OpenSSF Scorecards Biweekly, 9 Feb 2023

Previous Meeting Next Meeting

⏯

youtube image

►

From YouTube: Scorecards Biweekly Sync (February 9, 2023)

Description

https://github.com/ossf/scorecard#connect-with-the-scorecards-community

A

Jeff long time no see.

B

C

A

Everybody hope everyone's doing well.

C

So I think Laurent was supposed to be the original facilitator and is out on travel this week. um So if anyone else wants to step in otherwise I can always fill in as well.

A

Those who speak lead go for it.

C

All right uh I should have the agenda up, um so the dock. You should be able to find this link from the slack Channel I can put a link of it in the Zoom chat as well, um and then, if you don't have access to it, there is a Dev group that you should join.

C

um Let me just get that link.

C

All right uh so joining that group Google group should fix any permission. Issues uh if folks are unable to look at the doc um so feel free to sign in add your name to the attendee list.

C

um I see a lot of you guys are doing that already um and then, usually we start off by going through the attendees and for anyone that might be new or um welcome them to introduce themselves. um You know what they're here for kind of thing, um so yeah it looks like Ian has already added his name. If either of you feel like just a quick introduction, you don't have to but sure.

D

uh So I'm I'm here, uh Jerry Tech, is also here also we're both from Lockheed Martin. uh We work for the centralized steps, kind of organization um and we're doing a lot of work with in Toto, and we are interested in how we contribute out the gitlab support for scorecard.

D

So um any of us show up: let's, uh let's see how we can help out with that, a little bit um and there's some other stuff we're doing around Hopper and kind of augmenting s bombs, but specifically we're really interested in that good lab support for first four part.

A

That'd be great that has been on the to-do list forever. Yeah.

D

It looks like it's predominantly done: there's there's just kind of cleaning up that Mars a little bit and helping out with the testing and some other things so um yeah. We got some folks who are going to be getting spun up on doing that.

C

Cool well, thank you. Welcome I,.

E

Can say: hi I'm, Justin, first I'm here I work with eBay and I'm the author of the uh s-bomb scorecard project, which.

F

I'm hoping to talk about a little later.

C

Cool yeah welcome, I'll, go ahead and add that to the agenda like you asked him chat, it's.

A

Already been already.

C

C

Cool well barring any additional introductions, um let's start with uh project updates or individual updates, where these are usually shorter things just sort of for awareness.

G

No discussion, uh yes, so for All-Star um contributor ladder PR still open. uh If you have any comments, take a look at that and um also we've had a few external contributors submit some uh features and they've been asking for release um most people that run their own instance. Just build from head, um so I haven't been doing releases regularly, so I'm gonna do a really soon, because somebody asked for it and that's it for for updates.

C

All right thanks, Jeff um I, don't think there's any scorecard ones uh could also probably do a release. It's been a while, and we have some bug fixes.

C

All right um moving on to the agenda um I'm going to assume this was also Jeff. Yes,.

G

Yeah so um basically I'm asking this group uh first of all, so for technical infrastructure, um the guidance from the TAC is that working groups are free to use whatever resources they can find or solicit help from Member organizations or to request funding from the open ssf governing board to the TAC.

G

So I'm, looking for neutral infrastructure support for All-Star project. Currently it's about 300 a month. It's not a big Bill and I'm going to ask here for any if anybody has anything to donate.

G

Otherwise, I've already talked to the owning working group for the project, which is the security projects working group so that we can go ahead and request attack for funding.

G

Yep um yeah so I'll take that as a no uh so I've raised my hand, I don't know.

B

Yeah I see hi Bob, yeah, hey, Jeff, um yeah I know, Google has been funding it uh we're happy to continue funding. It um I think you know. Certainly the choices here is now wearing my attack hat and not necessarily my Google hat yeah. uh You know it's something I think we could take to uh the lfit team to understand, based on the architecture, whether that's something that they could uh to help support without the need for additional money versus um yeah.

