OpenSSF SLSA Biweekly, 22 Nov 2022

Previous Meeting Next Meeting

⏯

youtube image

►

From YouTube: SLSA Positioning Meeting (November 22, 2022)

Description

Meeting notes: https://docs.google.com/document/d/1tpPOXVzNSwtpWA7cXhTPLAO6HIP50obUvoP85XqgVHM/edit#heading=h.yfiy9b23vayj
SLSA repo: https://github.com/slsa-framework/slsa

A

Hi jumpsy give me one second I need to connect. My happens.

B

A

Can you hear me.

B

Yeah I can hear yes, okay,.

A

Awesome I can hear you now too. Thank you for joining. Thank.

B

A

um I know today is a working session, so it's it's purely optional and I know it's right before the U.S holidays. So it's possible that you know we might have a very light crowd today.

B

A

B

I'm joining from not from yours, oh.

A

Okay, okay, yeah so uh starting tomorrow, not tomorrow, A lot of times for Thanksgiving week, uh people will take off the whole week or sometimes they'll start dropping as the days progress so either today or tomorrow. Usually people like tomorrow, I'm not working. So okay right, you know, but today I am so. It just depends.

B

A

Yes, correct, correct yeah, so so yeah we, we may not have a lot of folks, but that's okay. um We could still get some work done, which is why I keep some of these sessions yeah, um because uh if I don't have dedicated time to work on this, it's it's probably not going to get done. So at the very least, I can get something done during this one hour session.

A

um So um so I am going to give you so that way you can sign in um if you are able to and then we can go ahead and get started because again, I'm not expecting a lot of people today, but I did want to start.

A

C

Did want to start.

A

Stir or not start, but finish, the um the blog as much as we can um so I, don't I'm starting to get my voice back. I was uh sick. Last week my my my little one got sick and then she got me sick, so um I'm still kind of recuperating. So you'll have to excuse my my raspy voice today.

A

um So, uh for today, um like I mentioned I think you were part of uh not last week's meeting, because my little one got sick, um but the week before we were able to, you know, start doing the the blog and getting it into like a really good position.

A

um Now we just have a couple of things and I know you commented on a couple of things for like prevent yeah. You know instead of uh helps, instead of prevent, helps to prevent so I did some modifications here and there for that, uh uh and let me see what other comments you had in here.

A

This I put build quality. Would that be sufficient? I.

B

Think I have a scene that that changes as well. uh It's it's for me. It looks good. uh So the point what I thought was like you know when we say about salsa quality is actually something different from what salsa provides. If you make it secure, we cannot I mean Quality. Security is also part of that. We can say when we say quality is there. Then security is also in in in line with that or integrated with that, but uh uh it's actually kind of two two terms right yeah.

B

So when we say salsa provides build quality, um so the build quality is also some part coming from the built engine, say the compiler or the the build tool or the machine which we are building so.

B

um And also the build steps, whatever we configure for that. So when we say build, involve multiple stages and to make that our psychology build. uh My my doubt was like whether it's also supported each stage.

A

Oh I understand.

B

Bottle build is fine, but when we say the total bill containing say five to seven steps, among that we are only doing some vulnerability analysis attestation.

B

um We are creating provenance information. This is the only step one among the steps in the build. So when we say the build quality, salsa is not focused on the entire build quality uh yeah. Maybe that that's good yeah.

A

Yeah, let me suggest it because I didn't write this paragraph, so I'm gonna put it like this I'm gonna suggest it and build integrity, quality, build.

C

And maybe build.

A

Integrity instead of quality, yeah.

B

I think that that would better, now yeah correct, okay.

A

Okay uh and I think I missed hi Matt. Thank you for joining. um Are you a new a new person joining us today?

A

Your last name before.

C

Yeah I'm new to the this positioning meeting, but I attended a couple. Other salsa related meetings last week.

A

Okay, well welcome. Welcome, for uh thank you for joining um I was telling jumpsy that I suspect today is going to be a light day for two reasons: one. uh This is a uh uh an optional meeting, it's a working session. So that way we can get stuff done, but then also because of the holidays right um people tend to either have the whole week off or they start dropping off as the day progresses, so um so yeah, it might just be the three of us.

