---
# System prepended metadata

title: Veraison go-cose Community Meeting Notes
tags: [go-cose]

---

# Veraison go-cose Community Meeting Notes

###### tags: `go-cose`

- Bi-weekly on Fridays 8:00-9:00 pacific time  
  See below for the next scheduled meeting and proposed agenda

Links

- [GitHub](https://github.com/veraison/go-cose)
- [Zoom Dial-in link](https://us02web.zoom.us/j/81054434992?pwd=YjNBU21seU5VcGdtVXY3VHVjS251Zz09)
- [Calendar/ics](https://zoom.us/meeting/tZUtcu2srT8jE9YFubXn-lC9upuwUiiev52G/ics)
- [go-cose-community email distribution group](https://groups.io/g/go-cose-community)
- [YouTube Recordings](https://www.youtube.com/@go-cose-community3000)

**Note:** Template for copying at the bottom of the note.

- Agenda items must identify the (owner) of the item

## March 8, 2024

### Attendees:
- Steve Lasker
- Orie Steele
- Henk Birkoltz
- Yogesh Deshpande
- Roy Williams

### Agenda Items:
- Triage issues and PRs
- Discuss release of 1.2, documenting the process before the next release
- Steve can focus on the release process post 119
- Orie: Discuss typescript support for cose, possibly added to the veraison project
    - Proposal to add a typescript-cose repo
    - For licensing, decision to use MIT license for the new repo
- _add your topics_

## January 26, 2024

### Attendees:
- Steve Lasker
- Orie Steele
- Henk Birkoltz
- Thomas Fossati
- Yogesh Deshpande
- Roy Williams

### Agenda Items:
- Support for CWT Claims
    - Add to veraison/go-cose
    - Add a new sub-project project for go-cwt
    - Orie: similar to: https://github.com/panva/jose
    - Orie: proposal to add a few header properties for CWT_Claims, for SCITT Support

### Notes:
- _meeting minutes_

## October 6, 2023

### Attendees:
- Steve Lasker
- Orie Steele
- Quim Muntal
- Henk Birkoltz
- Hannes Tschofenig

### Agenda Items:
- [PR: Validate content type header parameter #176 - merged](https://github.com/veraison/go-cose/pull/176/files)
- [Issues](https://github.com/veraison/go-cose/issues)
    - Triaged issues
    - Created v1.2 milestone
    - Closed v1.1 milestone
- Cut release 1.2
    - Defer CWT_Claims addition to 1.3
    - Release Policies
        - Folders for release polices
        - Minor releases are reviewed by maintainers
        - Major release followies the same policies as minor
            - We may do a third party audit, and would require it to be published before the release
            - We reserve the right to not do the audit, if the maintainers believe the costs of the audit aren't justified based on the capabilities added

## September 8, 2023

### Attendees:
- Steve Lasker
- Orie Steele
- Yogesh Deshpande
- _add yourself_

### Agenda Items:
- Review issues/PRs
- Waiting for some updates to the existing issues, but no known blockers giving time for folks to prioritize go-cose and other work.
- _add your topics_

### Notes:
- _meeting minutes_

## August 25, 2023

### Attendees:
- Steve Lasker
- Roy Williams
- Orie Steele
- Quim Muntal
- Henk Birkoltz

### Agenda Items:
- [Upgrade fxamacker/cbor to v2.5.0 #166](https://github.com/veraison/go-cose/pull/166)
    - Due to the underlying changes in fxamacker/cbor, we believe we need more test and dependent use validation. 
    - Are we asking folks to validate against a PR branch? Or, on main, which is not defined as a release?
    - Will add more test cases to cover 
    - Quim to research any additional tests requried for confidence to merge
- Release Process
- [https://github.com/veraison/go-cose/pull/167](https://github.com/veraison/go-cose/pull/167)
    - Merged
- [Detached signature verification fails with "missing payload" error
#150](https://github.com/veraison/go-cose/issues/150)
    - Some discussion about `external` which refers to AAD
    - Changing will be required across the whole library. Potential doc update to explain the parameter pattern.
    - Orie: Is there a higher level abstraction?
    - Quim: Yes, there's a sign1detached
    - Roy: We may want to add another method for detached
    - Steve: can we move forward, adding incremental enhancements later
    - Orie: yes, can guide users to the lower level APIs, if needed
    - Decision to move forward with the PR
- Discusion around what level of 3rd party testing we should do for each release. (Minor and Major)
    - Roy has the action item for research
### Notes:
- What is our merge and release process?
    - Merge to main, stabilize from there to RC branches?
    - Stabilize outside of main, allowing main to move forward past a current stabilizing release?
    - Need to document the release process
    - Discussion:
        1. For each PR, feel confident the test coverage is complete to merge into main. If not, add more tests before merging
        2. Main becomes a secondary stability point
        3. As RCs get released, dependent projects are requested to validate the RC before cutting the release (amount of time TBD)
        4. Release get cut.

## February 10, 2023

### Attendees:
- _add yourself_

### Agenda Items:
- _add your topics_

### Notes:
- _meeting minutes_

## Jan 26, 2023

### Attendees:
- Yogesh Deshpande
- Steve Lasker
- Roy Williams
- Lachie Evenson

### Agenda Items:
- Review open issues
- No active PRs at this point
- _add your topics_

### Notes:
- Closed out open issues, related to 1.0 release
- Created a [v1.1.0 milestone](https://github.com/veraison/go-cose/milestone/7) for assignment of new issues
- Todo: [Add community info #127](https://github.com/veraison/go-cose/pull/127)
- Added [go-cose-community email distribution group](https://groups.io/g/go-cose-community)
- _meeting minutes_


# Meeting Notes Template
(template for copying)

## Meeting Date

### Attendees:
- _add yourself_

### Agenda Items:
- _add your topics_

### Notes:
- _meeting minutes_