B

What that would fundamentally look like versus like keep doing what we're doing and just make sure that, like again, we have the right access permissions for folks in the community and figuring that that model out um I'm I'm wholly supportive of you know making sure that we have a neutral and sustainable um solution here. So I guess money is one option to it, but there may be other options that that uh might not involve necessary fundraising. Even though it's not a huge amount of.

G

Yeah I completely agree um so yeah. The request is for neutral infrastructure or funding for that. So either one would work.

B

So I guess one one clarifying question: is there a desire to stop using the current Google infrastructure?

B

um If so, what's the timeline around that.

G

um So the current infrastructure uh I've been informed has like stipulations for retaining access to it uh and the All-Star app has a private key that has elevated permissions to all the users who have installed it, as well as access to private data from all the users who have installed it.

G

um So it's sensitive and it's something that we have been proclaiming to be operated by the community and the open ssf. um So I want to continue to uphold that uh that claim um so. I, don't I, don't know what the timeline is, at least for the current infrastructure. If that's going to disappear at some point, so hopefully I can get something uh ready as soon as possible.

B

Got it so so you're I guess, let me just pair back what I heard yeah, um so your intent is to to move off of the Google infrastructure um as soon as reasonably possible. Are you gated by um I'm, just trying to make sure that we prioritize this this aspect of the attack and and uh LF accordingly, but that so your desire is to move off of that as soon as possible.

B

A

B

Why that's why I make echoing it back Yeah.

A

We actually had this conversation earlier, because I've.

B

A

Trying to tease out exactly yeah I think it's been challenging to to put this in words uh Jeff. So let me jump in and please tell me where, if I'm wrong, because we just.

G

A

This conversation yeah uh the way I understood it was the problem, isn't so much running on the uh Google um infrastructure. The concern was a uh a kind of access uh um that they expressly require. That I I think Jeff believes is not necessarily the case for a typical user of a cloud service.

A

um I, Jeff I'm, putting words in your mouth. Tell me if I'm wrong, I'm, just trying to paraphrase back what I understood, yeah.

G

So the current infrastructure um is running, but I've been given a request that uh it's that the provider has access to the data which I've denied so I. Don't know. If that's going to be mean that that infrastructure is going to be pulled and when.

A

Okay, meaning they have admin access to.

G

A

Control completely the yeah.

G

A

Any cloud provider obviously can read whatever.

G

Yeah yeah, whatever there's conspiracy theories yeah, so there's something different I'm trying to tease.

A

A

And Bob, if you don't know this situation better, please I'm trying to understand it myself, yeah.

B

No I myself as well, so that's I, I, think part of the uh part of the challenge here. I mean I. Think again from my perspective, I just want to make sure that you don't get caught up in a unnecessary fundraising activity. If there are shorter term solutions that would be viable that give you what you're looking for right.

G

So yeah, if there's I mean this is what I'm asking here. If, if I can, if somebody in this group can provide a neutral infrastructure, uh I'd be happy to take it without going to the TAC, um and if that's Google, then that'd be great, um it would just need to be without the stipulations that I've been told, are required. For that.

A

Okay Jeff, my apologies. If this is something you don't want in a more public forum, is there? Is it possible to like copy paste these specific stipulations that you don't that you feel are a problem and the.

G

Specific stipulation is a so in Google Cloud for sorry for those there, mostly AWS folks, but in Google Cloud platform, there's a project and then there's a uh administrator permissions on the project, which means you have access to everything, and the stipulation for my current infrastructure is that a Google engineer must be a administrator on the project. For me to be able to use it.

A

Okay and you think, a typical uh gcp instance, or another instance on Azure or AWS or other clouds. That would not typically have that stipulation absolutely.

G

B

H

My perspective.

B

Wearing my attack hat I I think we should. We can certainly open a ticket with openssf Ops and explore what options exist within the it framework, I think of its own Advantage by the foundation. That's probably the cleanest way, because you may be kicking the can down the road if another, another company raise their hand and said I'll do this, but there's some other restriction associated with it.

