►
From YouTube: SLSA Tooling Meeting (November 22, 2022)
Description
Meeting notes: https://docs.google.com/document/d/15Xp8-0Ff_BPg_LMKr1RIKtwAavXGdrgb1BoX4Cl2bE4/edit#heading=h.yfiy9b23vayj
B
A
A
A
C
C
A
You
gotta
love
these
holiday
weeks,
I'm,
actually
I
might
I'm
kind
of
excited
for
today,
because
we're
gonna
work
on
the
document
and
well
at
least
that's
my
plan.
Unless
someone
has
a
better
idea
but
cool
cool
cool
and
then
crime
figure
out
what
like
only
one
I,
think
one
more
of
these,
maybe
before
Christmas
time,
the
sixth,
oh
on
the
20th.
A
Okay,
all
right
all
right
that
works
anyway,
anyway,
all
right
so
where's,
my
tab,
everyone
sign
in
and
then
so.
I
put
an
agenda
together
for
espanol
here,
I'm
just
going
to
show
my
screen,
which
I
think
will
make
life
easier
for
everybody.
I
put
an
agenda
together
for
s-bomb
everywhere.
There's
the
please
introduce
yourself
in
the
chat
which
I'm
going
to
unshare
to
go
copy.
My
introduction,
which
is.
A
All
right,
I'm
struggling
to
copy
and
paste.
Today
there
we
go
all
right.
Here's
my
intro!
If
everyone
could
do
something
similar
that
would
be
appreciated.
It
saves
us
the
trouble
of
asking
new
people
to
embarrassingly
talk
for
an
unknown
amount
of
time.
All
right,
intros,
I,
don't
have
a
topic
for
today.
Let
me
put
my
screen
again:
sorry:
I,
don't
have
a
specific
topic
for
today,
which
is
why
I
put
in
this
document
make
it
like
a
working
session.
A
All
right,
I
assume
not
so
this
document
is
something
Brandon.
Lum
is
I,
guess,
sort
of
the
owner
of
I.
Don't
think
Brandon's
here
right
now,
but
so
that's
fine.
So
that
document
is
where
we
took
the
the
old
definition
of
s-bomb.
Everywhere
it
was
stream.
Nine
back
in
the
day,
I
don't
know
David
our.
E
A
And
after
talking
with
a
number
of
people
over
the
last
couple
months
about
everything
going
on
and
and
this
even
it
came
up
in
a
governing
board
meeting
at
one
point
is
like
it
is
very
hard
to
get
this
group
of
people
to
do
a
lot
of
work.
We're
very
busy
and
I
think
expecting
us
to
like
write
a
lot
of
documentation
or
work
on
tools
or
whatever,
isn't
necessarily
the
best
use
of
time
and
additionally,
I
think
there's
a
lot
of
other
work
happening
in
this
space
that
that
that's.
A
If
you
are
Kate,
oh
I
see
her
hi
Kate
Kate
basically
pointed
out
like
this.
This
Library
needs
help
and
she
had
a
contractor
like
ready
to
go.
All
they
needed
was
a
check
and
they
could
start
fixing
this
and
that's
what
we
did
and
it
was
very
successful
and
like
it,
it's
we're
doing
what
we
need
to
do
and
I
think
that's
an
example
of
where
I
think
this
group,
as
part
of
the
open
ssf,
could
have
the
most
compelling
impact.
A
Is
kind
of
funding
some
of
these
initiatives
and
helping
them
get
the
right
attention
versus
necessarily
trying
to
do
it
so
I
think
it's
no
secret.
If
we
came
to
this
group
and
said,
hey
everyone
we're
going
to
go
fix
the
python
spdx
Library,
it
would
look
exactly
today
the
way
it
did
like
three
months
ago,
because
no
one
would
do
it
and
I
get
that,
because
some
of
this
work
is
not
exciting
and
it
is
not
interesting,
but
it's
very
very
important.
It
has
to
be
done.
A
It's
like
the
comparison
I
like
to
use
when
I
talk
to
people.
Someone
makes
plumbing
fittings
like
there
is
a
designer
making
plumbing
fittings.
