. '''To Software [[Software|Software]]''' - '''To Software-Assessment [[Software/Assessment|Software/Assessment]]''' - '''To [[Software/Assessment/20130226-S-A-MiniTOP|previous meeting]]''' - '''To [[Software/Assessment/20130312-S-A-MiniTOP|next meeting]]'''

----

= Minutes of the MiniTOP on the 2013-03-05 =

== Setting ==
The MiniTOP will be held via telco  22:00 CET (21:00 UTC)

Attendees: BenBE, Marcus, Uli, Magu, Michael, dirk


== Topics ==

(skip to [[#AGENDA|agenda]])

Action items from last meeting '''[[Software/Assessment/ActionItems|Meeting Action Items]]''' 
<<Include(Software/Assessment/ActionItems)>> 



<<Anchor(AGENDA)>>
== Agenda ==

## last full agenda https://wiki.cacert.org/Software/Assessment/20120228-S-A-MiniTOP


=== 1. Preface ===

 1. Documentation - Review / Changes to add (relates to Policy Group SP review)
  * [[https://wiki.cacert.org/Software/Assessment/Documentation/UpdateCycle|Description of Software Development Update Cycle]]
  * further review required, edited u60
  {{{
1.
  step 1, point d) "by an attached diff (preferred) or updated/replacement file (deprecated) in the bug-tracker

2.
  Step 5 point 4: Send by signed mail to critical with cc to cacert-devel; CC skipped if private information have to be transferred, with public details disclosed ASAP.

3.
  s/querys/queries/g
}}}
  {{{
q: What's the difference between Testserver Branch and Release Candidate Branch?
a: release candidate branch is the bug-#  extract in relation to last cacert.git branch
dev --> bug# --> testserver --> critical is current path, where dev..testserver is looped by default
}}}

 1. Documentation - To-Do (relates to Policy Group SP review)
  * developer git repos under github
  * [[https://github.com/BenBE/CAcert/commits/bug-1131|bug #1131 history @ github]]
  * [[https://github.com/CAcertOrg|CAcertOrg @ github]]
  * see also [[Software/Assessment/ActionItems]]
  * relates to [[Software/DevelopmentWorkflow]]

 1. Patches list for today
  * dirk (next) 740
  *  602, 1122, 1121, 1137, 1146, 1147 in Prepare
  * 1008, tested by 2, needs 2nd review
  * Michael to review: 1008, 1121, 1122


=== 2. DEV on bug 1023/1054 "Thawte Patch" ===
 * "Thawte points removal, final step" [[https://bugs.cacert.org/view.php?id=1023|bug #1023]]
  * bug #1023 Testing (6.php)
 * last patch transfered to production system 2012-05-30
 * what are the next steps for thawte points revoke?
  * points settings codes eg 50 pts open gpg/pgp, which certs avail by how many pts
  * 15.php needs rename to 10.php
 * next step in: [[https://bugs.cacert.org/view.php?id=1054|bug #1054]] Review the code regarding the new point calculation in ./includes/general.php (current state: testing)
  * email debug notification, search for other solution
  * testing scenarios: see [[https://bugs.cacert.org/view.php?id=1054#c3163|bug note c3163]]
   * some explanations
  * assure someone - f2f, ttp, the sentence "Only tick the next box if the Assurance was face to face" is conflicting, fixed
  * new patches by dirk, pushed to cacert-devel, (update 2012-09-18)
  * tverify removed  (?)
  * merge conflict with account id 60  (eg email removal), see [[https://bugs.cacert.org/view.php?id=823|bug #823]]
  * max_points() routine replaced by new max_points() routine
  * get_assurer_status(), output_summary_content() with parameter 0 replaced by max_points()
  * received_points() 
  * Status testing ?
   * debug messages on testserver (1054)
    * test account 1
     * variant 1 (pwd login):  points3 (185/100)
     * variant 2 (cert login): points3 (185/100)points4 (185/100) 
     * first value relates to wot.php?id=10 count of pts
    * test account 2
     * points3 (350/394)points4 (350/394) 
     * 484 AP, anderer weg 64
     * 100 
    * test account 3
     * points3 (200/662) 
     * problem identified, fix transfered to testserver
 * current state: runs in debug mode  points1, points2, points3, points4 that reflects conditions
  * conditions points1 and points2 yet undefined
  * [[Software/Assessment/20121211-S-A-MiniTOP|meeting 2012-12-11]]
   * identified points1 + points2 debug points in routine
   * Logged-in, My Details, Edit, change something, submit changes
   * calculate points will be used to select edit mode for name, dob
   * if points==0  edit allowed, otherwise edit prevented
 * Patch moved out from testserver
  * new testserver branch stable
   * reason: more and more merge conflicts caused by bug #1054
   * patches to add:  1070 + 782 (?)
 * 2013-02-05 DEV on bug 1023/1054 "Thawte Patch" - no update
 * 2013-02-12 - no update
 * 2013-02-19 - no update
 * 2013-02-26 - no update