A

There might be other people, but um just uh wanted to give you that heads up, but thank you for joining, and what brings you here today: hey, there's Jay.

C

Yeah so um yeah happy to be here and I've just uh over the last year and a half been moving into the application security space at Dao and uh one of the things that I'm accountable for are making sure that we have the right security requirements um and I've just been looking into cyber threats and saw you know the opportunity to improve security specifically related to the software supply chain.

C

And that led me to salsa, and then I saw that it was um tied to open ssf and um I thought that'd be an opportunity to at least learn a little bit more behind the scenes on where Salsa's at with the vision is and how I can take.

C

um You know what I'm learning and and apply it at Dao.

A

Well, thanks for joining yeah, so for um the positioning meeting um we do have a oh actually, I, don't know if I've ever come, I think I did commit the charter.

A

um There should be a charter for the positioning uh uh Sig, essentially we're trying to evangelize or educate the community on what salsa is, what it isn't um and then, if we see deficiencies or things that could be improved upon, we bring it back to the course also uh Community for specification as an example.

A

um And so what we've been working on is a Blog right now to focus on Developers right and like why they should care about salsa right, how it helps them, um okay, and so that that that's, what we're kind of looking at right now and just trying to finish up that blog and uh the the link is in the meeting uh notes. But I will also put it here. Let me find the chat uh chat.

A

This is where the blog is so feel free to you know peruse through and and this isn't one person thing, it's multiple people that have contributed to this and we're just trying to finalize it. So what John C was talking about was you know this? This wording of build quality, so I just changed it to build Integrity I didn't I, didn't write that paragraph So I'm just going to suggest it for now um assistant Mickey build process.

A

Oh I see this one jumpsuit yeah I'll have to edit that one later um and thanks Jay for joining haven't haven't talked to you in a while.

D

Yeah I wasn't sure what was happening this week being the short one.

A

D

But uh but I guess all work this week is uh is good week I've been limiting. My uh I've been limiting a lot of my uh a lot of my work uh output this week, just because it's a it's a holiday week.

A

D

D

I was gonna, say another big push next week and the week after and then going and going into uh going into Christmas, but I figured uh you finish up a few things uh clear.

A

D

A

Yeah, that's that's my goal for today um and yesterday I'm getting to get stuff done that I never have time to do because nobody's bothering me right. So it's just been a little quieter at work and you know doing some coding which I haven't done in a long time, and so it's it's been a pretty fun. You know 24 hours and you know hoping that we can at least submit something uh as a PR for a Blog I'm hoping right. We've been working on this for a while, and it's like at the very end.

A

So I think uh where, where we need the most help um one is this call to action? It's the like very blah, there's nothing in here, so that definitely needs to be beefed up right like what do we want developers to take away from this? What should they do? Next?

A

um Obviously, there's going to be a part two, hopefully, um but that that is a pretty weak one um and then just trying to firm up the what kinds of problems it can catch.

A

um There was a huge thread with Mark, because I was trying to express, like you know, I I shared this picture with him, and then the downloading dependencies triggered the thought of well. Maybe this isn't something that we've actually talked about yet, and we should and so I need to alter the picture so that it doesn't have the dependencies part or we can try to see if we can get it in the 1.0 specification. I don't know.

A

um So that's something that you know Mark was concerned about with the dependencies, but I was trying to get a handle of you know. What is it preventing right? What is it? Is it catching an error, and so he was kind of going through and explaining it? So I was going to modify this language a little bit to express what he wrote in a different way for for the Developers.

A

um So I don't know if you saw that thread Jay it's on the specification. Let me see and I can I can tag you all. Are you on um an open, ssf, uh slack Channel map yep.

C

A

Okay, is it just.

C

A

Oh okay, I see you Matt uh Jay.

D

A

I stepped away for.

D

A couple of seconds what what was that I was supposed to see.

A

uh Sorry I just sent you uh and and the rest of the books on the call I tagged you in a slack thread.

A

um It went haywire after I it it I was asking about something very specific, and then it went completely sideways to like some other topic, um so uh I'm just trying to focus on this little bit here, um but I did tag you three. So if you wanted to follow the thread you could um so just just in case.

