OpenSSF Security Tooling WG, 20 Jun 2023

Previous Meeting

Next Meeting

⏯

youtube image

►

From YouTube: Security Tooling Working Group (June 20, 2023)

Description

Notes:https://docs.google.com/document/d/1jzxhzIfkOMTagpeFWYoZpMKwHYeO4Gc7Eq5FcMFEw2c

Our mission is to Identify, Evaluate, Improve, Develop & Ease Deployment of universally-accessible, developer focused tooling to help the open source community secure their code. This space allows members to collaborate together on these goals.

A

Hello Matt: how are you.

B

Give me a give me a second to unmute. There we go here. We go this.

A

Is my first meeting today and I was off yesterday and like everything's, always so jacked up after I? Don't know why, like every time, I have to run zoom on a Monday, it's just broken. I love it yep.

C

A

Although it's still better than teams, there's a Monday mornings, I have a teams meeting for uh the Vex group and like it's like God, damn it every time something ridiculous is broken. Thank you.

B

Yeah Zoom was outlawed for a period of time in IBM, but they had to relent.

B

So it's back on the supported list. Interesting.

A

So, like a lot is you couldn't join a zoom meeting.

B

Well, your idea's got a corporate uh WebEx account and that's what they want you to use, but.

D

B

Always possible so for sure, so it's in like our catalog of supported apps for a while that was taken out and was added back. It was interesting.

A

That doesn't surprise me.

B

Well, I mean I experienced the during covet the zoom bomb. um Oh that's right.

A

Yeah, because the meeting IDs were what like five or six characters, something hilariously small with no passwords.

E

B

Yeah it was, it was surreal, like hundreds of people joined with the seconds, and people were playing music and telling saying things that were not safe for work, so I had to kill it immediately. You know yeah.

A

I remember that holy cow man that was like it feels like it was a hundred years ago.

F

I know I know wow.

B

Mentally put all that covered stuff in our rear view, mirror you know.

A

I know a man holy cow holy cow, so we got. We got five minutes before the meeting starts. Thank you all for being early joiners, we'll just hang out and do nothing for a few minutes.

A

All right to avoid embarrassment when we have a larger larger group, is it facila? Is that how I pronounce your name correctly.

A

E

A

Wrong on these things, so I'm very.

D

A

A

F

D

A

You Max so I'll I'll not ask how to pronounce your name correctly.

G

Max is fine yeah combution, but uh it's like notoriously difficult for English speakers to actually pronounce this.

A

Combustion doesn't seem too bad. I know, I worked with a guy from Hungary at one point and I was like how do I pronounce your last name. He's like just just don't like know me exactly he's like I guarantee, you can't do it so we're not even gonna try. So it's like ah man like never felt like a bigger as an American.

C

G

I actually have an uncle who lives in New. York he's been living there, since the 80s and um I never asked him how he actually teaches people to how to pronounce his last name. He.

A

Probably gave up that's what usually happens to people yeah yeah.

A

I remember: I had a co-worker I worked with when I was at Red Hat his he was uh from Brazil, so it's Portuguese, obviously, and his name was Ramon, which is pronounced Haman in Portuguese and he moved to San. Francisco and I went out for lunch with him and some of his co-workers and they were calling him Ramon and I'm like what the hell he's like I gave up like I'm Ramon now, yeah.

A

C

I once meant a French Canadian when I was uh in San Francisco. That I hired me to go work in in LA with him as at his company, and it was really funny because everybody called him Chris, but he was very clearly French, Canadian and so I said Kristoff, and he says yes, but nobody calls me that right here and I said: okay. Is it okay? If I call you Kristoff, he said sure that'd be great, I got to the site and they said Chris will be here soon like who's Chris, nice.

C

I hadn't made the connection. It was really funny so nice.

A

It it's funny but I shouldn't it's sad.

C

I'm in Canada, so French French names, depending on your background, uh you know or normal by the way I'm being uh from the Linux Foundation.

A

C

And you didn't have to try and butcher my name. So that's good.

A

Makes it easier and whereabouts in Canada? Are you.

C

I'm I'm on uh Vancouver Island in Victoria, so yeah.

A

I know we were just out your way a couple weeks ago, I.

C

Just love that people have heard from where I'm from, because that's not normal, if it's not Toronto,.

A

Why do everyone knows Vancouver I mean.

C

Come on Vancouver Island I'm on the island of the southern tip of the uh the island off the coast, but yes, I've.

A

Never been I've heard it's just a magical place.

C

This is a great day, but this is a beach, because.

A

This is my window right, like.

C

No, not quite yeah.

