Christophe Poucet, Han-Wen Nienhuys, Luca Milanesio, Patrick Hiesel, Saša Živkov.
April 6, 2022
As Gerrit v3.6 release plan has been announced, the roadmap can be adjusted to reflect what is likely to be included:
The following features are WIP but unlikely to be completed by v3.6:
More clarification on the issue would be required from Nasser. At high-level it does not seem like a Gerrit project issue. Gerrit can also be compiled from source directly if the trust on Maven artifacts is an issue.
It remains also an open question to identify which SLSA level do we want the Gerrit Code Review project to be.
Follow-up discussion about potential DoS problem; cannot currently be disclosed.