A

um But uh so I'm trying to understand like here, prevent a bad compile for uh you know being submitted because it's not matching Upstream code, one of the things they said well, Sean Lowry said well: what's local versus Upstream, right and Upstream doesn't mean open source Community? Necessarily it's just whatever the build system says hey. You need to go pull code from that's what I'm considering Upstream. Could it be an open source repository? Yes, could it be internal?

A

Yes, yeah, for all intents purposes, is wherever the build system defines that Upstream repo and then for local is anything that's on the user system right, whether it's their laptop, it's a personal desktop. It could heck. It could be a you know: vdi environment, in a cloud somewhere um somewhere where it's not um uh what's the word uh somewhere, where the developers working so I'm, not sure if these are clear enough and if there's any tweaks that you all think I should make to these definitions.

D

A

B

Would say, as long as the definitions.

A

D

Consistent um are consistent across the board right so like like we're using these definitions, but they're also used uh not only in in uh with respect to uh salsa, but respect to the openness and stuff in general.

A

Yeah I put for this blog only because I didn't want to open that.

A

Working on that right.

C

And I don't know how.

A

Long, that's going to take, so that's why I wrote for this blog only. This is what we mean.

A

um Yeah because I I completely agree if we had those definitions- yes, but I, think those are very much in flux and um I I, don't know when we're gonna get those at least preliminary definitions where people are like yeah. We think this is good. It's just a tweaking of a word or two here or there I thought I heard someone else speak.

A

Matt chumsy did you have thoughts on on these two yeah.

B

I think that that particular specific I mean specifically we mentioned about what is Lockland Upstream is will be good. uh We help in Shield readers to understand what exactly.

A

C

I agree with Jay. As long as I mean consistency is probably more important than the definition in some cases.

A

Yeah yeah I think for for this entire Vlog, which is not very big. uh It should be consistent across the board and we'll definitely make sure of that.

B

Diagram so there we have mentioned about a running unit test. So if we are adding running unit test, unit test is a kind of best practices to be part of the build in. In that case, vulnerability check is also part of that uh that build right. So we can add more, like you know, steps in in that build process. So if we are indented only to the core build activity like importing downloading source code downloading dependency and we mood out or add additional steps, also like vulnerability analysis, I mean this is just a thought process.

B

You can also think on.

A

That, okay, yeah, let me um I'm gonna, have to reach out to Jory on editing that that this recording, I I, don't know why that Chrome browser popped up, um I I have access to this, or rather I created this. So that's a good point. um Let me let me edit it and then I'll. Do a new comment.

A

B

Became a unit test or can we add vulnerability, analysis.

A

And yeah we might as well add all the other things too. It's like signing, um yeah, um okay. So for for these, what do you all think about how salsa is defined for the draft level, one and level two right now.

D

I think I I think this I mean I, think I think it's a slippery slope, I I and the reason why I say that is because I I looked at the the uh thread and I've looked at um a couple of the the sites to see what changes have occurred and where we're at now with a lot of those changes in terms of the spec.

D

um We we gotta tread lightly here, because there seems to be changes all the time according to what's feasible, uh right now versus what's still in development, um that will end up resulting in what version one is going to be.

A

D

um If that makes sense, what I'm afraid of from uh from this blog's perspective is we're going to call out something, because so we've already right, we've already found discrepancies right. That we've said that we've um that we've sent back and and and and verbalized to the to the spec team.

A

D

My fear is that they're still hammering that stuff out and when we issue the pr we could be issued in the pr a little premature uh towards them, hammering something out, and we may be highlighting something that might not get uh dare I say we might end up being uh smarter than the fifth grader on this one.

A

Got it so what are your thoughts on right? Obviously, we can't release this until 1.0 gets released right. So what? If we do it? Where we're timing it right, we do submit the pr so that everybody's in agreement and if something changes before it gets published, we would know because it's dependent on right.

D

A

Also 1.0 and so right before it gets published, then there would be a last review, but at the very least we've written most of it up and we're able to to get through it and then, if something does change, then we can do it right after uh 1.0 gets published, yeah.

D

I'm good with that I'm good with that um I also saw in the beginning we referenced guac is that is yeah.

A

I I did do that um because of this chart. um I liked.