That
sounds
very
boring
to
most
of
us,
but
it
is
literally
the
foundation
of
modern
society.
If
we
didn't
have
those
people,
it
wouldn't
work,
and
sometimes
you
just
need
someone
to
you
know,
maybe
get
paid
to
do
a
thing
that
no
one
else
wants
to
do,
because
we
need
it.
But
I
I
want
to
just
jump
in
I'm.
Gonna
I'm
gonna
probably
talk
too
much.
E
E
You
know
how
what
kind
of
effort
that'll
take
and
then
you
know,
and
ideally
who's
going
to
do
that
and
then
bringing
it
up
to
the
attack
and
governing
board
Josh
I
know
you
already
understand
this
well,
but
for
those
of
you
who
don't
in
the
end,
the
governing
board
decides
where
funding
goes,
but
they
always
the
first
thing.
They're
going
to
do
always
is
ask
the
tax
okay.
What
do
you
think
so?
E
Basically,
you
know
embedded
in
various
tools
so
that
it's
as
much
as
possible,
it's
as
easy
as
possible
to
generate,
and
then
once
we
have
more
s-bombs
generated
tools
to
process
it.
On
the
other
end
being
fully
aware,
there's
a
chicken
and
egg
problem
until
there's
a
lot
of
s-bombs,
not
many
people
are
going
to
be
interested
in
processing
s-bombs
and
if
nobody
process
s-bombs
nobody's
want
to
generate
any
I
mean
this
is
the
this.
E
B
B
D
A
Our
grand
plan
in
this
space,
I
guess
is
there
is
I'm
gonna
I'm
gonna
show
the
landscape
again.
Everyone
probably
sticking
me
showing
this
who's
been
here,
but
one
of
the
proposals
Kate
and
I
started
working.
I
actually
haven't
touched
it
in
like
two
weeks,
but
the
cncf
has
this
thing.
They
call
the
landscape,
which
is
where
they
like
kind
of
categorize
all
this
stuff,
and
so
you
can
imagine
taking
a
list
similar
to
yours
and
building
one
of
these
for
s-bombs.
A
That's
something
we
want
to
do,
but
we
we
actually
need
money
to
do
it,
because
that's
why
we're
writing
a
proposal,
because,
basically
we
need
to
take
this
from
the
cncf
on
cncfi.
It
turn
it
into
something
for
s-bomb
everywhere.
The
the
open
ssf
actually
has
their
own
landscape,
but
we
are
not
using
that
on
purpose
and
everyone
involved
in
that
understands.
A
Why
but
basically
build
take,
do
something
just
like
your
list,
but
in
a
format
like
this
and
then
everything
is
driven
on
the
back
end
in
well
in
one
gargantuan
yaml
file,
which
is
another
topic
but
and
and
ideally
then
we
can
also
work
with
groups
like
sisa
and
spdx
and
Cyclone
DX
and
whoever
to
incorporate
all
of
their
working
groups
all
of
their
tooling
all
of
their
formats,
all
their
everything,
because
there's
so
much
going
on
in
the
space
and
I'm
sure
writing
this.
You
learned
tons
of
stuff.
A
B
This
is
great
I
I'm,
not
taking
one
of
this
yeah
I'd
like
to
also
add
some
autocadical
rise,
so
that
it's
easier
to
search.
It's
it's
the
initial
version
but
I'd
like
to
add
some
search
options.
For
example,
you
look
for
tools
that
generate
specific
format
or
Etc
that
are
build
time
or
or
from
source
and
so
on.
So
it's
on
the
list
to
add
something
like
that
and
yeah
I
hope
this
would
also
help
to
export
some
landscape.
B
Currently,
it's
not
that
smart
of
taking
everything
for
yeah,
it's
it's
manually
done
by
research
and
it
needs
follow-up
research
and
especially
the
summary.
It
contains
some
things
that
you
learn
when
you
try
out
the
tools,
because
not
everything
is
that
well
documented,
but
yeah
I
hope
it's
helpful.
B
D
B
E
D
A
E
E
A
E
Be
easier
if
we
can
get
integrated
into
tools
by
default
and
I
get
that
that
was
in
the
mobilization
plan,
but
I
think
that
there's
been
again
again,
it's
a
chicken
and
egg
problem.
