Continuous Delivery Foundation Technical Oversight Committee, 17 Dec 2019

Previous Meeting Next Meeting

⏯

youtube image

►

From YouTube: CDF TOC 12.17.19

Description

CDF TOC 2019.12.17

A

B

Okay, all right well, okay, looks like you're up for the first topic under yeah.

C

And I came complete with pictures today, so yeah so I'll just mention some updates for the security sig. We we've been on a little break from our bi-weekly meetings. Are we our regular schedules to meet just ahead of this meeting every other week, but because of the holidays, we've taken a breaks. Our next meeting is January 14.

C

We did have a meeting at after the last CD summit, um so it was held during the during cube con and we've got a group of people I think we had close to 20 of us. We have everybody's name to attended in the in the notes from the from the meeting at where we talked about supply chain security.

C

So there and we've created a new Dan Lopez created for us, a new github channel and know all the works and email, alias, etc for supply chain security and the readme for that group, and then we've got a framework document that describes kind of the overall, what we're working for working towards and that's what the picture is below to just just quickly.

C

So it, where are the thing that we're working towards is to understand supply chain where there are producers of software and consumers of software and producers, use signing services, artifact stores and meditative stores, and they output, artifacts and metadata.

C

The metadata we've been calling a software bill of materials or s LOM, and then consumers have policy specifying what they'll accept and then clients that will obtain the artifacts and metadata, compare it against policy and then gait, if needed, the inclusion of software into the consumers ecosystem, and so we're identified and they're bunch of players who have parts in in this overall space and so we're identifying who, though its players are and trying to get people together for discussions and what we ultimately want to do is have some standards around different parts of the ecosystem.

C

So one place that we're working toward a standard is for a software bill of materials. We think we also want standards around api's for metadata stores and then also policy policy frameworks and- and maybe some more things- we're just getting started with this. So then the second piece that I'll mention I'm moving down my list. So for a software Bill of Materials, we are actively involved in a standards effort for that.

C

There's, a readme that describes that effort at the link below and then we are working towards a submission for that standard on February 24th and we submitted to the object management group OMG so that much people involved in that SP DX from the Linux Foundation is involved.

C

Folks from Google are involved with the graffities project and quite a few others. I didn't get about 30 different people involved so and that's moving along pretty well sorry, Kay didn't mean, but nope, that's all I was saying: go ahead, I was just going to say: do you know how long that review process is going to take yeah? The review process will be at least nine months.

C

C

Yes, standards standards take a while so there's three months while it's in RF. What is it? Rf, RFC requests in the comment phase and then three months, one it's in no there's another phase after that, I forget what it is and then oh, it's a I forget the name of it right now.

C

I'll try to remember that that to bring that information for our next meeting and then the last three months is just the finalization phase, so essentially there's a long time for comments and then for review by the object management group technical board and then we'll go from there and then we'll submit for an international standard through ISO and I. Think that will take another year, but good grief, yeah. Okay. So let.

B

Me ask you the impatient question sure yeah wait: does it make sense, potentially to start executing some form of instrumentation against this idea from a technical standpoint, I think.

C

I'm on February 24th, it's a lot as soon as I would say as soon as we submitted for for comments. So this is I'll. Just tell you what we're what we're doing internally at Microsoft, we have a few teams line that already who are who will be running pilots starting there they're ready to run pilots already, but a few things are still in flux, so we've been holding them back a little bit but I think starting in January.

C

This fact I think I, hope, starting in January. The the schema will be settled enough that those teams can at least start reviewing it and praying for any feedback to it, and you know as soon as they're comfortable though they'll start to do some pilots against it. Okay,.

B

And the schema itself is part of the proposal, so it's public. Yes,.

C

B

Love to start making I would love to see the project start, making forward progress against that shaman. It would be good to understand what the potential technical impact would be.

C

Right so the so Brian Russell from Google, as so he's the Google he's the lead from Google. That's been involved in this and I know that they're starting to think about it for gracias what it means to import an export in this bomb and.

C

You know make it something: that's kind of the first-class innocent citizen and in gracias, I'm, not I've, heard that for Tecton there's some interest in as well, but I don't know that the details around that so.

B

Dance, hopefully asleep, so alright, alright, but that's that's something because certainly bring up with him and Christie Wilson anything from the Netflix folks.

C

You know what I Netflix is not involved, so so.

B

You're thinking.

C

For it spinnaker yeah, so do you want me to reach out, should I reach out to the.

D

Line right now, guys, why don't you and I chat offline I'd be happy to learn more okay.

B

Sure yeah I mean it's Vinick, wouldn't more likely be kind of receiving a whole bunch of them and then maybe aggregating them it'll be interesting to know what that looks like also good morning at me good morning, yeah exactly.

D

Good morning your morning,.

B

Cool, unless this is awesome, news I'm a little that the time but I guess I shouldn't be surprised, but it's good that we can get moving on it sooner rather than later. Yeah, okay, cool all right. Any anything else on.

