Status updates discussed in meeting:

Executive Summary​

• The website build-strategy and GitHub Actions rework are complete. The reported limit of five to six concurrent pull-request previews remains unresolved and will be tracked separately.
• The tractusx-starter-kit has completed its initial governance setup and held its first open meeting. Further contributors are welcome.
• The release-management workshop is being prepared as a cross-initiative Tractus-X activity, not a Catena-X-only workshop. Timing depends on stakeholder identification and availability.
• Secret-scanning performance, outdated documentation, component-maintenance responsibilities, and AI contribution guidance remain open.

Topics Discussed​

Community Days and Outreach​

• The seventh Tractus-X Community Days in Stuttgart were promoted as an opportunity for in-person collaboration, workshops, and business and technical discussions.
• Workshop details were not yet published at the time of the meeting.
• Participants were encouraged to share the event and support promotion through the Tractus-X LinkedIn page.

Website Builds and Pull-Request Previews​

• The website build strategy has been improved, reducing work and execution time during pull requests.
• The related GitHub Actions rework is complete.
• A reported GitHub Pages limitation allows only approximately five to six concurrent pull-request previews. Beyond that, publication can fail. -> Older previews are currently removed manually. A separate issue will track a more sustainable solution.
• Feedback Preview deployments were positively received as a way to review changes with non-technical stakeholders.

New Repository "wanted"​

• The proposed contribution from Daniel was deferred because Daniel was absent.
• Integration into the Tractus-X SDK was discussed as a possible alternative to creating a separate repository. No final integration decision was made.
• An additional repository was requested for the EDC Management Console application.
• The established repository-creation approach is to update the shared JSONnet configuration and submit a pull request for review.
• Repository descriptions, access permissions, and required workflows can be managed through that configuration.

Website Content, AI Agents, and MCP Servers​

• Website work covers FAQs, audience-specific information, reasons to use Tractus-X, AI agents, and MCP servers. -> A pull request for the AI-related pages is open. FAQ work is still pending.
• The proposed pages describe available agents, their repositories, capabilities, and skills, as well as MCP servers and the relationship between data spaces and AI.
• Review needed review the content and submit information about additional MCP servers.

Developer Toolbox and Workflow Documentation​

• The concrete next step for the testing-automation/toolbox topic remains unclear.
• Options discussed included formalizing the automation as a reusable workflow, documenting how to use it, or closing the issue if it is purely informational.
• Missing Developer Hub documentation for existing workflows was identified as a broader problem. -> no assignee yet

EDC Interest Group and Meeting Structure​

• Creation of the EDC interest group was considered complete. The group had already participated in an EDC meeting last thursday
• Continued collaboration should use the existing EDC meeting structure.
• The contributor meeting takes place on Tuesdays at 13:00 and is invitation-based. Interested contributors can request an invitation -> @lgblaumeiser

tractusx-starter-kit​

• The first open meeting took place on November 12 with @lgblaumeiser and @ReneSchroederLJ.
• Initial issues have been assigned, and @AndrYurk merged the initial pull request covering Eclipse governance requirements.
• Open status meetings are intended to continue every two weeks -> see open meetings page
• Contributors were encouraged to work through the existing issues, create additional issues where needed, and keep the community informed.

Data Space Management Stack and "Portal"​

• An open Data Space Management Stack meeting was announced for November 13 at 14:00.
• "Portal" development continues through the new working group, including follow-up work from the hackathon.

Outdated Documentation and Archiving Candidates​

• Testing documentation, including Jira/Xray-related pages, was identified for review -> no assignee yet
• Jira is still used for current E2E testing, so removing the documentation without checking current practice would be not benefitial.
• The product overview and deprecated-component lists need alignment before further cleanup.

Release Management and Timeline​

• The release-management workshop should represent Tractus-X and its wider ecosystem, including relevant initiatives and industries.
• Broader participation is required because the outcome also affects the Tractus-X Accelerator and future contribution responsibilities.
• Stakeholder identification is still in progress. The workshop is tentatively planned after the Community Days, or early next year if necessary.
• Participants were encouraged to provide release-process feedback through the shared Slido survey.
• R26.12 was reported to be in testing, with publication planned for December 2.
• Open Planning for 27.03 is complete; contributors can proceed with the planned development work.
• An Eclipse Foundation session on security options remains intended for next year. -> Lets talk next year

Secret Scanning and GitHub Actions​

• Secret scans can take approximately two hours because the current configuration scans excessive history.
• Scan scope, scheduling, and fetch depth need adjustment, particularly for pull requests.
• Removing the scanner from a documentation repository was questioned, but no decision to remove it was made.
• GitHub Actions pinning was reworked across non-archived repositories, with pull requests created for review and merging.
• Dependabot was reported to detect updates to SHA-pinned sig-infra actions, including actions associated with the main branch.

SSI DIM Wallet​

• No active maintainer was identified for the ssi-dim-wallet -> The wallet still supports lightweight testing scenarios
• Announcing the wallet as an archiving candidate through the established process was proposed -> The discussion referenced announcement in the Office Hour and Matrix, followed by an objection period described as approximately two weeks.
• Archiving is reversible if a user or maintainer later resumes the work -> The exact timing and execution owner were not conclusively established.