A

See you say that, but I've heard in the winter it's it does get a little a little toasty or a little chilly up. There.

C

It's around freezing yeah. We still have flowers all year round, oh wow. We we had snow for for four days this year, which was we were not happy with it's it's. It's like it's like Seattle, are uh very, very similar to Seattle a little bit less rain.

A

Gotcha gotcha, all right, we can get cracking it's five after I. Don't think it'll be a a huge crowd today, just because it was the holiday yesterday in the U.S. All right, so I will paste the first link in the notes. If everyone could sign in here.

A

We do this weird for anyone who's just joining, because this is technically the tools working group, but there's no tools meetings, because we don't really have a lot to talk about so I've hijacked it for the s-bomb everywhere in working group, so sign in on the tools meeting for me and then the s-bump everywhere agenda is in this second dock I'll paste and the first agenda item is I: ask everyone to just put their intro in the chat rather than going around the room, because that often takes too long.

A

um So I'll start and thank you for coming. We've got a pretty packed agenda today, so I'm very excited and we'll we'll just get moving right away. We'll start with, we have two guests who are here to discuss how they're using s-bombs like in the open source universe, and the first is Sila. So facila I will let you take it away and and tell us all about what you're doing with s-bombs.

H

Hello, everyone I hope you can hear me.

E

Yep we hear you yep.

H

um Yes, so my name is fasila, so I currently uh work in the open source project called istu, so SQL has been currently uh joining uh the CNC of cloud native Computing foundation, and then we had certain works on going on the supply chain, security area. So Georgians, who is on this meeting? He is my colleague in Ericsson, so she knew about our journey about it, istio and his bomb.

H

So he told like it would be nice to share this experience with them, why they rode the end so that they can also understand how we are using it and how on how we decided to incorporate as bond to its poem yeah.

A

For one moment, will you explain to everyone what istio is because I have a suspicion? Not everyone understands what it does.

H

Okay, so it's Q is a service mesh solution, so basically we provide a security traffic management, related operations, uh majorly for the kubernetes platforms and, of course, not just kubernetes.

H

There are other things as well, but yeah we majorly use it with kubernetes, so yeah supply, chain security, anyways an interesting topic for almost all the cloud native projects there are, uh and in cncf itself there is a lot of push across the projects um mentioning like okay, you should do whatever possible to enhance your supply chain security posture, so we were also thinking what and all we can do for this. So um kubernetes by itself adopted some of these F-bomb functionalities.

H

The kubernetes came up with a bomb utility within the kubernetes Sig release community, so they had written there on the love materials utility were the golang projects, can just use it and generate your bill of materials, so that is when we also because istio is also Major League project. Currently, so it became easy for us to use this particular utility and generate our bill of materials, and we were anyways in touch with the kubernetes community. For many of our other release. Related operations, so that's how it started.

H

uh Initially, we thought of using the xpd spdx had another utility to generate bill of materials. That's what the plan was and then exactly. At the same time, we came to know that kubernetes has this bomb utility which looks easier to use and we were easily getting support from them.

H

um So we decided to go ahead with this particular bomb utility. So at this time I was also new to istio. I had also presently relocated to Germany joining Ericsson. So since it was a new experience for me, the first thing I had to do was to write an RFC document to the HTO community and present okay. This is something which you would like to have in your project.

H

So what happens with all these non-functional requirements, usually, is that everybody wants to do it and everybody wants to have it in their project so that they can say. Okay, we have done all these cells level, one level two Etc, but nobody has enough time to invest on such things.

H

But since I was new and I had some of my previous colleagues or friends who are working in different supply chain, security related domains in the open source area, I was in constant touch with them and that's how I came to know about the utilities about bomb and others bomb related works. So I proposed this as an RFC. Maybe I can share my screen and then sure.

H

Okay, so we started with this document: it's not a big thing, but yeah. This is how in istio, usually in any new feature, request comes in, so we probably write a small document describing the background requirements and then how it can be done and what are the options in which this can be achieved um yeah. So this is how it started with.

H

So we initially started with this spdxs bomb generator tool which was readily available at that time, and then we enhanced it saying: okay, there is something called a bomb utility in K8 Community as well, and similarly we had this Cyclone DX tools as well. Most of them are doing similar things and yeah. It was just a matter of writing a very small script to get it done for istio, because the whole project was golang and we we generate two separate s-bombs one for the release artifacts and one for the source code um yeah.

H

So this is my PR for that. If you see it's, it did not take much effort. The bomb utility was also very straightforward to use, of course, when it was used outside kubernetes.

