OpenSSF Operation SLSA Video Series, 19 Jan 2023

Previous Meeting Next Meeting

⏯

youtube image

►

From YouTube: SLSA Biweekly (January 19, 2023)

Description

Meeting notes: https://docs.google.com/document/d/1cx3fOBfic6A0xc2on25ITK4vQHUdxgBmJoSS1LPqDJo/edit

A

Hello, everyone.

B

B

How's it going.

C

C

C

We'll give folks another minute or two to join I, think usually to this meeting folks show up a.

D

C

C

Looks like we haven't had anyone join the past couple of minutes, uh so I think we get started. um Welcome everyone happy 2023. If I haven't seen you um as a reminder, uh please um record attention in the meeting notes, I think uh put a link in the chat. I think everyone already saw that he's here. I think it looks like not in people um and also that will abide by the things Foundation code of conduct.

C

um Is there any are there any new members here looks like we have a small group today.

C

I think I recognize all these names. I think I recognize everyone, um okay and we could uh get uh start with updates uh from the special interest groups. I could go first for the specification um we are planning to tentatively have a release candidate for the 1.0 spec, both of like the levels and the provenance um optimistically the first week of February.

C

um The idea is that we will um time box it and effectively cut whatever we have as a release candidate, because it's in.

D

A good enough state to review.

C

um And then hopefully, Market is stable after a significant review and editing period, um I think no earlier than the end of February, but realistically probably sometime in March, um and you know once we we get it finalized. uh The idea is that we'll kind of like time box or release candidates and say we're going to cut it now, but.

A

Not necessarily the.

C

The um the stable release so we'll mark it as final only ones we're actually confident, and we think it's good, um the the thinking being that what people really want is a stable good release. And so, if we do a release quickly of 1.0 and then follow up with 1.1, it won't actually satisfy what people want which is like they just want it done. So they can work and implement it um and there's two things going on.

C

One is the spec itself, there's two four there's a couple: pull requests out now: I didn't link to them in the meeting notes, notes um about verifying systems and verifying artifacts. Those are the last major pieces to be added to the to the spec. uh There's, certainly a lot more writing to do like the threats.

C

Page, isn't updated yet and there's a bunch of to do's and clarifications, and we have to address some of the um items that were listed in the um uh on the project board on like clarification clarifications, uh but the the core bones of what is there I think is mostly there, and so um the plan is by the end of the month by the end of January.

C

uh We should have at least all submitted, so people could review it and start to like um you know, internalize these Concepts and see if they resonate and they work well, and we could we have time to edit it as needed uh and then the Providence 1.0. uh Similarly, we have a pull request right now. It's not submitted yet but I'm hoping to submit it hopefully this week um it is definitely not decided. There's some open-ended.

C

uh Some open questions there around like what's the best design, because there's, at least in my opinion, no obvious best design, um but what we want to do is have it submitted. So that way, people can easily review it and add comments and start to implement it um in like a Proto, you know Implement prototypes, um and so we can get get better feedback.

C

um Yeah I think those are the main things on this spec side feel free to jump in if I missed anything. Anyone.

C

Oh positioning I'm, guessing it's an Alba.

E

Hey Mark um so for the first item, uh I did bring up in the last salsa meeting of the year. I also brought it up in the salsa specification meeting, um and then we also talked about it yesterday in the supply chain. Integrity working group meeting about more communication, more collaboration within it's also within supply chain, Integrity working group um and so for salsa, specifically kind of like what Fresca Mike Mike who's on the call. um They have a road map for 2023 right I would like to see salsa have a road map as well.

E

um Obviously, 1.0 was part of that, but, okay, what's after that right, what are we trying to aim for um so that way we all can kind of go towards that vision from a tooling from a positioning perspective. uh So that's kind of the the first piece and then um as part of that, um one of the things for positioning is that Laurent brought up um in passing was about conferences for 2023 right, so that yet is another roadmap item as the salsa Community.

E

What do we want to participate in um as a group, not necessarily as individuals for our company but as the Sig leads or as a group which conferences are we going to try to Target submitting talks to? And so we've started doing that? Brainstorming for the salsa group to say: okay, we want to have a salsa for beginners. We want to have a what's new. We want to have a lab right and submit it um as it's also a group.

E

um So it would be great if we could have a road map for 2023 on all aspects of salsa.

C

um Do those two items, the the roadmap and the coordinating the talks? uh Is there a lead for each of those like a single person, who's going to kind of drive it.