G

As well yeah that could happen so yeah any any request. Any request here or like any anybody who provides uh infrastructure here, would it would need to be neutral so um yeah I agree that that might be the problem. If, if somebody provides it but then says oh well, we need we still need to access it right.

B

So that would be my recommendation. I mean I'm happy to support the the funding asset attack. Just for my timeline perspective, it may be way overkill for what you need, but again that may be premature. So, okay.

A

And let me just quickly speak for LF in general, we don't own computers uh or infrastructure, we we pay various Services Cloud providers and so on to provide that.

A

um So uh so it's not like there's an LF set of computers sitting around somewhere in San Francisco. That is ready to do the running.

C

All right, so it sounds like the action item is a ticket on uh Bob's side.

G

uh uh Now I'll um open the issue on the tech and um with the funding request. Okay,.

A

And and I think the key is to this Clarity on exactly what the current problem is because I, my apologies, we just talked about this earlier I've, been trying to come up to speed to understand the problem.

A

Foreign because, clearly any infrastructure, if they're running your instance, they can do whatever, whatever they want to to whatever they can see from a technical aspect. So it's something specific that I'm just struggling to understand.

C

All right um Jeff do you feel like this has been discussed.

G

Yeah absolutely.

C

All right um so moving on uh someone from Lockheed Martin want to talk about adding support for gitlab I know we have some openpr right now, um I believe raghav, who I'm not sure, if is in the call, um has been working on trying to sort of get that PR across the finish line. But if you wanna talk to it, go ahead.

D

Sure um so again, there's three of us from Lockheed on the call here, um I think he's getting here. It's gonna probably be doing a lot of work, but um yeah we're just kind of curious where to get started.

D

We saw the issues and the pr that's out there uh and happy to kind of help, get it across the Finish Line um we're using it with a sort of watch that we have called topper we're going in open, ssf, scorecard um data into augmenting s-bombs, which looks like a great topic for Justin I'd love to hear what you're doing um so, yeah I think it's it's something we're happy to help support, um because I think everyone benefits from the added brought scorecard data from gitlab.

A

Absolutely I'm excited so.

C

I haven't read, it'd, be great to uh get support for both git lab, and you know just augmenting, uh because scorecard does also support some local repo analysis.

C

So um Laurent one of the maintainers is working on some structured results and trying to make certain checks more granular and more data driven um so like, instead of just saying, does it pass the license check sort of break it down into sub components?

C

um So we've discussed that in some previous meetings should be available in the minutes. But uh one thing with those structured results is that it might uh enhance our ability to do more analysis locally. So between that and enhanced gitlab support, it's looking- or at least it sounds like a lot of impact.

D

That sounds good, we'll communicate through the issue in existing PR, and then you know how power are we going to get across that initially.

A

uh This is really just a request. Back.

A

um There was ever early on trying to make the scorecard's requirements not be specific to get Hub, but there's always the risk of you intend to do something, but you didn't quite accomplish it. So I would beg for if you've got feedback on the criteria. You know that sort of thing you know what's missing or you know rewording to make it more more General, I I, think we'd, be loved, we'd, be very, very interested in hearing it.

B

David are those published anywhere where we could take a look at those.

A

What the uh the scorecards criteria? Yes, uh uh somebody else want to give the link, because I'm trying to type in the note here real quick, but uh let's see here, we love yeah. So give me a moment: I will get I will put in the link once I. Do that.

B

I actually think I know what you're referring to now. I was thinking. You were talking more in detail, technical requirements, but yeah I, think I know.

A

Yeah, it's it's that little table and list, and you mean it's the standard thing you linked to with scorecards, but it's it's still a fair question. So I will go look for that.

C

All right, yeah, uh Jeremy I, think that's the list. um Yeah.