B

A

Chart ah I didn't want to reference it because of block per se. It was just because it helps give the user a way of visualizing right, um and this was the only place I could find. It was Google's, blog right um and so I thought this was a really good diagram right. It simplifies things. It helps. It helps the reader digest where salsa is in the grand scheme of things. So that's the only reason why I mention it right here, but we don't discuss it further.

D

Okay, okay, cool.

A

Yeah, um so if there's another picture um that helps uh by all means I'm all ears, I think this was the best one that I found at the time, because I think it was Sean shared it with us like three meetings ago or something like that and I'm like. Oh that's, a really good good uh diagram.

A

um Any other questions or concerns about that one.

A

A

This so for um Matt may not, uh since he wasn't part of these meetings before so. This is what problems it can catch right so at a high level helping to prevent misconfiguration local modifications and data processing errors. Somebody also said reduce time to release debug and determine root cause and then improve transparency in building a secure software supply chain.

A

So this one I don't remember who mentioned it? It could have been Laura. It could have been somebody else right talk to the developer, about reducing their time at work right. Do they have to stay late at work um if their code gets, you know not approved right before production push that's going to cause them to stay later right, and so it reduces that risk of that happening and them having this day later so I, don't know quite how to word this.

A

um So this is another area that I think I need help on to try to get into that mindset of. You really want to sell this as a if you want to reduce your time at work, kind of thing, yeah.

D

I'm curious to uh I'm curious to how to to how that parallel was drawn. Given the current um during the current levels, at um at one and two levels, one and two I'm curious to see how.

A

They did there yeah I, think the I'd have to go back to the recordings, but I think it's it's related to this right.

A

If you put something in the build that you're not supposed to and it gets caught right before production right, it's gonna delay everything same thing for vulnerability if they find a vulnerability or a package that wasn't approved for a legal review or for use blah blah blah, it's gonna get right. So these were the reasons right, gating near production, security issues, security design against policy. So there could be something that you're doing it they're like no way we would never. We would never do this.

D

B

Can add one point uh Jay here um I remember on that discussion. uh He was actually particularly telling about the security team's approval before the release. uh It's not the general approval. I think it's a security team's approval, so usually just do it for production, we'll be waiting for the security team, but if we put this Salsas into or the or the pipeline, so this attestation will have happened in advance or in an automated way, uh so that then we don't need that uh manual approval that may help to speed up our release.

D

Okay, I see where you're going so so this, so this would be odd up. This would be so that so that needs to be mentioned right. The automated nature of this needs to be mentioned right so tooling requires.

C

D

I think for the purpose of the blog and and so just for transparency. If we're going to say that we need to mention the tools that would be used for you if those if they exist.

B

Yeah we can see at least for one man to even we can say: Google Cloud will even also red gitlab, also supporting that. So we can mention, maybe, as some list of tools which supports salsa level, 2 started build yeah. That will also help.

A

But should tooling, because that's detail right and I think that detail would be in how would they Implement and maybe that's part of that.

B

Yeah there we can choose, uh we can give the options like use. uh Devops orchestrator such as Cloud, build or or GitHub or GitHub.

D

Yeah, we can absolutely point to like part two and say further um further details, as we mentioned in part two. But what like I said once again, when I saw the caution, let's make sure that it is in fact there is tooling, and that has been discussed before we mention it here, because there'll be a part. Two in the the part, two doesn't cooperate. What we talk about in part, one at the time of part, two's release, you know, I mean it's we're going to lose the audience.

B

A

B

Can just mention something called automated process of releases incorporating salsa will helps to reduce uh time to release Deepak and determine.com.

A

Okay, here I'm Gonna Save, this comment first and then in here. Let me see automated process. I lost what you said or build release.

B

Yeah with uh like uh salsa integrated Builders, so that's what our aim right so.

A

What what's uh would it be social requirements integrated.

B

Or another way, around uh automated process of being and release with salsa enabled build systems. It's also uh yeah.

A

B

Ourselves not enabled salsa certified build tools or build machines or build systems. Yeah Building Systems.

A

Yeah and this certified will also a certified we'd have to talk about the blog too.

D

A

Do you get certified right, there's a whole process that they're creating for that yeah.

A

um Okay so job see, since you remember the conversation better, do you think you can write a few words around this hours.

