OpenSSF SIRT Best Practices WG, 7 Jul 2023

Previous Meeting Next Meeting

⏯

youtube image

►

From YouTube: BEST Working Group’s SCM Guide collaboration (June 29, 2023)

Description

Meeting notes: https://docs.google.com/document/d/1ttqkcYPmYZyqvtkaHs92bx2UeVUiXDhuzP-0WbP11Fw/edit#heading=h.7o2ubzl5z39r

A

Okay, so I don't think we have a notes and we don't have a meeting notes section in area. So let me just try and do that. That's what we have to talk about today, but.

B

Whatever it is, we're gonna have minutes.

A

All right, let's see.

C

B

Yeah, it's been a while, since we yeah.

A

A

I can say: there's it's up at the top.

A

And basically put yourself.

C

A

The registry, if you're, if you're here, if you're here yeah.

A

A

B

We could talk about is the the document links being all set up uh for a website that was.

A

B

The items from the previous meeting.

C

Yeah, that's super cool.

C

A

Was auto-generated.

C

Or some someone from this group had to to work on that.

B

It was actually done by David Whaler.

B

After Dan brought it up in the best practices, working group, uh David went off and.

A

B

Really quickly, yeah.

A

I said I said something and then David wheeler did a bunch of stuff and I was like oops.

A

Done so, where is where do we see? What's the I mean I see the where, where is what's the link.

B

Let's start open ssf.org, let me drop it uh okay. This is.

A

Oh yeah, okay and.

A

Sorry I'm just trying to take notes.

A

uh So is the current the way this is set up, then that we it gets re, it gets regenerated.

B

We leave based on what's in the docs folders as as long as I think he answered some uh get a battery or something the cicd set up to do it automatically.

A

C

Okay, so basically.

B

C

Done I think I.

A

B

As as reviewing the previous action items and I know, there's Tooling in there, it looks like normal, whoever added it in there and and then there was something related to that. Putting a PR that I needed to get into I need to go back and figure out. What that was.

B

I was just reviewing our notes from our sixth one June first meeting.

A

B

A

That's the question like: what's left to be done.

B

Oh okay, so I have a few things that I need to add in there related to. If uh project is going from saying of private public or a reap was getting transferred, I just need to add a file, a PR for that so I know that's one thing that seems minor, but that's on the list.

C

I I think one thing we need to add now is that the github's new feature of whole sets Brands protection. All sets that was in beta last time we talked about is now enforced on new repositories.

B

C

On new repositories, if you open a new repo enforced, so I think we need to update the dog to reflect that.

B

Okay, you had said that you had tried it out and it was not predictable. I, don't remember what you said: I don't know if you had a chance to try it out thanks.

C

About a month ago, when we tried out, there were some problems in the API that you might, you could toggle it on the the branch protector in the whole set and off in the normal Branch protection, and you could tell which one is is applied from the API and so I'm, not sure about what what's happening in the API right now. I will check it out, um but I I think, at least in in the document.

C

We need to say something about that, because, right now, if you open here a new repo, you just can't uh create the old style, Branch protection rules.

B

B

A

B

To go and read it yeah.

A

Does that mean a change to the um the material that's generated out of the out of legitifying yeah, okay,.

B

C

I mean basically either way yeah we can edit the markdown as we wish. We wish so I can just add the policies manually or create them from the different.

B

Is the advice, then, is the advice then, for people to work with the rule sets or or what is the advice I mean they have to write for new projects.

C

Yeah um you're asking about like.

B

C

B

Should decide yeah what's yeah? What is the process now? Is it because I can see what I probably have to play around with it, because I make an educated, but I was just wondering what the flow is like, because there's going to be new projects and there's going to be all projects, I'm wondering what is the advice to apply the rules? That's because the new projects are going to take it up are.

C

B

C

Good point, because they can make some confusion in maintaining this uh these roles. And what do you think.

B

I guess I'm, assuming that no people are not going to be able to go in and do things really quickly, so I hope that they had a way to do it gradually.

A

Do you want to come back to the? Do? You want to do a little analysis and come back with a proposal of what needs to change based on that yeah, okay,.

B

Yeah there might be what needs to change from the legitified docs I might also go ahead and try to see what would change for uh from like say uh if you're, an Oscar type of what's the flow going to look like for that might be interesting as well.

A

Okay, the other thing that was, on my mind, taking a look at the generated HTML documents that um David produced is um do we like this are the things that we want to see differently.

A

um It's kind of uh people might get confused about, I mean I. I was the one who suggested the icons. I don't know do people do do we want to get some feedback from developers about? You know what they think about it and then, and then also when you look at the individual Pages like if I go into default, Branch should be protected and I look at the GitHub uh page. It's there's no navigation back to the front page.

A

Do we want to ask David to put something in that says like go back or something like that? I mean? Obviously, we've all got a back button, but you know this is the this? Isn't the 90s.

B

That's a great point: the navigation yeah.