H

We had hit some minor issues here and there, but we got immediate feedback from the kubernetes community and then they were open to fix the issues for us yeah, so it just got I mean it was just one pile and like 60 to 70 lines of code, and it was done, and if you see the istio release page, you can see that with each release we publish uh the source and release is PDX files for every release.

H

uh Yeah, that's pretty much about that and, of course, when we started publishing the s-bomb in spdx format, we were contacted by the Cyclone DX box as well asking like yeah. We should publish both the formats um yeah. We have not yet done it as of now. Kubernetes is also publishing only spdx format. I think that we have just done it this way, but of course we are open to do any other formats, whatever it's needed, so we have.

H

Then this is the first step and then uh I, don't know whether you know at all, for who is the kubernetes release manager and he has been doing a lot of work around all these supply chain. Security, related tasks and he's from chain God like a company called chain guard, uh so they have to come up with a checklist for the salsa complaints um like level one level two like that, um and if you go through it, we can see um like where your project stands. As of now, whether you're a level one complaint level.

H

Two like that. So we when we did that analysis, we understood that as bomb comes only at the level two, we had some other tasks to finish for level, one basically the Builder test station. So we are currently now trying to check how to do something like in Toto at a station or anything else that is possible to first um comply to the level. One checklist.

H

Here, that's all I had to share.

F

So I have one quick question: if I may.

H

F

uh Your your uh spdx files are: are you signing those? If so, what keys are you using.

H

uh So it's uh it's all the artifacts here we have uh um cosine related uh timing methodologies. I, don't have the exact details about it, but yeah the release manager uh does that okay.

F

I figured you were, but I wanted to make sure uh um trying to make sure people are actually signing their their s-bombs.

A

H

A

I, do have one quick question: does the do you know, does the bomb tool output Cyclone DX, or does it only output, spdx.

H

It only outputs spdx, okay, whatever we started using it, it had only spdx as far as I know, it has not been improved to have sex laundry. Okay.

A

Okay, so all right, that's all I'm not going to ask anything else. George has his hand up. Don't let him ask a question.

E

Yeah thanks I'm, just wondering how stable has this been for you over the time. I think this you've been implementing this half a year ago or about a year ago, yeah.

H

E

How stable is it? How quick does it break because I got the question the other day from a colleague asking? So if we're going to we're going to have an effort like the one we're discussing here, kind of being kind to projects and implementing um these things, that how hard is it to implement because we're adding maintenance burdens on projects so I'm wondering how how well that worked for you.

H

Okay, so for for us, I have never had any case where somebody reported that okay, the bomb utility now is broken. Please fix it so that we can release that never happened, maybe because um kubernetes releases stable versions of Boom only after they are internally trying it out, because they are also using the same code to generate their spdx files right. So maybe things are stable and working fine before they ship a new version, and then we also take a little bit of time before upgrading our bomb utility version, something.

H

That we did not have so far no case where things were broken, but we do keep updating our bomb version. It's not like. We are just using that old version where things were working, but we do upgrade.

E

H

But I think there are more things to do like if you see that cells are checklist. It's like really big. There are several things which we have to do so that we can be level buying compliant itself. I think kubernetes has achieved level two or level three compliance.

H

um Yeah HTO is not there yet.

D

Thanks for presenting this, this has been really helpful context for me and I'm really pleased to see that istio is doing this so successfully. My question is: have you heard from any of the consumers of your bombs with? Do you have people that your or companies or Downstream projects that you're aware of that are using your bombs in in any context, on their experience of.

H

The video on the Upstream we do get, uh you know issues now and then saying they would like to have the files generated in specific context, and we do get the enhancement request for different amount of operations like, for example. Here the docker images are all published as part of the relief, and then we use those published Docker images to generate the spdx. There were people who were asking like they want a mechanism to generate the experience file for Docker images, which are in the local repository.

H

So similar requests do come so I think there are people who are using it, but internally for Ericsson I think we have. We are I did present this and then we are exploring and have to um yeah leverage on this Downstream, but they do see a benefit in using this, because it has a lot of things automated, which currently, we are doing with a lot of manual effort using manual scanning, and a lot of you know, repeated effort goes away with this automated way of generating files. They do agree that.

A

I I kind of have a follow-up to that. So how often does this require like care and feeding I know you set up all the Automation and is it pretty much good.

H

To go yeah, that's it, so we have already done it. We did it like in HTO 1.14 release. So once done afterwards, we never had to do anything additional, except for upgrading the utility version to the latest version so that it, but otherwise the generation part is the same code. I have not even touched that for the last four releases. So if you see that it's 1.18 release now that's awesome. Yeah.

