OpenSSF SIRT Best Practices WG, 5 May 2023

Previous Meeting Next Meeting

⏯

youtube image

►

From YouTube: BEST Working Group’s SCM Guide collaboration (May 4, 2023)

Description

Meeting notes: https://docs.google.com/document/d/1ttqkcYPmYZyqvtkaHs92bx2UeVUiXDhuzP-0WbP11Fw/edit#heading=h.7o2ubzl5z39r

A

A

B

All right, then, how are you doing how.

A

Are you just looking?

A

It's been looks great awesome.

B

A

B

Some fine-tuning because yeah I have different names in GitHub and gitlab, so it's maybe show some duplications.

B

But I was shot on time so we're you know.

A

Okay, yeah yeah I see what you mean, but yeah.

B

Yeah looks like you're in the office for the first time. I think yes,.

A

We have you know they are incentivizing us to try and come in that we have free drinks today. So you know: I'll come anywhere with the drinks.

A

A

Right so let's see if we get the question.

C

All right, oh hello,.

A

B

C

A

I was just chatting with no earlier today and now do you want to share that link that you shared with me.

A

um Make progress on Auto, generating the index files that markdown files and the kind of format that we talked about last time.

A

C

Now, oh, these are auto-generated yeah, oh I'd, just like you to put it together.

A

Yeah, this is really good, because then we can, we can take these files.

A

I don't know if it's uh the links are.

A

A

um Thank you all right, just taking a look at it.

A

No I don't want to Fork I just want to see the rock code.

A

A

Sorry I I mean.

A

um I guess what I'm saying is that the code, the markdown, could just be taken over into the openness repo and you know, basically replace the market that readme.md in the um root directory of the um of the sem guide and then the directory of the GitHub uh and the gitlab directories.

A

um So that way, um the uh we have the basic like format um available, or you know with that that links through to all the different best practices or principles.

A

A

The other thing that is left to do then, is to try and figure out how we incorporate the under material, the introductory material right um and the operational stuff that you that we were working on Christine and.

C

A

Kind of like that's still a lot to do, we could you know um it sounds like templating to me, which is to solved problem which, which, what do we want to do. How do we want to do that, so that we can best.

D

C

A

Out of the legitify data, so that we're not doing a bunch of manual work every time.

A

um Right my thoughts.

C

Yeah that was going to be my next question, because I owe a PR, but now the question is: what form will the pr look like, based on this idea around templating.

A

I think you should probably do the pr.

C

Regardless, whether you're from your readme or.

A

Right now, no because what I want to do is take will mark down the Gnomes generated here and bring it over to the um replace. What's replace some of the material with this basically okay and then uh right, then you can do a PR, but we might end up replacing it all anyway. If we end up doing something more templating.

C

Okay, can we probably talk through the templating I haven't done anything.

A

I was thinking. One way that we could do it is was um for you to take the material that you're going to contribute and put it push it into a separate markdown file in the same directory that is like, um and then we can at the very least. We can then do like a process. We could use um some things. You know an already existing GitHub mechanism to do uh kind of build process for the final document.

A

I Jonathan amishay we're just talking about how to do this in a way where we can generate fragments of markdown pull them into this directory and then do like a build process where we put them together with editorial markdown that will come from us Slash from Christine's document, and so that we end up with something.

A

uh In the readme.md file that is kind of a mix of auto-generated stuff that comes out of gnomes process, um which is going to look a lot like this.

B

I think that right now it's uh so it should be simple, because the auto generator part is just in the middle. It's like yeah, epilogue.

B

um Maybe in the future, if we need to update the specific policy, the information might be more complicated, but I think we can solve it if, if it, if it happens at the end.

C

I was just wondering if that's a true statement.

C

The extra information would just be in the prologue and the end or the beginning and the end it it may or it may not be so.

A

Is it better yeah.

C

Is it better to actually put the content in, even if it's just in a PR that won't be accepted, but just for the purposes of looking at it and seeing what the structure would look like.

A

Yes, I think that's that's best. Let me like I said. Let me update the markdown.

A

That's in that folder right now, with the markdown that amount provided so that we can have at least because right right now, Watson there is a bunch of likes or a bunch of things that don't actually link to things um but uh marked on the noun provided has all the links stripped in, um and so let me do that and then you can do the mark and you can do the pr on top of that and we can take a look at what the result is and um and kind of review it together.

A

Yeah I, thank you. Yeah I mean we're we're not going to have that by next week. I, don't think.

C

No I don't think.

A

uh Maybe if I can, um because I because I'm happy to do that, one, the moving the legitimate moving nums markdown files over into the retail I, can do that right now or today, okay, right, um and so we could end up with something that we can at least take a look out by next week, uh which, uh which you get Which is higher. Which is higher quality than what we have now that could you could then watch it on screen if you're doing a presentation, yeah.

C

Yeah yeah, that's true.