A

B

You're talking here on mute, oh sorry, yeah, um we can say like security uh approvals,.

C

Manual, security.

B

Approval can be, uh like you know, replace the with automated process of attestation or yeah.

A

So I'm wondering uh if we should change this type well, should we change the title.

C

Yeah I was thinking, uh I know I'm brand new here. But to me this was like um building more predictable change management activities. I think it might be maybe change my insurance too generic and not going to resonate with the development Community, but building more predictable, continuous deployment.

C

I think that touches on the The General uh sentiment of this use case and I. Think that feeds very well into the call to action on.

C

What's in it for me for the developer, because we talked about how why would we want them to do something starting today and then there has to be some form of motivation for them to want to do this and the not being at work at night, because they're tied to the continuous deployment activities or processes of today, but leveraging something like salsa will build enough rigor into the work process that they they don't need to be there right before production, I, think I, don't know the right way to say that, but that was just what I I took from the last 10 minutes or so of dialogue and I.

C

Think um if we put the ad car mindset on the what's in it for me for the developer, that that would be a big one.

A

Okay and I'm gonna have.

C

A

The recording to record every single word you, you just said, I'm really bad about that. That's why I'm a bad note, taker I can't write notes when I'm listening, it's really bad, so I'll have to go back to the recording to write what you said because I really liked what you said.

A

um So, if I knew I was gonna like it, then I was gonna, write it down, but I.

D

A

Know what you were gonna say so I didn't know if it was something to add or if it was more of a general comment. um So now I I miss my my opportunity.

C

And that's okay: I mean I could also go into the document and put some of the comments on paper as a starting point. If that would be helpful.

A

Yes, definitely, please do so. You should have access to edit or suggest um this document I think we we opened it up. So it wasn't just one person that could edit.

A

Yeah, foreign, okay, so I'm glad that this is resonating because I again I, don't I. All I remembered was a you know uh the staying late, but the other thing was about the debugging and root cause.

A

If something fails, um I think it was around the artifacts that get generated that could help with debugging and finding root cause of why something would have failed.

A

Let's say it didn't pull from the right um from the right repo as an example or it didn't pull all the dependencies or I. Don't know, I think that's. That was another reason why someone said that this is really useful is for troubleshooting. If there is a failure of some sort.

A

And whoever's writing. Thank you. I appreciate it very much um and then s-bombs was something I know a Bruno Bruno mentioned right, A lot of people when, when they think about salsa first thing, they're they're gonna probably ask us: how does this help me with f-bombs right because everybody's thinking about us bombs, even though it's not one? In the same um so this was I, don't remember where I somebody mentioned this right.

A

It's an on-ramp to building a more secure software supply chain, and that's also one produces the s-bomb right and then you can use that for any number of reasons and salsa level 2 would produce a sine death bomb which prevents tampering of the artifact I. Couldn't really come up with anything in terms of why a developer would care about that right. I can't imagine a developer caring about that.

A

I can imagine a product manager, yes and potentially higher Opera security, but beyond that I I really couldn't think of a good way to sell this. This piece.

A

Folks on the phone.

D

No I I mean dare I, say I kind of I.

A

Can't think of audio, because I'm seeing hold on give me one.

A

A

Can you hear me yeah.

D

I can hear you fine.

A

Yeah I see the little microphones but I'm, not hearing anybody. So give me one second. Can you hear me now yeah.

A

C

A

A

Can you hear me yeah, okay, yeah, there's something wrong with it.

A

See if, if I sound, really bad.

D

No, you sound fine.

A

D

Still can't hear us.

D

Oh now now you sound like you're in the distance yeah.

A

Can you hear me better.

B

Yeah, no, it's.

A

Good, okay, so that's my webcam um microphone, um I I, basically stopped hearing you after I said whoever's. Writing! Thank you! So I don't know if people were talking or not after that.

D

Well, no so, actually responding to what you were saying about the s-bomb stuff. I mean I, I, I, I, I. Think uh you you, may you made the point with what you said: I I, don't know, but I don't know why a developer would care necessarily I I mean I, I. Think from a build perspective, the s-bomb is important from both from a developer perspective. I, don't know why a developer would um what what care you know prior to you know, prior to the to a nest Barn being developed for for the build itself.