A

That's great that's great to hear, because that that's my biggest fear on all this is that you're going to have to like fiddle every freaking release, and no one wants to do that. So.

H

It's like the mom utility is pretty much easy to use, but the only thing is it can be used only for Golan code, because kubernetes is golang and then they have no plans to support any other languages. So with istio we have one module which is in C plus plus, for which we are not yet generating the spdx files uh and for C plus we have not seen any good bomb utility so far. So yes for many languages, the support is not there, so that that is one shortcoming.

D

I have another question: um you mentioned that you're working on salsa compliance I was curious if you have run the security scorecard on your project and um if so, what that experience is like I know, that's a little bit different of a question from s-bomb, but I've really enjoyed hearing your perspective and it's another working group I'm in so, and one of the things that group is talking about is how to see if the projects have produced an s-bomb. So there may be a connection at some point down the road. Okay.

H

We were not aware of the Securities go covered utility. What we did is we were manually going through a checklist and checking One By One The checklist had uh questions like whether your project has the PRS approved by two people or just one person, um whether you generate build at a station whether the dependencies are clearly defined. Like that a lot of questions, and then we were just sticking the boxes and seeing where we are, we never ran any tools so.

D

The check right, the checklist, was the salsa complaints checklist right. Okay, thank you.

E

That's unfortunate I've been bullying some other projects that we're involved in to run scorecards but not least to you, because for sale has been taking good care of this. But we should run it for Sila and see what.

H

Comes out yeah it does there we would yeah. So if you see this I just to create this particular issue and istio to track this, and then we just had this one checklist which is like this, and then we were trying to take one by one and then see where we are so if there is a tool which we can run, that would definitely help us, but I know that chain guard um the company culturing.

H

They are working on something similar where you can run it against your project and it will tell you whether you are level one compliant or not. But of course it's a a different company and a different project. If you have something open source, we would definitely love to try that out. Foreign.

A

I'm going to move this along, but I guess the one thing I would add is this: is the old salsa uh checklist and there's a new version now so not to kind of ruin? Your party.

H

Maybe I will I'll talk to you again, get the latest one and then update our issue.

A

Everything Changes the only constant right, um okay, all right, all right so I'll keep us moving, then. Thank you so much Priscilla. That was this was awesome like well well done and and well done on the work, like that's a huge deal that istio is generating s. Phones, that's really really cool! Thank.

H

A

Right so we also have Max from sneak to have a chat with us Max the physio okay facility Max. The floor is yours: yeah.

G

Thanks um yeah, just quick intro about myself, I'm Max uh I work at sneak um in the open source group.

G

So, uh if you know sneak and and um our product line um a lot about is actually scanning your open source projects or your your software projects, which are built on open source components for vulnerabilities, and um we have actually had an internal representation of an s-bomb at sneak for a really long time, um similar to to how Anka's doing it with a sift I think, there's also proprietary, uh serialization format um that can be translated to to Cyclone, DX or spdx, and we are um not really uh um making that internal representation so public.

G

Even though um there's a public response repository with the schema and everything and um so far, what we have done mostly was to let our customers generate s-bombs off of this internal representation, which is fittingly called a depth graph. So um no no real magic. There and um I have been mostly working on the translation of this internal representation. So how our software works is that um we Anna we. We do a composition.

G

Analysis of a software project um turn that into the step graph and then translate that into Cyclone, DX and spdx, and um this is uh so basically what we're doing we're offering s-bomb generation.

G

We are um currently also working on s-bomb ingestion, so um trying to understand what are the different components um that you have in an s-bomb that you bring to sneak, and then we can analyze that for vulnerabilities um there, there's also other competitors who already um offer this and um and also something we uh have actually open source just recently is a tool that takes an s-bomb and can enrich that with um additional information.

G

So um right now, a lot of customers are actually asking for copyright information license information that kind of stuff and um with that tool you can actually get this information from from public uh uh libraries and I can only tell you guys from the the point of view of an and I see working with the available tools that we are using.

G

um So we, the the service that we have, which is constructing these s-bombs, is based on golang, so um obviously we're using the um for cyclone DX, the golang library, which I think is amazing.

G

um Also, the the Cyclone DX specification I think is easy to to grok um uh and I I point that out, because I I feel that um with spdx it is a bit different.

G

um So there is also tooling available for spdx, but um it's I I feel that it's not as good as well maintained as the Cyclone DX stuff, so um kudos to um the the maintainers of all the Cyclone DX tools, um but then also what I found was that the specification of spdx is actually um hard to understand, sometimes or to to give some good guidance on how you should be actually um constructing uis bombs um in in that schema.