A
lot
of
these
tools
don't
want
to
integrate
all
this
extra
excess
functionality.
Why
would
we
want
to
do
that?
Yada
yada?
Maybe
because.
A
So
yeah
that's
anyway,
not
today
not
today,
that'll
come
and
that's
good,
because
when
we
have
those
problems
it
means
we're
being
successful,
so
I'm
comfortable
with
that
all
right,
so
so
I'm
going
to
replace
this
document
for
anyone
who
might
have
joined
after
the
last
paced
I
wish
Zoom
kept
the
the
chat
log
for
everybody.
That
would
be
quite
handy.
A
F
F
Yeah,
no,
it's
yes
bomb
types!
There's
been,
you
know,
blog
back
and
forth,
discussion
in
that
spread
in
the
in
those
slides
initially,
and
now
it's
moved
over
yeah.
That
was
great,
so
here
just
a
second
putting
the
link
in
the
chat
and
I'm
about
to
squeegee
chair
too.
So
if
you
can
see
it
but
would
like
to
make
sure
that
we
keep
both
groups
nicely
lined
up
and
that
we
end
up
with
a
set
of
definitions,
because
this
will
be
useful
for
categorization,
eventually
too.
F
Okay
and
here
so
this,
this
document
will
be
published
under
csis
fospices,
as
we
had
had
talked
about
in
the
past.
But
obviously
this
group
has
live
had
a
lot
of
input.
We
seem
to
have
teamed
up
with
pretty
much
six
basic
types
of
s-bombs
at
this
point
now
and
we
have
a
and
we
have
definitions
as
well
as
roughly
a
description
of
the
type
of
data.
That's
going
in
found
that
useful
for
clarifying
what
it's
about.
F
The
other
thing
with
the
other
work
that
happened
in
that
group
and
that
some
of
the
people
here
participated
in
as
well
is
discussion
about
the
benefit
of
limitations.
Of
each
of
these
types
of
s-bombs
are
to
a
large
extent.
People
are
Focus,
have
been
focusing
mostly
on
the
build
and
the
source
up
till
now,
and
the
analyzed
I'd
say
is
the
third
one,
where
you're,
given
a
black
box
and
you're,
trying
to
figure
out
what
you
can
about
it.
F
F
You
know
in
terms
of
talking
about
types
and
hopefully
any
of
the
work
that
we
come
up
with
for
these
categorizations
and
work
like
Ivan
is
going
after
can
start
to
use
these
s-bomb
types
to
help.
People
understand
what
you're
working
with
so
in
terms
of
a
readout.
The
ask
is,
you
know,
I,
think
we're
trying
to
get
this
closed
in
the
next
week
or
so
on.
F
The
cesa
side
and
like
I,
say
that
Thursday
meeting
will
probably
see
it
closed,
so
just
want
to
make
sure
people
have
a
chance
to
put
their
eyes
on
it
and
put
any
concerns
that
they
have
in
there
and
see
if
we
can
get
it
closed
and
if
you've
got
concern.
I'd
encourage
you
to
come
to
that
Thursday
meeting
and
you
know
make
sure
that
it's
addressed
if
it
doesn't
get
addressed
asynchronously
here
from
your
perspective,
but
then
I
think
we
can
clear.
F
C
C
If
it
does
not
happen
by
the
end
of
2022,
we
certainly
are
optimistic.
It
could
be
out
right
at
the
the
beginning
of
in
January,
but
it
will.
We
don't
meet
this
week
for
the
tooling
meeting
just
because
it
falls
on
the
Thanksgiving
holiday,
but
we
do
hope
to
finalize
this,
perhaps
the
following
week.
If
we
have
to
go
one
more
week,
we
will
and
then
there's
about
a
two
week,
14
day
turnaround
with
getting
it
through.
C
E
Quick
quick
question:
I
I,
know
early
on
early
versions
of
this
there's
a
lot
of
discussion,
I
think
some
contention.
Heck
I
was
part
of
that
myself,
but
I,
at
least
in
the
meetings
that
I've
been
attending,
which
were
not
absolutely
all
of
them.
