spdx identifiers in source code, is that happening?
  fedora is using spdx identifier
  agreed that this is more a project level question
  
sboms?
  open chain

  sbom mentioned in NIST as example, but unclear if that really
  helps proof provenance of code.

  topic for licensing bof
  we should not spend time on this because we do ship the
  source code, sboms are for people that do not ship source code

gitolite
  Do we need to change the current hooks, incompatible with gitolite?
  We do checks as part of git push 
  gentoo has these
  Call out to another server, that server does something comes back
  with a response Ian sware can provide VM where to run the githooks
  solvable problem

Setting a forge will help with this need fewer people with special
access to the "real" repo

gerrit some projects have started using it but then hated it and
dropped it

Why would the forge impact the workflow of the review? why does it
necessary force the way you review patches?

Patches need to be rebased, and forge helps with that

patchwork CI bot does check and warns of need of rebase if patch no
longer applies.

Get structured info from unstructured info on mailing lists. We do not
have to move everything to do pull requests. not instantly. Joseph is
writing notes about what is desirable in a forge.

We should look at what we can do today w/o a forge, like b4
etc. Nobody knows that.

Richard E. no imminent move to a forge, we need to do a study to see
if it really meets our needs It's not an either/or.

experiment on sourcehut
Sends email from git, via the server. Reviewer send back comments by email.

The review goes to the mailing list.  Solves the problem of the
initial submission (well formed git send-email like) People seem to
like that, it is well explained.  It was used for another project.

Asking how to move a project over to the workflow.
We can set up a project on forgejo? 

People asked to have a VM to experiment with the Forgejo, so
sourceware will create an VM for it.

Mark will start an email about this
 
Involved in clang discussions with email, not website, but everything
mirrored, and you do not need to deal with the web interface at all

mailman:
  need to look for new mailing list software eventually
  archive: using public inbox
  FSF wants to upgrade to mailman3, and use inbox too 
  From-rewriting: look at lkml and Konstantin blog
  public inbox preserves everything, not like mailman

Is there anything that shows the whole month? people not subscribed,
just reload the archives can we get webarchives with inbox?

Liked the way before mailman (ezml), easier to see the archives, and
had dates also liked reversed date order We want to have something to
massage the inbox archives, instead of keep using the old mailman etc
stuff for security (Ian)

builder
  one big python file that needs simplifying, need help with that

patchwork
 Need integration with buildbot for pre-commit CI

snapshots
  gcc is not there yet

signed commits

Nick Alcock: knows how to easily sign commits, request to put it on
the gcc wiki

Also idea about having a comment at the commit time, printing
something like "please consider signing your commits, and this is
where the instructions are"