G

uh So so uh an example would be, for example, to to um describe the relationships which you between your components. They seem to be like different ways of actually saying package a depends on package B. You can also say um package. B is a dependency of package a so that's like just a simple example, but um it goes to show that actually you as um as somebody who implements this you are faced with the questions like okay, do I actually choose option, A do I, do I, choose option, b and I think with Cyclone DX.

G

You don't really have that much guesswork and um I mentioned this uh enrichment um uh util that we um have open sourced uh the again. We are facing some some challenges there with spdx, where we get some data from um uh ecosystems. If you know that uh you're, probably also familiar with depths.dev, that's been making the rounds lately we we're integrating with that. But ecosystems is very similar.

G

You just give it package coordinates, and it's giving you back a lot of Rich metadata about that package and um I have been working on the extension of our tool to actually consume that data. Put that into spdx and a lot of the fields I I find that I cannot really find the right definition in the xpdx specification.

G

If that makes sense, so um I actually then have to reach out to to people who have been minting. The specification ask um like how: how is this supposed to be used am I actually doing the right thing am I doing the wrong thing um so so, on the one hand, I feel that there is a little bit of a lack of enablement um where you it's not necessarily clear from the the content that you have available um to you as an engineer like what what choices do you actually make when you implement your code?

G

That's one thing and another thing um Escape my mind now: um yeah I'm, maybe gonna, stop right here, so I have I I'm, basically freestyling this as you, you guys can tell like I've, been asked to I've been asked to join this call um this morning and didn't have much time to prepare, but is this actually relevant context for you guys, yeah I find.

A

This fascinating um and shame on Dan for not giving you more warning he's known about this for like what four weeks almost I think no.

G

He did ask me last week, but I was out sick last week and then I jumped- uh or it was the week before I think and then so I jumped on this call, um but yeah. No, it's actually not not on tan. It's more on me! So um I take all the blame here.

F

Yeah sure, no problem so uh uh uh great uh to hear. What's going on at sneak, Max uh uh uh I've actually used Snick quite a bit uh uh and uh I think it's a great tool. You mentioned uh uh the idea of uh scanning s-bombs to uh determine what kind of vulnerabilities are are in there.

F

um Are you doing anything in regards to being able to grok uh back ports of patches uh to fix security issues in previous versions.

G

um If, if it's about like a consuming a Vex file for example, or um maybe ignoring certain issues, then um yes, that's actually built into sneak um already, um and we are planning to actually offer an API where you can upload your s-bomb, including um some directives of like the the issues that you don't really want to care about, um but that's all in the making currently so I'm I I can't uh disclose too many details about that. But yes, it's actually at the at the heart of our product.

G

Is that you also um you don't want to produce too much noise, because we appreciate that um this is mostly going to be interesting for um csos or it folks who actually want to understand. What's in the software they are using um and um maybe then also monitor for it. So I see that uh we're we're doing something similar in the vein of squawk or dependency track. If you are familiar with those tools, so you actually upload your s-bomb and you keep monitoring like.

G

Is there new um vulnerability that is being disclosed and um yeah, so so ignoring some of them and saying like? Well, that's not actually exploitable in our case um that that's actually uh something um we have as a yeah base requirement to this feature. Yeah.

F

Because of what some of what we're doing uh uh at Intel is is, for example, we have an internal curated version of openssl, where we support the the versions released over the last two years and and we've backported all of the fixes into those. uh um uh So we're trying to make sure that you know for us we'd love to have solutions that don't ding us. uh uh You know for shipping, older versions that would seem to have vulnerabilities because of their version number, but.

G

F

A

Anyone have any other questions.

A

All right, Max, you're free- that was awesome well done. Thank you. I appreciate it. That was that was really cool, all right, uh Matt! You are next on the agenda.

B

Thank you. Let me share, hopefully, was that successful.

B

Okay on the on the last call, I was actually pleased and shocked that we had a couple prisoners present early work on using creating build bombs in their experiences and I was like I need to inform this group what's going on in terms of cyclone DX.

B

um So in terms like lyrics There's, multiple work streams that s-bomb complexity is going up, formulation is, is one of the things I took under my belt, but I also participated in the machine learning work group as well as the attestation work group. Lots of new complexity is coming in. um So fundamentally, you know. I work for IBM and I've been I've been I've been trying to.

B

You know figure out how we create s-bombs for many years now and to satisfy the different requirements coming at us from from very you know, from from the ground, up from creating very controlled, uh build systems to get salsa level, three type um attestations, you know, reproducible build type stuff into an s-bomb I've got I've, got machine learning, AI, stuff I need to I want to associate with an s-bomb and and I keep telling I kept telling the second index Community from the industry work group um I've got tons of data from lots of different perspectives.