B

All right, interoperability, sig and we haven't.

E

Talked on that.

B

E

Iii put that topic and the next topic as well, so it's just the interoperability is just a you know, heads up. If someone missed the proposal on the main lists, we propose the con 19th of November and then Lawrence started to what last week, I think we have four out of six talk. Members voted on the proposal and we are waiting. The remaining two talk members toward. Hopefully we can start working on this important area right after New Year's, and there is a great interest I think.

E

Currently, there are nine people signed up as members, and there are more monitoring the situation and, depending on the success we have early success. They will probably start joining to this effort as well from the next relation with the engineering team or OpenStack foundation. So they are not listed in the proposal, but they will probably show up over time. Awesome.

B

In the end, I'm gonna mentor, who re missing just kick it later on this year, I.

E

Think KK and James they did a lot. I know.

B

Let's see if we can get those guys wrangled, my I know I'm, certainly very prone of this idea, so I'm looking forward to getting this sorted all right. Let's see, CD summit cube con Europe. You.

E

Know it's actually Watson who is on the call as well? He asked me the plans about this and I said. Let's ask during talk meeting so yeah any plans to have a CD summit like days relevant like we had in San Diego and if so, what are the plans for CFP and everything else about the summit.

B

That's a great question for Dan and Jackie.

B

D

Hey guys, sorry I am gonna track that down with the coupon events, team, I'm, not sure what the availability and budget is on the CDF side, but we'll come back with a solid answer in terms of the CFP or creating a track.

D

That also is a viable option and so we'll track that down what our options are and bring it back. We probably will either broadcast that over groups at I/o or come back to this when we first come back after the new year once.

B

The next general board meeting, because that that would be where we'd have the budget conversation right. It's.

D

This Friday that's.

B

This Friday, okay, I'm gonna, try and sit in on that, but yeah good question. We should get on that.

E

Especially supplying in Europe, you know of raising the awareness for CDF and Europe yeah.

B

Thanks for for the nudge and see if we can get that going all right, let's see moving on screwdriver, so I don't think we have jitan on the call, but I do believe. We've got the final approval to move that project forward. I.

D

Think all it needs is someone from the TOC to merge that I'm having.

C

D

Says Dan Lopez go ahead and merge it for us I'm happy to do that, but just let me know either way. Yeah.

B

I think I think Andy I think you were the last one I believe I just saw your plus one on that did I totally hallucinate that yep nope.

D

Take a note here that then go ahead and move this merge base juicy yep.

B

And then the only other follow-up and I'll take care of that is reaching out to Jathan, because there was a lot of discussion around the new community. They were building up, but I haven't seen any of the artifacts from that. Yet so I want to make sure that that's still progressing sure, but we can do that. Asynchronously.

B

All right next on the agenda, telemetry updates.

D

Spinnaker is complete thanks for Andy and team for getting that and up next is tech Tom, which is in process I, believe Dan and team are looking at that. I kicked that off with the LF t m-- review last week, or so we can have for Stoke. Jenkins is also in the hands of kohsuke and the rest of the gang on the Jenkins team. So each one are going out their own pace, we'd like to get that done and published out. Spinnaker I will try to send to the TOC mailing list.

D

The PDF version that's finalized and also published publicly, so it can be used as a baseline for any other projects out there.

B

Great I thought that Kristi's team was almost done for Tecton, but I can't commit to that. So I will I.

B

You know could have elucidated that too, but I can poke Dan and Christy just to make sure we get an update on that.

B

B

Cool all right, we have anything else on the agenda for today, code-signing Oh Danna, that.

D

Is uh almost done because of our way we're structured at the links foundation, the legal entity that holds the liability, for this is a little one-off for GG, cert and so they're just going through their compliance side we're just waiting, so we were really set up and then it got put on pause once we started trying to sign certificates and some code signing activities and I triage that with their management team. So we are, we should be hearing before the holidays. Okay, I'll double check. It awesome.

B

So almost there again, it.

D

Was there if we got a red flag from their compliance team and then now they understand how we're set up so we send them documentation. We should be in good shape.

B

B

Thank you for that update.

B

Anybody else have a topic that we missed.

B

Fabulous finished that in 21 minutes I have enough time to get to my next meeting I'm so excited. Thank you. Everyone I think. The next meeting is the week of New. Year's I will not be available. Do we want to just punt on that? One.

D

Yeah I think I. Unless you got a old calendar in, but I can't I moved it to the next week. But okay.

B

You off set it okay, perfect yeah,.

D

Okay, stay tuned: if not Tara I will double-check and kind of modify the invite and that would kind of trigger everyone to get an update. So.

C

Yeah so it'll be.

D

The following week.

B

Awesome, thank you so much Daniel. Alright, everyone have a for those of us who celebrate, have a happy holidays and I will see you on the weir. Thank.

D

You, oh that's,.

C

Great thanks, everyone.

F