►
From YouTube: SLSA Positioning Meeting (January 24, 2023)
Description
Meeting notes: https://docs.google.com/document/d/1tpPOXVzNSwtpWA7cXhTPLAO6HIP50obUvoP85XqgVHM/edit#heading=h.yfiy9b23vayj
SLSA repo: https://github.com/slsa-framework/slsa
A
A
B
A
C
C
C
C
C
A
A
So
there's
this
blog
and
I'll
put
it
here.
I
forgot
to
mention
it
last
week
and
so
I
put
at
the
end
of
the
notes
that
they're
trying
to
release
this
blog
on
salsa
and
in
Toto
and
what
it
means
Etc.
So
if,
if
folks
are
able
to
no
in
a
review
that
that
would
be
great
to
get
a
different
set
of
eyes,
because
the
majority
of
the
folks
that
have
reviewed
I
believe
are
from
the
in
Toto
community.
Okay,
I,
don't
recall,
yeah.
D
A
If,
if
possible,
I
think
it's
a
a
great
blog
I
think
the
only
big
concern
I
had
was
around
the
predicates
under
development
section,
because
this
blog
read
as
though
they
are
trying
to
advocate
for
software
supply
chain
attribute
integrity
versus
it
just
being
a
just
a
bullet
item.
So
it's
it
seemed
more
like
salsa
and
software
supply
chain
attribute
Integrity,
not
in
Toto
and
salsa.
So
that
was
my
my
biggest
feedback
for
them.
A
B
A
Right
so
we
need
to
finish
the
the
abstracts
today.
That
was
our
our
goal.
So
let
me
put
this
here
right
final
review
by
131..
So
if
we
can
kind
of
succinctly
say
you
know,
this
is
the
abstract,
for
this
particular
talk
or
you
know,
lab
or
whatnot,
then
we
can
start
communicating
that
to
the
old,
so
the
other
salsa
leads
to
see
what
they
think.
Now.
One
thing
I
don't
have
on
here,
because
I
had
assumed
that
market
and
and
Joshua
were
working
on.
A
A
B
A
A
A
A
A
C
B
A
B
A
D
A
C
D
C
B
A
D
That
last
one,
the
planning
and
transition
from
B1
to
1.0
I
think
that
went
to
the
provide
more
that
that
one
that
one
could
present
more
questions
and
answers
man,
because
because
I
mean
the
the
routes
taken
open
as
it
is
close
the
conversation
that
might
be
happening,
that
we
don't
get
the
chance
to
hear
right
along
with
all
the
stuff,
that's
happening
in
the
open
and
the
only
reason
why
I
say
that
is
because
I
mean
you
have.
You
went
from
just
the
build
Source
without
a
provenance.
D
A
What
do
they
do?
Okay,
okay,
yeah,
so
good
point
introduce
a
cannibals
but
I
think
it's
an
important
topic
right
to
touch
at
least
one
time
in
in
one
of
these
talks
right,
because
people
are
going
to
want
to
know
like
okay
should
I
start
with
version
dot,
one
and
then
transition
to
one
or,
if
I'm,
already
on
version,
one
or
I
think
I'm
on
version.1
right.
A
A
B
B
A
B
C
A
B
D
A
B
A
A
A
D
A
B
D
D
D
B
D
C
A
D
A
A
A
D
B
D
A
A
This
one
all
about
the
Baseline
it
talks
about
several
of
you
know,
missed
Frameworks
right,
that's
also
kind
of
helps,
Maps,
too,
and
and
and
how
the
different
levels
are
supposed
to
map
to
those
different
framework.
So
yeah
the
new
Cybertron
was
out
so
we
could
use
some
of
this.
It
probably
needs
some
updating,
but
we
could
use
this
blog
as
a
an
example.
We
also
have-
or
is
it
there's
a
spreadsheet
in
here.
D
Yeah
I
think
I
think
that's
something
that
we
really
do
need
to
iron
out
I
I,
because
of
because
when
we
do
these
talks
and
and
and
all
that
kind
of
stuff
like
that,
we
get
up
there.
Talking
about
the
secure
I
have
I
have
issue
with
a
mature
new
model
of
any
sort
calling
itself
a
security
framework.