=== 3. 2nd review of remaining patches ===

 ||<#ff8080> '''Software-Assessors task''' ||



==== 3.1 Michaels Task 2nd review ====
 * 1121 (see notes under top 4)
 * 1122 (see notes under top 4)

 || inopiae  || [[https://bugs.cacert.org/view.php?id=1121|bug #1121]] Record the CCA acception for the account creation || needs 2nd review || {0} ||
 || inopiae  || [[https://bugs.cacert.org/view.php?id=1122|bug #1122]] Give Support the chance to see when the first and the last CCA acception took place || needs 2nd review || {0} ||


=== 4. Patches Overview - Testing, Development ===

 1. summary - state of patches
  1. 922 needs work (returned from production)
  1. 782 needs work
  1. 440 needs work (NEO) (see also below)
   * Patch bug #440 was defered (timo addtl. work), but this project stalls. What to do with bug #440 ?
   || gagern, neo || [[https://bugs.cacert.org/view.php?id=440|bug #440]] Problem with subjectAltName || tested, needs 2nd review, rejected, new deployment getcn/getalt procedure, relates to [[https://bugs.cacert.org/view.php?id=1101|bug #1101]] || {r} 2 ||
  1. 1004 needs work by neo
  1. 1113 needs work by benbe, transfered to cacert-devel
  1. 1017 needs work by neo
  1. 1025 needs testing
  1. 1124 needs rework
   || inopiae || [[https://bugs.cacert.org/view.php?id=1124|Bugs #1124]] Selection of additional languages, sorting is somewhat strange || || {0} ||
   * Michael review ok
   * needs testing
   * sorting order strange under "addtl. language"
   * proposed: language, country
   * 2013-02-19 needs new patch 
  1. 1112 needs confirmation of 2nd review, then ready to deploy
   || inopiae || [[https://bugs.cacert.org/view.php?id=1112|Bugs #1112]] Exchange the text on the TTP page according to the new TTP programm || live testing, probs with form (if pts < 100) || {0} ||
   * 1112, tested by 3, needs 2nd review
   * Michael reviewed
   * 1112, did some rework (TTP text changes)
   * current state: 2nd review, some changes, BenBE to confirm 2nd review and deploy
   * BenBE, 2nd review -> ack
   * at least one essential change (get-count-ttp-assurances) changed search from "assurances-from" to "assurances-to"

  1. copied to cacert-devel, on testserver
    * available 740 fix isn't in compliance to [[https://bugs.cacert.org/view.php?id=671|bug #671]]
    * related [[https://bugs.cacert.org/view.php?id=1112|bug #1112]] is also in question
    || inopiae  || [[https://bugs.cacert.org/view.php?id=740|bug #740]] How to become an assurer is missleading wot 2+4 fixes || needs testing and 2nd review || {0} ||
    * contrary discussion
  1. BenBE: bug #569 pushed to testserver (2013-02-19)
   || inopiae || [[https://bugs.cacert.org/view.php?id=569|Bugs #569]] 569: output order when removing email address || || {0} ||
 1. Policy text and Arbitration ruling bug# fixes
  1. Policy text changes
   * new [[https://bugs.cacert.org/view.php?id=1131|bug #1131]] Replace all policies from php to html
   || Inopiae || [[https://bugs.cacert.org/view.php?id=1131|Bugs #1131]] Rename PolicyOnPolicy.php and other Policies too to .html || || {0} ||
   * dirk to review
   * PoP update running under [[https://wiki.cacert.org/PolicyDecisions#p20130223|Policy Decisions #p20130223]]
   * proposal to await final decision dated 2013-03-08
   * to wait until end of p20130223 -> 2013-03-08
   * POLICY images to transfer from www.cacert.org/images to www.cacert.org/policy/images -> img src="images/.."
   * url link
    * current: 3 variations
     a. href="//www.cacert.org/policy/PolicyOnPolicy.html"   vs.
     a. href="http://www.cacert.org/policy/PolicyOnPolicy.html" vs.
     a. href="PolicyOnPolicy.html"
    * proposal
     a. absolute url
    * a. or b. ?
     * // ... after download http missing
     * so therefor https
     * b. as https://..

