reviews.
    - Doug: Will schedule next v2 working group meeting for next week sometime.
