[Nomination] Adding an Nvidia representative to security group

[nikhgupt]

Summary

Hi,

I am Nikhil Gupta, and I am the security lead for the NVIDIA compiler org. At Nvidia, we employ the LLVM project in various parts of our compiler stack. Security is a pressing concern for us (as I’m sure it is for others) and we are therefore interested in being part of the LLVM-Security committee. I would like to nominate myself to be a participating member in the committee.

According to the information on the website, https://llvm.org/docs/Security.html, I fall under the following category: Vendor contacts

We are particularly interested in the following:

1. Being aware of any security vulnerability that has been found in the compiler in a timely manner.
2. Correctly reporting any vulnerabilities or other security issues we have found in the compiler stack.
3. Discussing our use of static analysis / dynamic analysis / fuzzing / threat modelling with the committee and raising any concerns that have risen from said activities.

Looking forward to participating in further discussions and security sync ups with the rest of the committee

TIA

[pietroalbini]

Synchronized the reviewers list with the one in D106917.

[nikhgupt]

Thanks for adding the necessary reviewers @pietroalbini. Please let me know if there's anything required of me to better inform reviewers taking this call.

[peter.smith]

Personally I've no objections to Nikhil joining as a Vendor contact, unless there are any objections I'd be happy to add my approval. I think you'll need to rebase this on top of D107234.

llvm/docs/Security.rst

36

Now D107234 has landed it would be good to update with a Phabricator name. If you haven't got one, D107234 has instructions on how to do that.

[nikhgupt]

Updated information to match with format mentioned in D106917.

[nikhgupt]

llvm/docs/Security.rst

36

Thanks Peter. I've added the tag info now. I am a little rusty with Phabricator so I hope I have rebased this correctly.

[peter.smith]

LGTM, thanks for updating the description.

[nikhgupt]

How many more approvals are needed for this to be final? According to D99232, it looks like eight?

[kristof.beyls]

In D106906#2929835, @nikhgupt wrote:

How many more approvals are needed for this to be final? According to D99232, it looks like eight?

See https://llvm.org/docs/Security.html, section "Choosing new members": "If a nomination for LLVM Security Group membership is supported by a majority of existing LLVM Security Group members, then it carries within five business days unless an existing member of the Security Group objects. If an objection is raised, the LLVM Security Group members should discuss the matter and try to come to consensus; failing this, the nomination will succeed only by a two-thirds supermajority vote of the LLVM Security Group."

With currently 16 listed members, that means 9 approvals to clearly exceed 50%?

I approve adding Nikhil Gupta.

FWIW, there are monthly public LLVM security calls, for anything related to LLVM and security that can be discussed openly. See https://llvm.org/docs/GettingInvolved.html#online-sync-ups for details.

[nikhgupt]

Thanks @pietroalbini. I am still short of 3 votes according to @kristof.beyls's comment. Requesting others to chime in as well.

I also intend on attending the sync up meeting on 8/17 to field any questions regarding this request.

llvm/docs/Security.rst

 Group Composition
 =================
 
 Security Group Members
 ----------------------
 
 The members of the group represent a wide cross-section of the community, and meet the criteria for inclusion below. The list is in the format `* ${full_name} (${affiliation}) [${phabricator_username}]`. If a phabricator username for an individual isn't available, the brackets will be empty.
 
 * Ahmed Bougacha (Apple) [ab]
 * Artur Pilipenko (Azul Systems Inc) [apilipenko]
 * Dimitry Andric (individual; FreeBSD) [dim]
 * Ed Maste (individual; FreeBSD) [emaste]
 * George Burgess IV (Google) [george.burgess.iv]
 * Kate McInnes (Apple) []
 * Kristof Beyls (ARM) [kristof.beyls]
 * Matthew Riley (Google) [mattdr]
+* Nikhil Gupta (Nvidia) [nikhgupt]
 * Oliver Hunt (Apple) [ojhunt]
 * Paul Robinson (Sony) [probinson]
 * Peter Smith (ARM) [peter.smith]
 * Pietro Albini (individual; Rust) [pietroalbini]
 * Serge Guelton (RedHat) [serge-sans-paille]
 * Shayne Hiet-Block (Microsoft) [Shayne]
 * Steve Klabnik (Oxide Computer Company; Rust) [steveklabnik]
 * Tim Penge (Sony) [tpenge]