  1. Arbitration ruling text fixes
   1. [[https://bugs.cacert.org/view.php?id=879|bug #879]]
    . CAcert must update the web page on disputes, and include an explanation how to file a dispute (a20091206.1)

 1. [[https://bugs.cacert.org/view.php?id=922|bug #922]] problem, transfered to critical, Wytze did a rollback
  || neo, dirk || [[https://bugs.cacert.org/view.php?id=922|bug #922]] missing "certificate about to expire" messages || tested, reviewed by 2, needs 2nd review || {0} ||
  * you can use previous test to also check "certificate about to expire" messages
  * notification expected: 1d, 15d, 30d, 45d
  * Uli: Marcus plz test again
  * Marcus+Uli: plz add serno of cert about to expire into the message text
  * NEO: added serno on Oct 2nd
  * Uli: 15d notification rcvd at 5th, 6th Oct, last 1d expiry warning expected: Oct 19, passed ok
  * moved to 2nd review
  * BenBe: 922 2nd review, currently busy, feels not ready to review this patch
  * tested by 2, needs 2nd review, BenBe passed to other SA
  * -> dirk, assigned
  * seems to be ok, ready to go
  * BenBe to transfer to critical team
  * patch transfered, but rolled back. reason: patch brings critical system to hung
   * Analysis
    * testserver less data then production system
    * potential problem distinct clause in query
    * whats about proposals by Timo?
     * [[https://lists.cacert.org/wws/arc/cacert-devel/2012-11/msg00012.html|proposal 12/11/02 by Timo]]
    * data count: 1000 on testserver, 900.000 on production
     * create a test set of 900k certs in database?
    * tables used, record counts: domaincerts 74, domlink 75, domains 52
     * which tables, table structure, db format: default myisam
     * domain*, email*, users
     * to contact critical team with general infos about above tables
   * wytze, timo, dirk, benbe, michael discussion by email
    * proposal to wytze, to add indixes (all tables selected by where clauses created, modified, expired, revoke)
    * confirmation by 2nd SA
  * 2013-01-22: still open
  * discuss with NEO
  * database modifications, index modifications
  * performance issues, needs applied into a patch
  * sql query proposal see https://bugs.cacert.org/view.php?id=922#c3347

 1. [[https://bugs.cacert.org/view.php?id=1004|bug #1004]] Stats page improvement
  || neo, BenBe || [[https://bugs.cacert.org/view.php?id=1004|bug #1004]] Stats page improvement || tested by 2, needs 2nd review || {0} ||
  * stats, Marcus + Uli did some tests, one problem identified, fixed 2012-08-25 by NEO
  * fully re-tested by 2: 2012-08-25 (at froscon)
  * needs 2nd review
  * moved out to cron job routine
  * -> BenBe, assigned
  * 1004 ... on review by BenBe
  * checked BenBe
  * work done by NEO, pushed to cacert-devel, transfered to testserver
  * needs 2nd review, tested
  * current state:
  * open issues
   a. How are deleted users handled?
   a. Isn't "verified_certs" misleading as the affected tables also contain certs that failed to be signed?
   a. User Statistics don't take removed assurances into account (???)
   a. Why not calculate backwards in the year-dependent loop from the already known values? The loop runs backwards already anyway.
  * the latter is still open

 1. [[https://bugs.cacert.org/view.php?id=1025|bug #1025]] Domain Dispute issue 
  * BenBe will pickup for 2nd review
  * needs further testing
  * magu, inopiae, u60 -> testing  https://bugs.cacert.org/view.php?id=1025
   * several test accounts, variations of one or more email addresses, 0 or 1 domain added 
   * test the full disputes procedure for all variations 
   * tested by u60