AI Contribution Governance and TRG Structure​

• Placement of AI-related guidance in TRG 7 versus TRG 11 remains under discussion.
• Copyright and license-header guidance was considered better placed with the existing copyright rules in TRG 7.
• Any requirements for commit messages or trailers need separate clarification because they are not currently covered in the same way.
• Existing Eclipse guidance should be reviewed before introducing additional Tractus-X-specific requirements.

Action Items​

• @stephanbcbauer: Create an issue for the concurrent pull-request preview limitation.
• @stephanbcbauer: Investigate and adjust secret-scanning scope and fetch depth.
• @stephanbcbauer: Continue preparing the cross-initiative release-management workshop once the stakeholder list is available.
• @stephanbcbauer: Consolidate the AI-governance documentation changes, clarify their TRG placement, and address redirects where needed.
• Unassigned: Review the AI website pull request and contribute missing MCP-server information.
• Unassigned: Define a concrete next step for the testing automation and its documentation.
• Unassigned: Submit the EDC Management Console repository request through the shared configuration pull-request process.
• Unassigned: Clarify ownership and timing for the SSI DIM wallet archiving proposal.

Status updates discussed in meeting:

Executive Summary​

• The current overall Tractus-X release model was questioned. Smaller, independent releases and continuous contributions could reduce coordination effort and delays, while retaining quality assurance and automation.
• Issue quality, unclear next steps, and missing documented outputs from requester/developer continue to hinder planning and progress.
• KITS archived, versioned website content has been removed from the GitHub Pages deployment branch to reduce deployment size. Redundant website builds and obsolete content remain under review.
• The wizard initiative has a repository and initial issues, but still needs governance compliance and active contributors.
• Security-team synchronization, secret-scanning efficiency, and sustainable funding for maintenance remain unresolved.
• AI contribution requirements need further review against Eclipse guidance before deciding whether to extend an existing TRG or create a separate one.

Topics Discussed​

Release Process and Workshop Planning​

• Team questioned whether large, coordinated Tractus-X releases still reflect how the project is used. The original rationale of releasing an integrated whole has weakened as users increasingly adopt individual components.
• Independent releases (products/services and KITs) could avoid making completed KIT changes wait for a quarterly release window.
• Continuous contributions, stronger automation, and ongoing quality assurance were discussed as alternatives to the current process.
• It remains open whether a coordinated release is still needed to capture configurations, compatibility mappings, or variants.
• The Tractus-X Accelerator's process-analysis work should allow fundamental changes rather than assume that the existing release model must be preserved.
• Release workshop planned for the next weeks to analyze the current process and possible improvements

KITs and Standards​

• KITs and standards (Catena-X) serve different levels of detail and do not necessarily require synchronized releases.
• A fundamental standard change may require a substantial KIT update, while minor changes may have little or no impact on KIT content.
• Starting with a KIT was discussed as a way to develop and validate approaches before promoting mature content into a standard.
• DCM, as an example of a mature standard whose Expert Group no longer intends to continue as before. Assumption -> This does not automatically remove the need for occasional KIT maintenance.

Open Planning and Issues​

• Stephan expects to present 13 Tractus-X Accelerator issues at next week's Open Planning. Outreach to other initiatives has so far produced limited substantive input.
• Stephan has cleaned up Tractus-X issues, including asking for concrete next steps on long-running topics.
• Issue (Office hour) descriptions often lack clear use cases, deliverables, or actionable next steps. Collections of links alone do not make the intended work understandable.

Website Deployment Size and Archived Content​

• Pull-request preview deployments had encountered GitHub Pages size constraints. Stephan reported that deployment content had temporarily exceeded 4 GB.
• Archived, versioned documentation and (old) KIT content has been removed from the deployment branch.
• The website now points to release tags and ZIP archives instead of deploying those archived versions as part of the live site.
• Stephan reported that this should address the immediate deployment-size problem; continued observation was suggested.

Website Actions and Navigation​

• Website verification, preview deployment, and production deployment perform similar builds, each taking approximately ten minutes.
• Johann will inspect the Actions and verifier structure for opportunities to remove redundant work and shorten the overall publishing cycle.
• The website also needs a content and navigation review. The test-management section was cited as potentially obsolete.
• Stephan has proposed an alternative menu structure and offered to show it in a future demo; no presentation date was agreed.

CX Next AAS-Related Contribution​

• Daniel Klein is expected to present a proposed contribution from an AAS-related UI tool at the November 13 Office Hour. The exact component scope remains to be clarified.
• Stephan discouraged creating a separate Tractus-X repository because of governance overhead and ongoing maintenance requirements.
• Integration into the existing Tractus-X SDK, alongside related libraries and wrappers, was the preferred direction discussed.
• No final repository placement or acceptance decision was made.

Wizard Initiative​

• The repository and initial issues are in place, but governance compliance is still outstanding.
• A first 30-minute weekly session is planned for next Thursday, although it overlaps with the Network Services Committee workshop. How to handle that conflict remains open.
• Interested contributors need to take ownership of implementation and governance tasks.