A

B

Think what's the navigation yeah because at least, if you looked at the markdown straight up, you see the navigation on the side and Samsung I believe yeah exactly.

D

So on that front, if I may interject there and I apologize I mean you know, I don't mean to bulging on your meeting. I usually have a conflict. I have been involved in the best working group, but usually I have an ongoing conflict, so I cannot attend. Today, my conflict cleared up so I said: hey I'm, going to call in and see what's up, uh I will I will push uh submit a pull request.

D

I have been adding publication dates on the documents, because once it's when it's in GitHub, if you look through a GitHub repo, you see when the document was revised, but if you see it from the best dot, openss.org website, there's no indication of the date and it's a bit of a pain because there is no mechanism to get this automatically updated.

D

So we are bound to forget to change the date when we update the document, but still better than having no dates. If we didn't forget to change the date, at least it's not going to be completely no dates. Yeah totally.

A

A

So yeah, let's let's, hopefully we can work out a better, more automated way to do it. But at least we can uh for now you're going to add a PR just to add a date onto the onto the document itself.

D

Yeah and in fact, I mean I, we started yesterday and uh it says that it's it was published by the open, ssf best working group. Best practice is working group and it puts the date after it great.

A

Would you it does? It also include a link to the source to the source file in uh on GitHub, actually.

D

It does have that at the very bottom if.

A

You look, oh I, see it has to improved, which.

D

Is not quite the same because it kind of you know puts you in the mode where you trying to edit and send the pull request, which is maybe not you know what everybody wants to do, but.

A

Right right concerning the edit mode: okay, right, okay,.

B

What's the norm because I see sometimes when you go to bottom of certain docs, you see edit this page on GitHub I've seen that so it's very.

D

Clear that when you're clicking on it.

B

You're editing we.

D

Don't put this right, it's the oh! We don't! It's done automatically.

B

I see so awesome.

A

Well, it's done by software, so maybe but.

D

It's not software, that's under our control is done by GitHub.

D

And this is the whole thing about the publication of those documents and the best openssf.org website we've been debating. How to do this and David says? Look there is an easy way. It's super simple. It is limited, but I suggest we just stick to this, which I agreed with because- and we talked about this on the attack yesterday- because there's Alternatives, you can have a whole Jekyll environment and create your own and then we could use mock-up with liquid and stuff and I do that, like in the salsa specification.

D

The whole website salsa.dev is done like this, but it's no small task to maintain this and.

B

D

To distribute documents seems a bit Overkill.

A

Yeah yeah no I take I, take the point well as long as we can get the the other in. But if we're adding other metadata like the date, then maybe it makes sense to add a in in the general in the file and Link back to the to the get you know manually added in a link back to the repo, so that it's so that we also say forecast on GitHub or something like that. You know or I, don't know whatever you're.

D

Saying we could we could have that kind of header.

D

That's what we've been trying to establish is some kind of standard header that we would try to put on all these documents.

A

Yeah, okay, well, I! Guess we'll wait for your PR or not.

D

And then yeah on this one in picture, but if you want to see what it looks like it was done for. Where was it.

D

If you go to the best uh the opennessf.org website for the concise guides, they already have that.

B

D

Link to the repo actually I got that from uh no, it only points to best. Maybe we should change that.

A

I see so it's up at the top up at the top audio source, security, Foundation, best practice, working group and then a date.

B

Oh, what's the link, how do you it's.

A

Just a best startup incept.org, oh.

B

A

To the main one and then there's a link to concise, guide and uh yeah, there's no link to ours thing yet because it because we haven't set its times.

B

I see so buy this and.

D

Then the date, but so you can get to the repo indirectly, if you click on you know where it says best practices working group, you click there due to the home page of the best open, ssf.org website, which then links to the people.

D

Thank you, but it's a choice. Do we link directly to the reboard or we link to the website? I. Think the.

D

Since we are trying to present a more like, you know, maybe interface to the to the group, it seems reasonable to do it the way it's done now.

B

Yeah and I'm, assuming it'll, probably prove in the future, so yeah.

D

Of course, yeah.

B

D

So but yeah I will add the date for this document.

B

D

A

A

So then, I think, where when's, the next um a Wednesday next best practices working group called it's.

B

Not going to be next week because of uh U.S holidays, so it will be two weeks from them.

B

A

I guess if we can so we're going to have another SCM guide call before then? Yes, so we could try and finish up what needs to be finished up by then.

B

A

As well so it's so it's kind of like we're kind of going into a low uh period now, but um but we we then could say to we can we can put ourselves on the agenda for the next best practices. Group call and tell the group that we're done.

A

With version 1.0, whatever.

B

Yeah I agree, and we can always like you ask me about feedback for the icons and all I. Think it's fine as the one. You can always get feedback and do that yeah.

A

B

A

Agree: I agree.

A

Okay sounds good, shall we close off in that.

B

Case sounds good thanks all right. Thank you.

A

Thanks everybody.