Community Office Hour Meeting Minutes​

Status updates discussed in meeting:

Executive Summary​

• The current overall Tractus-X release model was questioned. Smaller, independent releases and continuous contributions could reduce coordination effort and delays, while retaining quality assurance and automation.
• Issue quality, unclear next steps, and missing documented outputs from requester/developer continue to hinder planning and progress.
• KITS archived, versioned website content has been removed from the GitHub Pages deployment branch to reduce deployment size. Redundant website builds and obsolete content remain under review.
• The wizard initiative has a repository and initial issues, but still needs governance compliance and active contributors.
• Security-team synchronization, secret-scanning efficiency, and sustainable funding for maintenance remain unresolved.
• AI contribution requirements need further review against Eclipse guidance before deciding whether to extend an existing TRG or create a separate one.

Topics Discussed​

Release Process and Workshop Planning​

• Team questioned whether large, coordinated Tractus-X releases still reflect how the project is used. The original rationale of releasing an integrated whole has weakened as users increasingly adopt individual components.
• Independent releases (products/services and KITs) could avoid making completed KIT changes wait for a quarterly release window.
• Continuous contributions, stronger automation, and ongoing quality assurance were discussed as alternatives to the current process.
• It remains open whether a coordinated release is still needed to capture configurations, compatibility mappings, or variants.
• The Tractus-X Accelerator's process-analysis work should allow fundamental changes rather than assume that the existing release model must be preserved.
• Release workshop planned for the next weeks to analyze the current process and possible improvements

KITs and Standards​

• KITs and standards (Catena-X) serve different levels of detail and do not necessarily require synchronized releases.
• A fundamental standard change may require a substantial KIT update, while minor changes may have little or no impact on KIT content.
• Starting with a KIT was discussed as a way to develop and validate approaches before promoting mature content into a standard.
• DCM, as an example of a mature standard whose Expert Group no longer intends to continue as before. Assumption -> This does not automatically remove the need for occasional KIT maintenance.

Open Planning and Issues​

• Stephan expects to present 13 Tractus-X Accelerator issues at next week's Open Planning. Outreach to other initiatives has so far produced limited substantive input.
• Stephan has cleaned up Tractus-X issues, including asking for concrete next steps on long-running topics.
• Issue (Office hour) descriptions often lack clear use cases, deliverables, or actionable next steps. Collections of links alone do not make the intended work understandable.

Website Deployment Size and Archived Content​

• Pull-request preview deployments had encountered GitHub Pages size constraints. Stephan reported that deployment content had temporarily exceeded 4 GB.
• Archived, versioned documentation and (old) KIT content has been removed from the deployment branch.
• The website now points to release tags and ZIP archives instead of deploying those archived versions as part of the live site.
• Stephan reported that this should address the immediate deployment-size problem; continued observation was suggested.

Website Actions and Navigation​

• Website verification, preview deployment, and production deployment perform similar builds, each taking approximately ten minutes.
• Johann will inspect the Actions and verifier structure for opportunities to remove redundant work and shorten the overall publishing cycle.
• The website also needs a content and navigation review. The test-management section was cited as potentially obsolete.
• Stephan has proposed an alternative menu structure and offered to show it in a future demo; no presentation date was agreed.

CX Next AAS-Related Contribution​

• Daniel Klein is expected to present a proposed contribution from an AAS-related UI tool at the November 13 Office Hour. The exact component scope remains to be clarified.
• Stephan discouraged creating a separate Tractus-X repository because of governance overhead and ongoing maintenance requirements.
• Integration into the existing Tractus-X SDK, alongside related libraries and wrappers, was the preferred direction discussed.
• No final repository placement or acceptance decision was made.

Wizard Initiative​

• The repository and initial issues are in place, but governance compliance is still outstanding.
• A first 30-minute weekly session is planned for next Thursday, although it overlaps with the Network Services Committee workshop. How to handle that conflict remains open.
• Interested contributors need to take ownership of implementation and governance tasks.

Security Team Synchronization​

• The selected project security contacts do not match the GitHub security-team membership: the GitHub team currently includes all committers.
• Stephan has already opened an Eclipse help-desk issue about the synchronization problem.
• Security notifications should reach the designated security contacts rather than all committers. The issue remains unresolved.