Security Team Synchronization​

• The selected project security contacts do not match the GitHub security-team membership: the GitHub team currently includes all committers.
• Stephan has already opened an Eclipse help-desk issue about the synchronization problem.
• Security notifications should reach the designated security contacts rather than all committers. The issue remains unresolved.

TruffleHog and Maintenance Capacity​

• TruffleHog was reported to perform expensive scans deep into branch and commit history, including during pull requests.
• Lars recommended checking new changes and the latest main-branch state, including changes that may bypass pull requests, rather than repeatedly scanning unchanged historical commits.
• A previously resolved false positive in an old commit illustrated the cost of repeated historical scans.
• A shared Security/DevSecOps or system-team function was suggested for investigating and maintaining this infrastructure.
• Ownership and funding remain open.

AI Guidance, Commit Requirements, and TRG Placement​

• The group discussed whether AI-related requirements belong in TRG 7 or a separate TRG 11.
• Lars cautioned against introducing obligations beyond those required by Eclipse without a clear reason.
• Commit-message conventions, including sign-off and co-author information, need to be checked against actual Eclipse requirements rather than assumed to be mandatory.
• A consolidated Tractus-X explanation could improve discoverability, since contributors may not read either the TRGs or Eclipse guidance consistently.
• The group questioned whether AI disclosure fits release-time checks: unlike license or copyright-header checks, undisclosed AI use cannot reliably be detected during a release review.
• Lars questioned the legal usefulness of a general AI-assistance declaration when it does not identify which parts of a contribution were generated. No legal conclusion was established.
• Stephan will review the guidance before the next session. Placement and scope will be discussed with a broader group.
• Closing the long-running topic before Christmas was expressed as an aim, not an agreed deadline.

Decisions​

• Decision: Archived, versioned website content will no longer be included in the GitHub Pages deployment branch; release tags and ZIP archives will be referenced instead.

Action Items​

• @stephanbcbauer: Present the 13 Tractus-X Accelerator issues at next week's Open Planning.
• @stephanbcbauer: Review the AI-related Eclipse guidance and provide further information before the next Office Hour.
• Johann Schütz: Review the website Actions and verifier structure and investigate build and deployment optimizations.
• Unassigned: Finalize a feasible date for the release-process workshop.
• Unassigned: Evaluate alternatives to coordinated overall releases, including quality assurance, automation, and configuration or compatibility mapping.
• Unassigned: Review obsolete website content and the navigation structure.
• Unassigned: Complete the wizard initiative's governance setup and secure contributors for its initial issues.
• Unassigned: Clarify ownership and funding for shared security and DevSecOps maintenance.

Status updates discussed in meeting:

Executive Summary​

• The meeting clarified that the proposed Toolbox and wizard/starter-kit concepts still need alignment before definitive next steps and milestones are set.
• The group agreed on tractusx-starter-kit as the working repository/project name.
• The repository will support a static webpage and a dynamic wizard-like tool for generating configured Docker Compose files, initially for two or three components.
• Release-process improvements are planned, focusing on better documentation, broader participation from initiatives and industries beyond Catena-X, and more accessible planning meetings.
• Several tracked items remain blocked or awaiting review, including Gateway API updates, committers information, security follow-up, and the AI-related TRG discussion.

Topics Discussed​

Toolbox and Starter Kit​

• The relationship between the Eclipse Tractus-X Developer Toolbox and the existing wizard remains unclear; intended integration and the next steps should be confirmed with him.
• The planned repository will contain a static webpage and functionality to generate an easy-to-run, fully configured Docker Compose file with documentation, without requiring Kubernetes.
• The initial scope is two or three components, with the possibility of adding more later.
• The working name agreed in the discussion was tractusx-starter-kit.

Portal Hackathon​

• The hackathon remains planned for Friday, with a large attendee list for the onsite meeting at the Arena.
• Differences in the new architecture were not reviewed because they are expected to be discussed again immediately before development begins.

Eclipse Tractus-X Community Days​

• Registration is still open; participants were encouraged to seek approval to attend and book hotels early.

Product Page and Repository Status​

• The new product page was described as an improvement, but the displayed people may incorrectly mix committers and contributors.
• The repositories and people shown on the page still need validation before the information can be considered accurate.
• Work on the related item was deferred because other work is currently taking priority.

Release Management​

• The release timeline is approaching the testing phase.
• Initial pull requests for kits should be created soon so reviewers have enough time before the release.
• A brainstorming effort planned for next week will examine the current release and planning processes, including how to document them better and make them more open to other initiatives and industries.
• The current planning meetings were described as having approximately 100–120 participants in the past (two years ago) and approximately 10–20 currently -> this is the place where we can discuss and plan YOUR features -> don`t be shy, join the meeting and create your issues/requirements

Security​

• The Eclipse Foundation is expected to offer a meeting next year to present security options.
• The team discussed whether the existing security issue is still needed after changes for five individual users.

Gateway API and Other Issues​

• The Gateway API work remains blocked until the active repositories are identified, after which a major issue can list the repositories requiring updates.
• A pull request concerning the committers project description was created, but it still needs review by someone other than its creator.
• The AI-related pull request remains unresolved after an earlier discussion about whether the topic needs its own TRG.