B

I need a framework in terms of s-bomb and a logical place to put the game, put put the data a context if you will um and and so this formulation work came up, I found out about it. Last fall and I I end up volunteering use cases uh and uh and, and they said hey, why don't you take a stab at writing a proposal for the schema which I did and and uh and and so Cyclone DX 1.5? This I just did a two hour.

B

uh The RFC went out early may I did two-hour review with a small group of people going through all the RFC comments that came up during the review period, but this is this work I'm describing is work, that's going in the cycle index 1.5, which will be J J later this week or early next early next week.

B

um So again, I I have a I. Have you know? Tons of data and I have salsa data. Attestations I've got evidence, I've got you know, information from GitHub I've got I, got tons of things and many things we do. We build with techton, so um I I needed a way to capture the build pipeline. The CI CD pipeline, if you will and of course, I've been a follower of of Fresca since the beginning, so I'm a big tectonic fans.

B

This was part of k-native build um and it's It's ability to perhaps get you know, create that to stations and actually capture them, um but also capture the the runtime stack below it. So how do I capture uh tecton tecton triggers pipelines, tasks uh kubernetes, maybe cut a container runtimes um kubernetes below it all configurations down to Hardware, because we have customers, Federal customers that need s-bombs that have the entire runtime stack um include inclusive. So you know we have a lot of complexity. So typically a CI CD pipeline concept is common.

B

Travis Jenkins have these com con Concepts tecton is kind of taken to the next degree. um So let me try to try show a ticket, so you basically have triggers. You have events that trigger the pipeline, so you can grab the source code. You can grab the people and events and things that actually trigger the build in an automated fashion. You have a series of tasks that are conditionally executed that bring it. There typically are run as containers.

B

You have workspaces that are shared and each of them passes, passes outputs and inputs to to Downstream tasks. And, of course, no. It's not pictured here. They're evidence lockers and things that produce not not just logs but actually perhaps salsa attestations from Sig store in total records uh attestation records Etc. um But you know we need a way to capture all these things and I mentioned the you know the complexity can be quite large. So how do I do this? In s-bomb, when I Collapse have the pipelines are very complex?

B

I'll just give an example: one of our products in IBM has uh three layers of builds to create one product with a total of 400, build steps, 400 tasks and a lot of. In addition, they run parallel pipelines at different points to check to run AI fuzzing. To do you know, scanning sniffing and a whole bunch of things, and if I wanted to show everything that I did my due diligence to build that one product out of 2200 products that we actively produce. How do I give that to a Federal customer?

B

How do I do that within a context of cycle index, so so here's what I'll show you pictures with the thousand words. So so, basically there's a there's. This I didn't want to do that. uh Let's see the bar is coming up, I think so. So here's the schema on a nutshell, so I thought you'd show you the scheme.

B

Let me let me zoom in a little bit, so just give you a flavor for what's going on Cyclone DX, so in the top of an s-bomb you'll, have this new thing called formula, so you can actually provide your build formulas and in the form of workflows.

B

So you, basically within the formula you can define components, tools, services that took part are participated in the CI CD process to either to build scan anything that touched your build or was part of a task and bringing the components and describe them um and if you're familiar with second load YX. These are these are parallel, but these are. These are separate from the components and services that are part of the actual subject of the build. These are actually the things the the the components of resources that participated in creating the subject component.

B

So in terms of workflows um again, you'll see a lot of you know, techcon or Jenkins. Familiar semantics, so workflows are actually tasks themselves. So it's kind of an inheritance model uh workflows are comprised of a series of tasks and there's tasks.

B

Dependencies there's a graph that maintains the graph between dependencies and there's a set of workspaces that are found that are shared workspaces between the tasks and, of course, that there's a there's a trigger and the trigger has there's events and things that that cause the trigger to activate to cause the build to happen, and you basically have time stamping for every workflow and for each each task you can see again. Workspace is exciting, you can see yeah, you can describe the volumes and you can describe how they were mounted and and all sorts of things.

B

If you want to do those things in terms of task dependency or tasks themselves, we could look into those you'll see a lot of duplication, but you have different task types. You can describe using tagging mechanisms what your task was doing, so you can do searches uh through your on your workflow, basically to determine which tasks we're doing certain activities like did you do a scan? Did you do this?

B

Where did you do that you can actually dive into the s-bomb and do type of XPath type queries or Json jQuery mechanisms into the into the final ask bomb to figure out where those tasks lived and what things they touched and what they did um in terms of um you also have things like Steps, so you have your trigger definition. What triggered the task, so every task gets triggered.