TruffleHog and Maintenance Capacity​

• TruffleHog was reported to perform expensive scans deep into branch and commit history, including during pull requests.
• Lars recommended checking new changes and the latest main-branch state, including changes that may bypass pull requests, rather than repeatedly scanning unchanged historical commits.
• A previously resolved false positive in an old commit illustrated the cost of repeated historical scans.
• A shared Security/DevSecOps or system-team function was suggested for investigating and maintaining this infrastructure.
• Ownership and funding remain open.

AI Guidance, Commit Requirements, and TRG Placement​

• The group discussed whether AI-related requirements belong in TRG 7 or a separate TRG 11.
• Lars cautioned against introducing obligations beyond those required by Eclipse without a clear reason.
• Commit-message conventions, including sign-off and co-author information, need to be checked against actual Eclipse requirements rather than assumed to be mandatory.
• A consolidated Tractus-X explanation could improve discoverability, since contributors may not read either the TRGs or Eclipse guidance consistently.
• The group questioned whether AI disclosure fits release-time checks: unlike license or copyright-header checks, undisclosed AI use cannot reliably be detected during a release review.
• Lars questioned the legal usefulness of a general AI-assistance declaration when it does not identify which parts of a contribution were generated. No legal conclusion was established.
• Stephan will review the guidance before the next session. Placement and scope will be discussed with a broader group.
• Closing the long-running topic before Christmas was expressed as an aim, not an agreed deadline.

Decisions​

• Decision: Archived, versioned website content will no longer be included in the GitHub Pages deployment branch; release tags and ZIP archives will be referenced instead.

Action Items​

• @stephanbcbauer: Present the 13 Tractus-X Accelerator issues at next week's Open Planning.
• @stephanbcbauer: Review the AI-related Eclipse guidance and provide further information before the next Office Hour.
• Johann Schütz: Review the website Actions and verifier structure and investigate build and deployment optimizations.
• Unassigned: Finalize a feasible date for the release-process workshop.
• Unassigned: Evaluate alternatives to coordinated overall releases, including quality assurance, automation, and configuration or compatibility mapping.
• Unassigned: Review obsolete website content and the navigation structure.
• Unassigned: Complete the wizard initiative's governance setup and secure contributors for its initial issues.
• Unassigned: Clarify ownership and funding for shared security and DevSecOps maintenance.

Community Office Hour Meeting Minutes​

Status updates discussed in meeting:

Executive Summary​

• The meeting clarified that the proposed Toolbox and wizard/starter-kit concepts still need alignment before definitive next steps and milestones are set.
• The group agreed on tractusx-starter-kit as the working repository/project name.
• The repository will support a static webpage and a dynamic wizard-like tool for generating configured Docker Compose files, initially for two or three components.
• Release-process improvements are planned, focusing on better documentation, broader participation from initiatives and industries beyond Catena-X, and more accessible planning meetings.
• Several tracked items remain blocked or awaiting review, including Gateway API updates, committers information, security follow-up, and the AI-related TRG discussion.

Topics Discussed​

Toolbox and Starter Kit​

• The relationship between the Eclipse Tractus-X Developer Toolbox and the existing wizard remains unclear; intended integration and the next steps should be confirmed with him.
• The planned repository will contain a static webpage and functionality to generate an easy-to-run, fully configured Docker Compose file with documentation, without requiring Kubernetes.
• The initial scope is two or three components, with the possibility of adding more later.
• The working name agreed in the discussion was tractusx-starter-kit.

Portal Hackathon​

• The hackathon remains planned for Friday, with a large attendee list for the onsite meeting at the Arena.
• Differences in the new architecture were not reviewed because they are expected to be discussed again immediately before development begins.

Eclipse Tractus-X Community Days​

• Registration is still open; participants were encouraged to seek approval to attend and book hotels early.

Product Page and Repository Status​

• The new product page was described as an improvement, but the displayed people may incorrectly mix committers and contributors.
• The repositories and people shown on the page still need validation before the information can be considered accurate.
• Work on the related item was deferred because other work is currently taking priority.