Decisions​

• Decision: Use tractusx-starter-kit as the working name for the repository/project.

Action Items​

• @stephanbcbauer: Create the tractusx-starter-kit repository and submit a pull request to the Eclipse Foundation repository.
• @stephanbcbauer: Create the open meeting and kickoff issues on the Tractus X webpage.
• @stephanbcbauer: Add screenshots to the security-related issue and move it to done if complete.
• @stephanbcbauer: Check whether the committers pull request matches the issue requirements.
• Unassigned: Review and merge the committers pull request; the creator cannot approve it.
• @stephanbcbauer: Create a 15-minute meeting with the participants of the AI-related pull request discussion.
• Unassigned: Decide whether the AI topic should have a separate TRG or be handled within another TRG.

Status updates discussed in meeting:

Infrastructure and Test Management​

• Test phase for Release 25.12 is ongoing. Currently blocking issue with Portal onboarding of new test companies.
  • Workaround using existing ones is also limited due to issues with email notifications for new user accounts and presumed issue for creation of new technical users.

Release Management​

• Release Planning Timeline:

  • 26.03 Eclipse Tractus-X Open Planning was conducted on November 13th.

• Policy Hub recommendation to be archived: Decision of Data Sovereignty Expert Group that the Policy Hub is not needed anymore, as it adds no value to the ecosystem.

  • See for details this issue on the Office Hour Board. It will remain in progress to track further information.
  • Input from Mathias Moser to follow the official process as outlined in TRG 7.09

Security​

• Please check regularly if there are findings for vulnerabilities or dependency updates in the security tab of your project repository.

Community/Open Planning​

• Everyone is invited to join the Fifth Eclipse Tractus-X Community Days on December 4th and 5th in Stuttgart. See this link for registration
• New Calendar View for open meetings, see for details the open meetings page
  • Potentially type color for time and date could be set in white for better legibility.

Feedback / Questions / Requests​

• Discussion of planned PostgreSQL updates and image provider change

  • Mikel Garcia has updated the applicable TRGs, including the change from Bitnami to Cloud Pirates images
  • He also created a migration guide using the SSI DIM Wallet Stub as an example.
  • However there were issues encountered by Lars Geyer-Blaumeiser for the BDRS service with the automated Helm Upgrade failing, thus requiring a manual deletion and redeployment. See this link for further details.

• Question from René Schröder regarding maintenance of IRS -> Will contact Robin Gottschalk to follow up.

• Suggestion from Mathias Moser: TRG for quality of new or existing repositories in GitHub, e.g. with the 3 phases sandbox, incubating, graduated. He will elaborate this further. The plan would be in a later step to display this automatically as a "maturity level" for each repository in the Eclipse Tractus-X product list overview.

• Discussion regarding a legal need to remove/replace references to EPL licenses from files in Eclipse Tractus-X. Finding a solution is ongoing.

Update Infrastructure/Test Management​

• Deployment phase for 25.12 is ongoing. None has deployed yet, please start.
• DTR has an update ongoing, but the PR is open. New version expected on next week

Update Release Management​

• Release Check issues must be created next week to confirm who joins or opts out of the test phase; reminders have been sent to previous participants.
• Current reminder for 26.03 open planning: https://eclipse-tractusx.github.io/community/open-meetings#open-planning-r26-06

Update Security​

• Please patch high and critical security vulneratiblities before e2e test.

Update Community/Open Planning​

• Community Days: registration open; a lot of other data spaces have been invited.
• Container images: @mgarciaLKS raised a TRG update for postgres with an example linked eclipse-tractusx/eclipse-tractusx.github.io#1367, committers aligned on 18.x
• What's the last date to provide the semantic model? Should be in line with the Final KIT PR (25.12 = 2025-11-17)
• What needs a ticket for release and how to release a kit? If you release a KIT, you need a release ticket: PURIS example - If you release something unfinished or not released in standards, add a disclaimer.

Update Infrastructure/Test Management​

• Briefing meeting for the upcoming test phase is on Monday; invitations were sent out. If anyone was missed, invitations will be forwarded upon request.
• Scope: overview of the test phase (deployment, who joins, and key updates).
• Test phase start: 20 October.

Update Release Management​

• Release Check issues must be created next week to confirm who joins or opts out of the test phase; reminders have been sent to previous participants.
• Feature freeze is approaching; merge necessary PRs, especially for core products, to enable testing.

Update Security​

• Vulnerability identified in Python Keycloak-related dependency (PyPI package with no fixed version) causing Trivy workflow failures.
• Mitigation: use .trivyignore, include a review date, and document the waiver in the release issue.

Update Community/Open Planning​

• News: blog entry for 26.03 is online (alignment day, open planning day). Open source participants should use the open meetings page.
• New committers: Theresa and Andrii approved; complete Eclipse Foundation paperwork.
• Community Days: registration open; workshop proposals and sponsors welcome.
• Container images: evaluating CloudPirates Helm Charts (Keycloak, Postgres, etc.) that wrap official Docker images; Eclipse feedback indicates Docker images are acceptable if referenced transparently.
• KITs coordination: new Matrix room created to align multi-dataspace development and onboarding; plan a weekly KITs office hour once processes are established.

