10th Aug 2026 - GitProxy Meeting Minutes

[kriswest]

Date

20260810 - time

Meeting info

• Meeting link

• Register for future meetings

Meeting notices

• FINOS Project leads are responsible for observing the FINOS guidelines for running project meetings. Project maintainers can find additional resources in the FINOS Maintainers Cheatsheet.

• All participants in FINOS project meetings are subject to the LF Antitrust Policy, the FINOS Community Code of Conduct and all other FINOS policies.

• FINOS meetings involve participation by industry competitors, and it is the intention of FINOS and the Linux Foundation to conduct all of its activities in accordance with applicable antitrust and competition laws. It is therefore extremely important that attendees adhere to meeting agendas, and be aware of, and not participate in, any activities that are prohibited under applicable US state, federal or foreign antitrust and competition laws. Please contact legal@finos.org with any questions.

• FINOS project meetings may be recorded for use solely by the FINOS team for administration purposes. In very limited instances, and with explicit approval, recordings may be made more widely available.

Agenda

• Convene & roll call (5mins)
• Display FINOS Antitrust Policy summary slide and review Meeting Notices (see above)
• Approve past meeting minutes
  • 27th July 2026 - GitProxy Meeting Minutes #1659
• Update Git proxy's governance to latest FINOS standard and formalize agreement reviews #1660
  • docs: add Technical Charter and restructure governance documentation #1664
• 2.1.0 release status: https://github.com/finos/git-proxy/milestone/10
• 2.2.0 release prep tasks; https://github.com/finos/git-proxy/milestone/11
• Using Git Proxy to govern other GitHub/GitLab activity such as issues, PRs, Discussions, Comments, Access to release assets, etc.
• AOB, Q&A & Adjourn (5mins)

---

Meeting Minutes

• Approval of Past Meeting Minutes

  • Previous meeting minutes (27th July 2026 - GitProxy Meeting Minutes #1659) were acknowledged; no objections raised. Actions items reviewed.

• Update Git proxy's governance to latest FINOS standard and formalise agreement reviews

  • Governance documentation restructure (PR docs: add Technical Charter and restructure governance documentation #1664) reviewed; aligns with FINOS standard and adds project charter, contributing guidelines, and cross-firm review requirements.
  • Maintainers present agreed to review and approve PR; Citi team to be asked for input before merging.

• 2.1.0 Release Status

  • 2.1.0 is ready; demo video scheduled to be recorded and release to be published imminently (@jescalada).
  • Final placement of demo video (contributing guide or repo) discussed; preferred to keep it accessible.

• 2.2.0 Release Preparation

  • HTTP Basic and NTLM auth methods merged and moved to 2.1.0 milestone.
  • Remaining features for 2.2.0 include refreshed UI, Postgres support, modification date fields, hybrid cache architecture, LDAP improvements, and dependency upgrades.
  • Dependency upgrades (e.g., Vitest 4, TypeScript, TypeScript ESLint) should be grouped for easier maintenance.
  • Migration of E2E tests from Cypress to Playwright discussed as a future enhancement.

• Using Git Proxy to govern other GitHub/GitLab activity such as issues, PRs, Discussions, Comments, Access to release assets, etc. (Not discussed in depth)

  • Topic deferred to future meetings. Initial ideas and requirements were raised, but a full discussion was not held due to time constraints.

• AOB, Q&A & Adjourn

  • No further business raised; next meeting scheduled for 24th August.

---

Rolling Over/Comments on Previous Action Items

• Internal security requirements (user credentials/tokens, OAuth, signing) have been completed after discussions with security teams.
• New maintainer onboarding continues; Citi team maintainers and PRs outstanding.
• Deprecation warning PR merged, but needs generalising to schema-based warnings; new issue to be raised (@jescalada).
• Recruitment of new maintainers/reviewers ongoing; @kriswest working with a new contributor (Adrian Neow).
• Combined SQL/Postgres PR is still in progress (@dcoric / @fabiovincenzi); main PR and documentation being prepared.
• Review and feedback for SSH fingerprint verification was not clear; identified as issue SSH fingerprint verification #1648—@fabiovincenzi to review and follow up.
• LDAP PR conflicts and coverage improvements still pending (@jescalada coordinating).
• FINOS events team follow-up for OSFF New York booth logistics not completed; needs action.
• GitProxy Boy vulnerability review (OSTIF) ongoing; to be monitored and action item rewritten for clarity.

Action Items

• @Andreybest: Propose slots for architecture/workflow roadmap workshop (coordinate with @grovesy and Citi participants). (Rolled over)
• @Andreybest: Submit initial PR for alternative to TSOA for API documentation/control (Nest/TSNext); review and iterate. (Rolled over)
• @ALL: Actively recruit additional maintainers/reviewers, especially from G-Research and Citi, to accelerate PR review. (Ongoing)
• @jescalada: Follow up with FINOS events team for OSFF New York booth logistics and content updates. (Rolled over)
• @dcoric / @fabiovincenzi: Create subtasks and combine smaller SQL/Postgres PRs into a main feature PR; provide documentation and migration tools. (In progress)
• @jescalada: Resolve conflicts and coordinate minor changes for LDAP PR; follow up with contributor for coverage improvements. (Rolled over)
• @ALL: Actively review issue SSH fingerprint verification #1648 (SSH fingerprint verification); @fabiovincenzi to lead review and recommend actions.
• @ALL: Continue to monitor and contribute to OSTIF vulnerability review as updates become available; clarify and rewrite action item.
• @jescalada: Raise issue to generalise deprecation warning handling to schema-based approach.
• @jescalada: Raise issue and review changes in PR feat(proxy): resolve push identity from token via SCM provider API #1604 (push identity); ensure architecture documentation is updated and maintainers understand edge cases.
• @kriswest: Raise issue to review and improve Dependabot config for CVE tagging and workflow clarity: Review dependabot config and ensure that PRs that resolve current CVEs are clearly labelled #1667
• @andypols: Raise issue to migrate E2E tests from Cypress to Playwright : Migrate e2e from cypress tests to playwright #1666
• @jescalada: Record and publish demo video for 2.1.0 release; ensure accessibility from contributing docs or repo.
• @ALL: Review and approve governance update PR docs: add Technical Charter and restructure governance documentation #1664; request input from other maintainers (@coopernetes, @grovesy).
• @kriswest: Resolve merge conflicts in dependency upgrade and security PRs.
• @jescalada: Group and coordinate dependency upgrades (Vitest, TypeScript, ESLint, etc.) for 2.2.0 milestone.
• @ALL: Prepare for discussion on using Git Proxy to govern wider GitHub/GitLab activity at the next meeting; consider requirements and potential approaches.

---

Not Discussed

• "Using Git Proxy to govern other GitHub/GitLab activity such as issues, PRs, Discussions, Comments, Access to release assets, etc."
  • Deferred due to time; added to future agenda.

[kriswest]

Minutes and actions posted