D

I, don't I, don't know, I, don't know why a developer would care about that.

D

A

D

B

Yeah uh other way around among more things where maybe I'm not right here so is it like, for example, uh lab or Cloud build when it's it's creating the prominence information uh is like mandatory to create the s-bomb format, uh because somewhere I remember uh it's mentioned. uh Salsa format and S4 format are two different format and currently Cloud build uses, salsa format and gitlab, or maybe some other tool use the system format. So are we specifying for salsa level one? The provenance information should be in s-bomb format,.

D

Well, there isn't, isn't there uh a a use case for spdx or something like that? I, uh yes,.

B

Something like that, yeah.

A

There's three formats: there's spdx Cyclone, DX and Swig, but no not many people are using Swig.

D

A

People are using either Cyclone or spdx.

A

But salsa, is it really, you know it? It doesn't really care about how you create your s-bomb necessarily right right now we don't have Source defined, but doesn't care about how you generate that s-bomb necessarily from the accuracy or the formatting. It's just saying your build is supposed to generate something.

D

Right, whether.

A

It's accurate or not is a different story.

B

So, in that case, do we need to say would produce an Esco modified or we will say products, information that can help with understanding can.

A

You repeat that last part that last sentence.

B

So here in the sentence we written SLS and produce an sbom artifact, so instead of artifact, can we replace that with permanence information.

A

So provenance have we defined provenance J in salsa I, think that was a big TBD.

A

Oh okay, because.

D

That was one of the items of contention that we discovered early on and whether or not that that was actually a part of the. um If that was actually part of levels, one and and two and not and not not well and I, might even show, because love is one and two or more about the build versus The Source.

A

Correct yeah, so that was yeah I think there was a benefit because some of these benefits um for for um jumpsy and Matt uh I've copied them at the bottom. This was actually in salsa documentation and one of them mentions uh provenance at some at some level. I can't remember where- um and we had a uh interesting conversation about that, because we weren't sure if it was for build or if it was for um a source yeah, we don't have source levels defined, um but I don't know that we've defined provenance for build.

B

Yeah, that's right. Yeah.

A

Well, we think it's the same, except that you insert build or source, and maybe the examples are different right, but.

B

uh Can we say like Integrity of the build, because finally, Integrity of the build is verified through the provenance details right.

A

A

But then how do you define integrity right.

B

um So uh in another way around like uh we have different mechanism for for proving or for providing Integrity to the field, so we can have different signing procedure. We can have different type of signers uh yeah, so I should say it would be like either prominence or Integrity of the build and how to actual Integrity is through the attestation and signing procedure which can be done in different ways.

D

I think we if we say that I think we're back to uh we're back to the question. What does that have to do with the developer?

D

I mean if we, if we're talking about signing that, that's a that, that's a that's a that's a bit later right, I mean we're. I mean hell, especially if we're addressing vulnerabilities and all that kind of stuff- and you know sign something unless you, unless you're good with the. Unless you go with the package right I mean I. I, dare I say that we we're talking about levels, one and two dare I say that might be a level three, a level three item.

D

A

Or for s-bomb a level three item.

D

Well, I'm saying for for, if we're talking about integrity right, if we're.

A

Talking about integrity got.

D

It and we're using signing as a mechanism for integrity, which will probably include some type of a hash, then we're kind of at the later stages, yeah of salsa, not at the beginning of stages, where Developers, what developers are relevant.

A

um I want to make sure uh I know. We talked about integrity up here somewhere.

D

I mean that that unless we're making a reference towards um iteration and then all that and release management, I but then once again, but then I think I think we might even be scope creeping on that one too. So I digress.

B

I can see in the slsa specification itself mentioned um something called request: Version Control and hosted build services that generates authenticated prominence, so that terminology is already there in in cells about them.

A

uh Yeah, can you share the link that might be for version.1, yeah yeah.

D

B

Is dot ah it's dot? One sorry yeah.

D

So so yeah so that so so what so one yeah. So once again, while you see that and then, if you go to the, if you go to the actual repo and then you see what they're talking about for for version, one right perspective version one that that was a discrepancy that we caught um where that was mentioned.

D

And then they said well, it's not mentioned here, but there's mentioned like two other places different.