I
got
the
impression
that
early
on
lots
of
debate
lots
of
discussions,
but
productive,
just
you
know
different
points
of
view,
but
it
seems,
like
everything,
has
kind
of
coalesced
into
General
acceptance
from
the
places
I've
seen.
F
F
So
these
different
perspectives
as
they
come
in,
are
helping
to
influence
the
overall
definitions,
but
the
the
six
basic
types
seem
to
be
gelling
and
the
distinction
between
what's
deployed
and
what's
runtime
seems
to
have
been
clarified.
But
part
of
this
has
been
this
exercise
of
trying
to
make
sure
we
get
everyone's
views
weighed
in
and
make
sure
that
they
can
live
with
these
types
of
definitions,
so
I
think
we're
close
I'm,
not
encouraging
people
to
widely
diverge
at
this
point
in
time
to
put
it
loudly.
E
A
And
Justin
I
have
a
procedural
question
just
from
kind
of
a
government
perspective,
so
sisa
is
going
to
publish
this
list
of
definitions
and
then
what
is
the
expectation
like
with
nist,
because
I
know,
nist
has
been
releasing
some
various
guidance
around
s-bomb.
Do
they
refer
to
the
assistant
guidance,
or
will
they
pull
this
in
as
part
of
their
like
lexicon
of
definitions
and
terms.
C
Great
question,
our
our
hope
we
should
change
is
that
our
friends
in
Gaithersburg
will
will
pull
this
in.
They
will
be
aware
of
its
existence
and
we
can.
We
can
lead
the
the
horse
to
water
right
and
and
hopefully
they'll
drink,
but
we'll
we
will
do
our
best
to
help
that
government
coordination
is
as
good
as
it's
our
our
coordination
with
all
of
you
have
been
so,
hopefully
that's
a
nice
satisfactory
government
answer
for
you
yeah,
it's
a
pretty
normal
one.
F
C
D
C
Friends
who
are
involved
with
the
MVD
we,
we
were
in
an
on-site
meeting
a
couple
weeks
back
and
we
had
short
discussions
about
about
these
those
efforts,
because
I
actually
sat
in
on
this
meeting
a
couple.
It
was
a
couple
weeks
back
and
we
were
in
Pensacola
for
that.
So,
yes,
they
are
aware
of
the
effort,
so
it
won't
be
won't
be.
D
A
F
F
The
other
thing
just
to
give
you
guys
a
quick
update
is
the
tooling
2.3
and
2.2
of
the
Python
tooling,
should
all
now
be
working
refactoring.
These
in
progress
has
started
and
is
working
probably
will
be
finishing
off
in
the
next
couple
weeks.
So,
but
if
anyone
is
wanting
to
use
the
python
tooling,
now
is
a
really
good
chance
to
go
and
make
see
if
you
can
work
with
it
and
let
people
know
if
there's
any
issues.
G
H
A
A
We
want
to
redefine
the
goals
and
purpose
to
be
more
focused
on
empowering
external
entities,
be
it
through
connections
or
or
funding
or
or
whatever,
and
so
I
want
us
to
go
through
this
for
the
next.
What
do
we
have?
We
have
like
25
minutes-ish
and
just
if
anyone
has
comments,
you
can
just
add
them
straight
to
the
dock.
You
can
just
jump
in
and
say
something
and
zoom.
It's
I,
don't
I,
don't
have
a
great
way
to
do
this.
A
I
know
these
kind
of
working
sessions
are
always
a
a
bit
rough,
sometimes
I'll
resume,
but
I
I
feel
like
I
I
feel
like
this
is
important
and
I
think
it
is
an
easy
way
to
help
gain
some
quick
consensus
versus
asking
everyone
to
kind
of
do
it
off
on
their
own,
because
I
know
we're
all
very
busy.
So
we'll
start
with
the
overview,
I
read
this
earlier
and
I.
Don't
have
any
huge
comments
on
this
overview.
I
think
it's
acceptable
for
the
moment.
A
So
this
is
where
we
start
here,
and
this
goes
back
to
what
David
was
saying
so
there's
the
adoption
and
the
consumption
of
s-bomb
at
all
levels,
and
actually
this
Source
build
deploy.