C

um So, with uh Laurent structured results, it's sort of being split where Under, the Umbrella of say, dangerous, workflows or token permissions. There might be a GitHub specific check, but nothing that sort of prevents a gitlab specific check as well, all under the umbrella of the token permission, ship, okay,.

A

I think that said, if you see something that there should be a check in git lab, that doesn't make sense for GitHub I mean frankly, what I would suggest is maybe there's some more General criteria. You talk about it and then you implement as a GitHub check and a get lab check. If that makes sense,.

A

Awesome. Thank you.

C

All right, um so it sounds like that. Action item is just to have the discussion in the issues, which is what I heard um so on our next item. uh Talking about s, balance corporate project, Justin.

E

Yeah um so I wrote this thing called the spawn scorecard. It scores s-mobs the.

E

I think having an s-bomb is an important part of an open source project and contributes to some of the security. It's it's an it's an it's a useful input into security organizations um as such I think a criteria on the scorecard on your scorecard should be hey.

E

Do you have an s-bomb uh and then the second piece is that you can have one and they're pretty useless um and so like you can have a valid s-bomb that doesn't list your dependencies or you can have a valid s-bomb that doesn't tell you the version of the dependency that you're using um and so then there's a there's, a subsequent thing which is like: how do we evaluate the quality of those s-bombs that we require?

E

uh Which is the thing that my project attempts to do, um and so two parts uh have suggest people uh deliver s-bombs and then second make sure they're of high quality and so I'm happy to I. Think someone filed an issue about this and I said. I would be happy to support this happening, but it's not entirely clear what what that might look like for y'all, and so I am here to have that discussion.

A

Is this an existing project or project you're you're intending to do.

E

A

Exists, it's got a URL.

E

um Github.Com scorecard.

A

Where are we oh? Okay, it's in.

F

The you drop it in the chat, yeah yeah.

A

I'm gonna I'm, gonna, yeah, I'm gonna move it over to our notes, because when this call ends all chats disappear,.

A

F

Yeah I'd be I'd, be interested in this, because this is so This Jared I I work on with the second with the ex-working group industry, working group, and so one of the biggest challenges. Is you get an s bomb out of one of the generated tools and then it's missing Shaw's, it's missing hashes. It doesn't tell you who wrote it or who designed it. It's missing vulnerabilities.

F

It doesn't have any they're, very weak, right, they're, very lightweight, so the quality would be really interesting to see the challenge that that I'll dive into this but understanding you know how are you pulling it? Are you pulling it from Marine Corps? Are you pulling it from archivists or you know? Is it you got a point at a repo that has all your f-bombs? You know that I'll check that out later, but full project.

C

Cool, um so you mentioned an issue I assume the issue was something like add s-bomb as a check.

E

uh The issue is in your repository: I can dig up the URL, but it it's effectively. Hey y'all should use s-bomb's scorecard as part of your thing and I didn't file that issue. Someone else did but I'm happy to support that happening.

A

Have you compared this to uh the US government's list of uh minimum viable.

E

um I've not um I suspect they are complementary, given the s-bomb space, where everyone has their own view of the world and they circulate around the same idea, but are not necessarily ubiquitous.

D

A

Now, here's a weird question for you: have you considered whether or not they include the dependency trees? When you know they've got them but are missing.

E

um The scorecard project does not s-bomb scorecard, does not validate that the s-bomb you have is correct.

E

It makes sure that the data that is there is useful, and so, if you say you depend on spring, then this thing will say: hey, but but like what version of spring right- and you didn't say what license spring was and uh your s-bomb file is not even syntactically valid, so yeah, it.

D

Does those sorts of things okay,.

A

Is useful in certain kinds of data are present.

E

A

E

Was mainly generated from eBay's use case, which is as generators of software packages that we use internally and like there's, we're going to feed that into a system and that system will decide like.

E

Is that software healthy do we have like? Can we do Regulatory Compliance stuff, and we need to know things like yeah, but what version of spring is? Is it so that when spring 4 has a CDE, we know? Oh, yes, this is spring four and we can do something about it.