D

What's it going to be exactly and then we saw the differences between source and build um just split off between source and build, and this was one of the um one of the things that spilled off between source and build.

A

Do you know an easy way of getting to that that draft.

D

D

A

D

Happened: I think I happened upon it by accident too, thanks right, that's just sitting there looking.

A

And they're, like oh wait.

D

What's this oh yeah,.

A

I think it is it this I thought I had it linked in here somewhere yeah.

D

That this is building, and it should uh should talk about so at the I know. I think this is it I think this is the one I found before this is a source track not yet defined.

D

And this- and this was a discrepancy between this and then what we saw on the other one and like well, what? What is it going to be exactly because this doesn't because this references uh version to uh level two or.

A

Level three elsewhere.

B

A

I, remember so build provenance is defined, um so let's at least copy that down and put that in here in the comments uh to build problems.

A

Now, in terms of s-bomb.

A

And why a developer would care I can only think about remediation.

A

And then streamlining this use case up here right, foreign.

A

So it's like you just you just got to get prepared for it and if somebody asks you for an Xbox, you have to know what it is right, um but outside of that I, don't know how to sell it right to a developer themselves. Right me as a security professional right, that's all I'm talking about as a developer.

A

They're like ah what is this that's bomb stuff, everybody keeps talking about right, like they don't really care um only if you're higher up uh in terms of the the felt like if you're a senior developer or you know, you're, overseeing a project, then you care, but you know a lower level developer, does not care.

D

Yes somewhere further down the chain, um yeah.

C

Well, that's a I think that's a broader challenge as well with the who cares part because I guess I I, like I, said I'm I'm still really new in this space, I'm more of a security generalist, but it seems like the alignment to business value and and getting agile teams working together with the with the same goal. There should be a focus on um building the highest quality product that we can to support the business outcomes that were we're all you're getting paid to deliver right.

C

The the reason that we all work for a company is to provide business value and fully understanding or understanding to the best of our abilities. The components that we use is part of the job right. I. Think the the stuff that we've already written down or you've all written down um around quality is is spot on, because the analogy that I have in my head and I'm not saying it's right is if a an automobile manufacturer picks a a component company that has faulty equipment.

C

The news is going to look at that automobile manufacturer, not the component company when things go wrong and the due diligence lies on that automobile manufacturer and then the developer analogy to me. That's the the easiest way to resonate with the people that are putting together the applications or cars in this analogy and I saw up above something about the ingredients and I think that was uh really telling of making this relatable.

C

A

C

Unders I appreciate what what the comments that we've made about you know: Junior developer may not instinctively jump up and down about s-bomb and that's a broader cultural component that we're up against that up against as well.

D

A

Sorry go ahead.

D

uh I was going to say, I think um you know and what you just said, and this is just making sure we we level set the reader are we talking about?

D

Are we talking making sure that we level set on whether we're talking about Upstream versus Downstream on this?

D

um Because if we're talking about Downstream well, then we're verifying, you know we're verifying the the yes, whatever whatever signing mechanism or whatever hash came with the with the package that we're pulling down that's going to be used towards our Downstream um product or whatever it is that we're developing versus something that, where some something that developer might be building, that's that's being sent Upstream right. That gets that gets an s-bomb later on, or maybe I mean. We need to make sure we preface this um preface this properly for the reader I mean.

C

I think that's a good point.

A

Yeah I thought the way the way it was explained it sounded like it's like if we were to assume this is our build environment. This is our s-bomb that we're producing, because it's also level one. You say that you're going to produce in that spot mode effect, but that doesn't mean that the dependencies that you are using having that spawn having.

C

A

Level one right so I think this is the perspective of a product or application that you are building as a developer, because then you have the control of creating an s-bomb, but I get your point about the uh dependencies or the components that you are ingesting and trying to get those s-bombs I. Don't think.

D

A

Yeah because I mean.

D

How do you verify the trust? How do you verify what what well first of all, what is trust in your environment right how you? What what do you believe to be trustworthy? You know what's a trustworthy process for you right, you don't trust the product trusted process, so you have a process that your that you deem to determine what something is: is trusted what is trusted or what isn't and should that include its own s-bomb right.

D

So is there a verification, I mean, but once again, I I think I dare I say that we might be scope creeping a little a little bit going that far I think I think if we I think we should oh.