E

I mean I can drive it right, um so yeah I.

A

Don't mind driving it.

D

E

It's just we got to do it right. um It's kind of my point, uh so I'm hoping I think many of you agree. So it's more of the buy-in. Let's, let's just do it.

C

Yeah yeah I feel, like those things, are the kind that, like people generally agree, but it takes like some like cat hurting and like nudging people and getting it to like make it actually happen. So that's great.

F

Yeah I think two two things to follow up on on the the conference uh part is um one is I think we should definitely reach out to um the the chairs and those who are um putting on uh the conferences just to make sure that we could potentially have some time Associated uh specifically for salsa right, as opposed to necessarily being to compete with everybody else, who's submitting uh talks, because this is similar to let's say how the cncf has maintainer tracks. Where you know, projects like ours um could have.

F

You know a handful of talks that are just allocated, and then we get to choose as as we see fit, um and another reason for that uh is um the way that you know LF or at least most LF project rules work.

F

Oh sorry, um LF uh conference rules work is that uh if you give a talk like you're only allowed to give one talk at a conference and for a lot of folks who might be interested in, let's say, help being out with salsa might be a little bit less inclined to if they find out like hey. Actually, you know from you know my standpoint: I want to give a talk on this thing um and I want to submit a talk there, but I would you know and I can't do both.

F

So this that's something that is um you know, whereas in the cncf at least uh you can give a talk like you know, you could give a talk. That's your own talk on whatever you want to do in open source, um as well as a talk as on behalf as a maintainer on a you know, cncf related project, so I think some of those things would be useful to just sort of get ironed out um and I also know that there's a million different.

F

You know tracks inside of the open source Summit, and it can be a little unclear which one it would fall under exactly whether it's open ssf day or supply chain con. um uh So so that's uh something else. There.

E

That's it for me, tooling's next.

F

Okay, um so from the tooling side, uh the main things I think we're focused on um right now uh is trying to hit 1.0, um and it's been a little. um We haven't had a ton of attendance, the past a few weeks, I'm hoping to kind of uh bring that back in the new year. uh The main things are and I'll add this into the uh oh okay.

F

It's thanks, Melba for adding it in um uh so the the main things that we're looking to try and do is um the big one is any projects that have a short sort of um release cycle. So this is stuff like underneath the salsa uh GitHub GitHub org itself, stuff like the salsa, GitHub generator and and so on those those sorts of things.

F

It would be nice to see if we can get those pretty much as soon as possible, ready for the draft of the 1.0 um Providence spec, just so that you know um we can kind of show some examples to some folks on how to how they might implement it and so on and so forth, and also help uh potentially road map or get on the roadmap for some other projects like that, have a longer release.

F

Cadence, like tecton, which is a big um tecton chains, which is which supports V, 0.1 and V 0.2 of the um Providence spec, making sure that they're like at least aware of hey here's this draft, um they might not be willing to sort of implement the draft if the draft is going to only be around for, let's say a couple of months, whereas they might be more, you know um pushed for sort of just being ready for the full-fledged 1.0 when it's ready, but just those are, the things I think were kind of um a bit focused on.

F

Secondarily we're focused on um still working with some of the different um ecosystems and projects about maybe building out some um either examples or documentation around what we believe um should be supported or or like the best practices around Distributing salsa metadata, because I know this has been a a talk in the past, um or we know that there's been a talk in the past of like a lot of folks who, who let's say, run different packaging ecosystems are like hey.

F

If we were to distribute salsa Providence, should it be part of the package? Should it be part of an API? That's associated with the package: how should this work and I think um some of that might might prove to be useful even having some, like? You know, a simple, um uh a simple um like API example, or something like that, so that that's those are I, think the main threads um Bruno I, don't know if there's anything I, oh sorry, uh no, it wasn't Bruno.

F

It was Eric who's on who was uh talking about something else, never mind.

E

D

E

Capture what you said so feel free to edit away if I miss something.

C

C

Thank you, uh I saw there's a thing by Laura here, but he doesn't look like he's at the meeting, so um we'll skip that and is odds right here looks like ozer is not here as well, um so um I think I I'll just move that to the um the next time and I'll. Oh Michael, yeah.

F

Oh yeah, so I do know that one of the things that Lauren had brought up this is in um slack chat, uh was potentially something like a salsa Colin um uh and if that makes sense and I think uh I I know personally I think there's more than enough conference.