 1. [[https://bugs.cacert.org/view.php?id=1054|bug #1054, test 1054.3.6]], [[https://bugs.cacert.org/view.php?id=1035|bug #1035]]
  * create several types of certs (client certs, server certs, org client certs, org server certs) and analyse the content of the certs -> subjectAltName and CN  with single SAN and multiple SANs
  * renew the certs
  * addtl. tests ?  Marcus? Magu? BenBe?
  * 2012-10-02 dirk: problems with git push #1054, got fixed
  * DEV on bug 1023/1054 "Thawte Patch"
   * check last changes by dirk to transfer into test scenarios
   * [[Software/CurrentTest/bug1054|Bug #1054 test scenarios]]
  * see reference notes [[https://bugs.cacert.org/view.php?id=1101#c3225|note 3225 on bug #1101]] and [[https://bugs.cacert.org/view.php?id=1101#c3245|note 3245 on bug #1101]]

 1. --([[https://bugs.cacert.org/view.php?id=964|bug #964]])-- and [[https://bugs.cacert.org/view.php?id=1017|bug #1017]] {o} , relates also to [[https://bugs.cacert.org/view.php?id=1054|bug #1054, test 1054.3.6]] - Chrome certificate enrollement (relates to #964 "Black Jack")
  * create client certs, go to signing routine
  * new routine with 3 different potential signed public key download routines /account.php?id=6 list 3 options
   a. Install the certificate into your browser   (tested)
   a. Download the certificate in PEM format
   a. Download the certificate in DER format 
  * [[https://bugs.cacert.org/view.php?id=1017|bug #1017]] Chrome certificate enrollement
   * BenBe will pickup
   * [[https://bugs.cacert.org/view.php?id=1017|bug #1017]], doing some more tests?
    * new routine with 3 different potential signed public key download routines /account.php?id=6 list 3 options
     a. Install the certificate into your browser   (tested)
     a. Download the certificate in PEM format
     a. Download the certificate in DER format 
    * Alex, Marcus doing some more tests
  * BenBE to review
  * review bug #964 by Michael
  * bug #964 transfered, still open: bug #1017

 1. Marcus Bugs list
  * see [[Software/BugsOverview]]
  * according to [[https://bugs.cacert.org/view.php?id=976|Bugs # 976]]
   * 0000976: List of update request for webdb database structure upgrade with tables / fields
   * addtl_notes table hasn't been added in [[https://bugs.cacert.org/view.php?id=976|patch bug 976 on 2011-11-25]]
   * OU info from Org cert not stored
   * addtl_notes table hasn't been added in [[https://bugs.cacert.org/view.php?id=976|patch bug 976 on 2011-11-25]]
   * extend org certs table ? new bug?
   * OU in subject?
   * includes/account.php (17)
   * in org certs it is in subject
   * addtl. field ou ? new bug# ?
   * used bug #1010

 1. new [[https://bugs.cacert.org/view.php?id=1095|bug #1095]] "Problems with creating server sertificate where the csr is created with Java SDK Tools"
  * cmdline sample: keytool -genkey -alias test.test.net -keyalg RSA -keystore test.test.net.ks -validity 1095
  * NEO couldn't reproduce the problem using keytool, tested against production and testserver
  * identified as weak key usage: csr used MD2 encryption, not or no longer supported by openssl, add new error message