Now
we
can
refer
to
sister
document
which
will
exist
soon
right.
The
goal
of
the
F
stream,
identify
methods
and
processes
to
leverage
s-bomb
data
across
the
router
I
mean
this
is
word
salad,
I,
don't
know
what
this
this
doesn't
really
mean.
Anything
I'm
just
going
to
comment
on
that
that,
like
like,
is
that
really
part
of
the
scope?
A
A
This
for
the
moment,
I'm
just
gonna
put
it
on
strikethrough.
Does
anyone
have
any
comments
on
like
the
scope
right?
It
says:
securing
the
open
source
ecosystem,
which
I
don't
think
anyone
will
argue
with
that?
Is
it
require
making
doctor
consumption
of
s-fom
data
easy
at
all
levels
like
that
feels
like
the
scope?
Is
the
open
source
ecosystem?
I?
Don't
think
anyone
do
do?
We
have
art
comments,
questions
does
that
make
sense.
I'll.
A
E
H
E
C
E
G
A
Know
what
we
should
add
it
just
to
help
clarify
because
I
think
so
one
of
the
things
that
has
become
very
apparent
to
me
over
the
last
couple
weeks.
Well,
this
comes
up
a
lot.
Is
we
live
in
this
world
that
other
people
don't,
and
so
we
take
things
like
distribution
for
granted
when
we
read
consumption,
that
I
think
the
the
non-supply
chain
nerds
even
grasp
at
this
point,
so
I
think
we
should
be
overly
explicit
when
we
describe.
E
A
A
E
A
E
Yeah
I
I
again,
but
it
sounds
like
you're
actually
making
my
case.
I
would
kill
the
maintainers
there,
because
that's
that
you
know
the
goal.
Is
producers
Distributors
consumers
now,
if
you're
talking
about
maintainers
of
an
open
source
project,
absolutely
but
I,
think
that's!
You
know
collaboration
between
everybody,
and
that
includes
you
know
enabling
yeah,
I
guess
I
would
say
this
includes
enabling
open
source
software
or
helping
open
source
software
maintainers
implement
this.
A
No,
you
know
what
David
I
think
you're
right
I
think
we
should
leave
it
with
producers,
Distributors
and
consumers,
and
we
we
don't
even
need
to
do
it
down
there
in
that
sentence,
but
we
can
Define
some
of
this
more
in
depth
elsewhere.
Okay,
because
the
word
producer
can
mean
probably
any
one
of
ten
groups.
A
E
D
A
A
I
I
E
E
D
I
A
Right
because
we'll
get
to
that
already
done
yeah
so
I
want
to
I
want
to
keep
us
on
on
Focus
here.
So
we
are
going
to
identify
common
barriers,
but
I
don't
know
about
production
and
consumption
of
s-bomb
data
is
that
I
I
think
it's
more
than
just
production
and
consumption.
It's
it's
all
s-bomb
kind
of
everything,
yeah.
A
F
G
Okay,
I've
got
a
commentary
and
I
think
you've
disappeared,
but
he
said
have
we
identified
the
use
cases
and
it
needs
to
be
used
on
the
consumption
side
as
well
as
from
the
generation
side,
because
I
think
we
can
all
say
it
from
the
generation.
Sideways
are
good,
but
have
the
consumers
understood
why?
What
we're
going
to
do
with
it?
Why?
Why
do
they
need?
It?
Is
the
information
useful.
A
I
think
we
understand
the
intent,
it'll
be
okay,
so
so
someone
just
brought
the
UK's
use
cases,
I,
don't
I,
don't
know
who
was
speaking
when
they
said
that
I
believe
in
Kate.
You
can
correct
me
on
this,
but
at
least
the
ntia
started
down
this
I.
Don't
know
if
Sissa
has
picked
it
up
yet,
but
I
don't
think
this
group
should
create
the
use
cases.
I
think
we
need
someone
like
sisa
doing
that
particular
group,
but
again
effort.
But
again,
that's
I
think
where
we
can
hopefully
Empower
others
to
work
on
this.
A
E
G
E
G
You
need
an
answer
for
don't
you
need?
The
architecture
seems
to
be
there
looking
at
software
architecturally
in
implementation,
which
I
can
understand.