B

There's conditions to trigger the task since there's conditional logic in the pipelines so yeah you can actually describe the events and the conditions that existed this much like a policy enforcement point. If you're familiar with General security policy enforcement, uh you can describe those things here, um Etc, so uh just try I mean I'm somewhat trying to blow you away, but basically this is what you need for salsa level, three plus compliance, and this is the framework that we we designed to hang the data so to make it real.

B

Let me let me make it real uh so and so I'm I haven't done a work. A lot of work with this since mid-may, but I'm I promise to write a guide on how to do this. In Cyclone DX, so I took a basic techtime, build of a of a of an application which is a it's a Java spring boot application, and it's comprised of a pipeline that builds the application in terms of there's an event. A developer does a push to a repo.

B

Perhaps perhaps, if this is a release or developed, just normal developer push to him and you basically can kick off a pipeline that fetches the repo and GitHub provides a web Hub to do set. Do that and you can actually build. You know fetch the repo you can actually do a maven build on it. You can use builda to build the application into a container image. You can actually the next. This application actually does use Cube cuddle to actually deploy it to a running kubernetes instance.

B

So it does a live update of the application as it's built. This is true, Cloud native. This is true, Cloud native continuous delivery right. um So how do we do that? How do we represent these things in in like a cyclone, DX workflow? So in general, conceptually you'll see you'll, see the concept of yellow formula, your components and services. You have a workflow or in this case we're describing one contiguous workflow. It's made up of a bunch of tasks and uh you can list the tasks. You know a b c d here and Instagram.

B

So let me show you how we do it so here's the subject to build this, the Spring Book application- so is the metadata. That's the component, we're building. We describe that in terms of formalization data. We have to describe describe the tecton resources. So you know, uh we've talked about istioce everything. Kubernetes has basically resource definitions. How you declare them? uh You have pipeline, run task, runtime and Trigger runtime components.

B

You have to describe all these things, you're moving parts that take place in the in the in the pipeline, and you know basically how you map these things to the to the schema. So in terms of formula. So, for example, you have components so in terms of kubernetes tecton. You basically have these tasks. For example, you have well, you have a pipeline itself, which does the Clone build push, deploy Pipeline and you have an event listener. So this is the event that GitHub provides that we as our web hook.

B

Basically that triggered the pipeline, we have a trigger template. Here's a trigger that receives the event, decides whether to kick off the thing kick off the CI pipeline. We have it. We have a very sub volume claim so we're. Basically, our workspaces are backed by PVCs or actual volumes, and we have things like the tasks. We have a get clone task. We have a maven task.

B

We have a build a task, so we can Define these components in the context of the formula in terms of uh runtime components, you can see an example of uh the actual stack so kubernetes itself. You can actually have an entry in the component saying it was built on kubernetes and you can describe the component, the kubernetes component, where you grabbed it from uh the district. So in this case, there's many places that you can install kubernetes from so I picked this one from from Google. So, basically, you know pulls pulls the code down.

B

He also in terms of tecton. You need to pull down two parts of tuckton to build it. uh You need the pipeline stuff itself, which is inclusive tasks as well as the trigger. So you have to Define tecton your tecton component. You define your tecton triggers as well and where you got it from you, got it from I got the containers from Google Google storage from techton releases uh and I.

B

Have my uh my my techcon tasks themselves that I can describe um so I can Define all these things in terms of a workflow and here's the trigger, for example, I can describe the trigger itself, and these include input parameters, output parameters. They include attestations on and evidence uh you can describe any type of inputs to to a black box task and in the outputs, and you can actually point to them either. If they're in your s-bomb, you can point to them externally or you can actually Point them as a bomb link.

B

So if you have another bond that describes the pump component, you don't have to inline it. You can actually say here's the bomb for kubernetes, here's the bomb for whatever and just point to it. So so so I don't know how deep I should go for the audience here, but I'm just trying to say that the goal here was to try and show you that s that bombs.

B

You know many people, you know in the open source or the stage of like, let's just get a bomb created, um but in terms of you know where we're headed with government and with even the recent ransomware that things happened over the last weekend. That I I saw lots of talk, shows on the federal government and financial institutions, because a lot of our products are built on open source, kubernetes, tecton istio. We use, we use the mesh stuff. We use kubeflow for building our AI models, Etc, it's all open source that you know we're gonna.