A

A

That sounds like a plan.

A

Do we have other things? Did you receive? Did you want to write these other points.

C

Oh, there was only one other thing and I was looking for the actual blog post, because GitHub had put in something where, at the organization level, you could actually set up rules that might that you'd able to trickle down to each repo in the organization and I was looking for the blog post. But the question I had for Gnome is how legit, if I, was going to incorporate that information. But before I. Just let me look for the link.

D

Right they just announced it.

C

Yeah it's in uh beta.

B

Yes, actually, we did some research on our team in legit notification and because it's data, it has some weird behaviors like in the in the UI. So we don't want at the moment to the.

B

At this policies to notify, because the behavior is not sure you can have rules defined in the in the in their new method- and you can have also all defined in your repository different rules and only the the new branches are applied. So it's a little bit mixed I. Think at.

A

B

So we want to wait until it's more robust before we Implement sorry for the noise.

C

Okay, okay, yeah, and it's it's beta anyway, so.

B

B

But but for sure we will add, We'll, add uh these policies once they are ready.

B

Okay, and by the way we just added some uh a a new namespace and identifier called the Enterprise that uh has some new feature. That applies to all the organizations that the a company had have.

C

Oh I see: okay, that's a new name space beyond repo and organization. You have a one called Enterprise.

B

C

B

B

Alongside the gitlab server policy, I.

D

B

um But we can think about what's what's the right decision.

B

A

B

C

Okay, it's it's on the server where it talks about two-factor, authentication and Enterprise should not allow am I looking at the right tweets, yeah.

B

I know server: all this um Enterprise should not allow members to create public repositories. So now applies to all the organizations and oh okay,.

C

Got it I got it.

B

Just close my window, one sec, you've got another memos.

C

The only the only other thing that I had and I don't know if it probably doesn't fit into this discussion. Maybe scorecards as scorecards we were thinking we wanted to add scorecards into oh yeah. It does so. um The only other discussion or question I had- and it doesn't fit into this discussion is just when you have a lot of repos and are trying to run scorecards.

C

There's all these API limits that can take place, but just some more information related to how to get past or to deal with those GitHub API limits and I'm, not sure I. Don't think it applies to best discussion, but it was it's. It was actually pretty tricky.

B

uh Yeah, so maybe we can take it offline. We have some methods like when the rate limited indication and Etc yeah and for big organization. It might still uh hit the right limits.

C

C

And it wasn't clear whether to kind of go through it with legitify or address it with scorecard. So.

B

uh Yeah, let's, let's take it offline I can okay assist with that. Okay.

A

And all right and I will um I will decent markdown editing right now: okay and I'll. Let people know on the slack uh when I'm done with that? Okay, okay, let's let's close off here unless anybody else has a lot of points. Okay,.

C

B

Yeah I wanted wanted to suggest. Maybe we can like create a long-term, a roadmap so so that we can follow, um maybe like what are the next big steps like for the following uh for the next month Auto? So it will be easier to to to finish the point: learn a project yeah yeah.

A

C

In terms of what we want to do to kind of like round up the document and say it's done.

B

C

Even just like what we think is coming up, but I guess we want to kind of get the the first. The guide done right.

A

Can we focus on getting the proof of concept done, which I think we can do this week? If we or we can get? You know a lot farther heads down right now and then next call we will um focus on planned and also hear the feedback that came from like from any presentations or discussions that happen next week about it.

A

C

I guess on that front it might be a good idea now to ask. Is there any particular Focus that you may want me to bring up in the presentation, or that would help with feedback ahead of the plan.

A

I guess it'd be just nice to hear if people think this is helpful. Slash useful, okay,.

A

And validate our our kind of assumptions.

C

Okay, because I know, one thing that I was probably going to try to see is if we had any people who used git lab and try to especially at the Enterprise level and try to get them to either participate or give more feed. So at least that for me that was one thing.

A

D

Thank you just in terms of their planning I think we also uh agreed to have a shared blog post with this project team right.

C

B

With which team.

D

With a scorecard.

C

D

I think we also discussed potential kind of a development collaboration right around there. Dynamic kind of uh rules set I guess that.

A

They think that's the mediation steps that they're talking about being able to provide and I guess the once we have kind of these things sitting at are the principles sitting at stable URLs. Then.

A

Maybe create a they can create a prototype based on that that sends users to those individual Pages. If we want to get more information about that stuff, that was then then I think then, once we established it, that's how we want to work together. Then then we move towards a blog post. Basically.

A

So I think there are a few different steps there and that is part of the roadmap different. It has to be definitely.

A

Okay, I think we'll close off there and um for those going to Vancouver next week. I wish you well I'm not going to be there, unfortunately, but um I'll be trained to learn as much as I can to be up in a second but anyway, okay.

C

Yeah definitely.

A

All right, yeah I, have lots of protein or whatever they happen. Okay bye.