C
D
Because
when
you
have
level
one
right,
if
you,
if
you
say
we're
salsa
level,
one
okay,
well
what
so
so
in
the
maturity
model,
you
have
a
defined
I'm,
just
taking
I'm
just
going
by
the
the
capability
maturity
model
right
where
you
you
have
one
through
five,
and
you
know
your
three
is
a
defined
and-
and
you
you
know,
four
is
managed.
Five
optimal
right
does
because
you're.
So
if
you
are
defined
in
most
organizations,
you
met
the
standard
right
to
have
a
defined
anything.
D
C
D
That
means
to
cure
yeah
right.
That
just
means
you've
met
criteria,
paperwork,
people,
process
and
procedure.
You
met
the
criteria
for
that
level,
which
is
what
we're
saying
with
salsa.
You
can
meet
level
one
two
and
three
level.
Four
is
still
right:
they
move
level
four
up
to
table
hell,
move
level,
four
off
the
table,
busted
out
these
these
other
instances,
but
there's
still
a
maturity
model
element
tool
which
I
still
think
is
great
I.
Think
a
compliance
requirement,
I
think
a
maturity
month.
D
I
think
that's
excellent
because
it
allows
it
to
be
Universal
across
all
of
these
other
security
Frameworks.
You
could
take
these
other
security.
Frameworks
apply
the
controls
there
in
and
applying
those
controls
will
help
you
meet
respective
salsa
levels,
agree
yeah,
but
to
say
that
salsa
is
a
security
framework.
D
D
D
B
D
A
D
A
C
A
C
A
A
A
A
A
C
A
D
Pretty
I'm
pretty
sure
that
that
this
is
that
that
this
deals
with
supply
chain
software
supply
chain
types
of
them,
I'm,
actually
pretty
sure
about
that
in
terms
of
what
exactly
is
covered
in
it,
I
mean
what
look
what
you
mean
help
we
think
about
open
source
right.
800-161
has
literally
like
two
controls
about
open
source.
D
C
C
D
A
C
A
A
Put
ISO
because
I'm
gonna
forget
what
that
means.
I
think
I,
don't
do
that.
Okay,
so
I
think
this
is
a
good
high
level.
You
know
what
what's
also
is:
what's
not
the
benefits
right
mapping
to
we'll
have
to
do
some
research
for
the
actual
presentation
on
which
security
Frameworks
are
relevant
for
this
audience.
B
A
C
C
A
A
Hey
we're
going
to
take
this
code
from
this
repo
sample
and
take
maybe
if
it's
GitHub
action,
something
simple
right
that
we
have
access
to
and
take
it
through
that
Journey
right,
but
everybody
can
actually
do
it
on
their
own.
That's
my
vision!
Yeah
I!
Don't
want
to
I,
don't
want
to
say
that,
but
that's
that
was
our
intent
when.
A
B
A
We
did
want
people
to
actually
bring
their
laptops
and
get
kind
of
acquainted
with
how
this
could
work.
If
it's
GitHub
actions,
fine,
if
it's
something
else,
fine
I,
don't
think
we've
figured
out
the
details
yet
right.
We
still
have
to
figure
out
how
to
do
that,
but
I
think
it
would
be
a
a
good
way
of
getting
people
seeing
how
salsa
could
work.
A
A
D
Well,
no
I
mean
so
open.
This
is
up
is
open
the
sub
day,
but
the
rest
of
it's
just
the
open
source
conference
I
mean.
But
if
this
is
being
presented
during
the
open
Summit,
then
you
know
you
can
you
can
say
open
ssf,
because
that's
where
we're
working
on
all
this
stuff
in
right,
so
it
would,
it
would
be
if
it's
during
the
open
Summit,
it
would
be
good
for
us
to
say
open
SSL
with
everything
that
we're
doing,
because
that's
what
we're
working
on
this
stuff
now.
A
A
A
A
A
A
C
C
C
A
D
D
D
C
B
A
Obviously,
I
I
hate
that
stuff
I
hate
it
I
hate
it
I
hate
it
I
think
it's
just
because
I
didn't
grow
up
with
that
kind
of
palette.
My
palette
is
more
of
a
Caribbean
palette,
it's
very
it's
either
a
little
spicy
or
you
know
Bland,
and
so
that
is
a
very
Wasabi
tasting
like
it's
a
like
I,
don't
know,
I
can't
quite
explain
it's
not
Wasabi,
but
they
like
radish
and
cabbage,
and
it's
just
not
my
my
cup
of
tea.