Release 25.12 – Participation and Preparation​

• All teams must create their release check issues in sig-release by latest next week to prepare for the briefing meeting.
• Connector participation in 25.12 is undecided; decision expected after Tuesday’s discussion.
• Even minimal releases (e.g., only bug fixes) should still raise a check issue.
• Test phase briefing → next week, kickoff → two weeks after briefing.

Changelog & Documentation Changes​

• DocuSaurus updated to v3.9.1.
• New changelog presentation: structured by year/release using DocuSaurus blog plugin.
• Added contributor/committer acknowledgements (from GitHub analytics).
• Archived kits now provided; possible change to single current zip package instead of multi-version archives (to be discussed in committer meeting).

Governance & Repository Changes​

• Digital Product Passport repository deprecated and archived per TRG rules.
  • DPP verification docs → moved to Data Trust & Security Kit.
  • Full DPP documentation now lives in Ecopass.
  • Tutorial relocated to Tutorial Resources (still migrating images).
• Topic on centralising tutorials for Community Days still open.

Office Hour & Moderation Planning​

• New round-robin schedule; participants to confirm dates in the shared discussion link.
• Some moderation slots reallocated due to vacations/conflicts.
• Check for a new series needed with beginning of next year

Committer Elections​

• Theresa nominated as committer (focus: release management).
• Election closing next Thursday; committers asked to vote.
• Andrii's PMC election pending next PMC Monday meeting.

Community Days​

• Agenda still forming; workshops/presentations needed.
• Deadline for workshop confirmation: ideally within next 1–2 weeks, but minor changes possible up to event date.
• Semiconductor-X project may provide up to two workshops (cross-dataspace, traceability) depending on progress.

Security Reminders​

• Teams must check and address security tab issues to avoid deprecation.

Postgres 17 Upgrade & Image Source Problem​

• 25.09 used Bitnami Legacy images (last viable for that release).
• For 25.12+, Bitnami Legacy is not sustainable — need an alternative.
• Options under consideration:
  • Official Docker Hub Postgres images (license implications to check).
  • Cloud Pirates Helm charts/images (to evaluate; may wrap Docker Hub Postgres).
  • Hosting our own images (currently no team capacity).
• Eclipse Foundation guidance: use Bitnami Legacy for Sept release, evaluate Cloud Pirates for next.
• Action: Committers to research viable alternatives and check licensing with Eclipse Legal (possibly via Angelika).
• Decision deferred to Committer Round.

Infrastructure Test Management​

• GNI X-Ray Test Sessions:
  2 sessions held; no active registrations.
  Keep status in progress for potential October session.
• External Product Test Phase:
  Release Candidate 3 published by Lars & team; some issues remain.
  Next evaluation meeting on Tuesday.
  Confirmed: Catena-X does not provide dedicated dev environments — teams are responsible for their own.

Release Management​

• Release postponed; target Tuesday/Wednesday.
• Preparation:
  • Change logs ready for review (Teresa prepared initial version).
  • Need contributions for Known Issues and product-specific notes (e.g. BPDM, Connector).
• Screenshots in Release Notes: Discuss post-release.
• Changelog Improvement Idea: Block-format inspired by Docusaurus for better presentation.

Security​

• Reminder: Check the security tab regularly.
• Deprecation of "Digital Product as Repository of Surveillance" planned next week.
• Plan to migrate VP visualization to Industry Core.

Community & Events​

• Catena-X Community Days (End of December): Registration open.
  • New field to list products you contributed to.
  • Multiple select option fixed.
  • Booking changes may require cancel/re-register.
• Call for workshop leaders/presenters.
• New “Community Events” room created for event promotion and discussions.

Committer Election​

• Andrii proposed as new committer — key contributions on EDC component, DSP/DCP TCK, release process improvements.

General Reminders​

• Moderation list update needed (René added).
• No office hour next week due to public holiday in Germany.

GitHub Fork Access Clarification​

• Forks in private accounts do not inherit original repo’s write access.
  Owner must explicitly grant rights.
  Public forks: read-only access by default.

Update Infrastructure/Test Management​

• Bitnami Image Dependency

  • Bitnami container images (e.g., Keycloak, Postgres) are moving behind a paywall; legacy images will be deprecated and not maintained.
  • Security risks for future releases if legacy images are used.
  • Eclipse Foundation and other users are also affected; no immediate action required, but migration planning is needed.

• Repository Naming & Creation Guidelines

  • No strict naming convention; guidelines to be documented on the website.
  • Requirement: At least one ticket in SIG release, compliance with TRGs, and proper documentation (README, license).
  • Action: Present new repository requests in office hour; contributors to be added and approved.

Update Release Management​

• Release & Test Phase Updates

  • EDC 0.11 release candidate delayed by one week due to upstream issues.
  • Products using EDC will start testing one week later; other products should stick to the initial plan.
  • Tight timeline for release; last week reserved for bug fixes.

