What is open source project governance?

In many discussions of open source projects and community governance, people tend to focus on activities or resources like "speaking for the project" or "ownership of the web domain." While documenting these things is useful, they aren't truly governance matters. Alternately, others focus exclusively on technical matters like election rules, codes of conduct, and release procedures. While these might be the tools of governance, they're not governance itself. So what exactly is open source project governance? In short, governance is the rules or customs by which projects decide who gets to do what or is supposed to do what, how they're supposed to do it, and when. This definition of governance can prompt important questions for open source communities seeking to evolve their governance models. Let's explore how.

Software: ledger2beancount, TenFourFox, KDE Itinerary, GCompris

• Martin Michlmayr: ledger2beancount 2.2 released

  I released version 2.2 of ledger2beancount, a ledger to beancount converter.

• TenFourFox FPR23 available

  TenFourFox Feature Parity Release 23 final is now available for testing (downloads, hashes, release notes). This blog post was composed in the new Blogger interface, which works fine but is slower, so I'm going back to the old one. Anyway, there's no difference from the beta except for outstanding security fixes and as usual, if all goes well, it will go live Monday evening Pacific time.

• April/May in KDE Itinerary

  It has been a busy two month since the last report again, KDE’s source code hosting is now using Gitlab, we got the 20.04 release out, notifications were significantly improved, and we are now leveraging OpenStreetMap in more places, with even more exciting things still to come. The global travel restrictions have been hampering field testing, but they have most certainly not slowed down the development of KDE Itinerary!

• GSoC’20 Wrapping up Community Bonding Period

  As the coding period of GSoC is going to begin in the next 2 days. In this blog, I am going to write all about what I did during the community bonding period. During this period I have interacted with my mentors and finalized the multiple datasets of a few activities. Recently, the GCompris project has been moved to GitLab so I set up my account over there and also asked my mentors how can I push my branches to the server and everything else. I have also gone through the code of the memory activities and planned about the resources I will be using. I have also set up my environment as to how to test the GCompris on the android platform. I plan to start my work with the enumeration memory game activity so I have created a branch for it and pushed it to the server.

Security Leftovers

• KernelCare+ Now Available In Beta For Selected Distributions

  The beta version of KernelCare+ is now available for download for Red Hat Enterprise Linux 7, CloudLinux OS 7, and CentOS 7. More distributions will be added in June 2020. KernelCare extends live patching beyond the Linux kernel with KernelCare+. This new version of KernelCare adds detection and live patching for glibc and OpenSSL vulnerabilities. KernelCare+ was created to ensure that critical glibc APIs and OpenSSL libraries stay patched, as well as the Linux kernel, and it’s now available for evaluation in beta.

• The Ongoing CPU Security Mitigation Impact On The Core i9 10900K Comet Lake

  At least for the workloads tested this round, when booting the new Intel Core i9 10900K "Comet Lake" processor with the software-controlled CPU security mitigations disabled, the overall performance was elevated by about 6% depending upon the workload. Here is a look at the out-of-the-box security mitigations for this new Intel desktop CPU against foregoing the default CPU security mitigations and running an unprotected configuration to see what the pre-Spectre performance looks like.

• How GitHub untangled itself from an 'Octopus' malware that infected 26 projects

• GitHub Supply Chain Attack Uses Octopus Scanner Malware

• Supply chain attack hits 26 open source projects on GitHub

  In March, an anonymous security researcher discovered open source software (OSS) supply chain malware, dubbed Octopus Scanner, in a set of repositories on the GitHub platform. The researcher, who goes by the name "JJ" and writes a security blog called DFIR IT, notified GitHub's security incident response team. "The malware is capable of identifying the NetBeans project files and embedding malicious payload both in project files and build JAR files," JJ wrote in the report to GitHub.

• GitHub warns Java developers of new malware poisoning NetBeans projects

• Baidu open sources its quantum machine learning toolkit on GitHub [Ed: Proprietary security risk]

Kernel: Reiser4 and Generic USB Display Driver

• Reiser4 Updated For Linux 5.6 Kernel Support

  While the Linux 5.7 kernel is likely being released as stable today, the Reiser4 port to the Linux 5.6 kernel is out this weekend. Edward Shishkin continues working on Reiser4 while also spearheading work on the new Reiser4 file-system iteration of the Reiser file-system legacy. Taking a break from that Reiser5 feature work, Shishkin has updated the out-of-tree Reiser4 patches for Linux 5.6.0 compatibility. This weekend on SourceForge he uploaded the Reiser4 patch for upstream Linux 5.6.0 usage. This is just porting the existing 5.5.5-targeted code to the 5.6 code-base with no mention of any other bug fixes or improvements to Reiser4 in this latest patch.

• The Generic USB Display Driver Taking Shape For Linux 5.9~5.10

  One of the interesting new happenings in the Direct Rendering Manager (DRM) driver space is a Generic USB Display stack including a USB gadget driver that together allow for some interesting generic USB display setups. This work was motivated by being able to turn a $5 Raspberry Pi Zero into a USB to HDMI display adapter.