 1. [[https://bugs.cacert.org/view.php?id=440|bug #440]], [[https://bugs.cacert.org/view.php?id=1101|bug #1101]] (extract CSR) (back under development)
  * ASN.1 format
  * CSR extract: needed for signing: email address, hostname
  * Timo will  write a CSR parser
  * Current:
   * CN will be parsed
   * some information about public key
  * ASN.1 php library
  * Whats about UTF-8 ?
  * IDN's
   * Policy: [[PolicyDecisions#p20091108|p20091108]] CPS to drop assurer critieria and allow IDN certificates in specified TLD or single script character sets
   * [[FAQ/Privileges|FAQ Privileges]]
   * [[http://www.cacert.org/policy/CertificationPracticeStatement.php#p3.1|CPS 3.1.7]]
   * [[AssuranceHandbook2/SomeMoreInformation|Assurance Handbook - Some more Information]]
    {{{
Code signing and IDN certificates
If you are an Assurer, you can get certificates signed/issued by CAcert for code signing and IDNs (International Domain Names).
Due to the increased possibilities for abuse those certificates have additional requirements. The CPS states that this requires Assurer level, which you meet if you are reading this Handbook. However note that as of 20091106, there is a move to reduce these requirements. Watch this space. 
}}}
  * current only client and server certs, other options currently not selectable, except Code Signing
   * extensions currently not supported eg jabber
   * [[https://bugs.cacert.org/view.php?id=530|bug #530]] XMPP extension not present after renewal	
   * [[https://bugs.cacert.org/view.php?id=87|bug #87]] Issuing certificates for Jabber servers/users
  * parameters: domains, current first becomes CN, others SANs
  * rebuild subject routine ... to check
  * Michael: shall we enforce cn from csr?
   * optional?
   * enforce copy cn to SAN
  * asn1 parse procedure, http://lapo.it/asn1js/
   * getcn, getalt procedure
   * docs für extractit() und getcn(): [[https://github.com/timoahummel/CAcert/blob/bug-1101/includes/general.php#L230|general.php line.230]]
   * felicitus: how someone get "CN" from "commonName"? where is it documented that "CN" is "commonName"?
   * OID of commonName is 2.5.4.3, but there is nothing about "CN"
    * BenBE: see Header of OpenSSL-Header
  * Patch bug #440 was defered (timo's addtl. work), but this project stalls. What to do with bug #440 ?
   || gagern, neo || [[https://bugs.cacert.org/view.php?id=440|bug #440]] Problem with subjectAltName || tested, needs 2nd review, rejected, new deployment getcn/getalt procedure, relates to [[https://bugs.cacert.org/view.php?id=1101|bug #1101]] || {r} 2 ||
   * comments [[https://bugs.cacert.org/view.php?id=440#c3243]], [[https://bugs.cacert.org/view.php?id=440#c3251]] checked?
   * Neo started some fixes (getcn and ...), to be continued
  * ASN.1 parser - planned: incorporate asn.1 from openssl

 1. [[https://bugs.cacert.org/view.php?id=1101|bug #1101]] refactoring getalt getcn (Timo)
  * might [[http://bugs.cacert.org/view.php?id=1101#c3225|1101 comment c3225]]
  * tries to build a php library for openssl parsing replacement
   a. asn.1 parsing, own library
   a. ???
  * openssl does escaping (per man page) (input? output?)
  * library test thru unit tests
  * openssl command for multiple san's ?
   * undocumented feature?
   * currently only known with -extfile [[http://therowes.net/~greg/2008/01/08/creating-a-certificate-with-multiple-hostnames/#comment-595|creating-a-certificate-with-multiple-hostnames]]


 1. New patches
  1. [[https://bugs.cacert.org/view.php?id=782|bug #782]] Add "notes" field to certificate information
   || inopiae || [[https://bugs.cacert.org/view.php?id=782|bug #782]] Add "notes" field to certificate information ||  || {0} ||
   * moved to testserver
   * Client certs
   * Current:
    . Renew/Revoke/Delete | Status | Email Address | SerialNumber | Comment | Revoked | Expires | Login
   * move comment to end
    . Renew/Revoke/Delete | Status | Email Address | SerialNumber | Revoked | Expires | Login | Comment | edit
   * create new cert below all mandatory fields?


 1. GPG bugs
  1. import prob (eg [[https://bugs.cacert.org/view.php?id=992|bug #992]] )
   * rfc standards:
    a. rfc 4880, defaults to utf-8, section 5.11
     * https://tools.ietf.org/html/rfc4880
     * RFC 4880 updated by https://tools.ietf.org/html/rfc5581
    a. email rfc-2822
  1. delete/revoke GPG keys (eg [[https://bugs.cacert.org/view.php?id=1079|bug #1079]] )
   * trust signatures can be revoked
   * CRL's have to be added to keyservers, but no one will check
   * revocation: 5 reasons given
   * should be possible, but project needs a developer
  1. GPG bugs
   * OpenGPG parser project, reviewed by Michael last weekend
   * Michael remark: using 3x = (===) instead of 2x = (==)
   * unpack (N) 32bit unsigned may become a problem
   * relates to hardware platforms, signer has been replaced about 2 years ago, but needs to be used on both sides (webserver + signer). Webserver upgrade is WIP
   * in principle ok
  1. BenBE: GPG/PGP parser
   * revoke gpg keys implemented