• Feature Planning for Release 25.12

  • Open planning session scheduled for August 14th.
  • Teams must refine features and inform needed teams/contributors before the session.

Update Security​

• Security Responsibilities
  • Teams are responsible for addressing security vulnerabilities in their releases.
  • Eclipse Foundation will support major issues but responsibility remains with the product teams (related committer).

Update FOSS Governance​

• API Versioning Discussion

  • Debate on enforcing API versioning (e.g., v2, v3 in URLs).
  • Previous decision: Recommend but not mandate versioning; no TRG (Technical Release Guideline) enforced.
  • Open for further discussion in the committer round.

• Project Description & Initiative Listing

  • Updated project descriptions to include Manufacturing-X and clarify scope.
  • Initiatives must contribute back to Tractus-X to be listed.

Update Community/Open Planning​

• Community Day Announcement

  • Community Day planned for December; registration opens in September.
  • Manufacturing-X initiatives invited to host workshops and demos.

• Tutorials & Identity Hub

  • New tutorial released for Identity Hub deployment and development.
  • Intended for demonstration and proof-of-concept, not production use.

Feedback / Question / Request​

• New Initiatives & Collaboration
  • Wind-X collaboration: Plan to create a Python SDK for asset administration shell, combining existing SDKs for broader API support.
  • Open invitation for contributors from other initiatives (e.g., FactoryX, Semi, Energy Data X).

Infrastructure & Test Management​

Management & Progress Updates​

• Recent development tasks were completed, including resolving rate limit issues.
• Teams are reminded to create release check issues for the upcoming major release, including mapping features to test cases and noting responsible committers.

Environment Reset for Testing​

• Discussion on whether a reset of the test environment (25.09) is needed for a clean slate.
• No strong need identified; decision deferred to the next portal meeting for further input.

Release Management​

Timeline Review​

• Timeline for upcoming releases (25.12 and beyond) was reviewed.
• Alignment and open planning days are scheduled; some concerns about holiday overlaps, but dates are fixed due to release dependencies.

Security & Governance​

Security​

• Reminder to update the security tab and deprecate outdated repositories post-release for security reasons.
• Ongoing process to review and close out old (not maintained) repositories.

FOSS Governance​

• Ongoing review of the "one license file per folder" policy; to be discussed in the next committee meeting.
• Decision: No notice section required for blogs, news, or meeting minutes; required for other documents.
• Discussion on maintaining and updating changelogs for TRGs (Technical Reference Guides).
• Reminder to update API versions in the API hub and ensure .tractusX files are properly tagged.
• Emphasis on maintaining quality and consistency across KITs and APIs.

Community & Events​

• Recap of successful French Catena-X Days in Paris, including workshops and presentations.
• Ongoing search for contributors with wallet/identity hub experience; open meetings scheduled weekly.
• Presentation of Tractus-X to the Eclipse Data Space Working Group (EDWG) and discussion about associating the project with ADBG for increased visibility and marketing.
• Farewell to Evelyn, with best wishes from the team.

Infrastructure & Test Management​

Release Roadmap​

• 25.09 release is in testing; 25.12 is upcoming.
• Teams must create and fill out release check issues, including responsible contacts, app versions, and feature lists. This must be done for both, KITs and FOSS Products.
• Quality gate checks should be created and linked early.
• Products not part of the release should be communicated.

Kubernetes Update​

• Core cluster update started; end environment update scheduled (1–5 PM).
• Upgrading to version 1.33.0 (from 1.28/1.29).
• Teams should consider the new version in their release checks.

Release Management​

Timeline Review​

• R25.09: Currently in development and test case creation phase. Deadline for KIT readiness: August 18.
• R25.12: Briefing meeting for testing in July; each team should send at least one representative.
• Open source community encouraged to contribute to "KITs" (documentation/tooling packages).
• Discussion on deadlines for KIT PRs—suggestion to focus on merge deadlines rather than initial PRs.

KIT Management​

Versioning & Changelog​

• Maintain changelogs in every request.
• Avoid last-minute KIT changes; contribute early to prevent release delays.
• Release check issues for KITs are still required and tracked on the release management board.

Refinement Phase for 25.12​

• Teams can already create features for the next release.
• Upcoming "Alignment Day" for cross-team coordination.

Security & Governance​

Security​

• Reminder to use the security tab and available tools (e.g., Snyk) to address critical/high findings.
• Contributors should consult committers for access.

FOSS Governance​

• TRGs (Technical Reference Guidelines) 7.XX, 7.XX, 7.XX updated; 7.XX to be deprecated. Improved handling of license/copyright information, especially for images and non-code artifacts. Find details in the PR.
• Reminders
  • Markdown files must include a notice section; code files require license headers.
  • Reviewers should enforce these requirements.
  • Discussion on imported notice sections and license mismatches. Not recommended

Community & Events​

Tractus-X Promotion at Catena-X Tech Days (France)​

• Event on July 9; open invitation to join and help build the French community.
• Announcement posted to the mailing list. Link to event.

Mailing List Etiquette​

• Replies and reactions to mailing list messages notify all members; use with consideration.

Open Discussion & Q&A​

• Issuer service deprecated; functionality moved to Identity Hub.
• Call for developers with Identity Hub experience.