Release Management​

• The release timeline is approaching the testing phase.
• Initial pull requests for kits should be created soon so reviewers have enough time before the release.
• A brainstorming effort planned for next week will examine the current release and planning processes, including how to document them better and make them more open to other initiatives and industries.
• The current planning meetings were described as having approximately 100–120 participants in the past (two years ago) and approximately 10–20 currently -> this is the place where we can discuss and plan YOUR features -> don`t be shy, join the meeting and create your issues/requirements

Security​

• The Eclipse Foundation is expected to offer a meeting next year to present security options.
• The team discussed whether the existing security issue is still needed after changes for five individual users.

Gateway API and Other Issues​

• The Gateway API work remains blocked until the active repositories are identified, after which a major issue can list the repositories requiring updates.
• A pull request concerning the committers project description was created, but it still needs review by someone other than its creator.
• The AI-related pull request remains unresolved after an earlier discussion about whether the topic needs its own TRG.

Decisions​

• Decision: Use tractusx-starter-kit as the working name for the repository/project.

Action Items​

• @stephanbcbauer: Create the tractusx-starter-kit repository and submit a pull request to the Eclipse Foundation repository.
• @stephanbcbauer: Create the open meeting and kickoff issues on the Tractus X webpage.
• @stephanbcbauer: Add screenshots to the security-related issue and move it to done if complete.
• @stephanbcbauer: Check whether the committers pull request matches the issue requirements.
• Unassigned: Review and merge the committers pull request; the creator cannot approve it.
• @stephanbcbauer: Create a 15-minute meeting with the participants of the AI-related pull request discussion.
• Unassigned: Decide whether the AI topic should have a separate TRG or be handled within another TRG.

Community Office Hour Meeting Minutes​

Status updates discussed in meeting:

Infrastructure and Test Management​

• Test phase for Release 25.12 is ongoing. Currently blocking issue with Portal onboarding of new test companies.
  • Workaround using existing ones is also limited due to issues with email notifications for new user accounts and presumed issue for creation of new technical users.

Release Management​

• Release Planning Timeline:

  • 26.03 Eclipse Tractus-X Open Planning was conducted on November 13th.

• Policy Hub recommendation to be archived: Decision of Data Sovereignty Expert Group that the Policy Hub is not needed anymore, as it adds no value to the ecosystem.

  • See for details this issue on the Office Hour Board. It will remain in progress to track further information.
  • Input from Mathias Moser to follow the official process as outlined in TRG 7.09

Security​

• Please check regularly if there are findings for vulnerabilities or dependency updates in the security tab of your project repository.

Community/Open Planning​

• Everyone is invited to join the Fifth Eclipse Tractus-X Community Days on December 4th and 5th in Stuttgart. See this link for registration
• New Calendar View for open meetings, see for details the open meetings page
  • Potentially type color for time and date could be set in white for better legibility.

Feedback / Questions / Requests​

• Discussion of planned PostgreSQL updates and image provider change

  • Mikel Garcia has updated the applicable TRGs, including the change from Bitnami to Cloud Pirates images
  • He also created a migration guide using the SSI DIM Wallet Stub as an example.
  • However there were issues encountered by Lars Geyer-Blaumeiser for the BDRS service with the automated Helm Upgrade failing, thus requiring a manual deletion and redeployment. See this link for further details.

• Question from René Schröder regarding maintenance of IRS -> Will contact Robin Gottschalk to follow up.

• Suggestion from Mathias Moser: TRG for quality of new or existing repositories in GitHub, e.g. with the 3 phases sandbox, incubating, graduated. He will elaborate this further. The plan would be in a later step to display this automatically as a "maturity level" for each repository in the Eclipse Tractus-X product list overview.

• Discussion regarding a legal need to remove/replace references to EPL licenses from files in Eclipse Tractus-X. Finding a solution is ongoing.

Office Hour meeting minutes​

Update Infrastructure/Test Management​

• Deployment phase for 25.12 is ongoing. None has deployed yet, please start.
• DTR has an update ongoing, but the PR is open. New version expected on next week

Update Release Management​

• Release Check issues must be created next week to confirm who joins or opts out of the test phase; reminders have been sent to previous participants.
• Current reminder for 26.03 open planning: https://eclipse-tractusx.github.io/community/open-meetings#open-planning-r26-06

Update Security​

• Please patch high and critical security vulneratiblities before e2e test.