A

D

Lot, that's a lot! That's a larger conversation.

A

Yeah, this is that this part right here part two Source repos right like that I think that's where that trust conversation comes in yes,.

D

A

um uh Trust of components.

C

Yeah and I agree with Jay. We could. We could write a whole blog about the accountability, because that's kind of what we talked about with the cultural aspect and but to me Trust of components, is a is a risk management activity and whether whether the components are internal or open source, there's certainly different degrees of trust. But at the end of the day, it comes down to risk management accountability.

C

If a component, it becomes a vulnerability or a risk and that risk gets realized. Where does the accountability lie when you work that backwards, if you think it, through kind of from a threat, modeling exercise.

C

But again that that could be its own, its own entity, probably its own blog.

D

Just just a time check here we got about five minutes.

A

Okay, thank you so I think uh you're spot on about this is we need to clarify that this is a bomb for product application right um and maybe in a in a future blog in a future Vlog. We will cover the concept of trusted.

A

Yes, uh trusted uh components, uh something like that.

D

Yeah and you know what and I think in that we may have- we may have solved it well, there I say solve Loosely right, but we had a question before on what or how we could pitch this to a developer and I think through delineating one versus the other. That's how we do it right, yep.

A

Yeah, the other thing um I like this, because it still goes back to what was talked about up here, which um I'm trying to remember her name, Michelle Michelle wrote uh a lot of this um I think we can also.

A

I feel like we can be.

C

A

With the readers and say you know, as a you know, Junior developer, you may not care about s-poms right, you may not get excited, but this is why you should care. So maybe we have to call that out. It's like. Yes, you may not care about it. You may you may get asked for one here and there you, you may see one here and there, but this is ultimately why you should care about best bumps.

A

um Potentially, that is something we still have to call out like. Yes, it improves transparency, but oh Junior developer.

A

You know you have to care too because of XYZ, even though it's not exciting right, but this is what we get paid to do. Checks.

B

C

Specification itself.

A

So there was a lot of echo there. Jumpsy um I think I caught most of what you said, um but just.

B

A

There's a there's a big Echo um but yeah the shift left principle.

B

Still a queen or hello can.

A

You yeah no I, I yeah I can hear you better now. Yeah.

B

A

No, no, no okay,.

B

Yeah, okay, so I was telling, like uh developers, should also uh taken care of the information out of what is Boom. So when like I was a developer like, we were also forced to do all the qaqc checks and uh vulnerability analysis and everything in the laptop itself or the not the development machine itself. So here I was thinking like you know.

B

The program's information need to worry or need to be considered only in the in the build orchestrators like Cloud, build or uh gitlab or such tools, but in a case where, in the cell lslsa level, one or level 2 phase, when people are building something from their own laptop still, the laptop can create an s-bomb format. Output which can be also used to deploy, to uh I, mean securely deeper to a uh environment or to a cluster or to a Computing engine. Basically,.

A

Yeah that makes sense um yeah, so the shift left principle and I copied your your comment. Matt um I meant to put something about the. What.

D

C

A

Me it's okay, um so okay, so we only have one minute left. So what I'm gonna do here uh call to action. I think.

A

Okay, there's some stuff there, so we need to uh to do uh except the I think it's a debug, troubleshooting and salsa and s-bomb heart right. I think the other part was okay. If I remember correctly,.

A

B

A

B

A

You, if you can all take a look at this, this one, um oh yeah and that's the other thing um uh set up PR to release after 1.0 PR into time of independency to ensure we didn't miss or something wasn't dropped from that respect, Okay so yeah. If folks, can, can take a look um and feel free. Like I said I'm I'm, not the only writer in here there's multiple um and I'm, also not the best writer in the world.

A

So please feel free to to add words, um but I think we're we're very, very close to being done. um It's just a little bit of of tweaking here and there yeah. It was good yeah.

A

Well, thanks folks, for joining um and for those that are celebrating Happy gobble day um hope you hope you enjoy lots and lots of turkey. uh If that's your thing, um if that's not your thing hope you enjoy something yummy to eat, um but uh hopefully I'll I'll, hear you and see you all next week.

B

A

Thanks a lot bye, okay,.

B