 1. [[https://bugs.cacert.org/view.php?id=279|bug #279]] bad domains
  * .*top.*
  * regexp list
  * database table exist
  * update procedure?
  * whats about recuring distribution of update files via cabforum?
  * arbitration?
  * SE console for update?
  * critical admins?
  * check routine on add-domain
  * add domain under OA should be possible ...
  * one-time check of current existing domains ?
   1. first time check against full filter list
   1. individual check in event add domain
   1. global check in event add entry to filter list
   1. replace/update full filter list (case 1 + 4)
  * meta infos:
   a. datasources
   a. attributes (?)
   a. creation date
   a. delete entry / revocation date

 1. [[https://bugs.cacert.org/view.php?id=1121|bug #1121]] and [[https://bugs.cacert.org/view.php?id=1122|bug #1122]]
  * Assure Someone change request (result from 1122: assure someone, CCA acceptance in Assure someone process)
   1. question: where is the CCA acceptance path of an Assurer?
    * AP defines, Member has accepted CCA by joining CAcert and create an account
    * but there are also "old" assurers who didn't accepted CCA yet
    * 2 known requirements to become an Assurer: 100 APs, CATS passed
    * 3rd yet unverified: CCA acceptance
    * Assurance to be AP conform references to AP
    * Assurance statement gives no statement, that Assurer has accepted CCA
    * AP 4.5 only requests CCA acceptance from Assuree
    * CATS test requires a valid client cert. Client certs can be created without CCA acceptance!!!
    * There is no addtl. CCA acceptance check under CATS
    * so in effect:
     1. an assurer may have created an account before the CCA acceptance request was added to the join form
     1. an assurer may have received upto 100 APs + 50 EPs before CAcert's policy days
     1. giving an assurance doesn't request a CCA acceptance from the Assurer, only the request that assurance is AP compliant
    * so there is no straight verification path that an assurer has accepted CCA except receiving new assurances by -> passive CCA acceptance
   1. assure someone form enhancement
    1. New I verify that the Assuree accepted CCA
    1. Location
    1. Date
    1. assertion
    1. Ap
    1. New I accept CCA
    1. Policies
    1. Points
    1. text (a): I have read and understood the Assurance Policy,  the Assurance Handbook and the CCA and am making this Assurance subject to and in compliance with the policy, handbook and CCA.
    1. text (b): I have read and understood  the CCA, the Assurance Policy and  the Assurance Handbook. I am making this Assurance subject to and in compliance with the  CCA, policy and  handbook.
    1. AH AP CCA & & dup dup read understood comply.
    1. text (c): I have read and understood  the CCA, the Assurance Policy (AP) and  the Assurance Handbook (AH). I am making this Assurance subject to and in compliance with the  CCA, AP and  AH.
  * see also top 4

 1. [[https://bugs.cacert.org/view.php?id=1135|bug #1135]] SE activity audit tables
  * addtl. recording of arbitration numbers to members
  * results in long discussions
   * requirements, thought cases (eg name change request while another arbitration is running (-> uncritical))
   * delete account requests handled under precedent case [[Arbitrations/a20111128.3|a20111128.3]]), one "critical" case (certs misusage) is turned in procedure: arbitrator has to follow "emergency case" procedure and to keep track of open "delete account" cases
   * interferance/interaction of 2 of the 3 powers (executive, judicate) (arbitration has to act as executive to forward all new cases to support team with list of open/running arbitration cases)
  * all ends on (arbitration) "critical" cases
  * "critical" cases will be handled under Arbitration eg. [[Arbitrations/a20111128.3|a20111128.3]] within reasonable (eg 48 hours) window
  * discussion defered
  * 1135 (BenBe) 2nd review by another SA before moving to testserver
  * Michael to review
   1. [[https://bugs.cacert.org/view.php?id=1135|bug #1135]] Extend database table AdminLog et al

