►
From YouTube: SLSA Specifications Meeting (March 13, 2023)
Description
Meeting notes: https://docs.google.com/document/d/1kMP62o3KI0IqjPRSNtUqADodBqpEL_wlL1PEOsl6u20/edit#heading=h.yfiy9b23vayj
A
B
A
B
E
D
G
B
A
B
H
E
E
H
Okay,
well,
thanks
for
joining
everyone,
we'll
go
through
the
special
interest
group
updates,
which,
as
a
reminder,
is
the
kind
of
like
our
working
groups
within
salsa,
because
salsa
is
within
the
open,
ssf
supply
chain.
Integrity
working
group
so
like
this
subgroup,
is
called
special
interest
group.
On
the
specification
side,
we
put
out
a
1.0
released
candidate
and
announced
it
on
the
blog,
we're
Gathering
feedback.
Now,
thank
you
to
everyone.
Who's
contributed
either
with
issues
or
pull
requests
or
for
sharing
it.
H
My
guess
is:
it'll
probably
go
over
a
little
bit
just
from
like
the
current
number
of
issues
and
the
rate
of
change,
but
we'll
see
right
now,
there's
a
lot
of
pull
requests
going
on
around
organization,
Clarity,
simplification,
Etc,
for
example.
One
of
the
things
that
we
recently
decided
was
to
version
all
the
things
together.
Right
now
we
have
three
technically
three
different
specifications:
provenance,
VSA
and
salsa,
each
with
an
independent
version.
Number
like
things
like
that
to
just
kind
of
reduce
confusion,
use
consistent
terminology
throughout
Etc.
H
So
that's
what
we're
actively
working
on
now,
among
other
things,
I
know,
there's
a
lot
of
content
feedback
going.
This
issues
being
discussed
like
I
think,
for
example,
around
isolation
and
ephemeral,
Etc,
and
you
know
hopefully
we'll
get
to
those
probably
next
week,
I
think
so
far,
I
haven't
seen
any
major
feedback
that
was
like
I
think
the
tracks
are
a
bad
idea
or
something
like
that.
Certainly
any
feedback
major
like
that
would
be
welcome.
I'd
rather
hear
about
it
now
than
like
to
just
silently
think.
Oh
no.
H
H
I
D
D
But
there
is
one
talk
that
we're
going
to
need.
Help
with
one
that
was
accepted
was
really
for
Fresca
demo.
Of
how
real
time
can
you
show
a
salsa
build
level
two
or
three
at
the
conference
right
with
participants
and
potentially
even
them
having
their
laptops
along
to
follow,
along
with
the
sample
project
according
to
to
Mike?
D
There's
been
some
reshuffling
of
resources
in
in
Fresco,
where
they
may
not
be
able
to
contribute
anymore,
and
so
now
we
are
at
a
a
bad
point
in
time
where
we
really
need
those
devs
now
more
than
ever.
So
if
people
have
development
resources
to
help
build
that
kind
of
demo
lab
out
or
participants
in
ossna,
we
would
really
really
appreciate
the
help.
G
Yeah
just
to
provide
just
a
couple.
Little
other
points
there
yeah.
So
you
know
Fresca
is
an
open,
ssf
project.
It
does.
You
know
high
level
salsa
it
uses
Tech,
you
know,
uses
a
bunch
of
LF
projects
like
the
CD
foundations,
tecton
and
tecton
chains.
It
uses
a
bunch
of
other
stuff,
combines
it
all
together
to
make
kind
of
a
secure,
build
system.
G
But
then
there's
also
a
separate
thing,
which
I
think
is
also
something
that
we
should
kind
of
look
at,
which
is
you
know
most
folks
are
not
moving
off
of
their
their
their
CI
systems
so
like.
If
folks
are
using
Jenkins,
they
want
to
continue
using
Jenkins,
so
I
think
some
of
the
other
stuff
that
we're
looking
at
long
term
is
like.
How
can
we
or
do
we
need
to
draw
the
line
in
the
sand
and
say
certain
other
CI
systems,
maybe
just
aren't
suitable
for
high
level
salsa
stuff.
G
A
mix
of
both
you
know
a
lot
of
Open
Source
company.
Sorry,
a
lot
of
Open
Source
projects
right
now
are
just
comfortable
using
GitHub
and
GitHub
actions.
There's
been
a
couple
of
discussions
about
hey,
you
know
for
very
complicated
projects
where
something
like
a
simple
GitHub
action
isn't
going
to
work.
Something
like
sorry
if
Fresca
can
come
in
and
help
out
there,
but
Fresca
is
still
very
much
like
it's
pre
beta
at
this
point.
H
G
And
one
other
thing
just
as
a
donut,
completely
change
topics,
but
so
I
also
have
the
hold.
Let
me
bring
this
up
here
into
the
chat.
It's
it's
very
short.
I
haven't
finished
it
completely
yet,
but
definitely
looking
for
feedback
on
a
Blog
article
regarding
like
why
we
split
stuff
up
into
the
different
tracks.
G
J
H
I
B
Whoops,
okay,
so,
let's
see
so
I
wanted
to
just
give
everybody
a
brief
heads
up
about
this
survey
that
came
out.
It
says
it's
a
salsa
survey
but
and
in
many
ways
it's
really
a
supply
chain
survey,
but
using
salsa
one
0.1
as
a
baseline.
