SDLC Framework WG Bi-weekly call - June 22nd

## Date

22nd June 2026 - 10am EST / 3pm UK

## Untracked attendees

| Name | Firm | Comment |
| :--- | :--- | :------ |

## Meeting notices
- FINOS **Project leads** are responsible for observing the FINOS guidelines for [running project meetings](https://community.finos.org/docs/governance/meeting-procedures/). Project maintainers can find additional resources in the [FINOS Maintainers Cheatsheet](https://community.finos.org/docs/finos-maintainers-cheatsheet).

- **All participants** in FINOS project meetings are subject to the [LF Antitrust Policy](https://www.linuxfoundation.org/antitrust-policy/), the [FINOS Community Code of Conduct](https://community.finos.org/docs/governance/code-of-conduct) and all other [FINOS policies](https://community.finos.org/docs/governance/#policies).

- FINOS meetings involve participation by industry competitors, and it is the intention of FINOS and the Linux Foundation to conduct all of its activities in accordance with applicable antitrust and competition laws. It is therefore extremely important that attendees adhere to meeting agendas, and be aware of, and not participate in, any activities that are prohibited under applicable US state, federal or foreign antitrust and competition laws. Please contact legal@finos.org with any questions.

- FINOS project meetings may be recorded for use solely by the FINOS team for administration purposes. In very limited instances, and with explicit approval, recordings may be made more widely available.

## Agenda

- [x] Convene, roll call, welcome new people
- [x] Approve previous meeting minutes
- [ ] Roundtable discussion on project status
- [ ] Contribution Processes
- [ ] Control review
- [ ] OSFF London Discussion
- [ ] AOB, Q&A & Adjourn (5mins)

## Notes

- Discussion on https://github.com/finos-labs/SDLC-Controls-Framework/pull/75
- Might make sense to map this to https://cheatsheetseries.owasp.org/cheatsheets/Software_Supply_Chain_Security_Cheat_Sheet.html#harden-build-tools and https://slsa.dev/spec/v1.2/assessing-build-platforms#build-platform-components
- Is it more about using qualified toolchains with provenance?
- Or is it covered by other controls?
- How do we do the validation and evidencing?
- ...to be continued

## Follow Ups

- Check with @aaronsearle and @karlmoll if there will be a hybrid setup for workshop - @AlexKantor87

### Zoom info

**Join Zoom Meeting**
- https://zoom.us/j/94904595244
- Meeting ID: 949 0459 5244
- Passcode: 545224
- Find your local number: https://zoom.us/u/aesEqmNODb

**Github Repo:** https://github.com/finos/devops-automation/

**Project Board:** https://github.com/orgs/finos/projects/33

**Mailing List:** Email devops-mutualization+subscribe@finos.org to subscribe to our mailing list

This issue is a record of the June 22, 2026 SDLC Framework WG meeting, including its agenda, notes, follow-ups, and meeting links. No source file, test, or requested change is identified; review the meeting record and linked discussion only if a maintainer defines a documentation task.

Written by the indexing model from the issue text.