 1. [[https://bugs.cacert.org/view.php?id=1136|bug #1136]] SE console, delete all certs of a member (instead of highjack an account)
  * probably 1 requirement: addtl. verification step
  * bug #1136 - revoke certs doesn't work
  * server log shows no errors

 1. [[https://bugs.cacert.org/view.php?id=893|bug #893]] Extend Delete account feature for support
  || inopiae  || [[https://bugs.cacert.org/view.php?id=893|bug #893]] Delete account rev 3 procedure || needs testing and 2nd review || {0} ||
   * test 893 (delete account) with existing server certs, also gpg certs
   * gpg revocation is currently not avail ...
    * manual procedure: currently we hadn't such a case in manualy procedure
    * proposal: in production: set on hold until gpg key expires
    * for testing: gpg keys not expired -> stop procedure if remaining gpg keys not expired
   * if account is locked -> no special exception
   * org admin flag set -> procedure stop  (includes Org certs avail)
   * related dispute bugs 1136? 1045?

 1. [[https://bugs.cacert.org/view.php?id=1137|bug #1137]] Record the CCA acception for entering an assurance
   || inopiae  || [[https://bugs.cacert.org/view.php?id=1137|bug #1137]] Record the CCA acception for entering an assurance || needs testing and 2nd review || {0} ||
   * 1137 "Record the CCA acception for entering an assurance" needs review testing

 1. [[https://bugs.cacert.org/view.php?id=740|bug #740]] How to become an assurer is missleading
  * according to [[https://bugs.cacert.org/view.php?id=671|bug #671]] all text pages should be banned within webdb and redirected to a wiki page
  * available 740 fix isn't in compliance to [[https://bugs.cacert.org/view.php?id=671|bug #671]]
  * contrary discussion

 1. [[https://bugs.cacert.org/view.php?id=1141|bug #1141]] If i delete Domains, no Servercerts for this domains are listet, even not the revoked
   * moved to testserver
   || NEO || [[https://bugs.cacert.org/view.php?id=1141|bug #1141]] If i delete Domains, no Servercerts for this domains are listet, even not the revoked || needs testing || {0} ||
   * discusssions: arb case? privacy (eg PP 10.), data retention (-> Australien DPA)
   * Marcus to contact Benedikt

 1. [[https://bugs.cacert.org/view.php?id=1008|bug #1008]] View for SE to see if user is Organisation Admin for which Organisation Accounts

 1. what to do with [[https://bugs.cacert.org/view.php?id=1143|bug #1143]] Web site doesn't scale vertically

 1. Advertisement
  * permission review script doesn't include ADadmin
  * relates to [[https://bugs.cacert.org/view.php?id=1003|bug #1003]] and Arbitration case [[Arbitrations/a20110118.1|a20110118.1]]
  * board motion? treasurer? adadmin?

=== 5. Long Term Projects ===

 1. NEO: "BlackJack" [[https://bugs.cacert.org/view.php?id=964|bug #964]]
  * NEO: "BlackJack" [[https://bugs.cacert.org/view.php?id=964|bug #964]] testing from last week -> error codes
   * started implementing
  * how does [[https://bugs.cacert.org/view.php?id=1017|bug #1017]] relate to this bug?
   * cert signing routine
   * ie5 ie6 automatic storage of signed key in local keystore
   * doesn't work under vista, win7
   * msi package is to download and import the keys to the local keystore under vista, win7
   * relates to [[https://bugs.cacert.org/view.php?id=1099|bug #1099]] but is quite different
   * neo sent msi package for testing to u60, benbe; test successful passed
   * bug #964 passed, #1017 still open

 1. Marek's sql class project:
  * is working on charset replacement

 1. api project, Carsten continues with portal project not waiting for vendor-api to be delivered
  * vendor-api delayed
   * no coders
   * other projects
   * related to sql class project
  * portal project continues with a workaround, needs an assurer
   * arbitration case on locations database orders outsourcing of find-an-assurer asap
   * with portal function, update of data is possible vs. update of data on critical system is difficult (keep data current for assurers)
   * relation to location database
    1. website find an assurer
    1. scripted mailing for ATE invitations
   * user check that data is still valid eg every 1 year
    * notification at login upto 6 months not online
    * notification by email if not logged in within last 6 months

