Meeting Minutes - Office Hours for CTI - 2026-10-09

Meeting Minutes - Office Hours for CTI - 2026-10-09

[Carlos O'Donell via Gdb]

CTI: https://cti.coretoolchain.dev/

The CTI project holds Office Hours every Friday, these are the minutes for this Friday's meeting.

The CTI project in collaboration with glibc is working on: https://cti.coretoolchain.dev/projects/glibc.html

RFCs:
[RFC] Using bugspray for updating glibc bugs in bugzilla?
https://inbox.sourceware.org/libc-alpha/a1c0fb87-de0f-40da-a917-25520839d209@redhat.com/

[RFC] Using git-mailbomb as post-commit VCS to email system for glibc-cvs emails?
https://inbox.sourceware.org/libc-alpha/5d2ef95d-94c4-40aa-83a7-84dc5f376e2b@redhat.com/

Posting across the project mailing lists since some developers had questions and are only subscribed on some lists.

​Agenda:

     * Discussed with Joseph Myers the concept of a web hook triggering git-mailbomb
       and passing in the key used to push along with the time in order to trigger
       the mailbomb email message with the additional information that otherwise
       is invisible. Today this is the closest we get to a transparency log.

       - The goal is to replace AdaCore hooks with something that doesn't run in the git server context:
         https://inbox.sourceware.org/libc-alpha/a1c0fb87-de0f-40da-a917-25520839d209@redhat.com/
       - The issue is that someone with a key can push a commit with different author/committer.
       - The simplest almost-transparency-log solution involves identifying the person who pushed
         and the time it was pushed at as things that are outside of git but needed for a
         full transparency log.
       - It should be possible to modify git-mailbomb to trigger as a webhook that receives
         the key and date of the push.

     * Discussed with Sachin Monga that we need to review regexps for bugspray:
       https://inbox.sourceware.org/libc-alpha/a9b8b1ab-fea9-4395-9e7f-fb9013273607@redhat.com/

-- 
Cheers,
Carlos.

Re: Meeting Minutes - Office Hours for CTI - 2026-10-09

[Ben Boeckel via Gdb]

On Fri, Oct 09, 2026 at 15:23:36 -0400, Carlos O'Donell via Gcc wrote:
>      * Discussed with Joseph Myers the concept of a web hook triggering git-mailbomb
>        and passing in the key used to push along with the time in order to trigger
>        the mailbomb email message with the additional information that otherwise
>        is invisible. Today this is the closest we get to a transparency log.

Git supports signed pushes:

    https://people.kernel.org/monsieuricon/signed-git-pushes

kernel.org also publishes a transparency log. This might be of interest
for this purpose. kernel.org's transparency log:

    https://git.kernel.org/pub/scm/infra/transparency-logs/gitolite/git/1.git/

--Ben