Update Community/Open Planning​

• Community Days: registration open; a lot of other data spaces have been invited.
• Container images: @mgarciaLKS raised a TRG update for postgres with an example linked eclipse-tractusx/eclipse-tractusx.github.io#1367, committers aligned on 18.x
• What's the last date to provide the semantic model? Should be in line with the Final KIT PR (25.12 = 2025-11-17)
• What needs a ticket for release and how to release a kit? If you release a KIT, you need a release ticket: PURIS example - If you release something unfinished or not released in standards, add a disclaimer.

Office Hour meeting minutes​

Update Infrastructure/Test Management​

• Briefing meeting for the upcoming test phase is on Monday; invitations were sent out. If anyone was missed, invitations will be forwarded upon request.
• Scope: overview of the test phase (deployment, who joins, and key updates).
• Test phase start: 20 October.

Update Release Management​

• Release Check issues must be created next week to confirm who joins or opts out of the test phase; reminders have been sent to previous participants.
• Feature freeze is approaching; merge necessary PRs, especially for core products, to enable testing.

Update Security​

• Vulnerability identified in Python Keycloak-related dependency (PyPI package with no fixed version) causing Trivy workflow failures.
• Mitigation: use .trivyignore, include a review date, and document the waiver in the release issue.

Update Community/Open Planning​

• News: blog entry for 26.03 is online (alignment day, open planning day). Open source participants should use the open meetings page.
• New committers: Theresa and Andrii approved; complete Eclipse Foundation paperwork.
• Community Days: registration open; workshop proposals and sponsors welcome.
• Container images: evaluating CloudPirates Helm Charts (Keycloak, Postgres, etc.) that wrap official Docker images; Eclipse feedback indicates Docker images are acceptable if referenced transparently.
• KITs coordination: new Matrix room created to align multi-dataspace development and onboarding; plan a weekly KITs office hour once processes are established.

Office Hour meeting minutes​

Release 25.12 – Participation and Preparation​

• All teams must create their release check issues in sig-release by latest next week to prepare for the briefing meeting.
• Connector participation in 25.12 is undecided; decision expected after Tuesday’s discussion.
• Even minimal releases (e.g., only bug fixes) should still raise a check issue.
• Test phase briefing → next week, kickoff → two weeks after briefing.

Changelog & Documentation Changes​

• DocuSaurus updated to v3.9.1.
• New changelog presentation: structured by year/release using DocuSaurus blog plugin.
• Added contributor/committer acknowledgements (from GitHub analytics).
• Archived kits now provided; possible change to single current zip package instead of multi-version archives (to be discussed in committer meeting).

Governance & Repository Changes​

• Digital Product Passport repository deprecated and archived per TRG rules.
  • DPP verification docs → moved to Data Trust & Security Kit.
  • Full DPP documentation now lives in Ecopass.
  • Tutorial relocated to Tutorial Resources (still migrating images).
• Topic on centralising tutorials for Community Days still open.

Office Hour & Moderation Planning​

• New round-robin schedule; participants to confirm dates in the shared discussion link.
• Some moderation slots reallocated due to vacations/conflicts.
• Check for a new series needed with beginning of next year

Committer Elections​

• Theresa nominated as committer (focus: release management).
• Election closing next Thursday; committers asked to vote.
• Andrii's PMC election pending next PMC Monday meeting.

Community Days​

• Agenda still forming; workshops/presentations needed.
• Deadline for workshop confirmation: ideally within next 1–2 weeks, but minor changes possible up to event date.
• Semiconductor-X project may provide up to two workshops (cross-dataspace, traceability) depending on progress.

Security Reminders​

• Teams must check and address security tab issues to avoid deprecation.