 1. Automated testing system
  * Timo: Unit-test testsystem, phpunit jenkins
  * [[http://ci.partkeepr.org/job/PartKeepr/]]
  * [[https://github.com/NEOatNHNG/cacert-frontendtests]]
  * can we merge both environments? frontend tests and unit tests?
  * Timo: automated testing systems are mergable
   * frontend test: java, may become a problem, alternate php version?
   * focus on unittests
    * dirk: code or screen?
    * code and screen
   * frontend and unit tests on one machine?
   * trial: port frontend tests

 1. Timo: monitoring signer, not yet done
  * Probably Wytze monitors the systems externaly ?!?
  * see [[SystemAdministration/Systems|Systems overview]]
  * monitoring system eg Zabbix instead of Nagios?
  * BenBE: Icinga as alternate?
  * Zabbix agents: requires to be the same revision as server

 1. Timo, Benny: Distro needs upgrade
   * lenny - support ended Feb 2012
   * upgrade etch to lenny was a long running project
  * squeeze (current stable release) - tests started by critical team
   * "wheezy close before release date
  * Michael: email sent 2012-10-09 regarding squeeze upgrade to critical team
   * response received
   * testing WIP
   * move to sun2 proposed

 1. TLS project
  * BenBe/Wytze talked @ fosdem
  * risks fairly low, awaiting fix

 1. CAcert installer project
  * Michael got codesigning and tries to add the cert to crypto stick
  * also related "Black Jack" project
  * profiling of use cases for different cert types (client, server, org client, org server)
  * cont. working code signing cert into crypto token for software assessment releases code signing
  * to build new revision of CAcert installer with all lang translations to sign via key on crypto token

 1. secure boot project (required steps?) (also relates to New Roots & Escrow)
  * we have
   * risk analyze
   * new roots procedure
  * required steps?
   * Escrow method to select
   * subroot under eg. org++
   * cps changes
   * new roots?
   * new signer?
   * indirect crl's

=== 6. next meeting ===
 * Tuesday, March 12, 2013 22:00 CET


== Minutes ==

 1. Documentation - To-Do (relates to Policy Group SP review)
  * developer git repos under github
  * started under:
   * [[Software/Assessment/Documentation/UpdateCycle/step1|Developer Tools Used]] (also github documentation)

 1. bug #964 transfered, still open:
  1. [[https://bugs.cacert.org/view.php?id=1017|bug #1017]] Chrome certificate enrollement
   * needs testing (lost by transfer to testserver stable)
   * commited 2012-09-04
   * new commited 2013-02-13
   * 964 create cert works, install into browser doesn't work
  1. [[https://bugs.cacert.org/view.php?id=901|bug #901]] Renewal of certificate with WIN 7 and IE8

 1. bug #1054
  * no update
  * new update: all ttp points starting 2013-01-01

 1. ttp requests
  * u18 is currently not possible
  * ttpadmin requirements (see [[TTP/TTPadmins]])



==== Fixed Action Items since last or within meeting ====

 || --(dirk)-- --(Brian)-- NEO || (new) [[https://bugs.cacert.org/view.php?id=964|bug#964]] || was: [[https://bugs.cacert.org/view.php?id=918|bug#918 (Part II)]] ([[Arbitrations/a20110312.1|a20110312.1]]) Weak keys: /pages/account/..  4.php, 17.php  to combine ? (/includes/keygen.php) || {g} ||
 || Hendrik, Inopiae || [[https://bugs.cacert.org/view.php?id=1082|Bugs #1082]] || 0001082: The text on the login form is not shown inside the grey box || {g} ||
 || NEO || [[https://bugs.cacert.org/view.php?id=1141|bug #1141]] If i delete Domains, no Servercerts for this domains are listet, even not the revoked || needs testing || {g} ||
 || SA || update cacert-devel git repository || github too || {g} ||
 || SA || replace webserver cert under CACERT1 testserver || || {g} ||


==== Action Items New ====





Action items: '''[[Software/Assessment/ActionItems|Meeting Action Items]]'''

----
 . CategorySoftwareAssessment