Infrastructure​

• no topics

Release Management​

Topics discussed:

• Release Timelines
• Recap Open Planning Day

Security​

Topics discussed:

• Regular Reminder Committers: Please check the security tab!

FOSS​

Topics discussed:

• automate dash + review
• github.io 3rd party check only on chnage "package.json"
• api-hub "needs an update"
• One license file per folder

Community/Open Planning​

Topics discussed:

• NEXT COMM DAYS IN MAY!!!! 22.05-23.05!!!
• New Committer Gonçalo
• Committer Election Borja
• EDC is not the connector, is Eclipse Dataspace Components

Feedback/Questions/Requests​

• No specific topics to discuss, except moderation round robin and hint on how to state questions

Infrastructure​

• All products included in the release should create their release check issue.

Release Management​

• A reminder was sent out regarding the alignment meeting scheduled for Wednesday, May 7th.
• A briefing on the testing phase will take place on Monday, April 28th.

FOSS​

• The Docusaurus migration to version 3.7, including necessary library updates, has been completed. This upgrade included significant cleanup. A detailed description of what changed can be found here.

Community/Open Planning​

• Everyone is encouraged to participate in the Community Days in May 2025.
• Once the Docusaurus migration is merged, a pull request will be submitted to add a calendar view to the Eclipse Tractus-X website.

Feedback/Questions/Requests​

• No specific topics to discuss
• The release timelines for TX, CX, and the broader ecosystem are now aligned and available here.

Infrastructure and Test Management​

• Friendly reminder to please create the release check issue for the upcoming test phase of release 25.06. for your product. Link: Create a new issue of type "Product Release Checks" and start filling out the information.

Release Management​

• Release Planning Timeline:
  • 25.06: E2E test phase coming up next month. Briefing meeting on April 28th, please get in touch if you still need an invitation (contact Monika Jacobsen, Harald Zimmer)
  • 25.09: Draft feature freeze coming up Thursday April 17th next week. Refinement day Wednesday April 30th.

Security​

• Check regularly if there are findings for vulnerabilities or dependency updates in the security tab of your project repository. Friendly reminder from Mathias Moser that this is a high priority for the community and the leads, and if repositories are not maintained they unfortunately would have to be deprecated.

FOSS Governance​

• Security check scans in GitHub are disabled by default after 60 days of no changes in repository. TRG update to inform about this has been suggested, issue will be kept on board until it can be merged.
• Issue regarding cleaning of archived repositories: No update, issue will be kept on board.
• Status of Docusaurus update to version 3.x:
  • Update from Stephan Bauer that already a lot of KITs have been migrated. Thanks to Philipp, Arno, Manojava who provided much of the work there.
  • Review and IP clearance is pending
  • Plan is to finalize the upgrade with the remaining KITS hopefully in the next week. KITs listed in the ticket linked above can still be tackled if someone has the time
• A Project Lead Workshop was held yesterday (10.04.2025). Stephan Bauer shared the agenda in the ticket
  • It was a good session, for example discussing the roles of Tractus-X vs. Catena-X in the ecosystem. Information about the workshop results will be shared in an upcoming Office Hour.

Community/Open Planning​

• Everyone is invited to join the Fourth Eclipse Tractus-X Community Days on May 22nd and 23rd 2025 in Stuttgart. See this link for registration

Feedback / Questions / Requests​

• No specific topics to discuss
• Please note that next Friday 18.04.2025 there will be no Office Hour due to a public holiday in Germany

Infrastructure​

Release Management​

• The first activities for the next release are coming up as per the timeline.
• docusaurus of the website will finally be updated to 3.x 😍 Everyone who is responsible for a kit should join the kick-off as announced per the open meetings page.

FOSS​

• There's a couple of PRs open and especially the suggestion to add a new TRG should be reviewed thoroughly https://github.com/eclipse-tractusx/eclipse-tractusx.github.io/pull/1187

Community/Open Planning​

• Everyone is invited to join the community days in May 2025.

Feedback/Questions/Requests​

• There's a new architecture whitepaper on integrating the identity hub with other TX components in the concept of a BYO-wallet concept.
• The release timeline of TX, CX and the ecosystem are aligned here.

Infrastructure​

• Test Environments:
  • STABLE environment24.12 installations in early december
  • Test Management: Reference Quality Gate Checks and walkthrough them in "Test Management"
  • Resolved Issue with SAP DIV -> Onboarding should work now

Release Management​

• Reminders
  • use TX EDC 0.8.0 RC5 -> RC6 is on its way -> Rediscuss in testmanagement daily during next week
    • we should improve test automation -> the umbrella helm chart targets to support that
  • reminder for open planning

Security​

• GitGuardian will be removed soon.