A

E

um And I think the the this is not supported yet, but the intent is for there to be support for customized rules to the degree that someone would like to have different opinions about what's required and um what sort of things need to exist. So.

C

Yeah, that's a very common theme that a scorecard has sort of been noticing is that people have very opinionated opinions about scorecard as well like which checks they care about, um and there should be an issue with uh clo monitor or something like that. Where you know more and more people are just having this sort of like we want to customize how we I don't know care about certain things, but not others and it'd be interesting to see the overlap there.

E

Yeah, there's probably some scorecard framework that'll exist in two years for people making scorecards for to support these sorts of things, um but yeah I think I. Think it's a question of like building a scorecard is a mechanism by which we can influence the culture and the direction that fits our agenda, and my agenda is that things should have licenses and versions, and when you get a cve, you should be able to look at the s-bomb and figure out if you're affected, um and so that's what's reflected in my tool um in the similar way.

E

That I suspect that the agenda of your scorecard is hey. We should write, secure software and try to get better at that and we'll put policies in place to uh to address it. So.

E

um So, uh to the degree that this is of interest to y'all, um what is uh what next step, do you need for me or.

C

uh So, usually, just based on the nature of the meeting I'm trying to look at all the attendees right now um we're missing quite a few maintainers on the uh just due to travel and parental leave and stuff, like that. So I think the best would be for sort of a discussion on this issue uh that I added to the notes about adding support for the s-bomb scorecard.

C

um So Laurent sounds like he's on board um and I I think it aligns with what uh sort of secure best practices would be in terms of software supply chain. So I. Think next step would be just soliciting comments on this issue and sort of going from there. Given that there's some conferences and maintainers missing right now,.

E

Cool, um do you expect that to happen out, do I need to attend this meeting again in two weeks to make that happen, or can it happen, but do one of you wanna help nudge, developing people.

C

Yeah so I I, think uh sort of soliciting for a comment in the slack um is good. um I understand that in the issue, though uh I'm pretty sure Laurent said bring this to the meeting, and then people just happened not to be here sort of thing, um but usually someone has an issue. They bring it to the meeting. It didn't immediately, get shot down, people either want to discuss it or for time reasons aren't able to and then sort of discussion flows back to the issue anyway.

C

A

Yeah usually go ahead. Sorry.

C

I was going to say just having it as a talking point in a meeting gets some initial opinions out where uh some people say like yeah. This sounds good or no. This doesn't sound good and then sort of opinions get finalized in the issue.

C

Are you gonna, say David.

A

Yes, I guess: does anybody have any strong um reservations, given what they've heard so far? Maybe you know, which is not a very strong straw poll, but uh you know hopefully at least gets the the juice is Flowing I I, don't certainly I think the idea of encouraging s-bombs is something we're trying to do anyway. So.

C

Yeah and I agree in terms of sort of scoring projects on best practices for securing the supply chain. Having an s-bomb is obviously up there. So I think there's some discussion to be had uh people are discussing about either binary artifact store score or whether this is its own check. Sort of thing.

C

um I think there's some discussion there, but in general any sort of s-bomb support in scorecard I support.

C

And sort of that format you described Justin where it's one thing to have in a spawn and then it's another thing to have a valid s-bomb, where you know there's some debate about what valid is, but that's something that scorecard checks have gone through before, like our security policy used to be. Does it have a security policy? It's like yes, but it could have been empty sort of thing and then the check was augmented to actually check a few things. So it sounds very similar to some of the checks.

C

We have now um really some of the discussions we've had now.

A

Yeah and by the way uh somebody else asked me if that was the of this particular NTA document is what I mentioned. And yes, that is exactly what I was referring to um sisa in the U.S. This is a U.S specific thing, um but well you know this list is specific to it's a recommendation from the U.S uh that said, I think other people have looked and said: yeah I mean we can there's probably more. That should be there, but this is a at least I would expect these to be there.