Postgres 17 Upgrade & Image Source Problem​

• 25.09 used Bitnami Legacy images (last viable for that release).
• For 25.12+, Bitnami Legacy is not sustainable — need an alternative.
• Options under consideration:
  • Official Docker Hub Postgres images (license implications to check).
  • Cloud Pirates Helm charts/images (to evaluate; may wrap Docker Hub Postgres).
  • Hosting our own images (currently no team capacity).
• Eclipse Foundation guidance: use Bitnami Legacy for Sept release, evaluate Cloud Pirates for next.
• Action: Committers to research viable alternatives and check licensing with Eclipse Legal (possibly via Angelika).
• Decision deferred to Committer Round.

Office Hour meeting minutes​

Infrastructure Test Management​

• GNI X-Ray Test Sessions:
  2 sessions held; no active registrations.
  Keep status in progress for potential October session.
• External Product Test Phase:
  Release Candidate 3 published by Lars & team; some issues remain.
  Next evaluation meeting on Tuesday.
  Confirmed: Catena-X does not provide dedicated dev environments — teams are responsible for their own.

Release Management​

• Release postponed; target Tuesday/Wednesday.
• Preparation:
  • Change logs ready for review (Teresa prepared initial version).
  • Need contributions for Known Issues and product-specific notes (e.g. BPDM, Connector).
• Screenshots in Release Notes: Discuss post-release.
• Changelog Improvement Idea: Block-format inspired by Docusaurus for better presentation.

Security​

• Reminder: Check the security tab regularly.
• Deprecation of "Digital Product as Repository of Surveillance" planned next week.
• Plan to migrate VP visualization to Industry Core.

Community & Events​

• Catena-X Community Days (End of December): Registration open.
  • New field to list products you contributed to.
  • Multiple select option fixed.
  • Booking changes may require cancel/re-register.
• Call for workshop leaders/presenters.
• New “Community Events” room created for event promotion and discussions.

Committer Election​

• Andrii proposed as new committer — key contributions on EDC component, DSP/DCP TCK, release process improvements.

General Reminders​

• Moderation list update needed (René added).
• No office hour next week due to public holiday in Germany.

GitHub Fork Access Clarification​

• Forks in private accounts do not inherit original repo’s write access.
  Owner must explicitly grant rights.
  Public forks: read-only access by default.

Office Hour meeting minutes​

Update Infrastructure/Test Management​

• Bitnami Image Dependency

  • Bitnami container images (e.g., Keycloak, Postgres) are moving behind a paywall; legacy images will be deprecated and not maintained.
  • Security risks for future releases if legacy images are used.
  • Eclipse Foundation and other users are also affected; no immediate action required, but migration planning is needed.

• Repository Naming & Creation Guidelines

  • No strict naming convention; guidelines to be documented on the website.
  • Requirement: At least one ticket in SIG release, compliance with TRGs, and proper documentation (README, license).
  • Action: Present new repository requests in office hour; contributors to be added and approved.

Update Release Management​

• Release & Test Phase Updates

  • EDC 0.11 release candidate delayed by one week due to upstream issues.
  • Products using EDC will start testing one week later; other products should stick to the initial plan.
  • Tight timeline for release; last week reserved for bug fixes.

• Feature Planning for Release 25.12

  • Open planning session scheduled for August 14th.
  • Teams must refine features and inform needed teams/contributors before the session.

Update Security​

• Security Responsibilities
  • Teams are responsible for addressing security vulnerabilities in their releases.
  • Eclipse Foundation will support major issues but responsibility remains with the product teams (related committer).

Update FOSS Governance​

• API Versioning Discussion

  • Debate on enforcing API versioning (e.g., v2, v3 in URLs).
  • Previous decision: Recommend but not mandate versioning; no TRG (Technical Release Guideline) enforced.
  • Open for further discussion in the committer round.

• Project Description & Initiative Listing

  • Updated project descriptions to include Manufacturing-X and clarify scope.
  • Initiatives must contribute back to Tractus-X to be listed.

Update Community/Open Planning​

• Community Day Announcement

  • Community Day planned for December; registration opens in September.
  • Manufacturing-X initiatives invited to host workshops and demos.

• Tutorials & Identity Hub

  • New tutorial released for Identity Hub deployment and development.
  • Intended for demonstration and proof-of-concept, not production use.