FOSS​

• TRG 7.09
• discuss how to document releases between ecosystem releases and deployment experiences -> ongoing / announcement
• TRG about testing will come up
• Mano's election ended. Reminders
  • small amount of participations
  • points that would have been great: participation in community & handling of TRGs etc.
• ClearlyDefined is down: revisit on next week and then ask via IP matrix check
• MDX files in KITs: only if needed, is CC-BY-4.0

Community/Open Planning​

• remove the .cal file and just state the time (in an international time format)

Infrastructure​

• Test Environments:
  • Currently a blocking issue is with SAP. They want to do a change in the DIF deployment and we are blocked by that. Target for the change is early next week. This involves both STABLE and INT environment.
  • It is important that we can start with the deployment for the e2e test of 24/12 on INT, there are school holidays in southern Germany between Oct., 28th and Nov., 1st, so deployment is constrained in time.
  • The INT environment has to be wiped to start from scratch with the deployment for 24/12.
  • Doubleslash will provide information on how to proceed next week.

Release Management​

• EDC 0.8.0 to be used during e2e testing. There will be a RC5 early next week, that should be used as a start for e2e testing
• Release check issues are due on Oct. 18th for release 24/12

FOSS​

• Sources of pictures: Do we need to regulate the availability of sources for binary pictures, as there are pictures in the website repo without editable sources.
  • There is already a TRG that specifies the handling of pictures. It should be controlled better by committers.
• Concerning intermediate releases, especially bugfix releases that need to be done in Tractus-X during a operating cycle. There is a task to make a proposal on how to handle the situation from Eclipse Tractus-X perspective.
• Deprecation of Repos. The regulation in TRG 7.09 is currently reworked to be more precise.
• Discussion on a TRG about testing.
  • Doubleslash prepares a TRG concerning automated testing
  • Some repositories use SonarCloud and code coverage measurements there
  • General openness towards a new trial on some specs concering testing

Community/Open Planning​

• Files like presentations done during Open Planning are currently not provided in Open Source. The proposal is to store such files in the already existing large files repository attached to the webpage repo.
• Open Meetings page has been enhanced, there are now relevant links like to the task board that is relevant and related release timelines
• Regular New Joiner meeting was canceled. If a session is needed, it needs to be requested

Infrastructure​

• eclipse-tractusx/eclipse-tractusx.github.io requires just One Committer Review now
  • Committers that approve: Please double-check the content, remember you have also responsibility when approving non TRG compliant content
  • Expectation for KITs: It should be less stressful to find a committer
• Setup Catena-X STABLE Environment
  • Organizational issue that’s why the stable is not there right now but they are working on it
  • Questions: Will the STABLE environment stick to the released version or will it evolve with the development of the components?
• Planned general infrastructure maintenance INT environment 2024-09-29
  • 24.12 e2e test phase on INT environment still planned to start 25.10. as communicated in adapted timeline

Release Management​

• EDC 0.8.0 to be used during e2e testing.
  • The upcoming Eclipse Tractus-X 24.12 release will include EDC version 0.8.0.
  • If your component relies on the Eclipse DataspaceConnector (EDC), we highly encourage you to align your development and testing efforts with this version to ensure compatibility.
• Reminder for Refinement Day 1: 16.10
  • Each group will focus on the first steps of skeleton-building for their features, based on the feature template, mapping them to the related roadmap items
    • For more information please read the news blog
• Reminder for Refinement Day 2: 06.11
  • Build on the work from Refinement Day 1 and focus primarily on the identified dependencies
    • For more information, please read the news blog

Security​

• [Trufflehog Update] Deprecation of GitGuardian and mandatory update to Trufflehog
  • Please update your repositories
  • There are still many issues opened and waiting to be resolved by their responsible committer
    • Parent Issue
  • The Trufflehog Workflow is a active TRG since March 26,2024

FOSS​

• TRG proposal for product deprecation including a process and criteria to close Issue #1037
• Please review and provide some input

Feedback / Question / Request​

• Add Testmanagement timeline into timeline of the overall release

Infrastructure​

• @ds-hzimmer will continue to report from the monthly infrastructure updates that are to happen every month's last sunday.
  • product teams will have to check their deployments after that

Security team​

• Trufflehog has now officially replaced GitGuardian as secret-scanning tool for Eclipse Tractus-X. This is encoded by TRG8.03
• @ds-hzimmer reports about the sporadic use of the current sonarcloud instance for Eclipse Tractus-X. There's no TRG for it. It's unclear what additional benefit it will bring to those tools that are backed up with TRGs (Trufflehog, trivy, codeql).

Q&A​

• @tom-rm-meyer-ISST reports issues with the tls provider which will be checked with the infrastructure team.

Infrastructure​

• Discussion on catenax-ng
  • @matbmoser: please cross-check your own repository, if you reference it!
  • @lgblaumeiser: we noticed that the R24.03 MIW needs catenax-ng resources. It temporarily stays up. (see issue)
• Consortia teams are gone. Thanks, it was a pleasure!

Security team​

• @matbmoser: Please do check for your security issues on the tab. High and critical issues need to be fixed. We should check this on high level / project level regularly in this meeting
• @tom-rm-meyer-ISST: For Truffle Hog, make sure that the workflow runs before merging. (see e.g.)

FOSS​

• @AngelikaWittek is gone. Thanks for your work!

Open planning / community​

• @stephanbcbauer:
  • Refinement Phase went well overall. Committers please join the planning meetings.
  • Some QGates are still open, please check.
  • Review together the release preparation