So
you
know
basically-
and
it
had
some
frankly
I-
think
some
surprising
feedback.
B
You
know
I
I've
put
two
of
them
right
here.
You
can
see
the
summary
and
the
report
for
details,
but
basically
it
most.
The
practices
were
considered.
Helpful,
I
think
that's
good.
Some
of
the
practices
were
considered
substantially
more
difficult
than
others,
zero
surprise
there.
Hermetic
builds
and
reproducible
builds
in
particular
the
hardest.
And
yet,
when
asked
well,
what
are
you
actually
doing
there?
B
Wasn't
any
statistical
difference
I'm
not
entirely
sure
how
to
interpret
that
I'm
going
to
interpret
that
for
a
moment,
I'm
interpreting
it
as
somewhere
harder,
but
not
so
hard
that
they
make
people
who
are
very
interested
in
countering
attacks
that
not
enough
to
prevent
them
from
doing
it
anyway,
even
though
they're
considered
harder,
maybe
there's
other
ways
to
interpret
this,
but
I
found
that
intriguing.
So
anyway,
there's
the
blog
post.
It
links
the
full
report
enjoy.
B
G
G
Around
some
of
these
things
and
I
know
there's
a
lot
of
different
work
on
this
front.
It's
more
just
hey.
Can
we
help
coordinate
with
some
of
these
groups
that
might
be
doing
this,
like
npm,
like
Pi
Pi,
like
gems
and
so
on,
and
not
saying
that
they
should
all
integrate,
implement
the
exact
same
thing,
but
if
they
sort
of
followed
similar
rules,
then
it
could
help
with
some
of
the
client-side
tooling
when
it
comes
to
implementation.
G
Like
are
you
actually
following
the
the
rules
of
the
spec
and
stuff
like
go
rust
python,
whatever
libraries
that
folks
can
consume
as
well
as
maybe
some
other
helper
things,
to
help
out
some
of
the
other
tools
that
are
out
there,
and
most
of
that
work
can
probably
be
pulled
out
of
some
of
the
stuff.
That's
already
in
stuff,
like
the
salsa
GitHub
generator
in
the
salsa
verifier
and
those
sorts
of
tools,
but
wanted
to
throw
that
out.
There.
E
F
Yeah
hi,
so
just
to
follow
up
on
what
Mike
was
saying.
We
do
got
into
the
the
regarding
the
tools
that
will
support
salsa
there
is
on
salsa,
then
the
website
get
started
page
that
was
recently
revamped
and
it's
mostly
focusing
on
freely
available
tools,
namely
Fresca
and
the
GitHub
salsa
generator.
But
there
is,
at
the
end
of
the
page,
a
little
table
that
is
open
for
people
to
add
the
ideas
to
you
know
the
list
of
tools
that
claim
to
be
Southside
compliant.
E
F
Whatever
level
this
is
part
of
the
information
that's
recorded,
and
there
is
work
on
the
way
to
develop
a
conformance
program
where
they'll
be
able
to
a
certification
with
a
little
bit
of
more
legal
framework
around
it.
For
now,
it's
merely
based
on
you
know
self
claims,
but
but
it's
meant
to
be
open
and
to
provide
people
who
are
starting
some
pointers
as
to
which
tools
are
available
out
there.
F
D
G
So
there's
no
work
on
it.
It's
just
literally
the
salsa
tooling
notes
so
yeah,
it's
mostly
just
some.
You
know
yeah
a
few
high
level
things
and
then
for
what
Dustin
said.
Yeah
so
I
I
went
to
the
security
working
groups.
The
I
think
it's
the
APAC
friendly
one
I
need
to
still
go
to
the
earlier
one.
For
me
at
least
a
Mia
one.
G
So
so
I
have
plans
to
to
go
to
that
one
as
well,
and
so
yeah,
the
before
kind
of
doing
anything,
I
think
the
only
high
level
and
I
think
it's.
It
should
be
in
those
notes,
but
the
high
level
guidelines
would
be
something
like
can.
We
follow
some
general
best
practices
and
assuming
we
could
can
also
some
of
these
groups
kind
of
have
some
like
a
handful
of
like
ways
to
sort
of
approach
it
because
not
everybody's
gonna,
say
yeah.
We
can
have
a
rest,
API
or
whatever
that
can
do.
G
H
Yeah
and
I
Linked
In,
the
notes
Dustin
also
started
a
pull
request
to
add
a
Distributing
provenance,
page
and
spec,
which
would
is
less
specific
than
an
API,
but
is
starting
on
like
General
guidelines,
for
how
you
know,
like
recommend,
basically
recommendations
for
how
to
distribute
provenance,
for
example,
like
the
notion
that
there's
like
releases
and
artifacts
within
a
release,
and
that
Providence
would
be
attached
to
an
artifact
Etc.
So
if
you
haven't
seen
that
and
you're
interested
in
the
space,
that
would
also
be
good
to
align
as
well.
H
I
F
H
Yeah,
okay,
once
going
twice,
okay,
it
looks
like
we
can
end
early.
Thank
you
everyone.
By
next
meeting,
we
should
have
a
1.0
published,
and
so
a
lot
of
this
work
should
be
happening.
As
always,
if
you
want
to
join
in
any
of
the
specific
working
groups,
you
could
join
on
slack
openssf.slack.com
in
the
there's,
like
a
salsa
group,.