Feedback / Question / Request​

• New Initiatives & Collaboration
  • Wind-X collaboration: Plan to create a Python SDK for asset administration shell, combining existing SDKs for broader API support.
  • Open invitation for contributors from other initiatives (e.g., FactoryX, Semi, Energy Data X).

Office Hour meeting minutes​

Infrastructure & Test Management​

Management & Progress Updates​

• Recent development tasks were completed, including resolving rate limit issues.
• Teams are reminded to create release check issues for the upcoming major release, including mapping features to test cases and noting responsible committers.

Environment Reset for Testing​

• Discussion on whether a reset of the test environment (25.09) is needed for a clean slate.
• No strong need identified; decision deferred to the next portal meeting for further input.

Release Management​

Timeline Review​

• Timeline for upcoming releases (25.12 and beyond) was reviewed.
• Alignment and open planning days are scheduled; some concerns about holiday overlaps, but dates are fixed due to release dependencies.

Security & Governance​

Security​

• Reminder to update the security tab and deprecate outdated repositories post-release for security reasons.
• Ongoing process to review and close out old (not maintained) repositories.

FOSS Governance​

• Ongoing review of the "one license file per folder" policy; to be discussed in the next committee meeting.
• Decision: No notice section required for blogs, news, or meeting minutes; required for other documents.
• Discussion on maintaining and updating changelogs for TRGs (Technical Reference Guides).
• Reminder to update API versions in the API hub and ensure .tractusX files are properly tagged.
• Emphasis on maintaining quality and consistency across KITs and APIs.

Community & Events​

• Recap of successful French Catena-X Days in Paris, including workshops and presentations.
• Ongoing search for contributors with wallet/identity hub experience; open meetings scheduled weekly.
• Presentation of Tractus-X to the Eclipse Data Space Working Group (EDWG) and discussion about associating the project with ADBG for increased visibility and marketing.
• Farewell to Evelyn, with best wishes from the team.

Office Hour meeting minutes​

Infrastructure & Test Management​

Release Roadmap​

• 25.09 release is in testing; 25.12 is upcoming.
• Teams must create and fill out release check issues, including responsible contacts, app versions, and feature lists. This must be done for both, KITs and FOSS Products.
• Quality gate checks should be created and linked early.
• Products not part of the release should be communicated.

Kubernetes Update​

• Core cluster update started; end environment update scheduled (1–5 PM).
• Upgrading to version 1.33.0 (from 1.28/1.29).
• Teams should consider the new version in their release checks.

Release Management​

Timeline Review​

• R25.09: Currently in development and test case creation phase. Deadline for KIT readiness: August 18.
• R25.12: Briefing meeting for testing in July; each team should send at least one representative.
• Open source community encouraged to contribute to "KITs" (documentation/tooling packages).
• Discussion on deadlines for KIT PRs—suggestion to focus on merge deadlines rather than initial PRs.

KIT Management​

Versioning & Changelog​

• Maintain changelogs in every request.
• Avoid last-minute KIT changes; contribute early to prevent release delays.
• Release check issues for KITs are still required and tracked on the release management board.

Refinement Phase for 25.12​

• Teams can already create features for the next release.
• Upcoming "Alignment Day" for cross-team coordination.

Security & Governance​

Security​

• Reminder to use the security tab and available tools (e.g., Snyk) to address critical/high findings.
• Contributors should consult committers for access.

FOSS Governance​

• TRGs (Technical Reference Guidelines) 7.XX, 7.XX, 7.XX updated; 7.XX to be deprecated. Improved handling of license/copyright information, especially for images and non-code artifacts. Find details in the PR.
• Reminders
  • Markdown files must include a notice section; code files require license headers.
  • Reviewers should enforce these requirements.
  • Discussion on imported notice sections and license mismatches. Not recommended

Community & Events​

Tractus-X Promotion at Catena-X Tech Days (France)​

• Event on July 9; open invitation to join and help build the French community.
• Announcement posted to the mailing list. Link to event.

Mailing List Etiquette​

• Replies and reactions to mailing list messages notify all members; use with consideration.

Open Discussion & Q&A​

• Issuer service deprecated; functionality moved to Identity Hub.
• Call for developers with Identity Hub experience.