A

F

A

So I yeah I'm, looking through I, mean supplier name, sometimes doesn't make as much sense, although you know at least the where the, if the supplier is the uh registry, the Pat or the or the package organization that makes sense and then component name and version. Obviously, yes, other unique, IDs and I think pearls and hashes make sense.

A

Why, how it's dependent and the author and time stamp you may not be checking but I bet. Those would be easy to check.

A

It's not a requirement in order to consider this. It's just that! That's that was my question.

A

um I think this makes some sense I'm sure what what we'll find is that a whole lot of projects don't have S bombs at all, and some of the s-bombs are don't have aren't very good. But that's okay in the sense that that's exactly why you have a scorecard.

E

Yeah I can tell you having trying trying to find s-bombs in order to test tools like this is surprisingly difficult.

A

um Because they're hard to find- or they don't exist,.

E

Both um in many cases, they don't exist and, in some cases, they're like alongside the artifact but aren't in any way linked to the source code of the project or.

A

E

A

Subject: I I think there is a challenge that um typically I mean the better ones. I believe typically are generated by the build environment, but then it's not necessarily included in the source code. It's you know. Well, where do you put it? It's not in the it's not in the uh package, that's generated necessarily and it's not in the source code.

A

These are doable, but we don't have a convention for it.

C

All right, well, I, see uh Justin that you dropped the link in the chat um and yeah I'll, probably ping, some people that were in the meeting just to encourage uh comments. But if anyone has any final discussion on the s-bomb scorecard bit, I'll give it a little bit, but otherwise I think we're.

C

Let's move on to the docs mini fix it plans which yeah I see is going to be Kara yeah.

H

uh Hi, for those of you I, don't know I'm Cara um I've done some work on documentation for both scorecard and tools are extend. All-Star um and I wanted to follow up on something.

H

From last week uh it I in the beginning of January I had said you know this documentation is getting mature enough, that it's getting out of date and it needs a freshness review and we need to do uh um just sort of a read through of everything and I grabbed a couple people and sat down, and we went through all the docs with All-Star and uh scorecard to generate some issues, um and it was pointed out last week rightly so that I probably should have announced that to the group and found out who else was interested in doing so.

H

So I want to apologize for that. First off that my bad um and so I want to put it out there. That uh I was hoping that maybe every six months we could discuss perhaps having an hour or two where whoever's interested gets in a call together reads through like speed reads through all the documentation I found. This is a good way to just generate real quick list of things of like yeah. That's out of date.

H

We've been meaning to fix that and oops we didn't realize that's not accurate anymore, um and then we can prioritize CSUS and decide what needs to get fixed. So I just wanted to put that out there and see if there was any interest for say, a twice yearly review of documentation on the projects.

C

So, just to give some context from last meeting, um Stephen Augustus, also sort of meshed with the idea of every six months, um so I think there is support out there um in terms of maintaining dock freshness just so that potential contributors or uh you know anyone trying to use it, has a time and like has an easy time and isn't fighting Doc's illness.

H

So if there's no, uh if there's no disagreement on that, how about rather than phrasing it the way I did if there's no disagreement, um I'd like to follow up in say summer, around july-ish or summer for the Northern Hemisphere folks. um Maybe this July will be about six months from January.

H

We'll have hopefully worked through all the issues that we created in January at that point, it'll be just time to do this again, so I'll um either announce it by email to the group or here, and we can then make a public meeting that anybody can go to to participate in this. That sounds good.

H

H

Great that was all I had, so thank you.

C

Yeah, thank you. Cara.

C

So with that we are currently at the end of the agenda. um I know. Sometimes people have additional things to discuss, but if no one else has anything right now, there's always the possibility of ending early and getting some minutes back.

A

Thank you. Everybody.

H

Sounds good. Thank you. All.

C

Right sounds good um thanks. Everyone for joining, especially new contributors um or new attendees. Looking forward to discussing these issues, foreign.