Why,
but
have
we
not
got
an
overall
Enterprise
architecture
of
like
yes,
bomb
business
model,
whatever
you
want
to
call
it?
How
it
all
works,
how
all
the
different
players
contribute.
I
Yeah
I
think
this
is
my
my
Eddie
right.
You
know
the
you
know:
I
keep
picturing,
you
know
about.
You
know
from
everybody
involved,
you
know
and
they're
in
show
where
individual
organization
and
a
consumer
and
and
and
I
think
that's
sort
of
I
I,
don't
think
anybody
has
has
whiteboarded
out.
You
know
what
what
all
this
looks
like
from
all
the
component
pieces.
Yeah.
E
A
A
H
And
David
I
wouldn't
want
to
overemphasize
the
funding
side
of
it
because
there's
some
projects
that
might
simply
benefit
from
us,
highlighting
their
existence
and
advocating
for
others
to
join
them
and
and
finding
you
know
if
people
pop
up
and
say,
hey
I've
got
a
few
devs.
We
we,
you
know.
Yes,
bombs
are
important,
so
I
think
I.
Think
I,
don't
think
fun
should
be
the
central
verb,
yeah
I,
agree,
I,
agree.
I
Well,
I
think
that
you
know
to
your
point:
David
I.
If
there's
no
point
in
implementing
anything,
if
you
don't
have
an
architecture
and
it's
just
but
it's
so
it's
chicken
chickens
and
eggs.
But
you
know
in
the
topic,
we're
you
know:
s-bomb
everywhere
we
should
be
able
to
answer
the
question
about
ask
Mom
to
anyone.
You
know:
hey
I'm
XYZ,
what
do
I?
What
does
this
matter
to
me
and
that's
where
I
think?
Whatever
the
word
is
your
architecture?
Network
diagram?
I
You
know
you
know
we
you
look
at
so
many
things
we're
talking
about
not
just
in
this
group,
but
you
know
this
definition
like
okay,
you
know
sure
we
have.
You
know
you
know
types
of
ass
bombs,
but
they
use.
You
know
producers
and
consumers,
it's
more
than
that.
It's
a
lot
more
than
that.
But,
right
now
everybody
is
just
like
look
I'm
producing
or
consuming.
That's
enough,
I
can't
think
about
any
more
than
that.
I
think
somebody
needs
to
stand
up.
You
know
stand
aside
and
say
all
right.
I
I
A
I
I
A
But
now
I
think
the
word
Foster
encompasses
that
because
I
think,
as
we
kind
of
nurture
and
Foster
the
s-bomb
ecosystem
in
whatever
way,
that
is
be
it
funding
or
highlighting
things
or
just
making
sure
the
right
two
people
are
talking
at
the
conference
or
whatever
I
think
what
you're
describing
will
be
the
natural
outcome
of
doing
the
right
thing,
or
at
least
I
hope
it
is
I,
think
so
all
right
I'm
going
to
write
the
word
Foster
down
because
I
really
like
it
I'm
not
in
edit.
Let's
do
suggest
me
over
there
all.
A
I
think
they're
in
charge
of
adoption.
Kate
I
don't
view
this
group
as
as
trying
to
do
any.
If
someone
else
is
doing
anything,
we
connect
them
to
the
rest
of
the
ecosystem.
That's
the
way,
I
see
this
I.
Don't
think
this
group
should
do
anything
that
anyone
else
is
trying
to
do,
but
rather
we
exist
to
empower
them.
G
G
A
A
A
A
A
B
A
Don't
know
what
to
call
it.
That's
ironic
in
in
for
for
the
normal
people,
I
think
part
of
the
intent
of
this
audience
is
we
have
to
speak
to
our
own
group
as
well
as
someone
who
might
be
coming
in
and
saying
I
just
heard
about
s-bombs.
What
do
I
do
and
I
think
if
s
bomb
everywhere
is
where
they
stop
first,
it
would
be
very
valuable
to
them
at
least
that
that's
what
I
would
like
to
see
and
then
yeah
I
guess
Wordsmith.
It
help
help
identify
some
of
these
themes
and
ideas.