@ComplianceAsCode/ubuntu-maintainers Please advise.

@evgenyz as mentioned in that page, those releases are still supported under Ubuntu Pro and Legacy

The question here is if it makes any sense to keep these in the upstream. Do they receive any updates from CaC point of view?

For RHELs we cut off upstream products once we stop importing and rebuilding the whole content from the upstream, which essentially happens when RHEL stops receiving regular batch updates. Also we align with DISA and co, which would stop issuing updates after official EOL. Therefore we don't have RHEL6 and RHEL7 in the upstream anymore (and we are happy about that, actually).

TLDR; It's up to you, but at least please deal with the runner.

Also please note that keeping obsolete products forever will block us from removing obsolete rules.

It is not personal hunt for Ubuntu, I'm going to try and clean up all obsolete products.

The question here is if it makes any sense to keep these in the upstream. Do they receive any updates from CaC point of view?

For RHELs we cut off upstream products once we stop importing and rebuilding the whole content from the upstream, which essentially happens when RHEL stops receiving regular batch updates. Also we align with DISA and co, which would stop issuing updates after official EOL. Therefore we don't have RHEL6 and RHEL7 in the upstream anymore (and we are happy about that, actually).

TLDR; It's up to you, but at least please deal with the runner.

we don't have anything based on CaC for ubuntu1604 and ubuntu1804, they were both submitted by the community, so I don't think that is on us (Canonical) to decide on removing them. Nevertheless, both releases are still supported for a few more years.

ubuntu2004 (which currently is still LTS) is the first that we use CaC and we will keep supporting it until 2032 as mentioned in the page. Also it is unclear if CIS and DISA will continue to support it in the future, but we do have plans to update it to the latest CIS version, therefore it is better to be on upstream as it benefits everyone on getting the latest fixes.

@evgenyz if you need still a sign off from me, I'm okay with removing ubuntu1604 and ubuntu1804.

For ubuntu2004, since it is still alive until April, I would say we wait until May to discuss if we remove it from upstream or not.

does that help?

@evgenyz if you need still a sign off from me, I'm okay with removing ubuntu1604 and ubuntu1804.

For ubuntu2004, since it is still alive until April, I would say we wait until May to discuss if we remove it from upstream or not.

Copy that, thanks. But I'm waiting till the deadline for more opinions anyways. The milestone is set to mid-May, so it should work fine.

Just to mark the milestone: Ubuntu 20.04 runners have been removed from GitHub.

@dodys It's 9-th of May and we are 2 weeks from the next planned release. Good time to get back to the discussion.

hey @evgenyz since no one said anything about 16.04 and 18.04, I think we can go ahead and remove it.
For 20.04, CIS just released a v3 last week and I'm a bit cautious if we should remove the support here or not.
Since 20.04 will go to Expanded Support end of this month, I think it is still fine to remove it.

We can remove all of them in the next release, actually, to be safe with time frames.