2023-01-23

Owned by doug walker
Last updated: Jan 23, 2023
2 min read

January 23, 2023

Host: Doug Walker

Secretary: Doug Walker

Attendees:

Rémi Achard (TSC) - DNEG
Mark Boorer (TSC) - Industrial Light & Magic
Mei Chu (TSC) - Sony Pictures Imageworks
Sean Cooper (TSC ACES TAC Rep) - ARRI
Michael Dolan (TSC) - Epic Games
Patrick Hodoul (TSC) - Autodesk
John Mertic - Academy Software Foundation / Linux Foundation
Carol Payne (TSC Chair) - Netflix
Mark Titchener (TSC) - Foundry
Carl Rand (TSC) - Weta Digital
Doug Walker (TSC Chief Architect) - Autodesk
Kevin Wheatley (TSC) - Framestore
Zach Lewis - Method

Apologies:

  • Carol Payne

  • Remi Achard

OCIO TSC Meeting Notes

  • CI Build Matrix:

    • Doug: Remi has been working on a proposal for a refreshed CI build matrix.  We will discuss again at a future meeting when Remi is able to join, but does anyone have any comments on the matrix right now?

    • https://docs.google.com/spreadsheets/d/12fS8A3rcAHz5X05NVM11CeeD2N8EG6l1dRbuOqnHL7U/edit#gid=0

    • Zach: Looking at the line between build 7 and 8, do we need that one to verify that the static lib is usable in other projects.  Doug: Cedrik added a test that should catch the OIIO issue you ran into that will run whenever there is a Shared=OFF build.  Looks like there is coverage of that situation without needing the line you referenced.

    • Zach: What does the blue color mean?  Kevin: Certain features, such as docs, are largely independent of interactions with the other variables, so they only need to be "ON" for one row, to verify that feature works.  The blue might be indicating that.

  • Third-party security notifications:

    • Doug: Looking for suggestions for what is the best way to deal with updates from third-parties, particularly around new security vulnerabilities.  Our sister repo, for ACES configs generation, uses DependaBot.  That's more straight-forward to use with a Python project, such as the config repo, than a C++ project.  Has anyone used that for C++ or have any suggestions for other approaches?

    • Kevin: One issue is that each dependency may have a different approach to notifying that an update is available.  We should find out what mechanisms are available for each of them.  The recommended approach for each should be documented.  Would also be nice to have a check-list of things that need to be done when adding a new dependency and this should be on the list.  Zach/Doug: Great suggestions.

    • Doug: One resource is the GitHub Advisory Database.  I will try to compile a list of each dependency and where we might be able to look for notifications.

  • Rez scripts

    • Zach: Would it be helpful to have Rez scripts for OCIO that could be used with different dependency settings?