B

You know the people who use it either they're going to Fork it and create themselves or the open source projects themselves have to step up start. Creating this type of data and I'm just happy that generationally, as spdx 3.0 with a security profile, has some Footprints for this with built b-bomb and that you know, regardless, if you're doing Hardware, building Hardware or AI models, or you know, SAS bombs or you know any type of manufacturing bomb.

B

They can capture your entire salsa 3, compliant workflow in Cyclone index 105 uh very soon, because now I can go back to my internal customers and say you have all this data. I can tell you exactly where to put it in the context of your build and all the tasks, so each each task that produces evidence can actually you know annotate that I produce the attestation and I can point to Sig store and and the transparency logs and things like that from Zig store, Etc.

B

So I'll stop and it's a fire hose and there's a lot here, but I just wanted to raise awareness to be informative um and uh again we're a lot of the the guide. Hopefully I'll will come out, hopefully by end of July. This is one of the examples I'm working on, but it goes you can actually represent a simple make file a manual make file build where your event is just a person, and you know, kicking off a make file and uh and those type of things, and it can do complex data models.

B

You can actually record the workflow for how you trained your model data. uh What prompts you use- and you know the same framework- could be just describe all the all those things and as we go forward, the machine learning with chat, GPT and and the Uproar around generative. You know Transformer models and, and things like that and Foundation models that are coming out in Mass. There will be more and more data and we need to. We need a logical framework to to hang the data or in and be inclusive in in the overall process.

B

More and more applications will ship with AI. So you need to describe now not just the files that for the build you need to describe the models as well. So so this gauge gives you the framework so I'll stop there.

A

Holy crap man like.

B

Yeah holy crap, yeah, yeah, I.

A

Agree: I guess the the only question I have when I see all this is. Are you working to like incorporate much of this into Fresco, because I have a suspicion? This is well outside the skill set or ability for many many projects to do well.

B

Yeah so yeah, so you know Tech time changes. My great hope and that's why I'm interested in my onset is you know, I, followed Tetons as well as in Canada, and when technology I saw Nebraska I was like I was Oliver I attended every work group that I could when I meetings from the small team of developers, but you know in a Fresca, you know, maintains you know, but I was hopeful that techcon and and the chains were consult, would their goal is to produce sauce acidation attestations.

B

um So it's all inclusive that this this design, first and foremost, is my top level. Use case was to include Fresca.

B

But there's but there's different viewpoints. So let me give you an example. So that's Fresco is the techton Viewpoint. So that's your workflow runtime. So it has a view. It has this attization. It only has a certain view. It knows what comes into the pipeline and what perhaps, what was produced by task in the pipeline, but it doesn't know what goes before, and this is the same problem. Salsa with you know, salsa Source stuff. So so, in terms of you know, IBM, you know our tecton. Our Fresca runs on something called tool.

B

Chains and Tool chains runs on different hardware and software environments. It runs on Z OS and it runs on different Power environments. It can and it runs on bare metal and it also use instead of using ephemeral, Keys like like Spire keys, that Fresca uses it uses Hardware keys or KMS keys. If you use a cloud provider, so you have, you need to be able to capture things that are outside the scope of tecton and you can do those things as well in terms of a general workflow.

C

A

Anyone have any questions for Matt. That was a lot to take in I. Think it'll be a couple days before I have any questions. Yeah.

B

But you know you know it's, but you know I'm. At the same point, I mean if you're aware I mean I created an s-bomb utility which I support, validating spdx and Cyclone, both as well as doing I added some diff capabilities and some other things. Vulnerability, capabilities and I do a lot more other things and I wasn't creating an s-bomb. So I, a couple months ago, I decided to grab I. Think uh our Snick friend was mentioning the one I grabbed for golang. It was a.

B

It was a plug-in I created a GitHub action, I'm, generating some very basic. You know: Cyclone gxs bombs for my own utility, but they're I mean they're still very rudimentary. You know it it in terms of tooling, it's all about making sure the tools um operate together. You know the all the tools operate in in tandem, so you can't just create a one utility rule them all for all languages. You know, even in the old days and going forward, you'll have different types of bombs, build bombs and M bombs.

B

Whatever types of bombs, you might have that the tools all have to understand how they work. In a tool chain together against the same data set, and the most important thing like I said, is this framework? If I have data, that's coming in from different views from different tools, I need to know where to put my data in context right and that's why this formulation and build bomb stuff is really important.

A

All right anything else from anybody for Matt all right. We don't have enough time to cover anything else, so how about we all bail and and do something for 10 minutes before your next meeting?

A

Thank you, everyone for presenting today. This was like an amazing fire hose of information and I truly appreciate it. Yeah great information from everyone, yep yep until next time,.

H

E