content: draft: Harden 'safe-expunging-process'

[TomHennen]

fixes #1135

Hardens the 'safe-expunging-process' by:

1. Suggesting that SCSs should document and log changes when possible.
2. SCSs should use multi-party approval when possible

Also clarifies that some of these changes may need to be kept private to comply with local laws.

[TomHennen]

@adityasaky I'd also like your input here.

[netlify]

✅ Deploy Preview for slsa ready!

Name	Link
🔨 Latest commit	ab601b2
🔍 Latest deploy log	https://app.netlify.com/sites/slsa/deploys/671abd38b224760008c87a71
😎 Deploy Preview	https://deploy-preview-1203--slsa.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.

---

To edit notification comments on pull requests, go to your Netlify site configuration.

[trishankatdatadog]

Don't see anything controversial

[adityasaky]

I'm still a bit curious what this may end up looking like. In addition to the experiences @zachariahcox and others have had at GitHub, GitLab, etc., I wonder if something like this has ever come up within the LF for https://git.kernel.org/ or so? Is there a public guide for dealing with these scenarios that we can leverage for this?

[marcelamelara]

Thanks for these revisions @TomHennen ! I agree with the other reviewers that the safe expunging process should be scoped to legal challenges.

[adityasaky]

Some minor language suggestions but I think this looks good!

[marcelamelara]

I think this process is much clearer now, thanks @TomHennen ! I have one remaining question about the multi-party approval.

[marcelamelara]

Thank you for these final wording changes @TomHennen ! LGTM

[zachariahcox]

This looks good to me and I recommend merging it.

We will need to come back at some point to review a real life expungement and see what can actually be accomplished to here. How smooth a process can we make it in git?

I'm also not sure the scs can be on the hook for enforcing that the data removals were for legal reasons.
Generally I think "the owner of the intellectual property in the repo (the root repo owner, in gh terms) can remove data. They should only do this for legal or privacy reasons due to the risk of severe reputational consequences (damage to artifact chain of custody)." Ie: it's indistinguishable from a repo hijack so you should have a good reason.

[TomHennen]

This looks good to me and I recommend merging it.

Thanks!

We will need to come back at some point to review a real life expungement and see what can actually be accomplished to here. How smooth a process can we make it in git?

Agreed. We'll probably want similar feedback for the entire build track. Once we're in the RC phase (hopefully soon!) we can try to elicit that sort of feedback?

I'm also not sure the scs can be on the hook for enforcing that the data removals were for legal reasons. Generally I think "the owner of the intellectual property in the repo (the root repo owner, in gh terms) can remove data. They should only do this for legal or privacy reasons due to the risk of severe reputational consequences (damage to artifact chain of custody)." Ie: it's indistinguishable from a repo hijack so you should have a good reason.

Filed #1222 to track.