F

That's just my my opinion, but I think that there is something valuable there of like, especially for gearing up for 1.0, and this is uh something I forgot to talk about when Melba was uh so it is, it might still be worthwhile to have something like a pre or post 1.0 webinar, or something like that, or like a virtual salsa day where, like hey, we are releasing 1.0 or we've just released 1.0, and you want to know stuff like here.

F

You know it'll be half a day or or a day's worth of virtual talks where, where people can kind of get a good understanding of how to get started, might be useful.

C

Yeah, that sounds good.

C

um Okay, I think that was it for what was on the agenda. um Any other topics.

B

Just uh just to underscore something I thought was interesting. um You know helping with the verifying build systems PR, uh it seems like there might be some sort of Interest around creating a an attestation spec for verification of the build system which I thought was kind of neat, so just want.

D

B

F

um Yeah no I agree with you. uh There uh Aaron, a few of us, have been um looking at, for example, for guac, uh integrating like something like that sort of attestation, so that you could associate all builds associated with that, like sorry all salsa provenance that has that listed as potentially like a build ID or Builder ID um or Builder. Whatever uh can um you know so folks can go and say: oh, this has been certified by like self-certified or it's certified by a third party auditor.

F

Okay, cool I know that I trust like I, I, transitively trust all salsa Providence. That is based on this that that comes from you know this sort of questionnaire or whatever um support the other thing. uh Actually, that's related there um that that I I don't know if anybody's heard anything back regarding the salsa conformance, stuff, um I, I I know.

F

A lot of folks are starting to ask a lot of questions, especially with the questionnaire um PR um and and some of the other uh stuff that that's been um getting sort of Spun up there where I know a lot of folks are just like hey what what's kind of the status of that I. Don't know. If anybody has that foreign.

C

F

I I could definitely follow up, I believe uh Kim, and uh there was somebody else who were helping lead that up so I can I can reach out.

C

um Okay, it sounds like that's it I wonder actually, should we make this just a 30 minute meeting instead of 60 Minutes, it seems like the last several sessions. We've only used 30 minutes.

F

um So I was uh just gonna say. Actually one of the things I would just be interested in is um I love if like, because what we used to do was like usually the first 30 minutes would be stuff like this and then usually the last 30 minutes would be somebody giving a demo of how they implemented um salsa and some of that stuff and I'd be curious to know.

F

If, if folks are, you know interested in some of that doing some of that again, um I know we're interested in in demoing off some of the stuff we've done with guac plus salsa, to sort of show how you can sort of integrate all those pieces together, but we're also not sure which, what's the best meeting anymore, to sort of show. That often is that salsa tooling, is that more of a salsa positioning demo, because it's kind of like combining a bunch of different pieces or what.

A

Yeah uh uh thanks yeah I, think I, think I mean um Michael does raise that interesting. Point I think with the split of so many meetings. Now we have, you know a meeting for tooling and specification, and so on that we may not need the whole hour for the general meeting, but that's just my two cents. uh Someone else go ahead. Please.

B

I guess I can repeat myself uh from chat, so I would I vote to try to keep this meeting an hour and focus any of those sort of like demos from the different sigs into this.

B

um You know encourage folks to join, especially maybe we can broadcast when we know some interesting demos are coming up um and then the actual work gets done in the Sig meetings is kind of what I was thinking.

F

Yeah I I, like that idea, Aaron and I, don't want to uh volunteer um Melba but Melba I, wonder if, if the positioning meeting like, if the positioning group can help with like maybe helping organize some of that stuff, like you know, making sure that folks know like hey, there's assault, there's a monthly salsa meeting and we're always looking for demos, and you know, um and that sort of thing.

E

I mean yeah I, don't mind doing that now. I am curious. How how that will play out if we're up up I forget what Josh said yesterday um upvoted or something like that: they're talking about moving positioning up to supply chain security, oh.

F

E

If so, if that or supply chain Integrity rather um so, if that happens, then there's only two specification and tooling right and then this meeting right so again I'm more than happy to keep doing that until that happens, but I don't know once if that happens, and what do we? What do we do then.

D

C

Yeah I think that makes sense. So then the Sig meetings would be about more, like kind of nitty-gritty topics of like working through the details, and this is just a more general interest meeting and we just happen to not use up the time, but it's useful to have the slot available. um Okay sounds great all right. Thanks for clarifying everyone.

C

Okie doke all right. Well, uh it was good seeing all of you, although I think I've seen most of you in the same meetings um and uh we'll see you again in in the next meeting or uh talking over GitHub or on slack or at the next uh community meeting bye. Everyone.

A