OpenSSF SLSA Biweekly, 31 Jan 2023

Previous Meeting Next Meeting

⏯

youtube image

►

From YouTube: SLSA Positioning Meeting (January 31, 2023)

Description

Meeting notes: https://docs.google.com/document/d/1tpPOXVzNSwtpWA7cXhTPLAO6HIP50obUvoP85XqgVHM/edit#heading=h.yfiy9b23vayj
SLSA repo: https://github.com/slsa-framework/slsa

A

Hello good afternoon good morning.

B

Hey Bruno I was wondering I mean I was looking around to see if this was canceled or what no.

A

It was not canceled Melbourne she's not able to attend, so are you run for today, but um I realized that it was also in a wrong Zoom meeting, because in the in our Google Docs we have a different link.

A

B

Think I got it from the calendar right.

A

Yeah I went in in the this one that we have. Let me show my screen.

A

And then that's reason that I was late. Let's put in the camera here.

B

I, don't know if you can see late when it's like I mean after the hour, but.

A

Yeah, this link is wrong. I have to fix it.

A

A

So hello, Kathy uh Jay.

B

C

Guess this is the wrong meeting link then.

A

B

A

This one it's wrong, that's where I realized this.

B

Morning, okay, yeah.

A

What is in the calendar, that is the right one, I tried. Let me see if I can fix it. This, oh boy, the problem of I have many.

B

Oh and the color that there's another link to that book to that Google doc.

A

B

Can you put the link to the into the chat.

A

Yeah, this is the right one.

B

Thank you. No, no, no, no I meant it's linked to do. Cument notes.

A

Oh, the document. Okay, sorry.

B

The Google Doc yeah.

A

We have both problems.

B

Yeah, it's like they. Normally we get both in the event or the the calendar yeah.

A

Yeah Mel bush is much better doing this than me.

A

Let's fix that. Oh, let's take the new Zoom the right one, because I think that a it was not the first time that I have this problem not to fix. While you are here.

A

A

Okay I spoke with Melba early today, and uh she said that uh the only topic that we have for today- maybe we don't need the whole hour uh it's to agree on those abstracts.

A

uh Unfortunately, I was not able to attend the last meeting, so I need to wait.

B

Wait Kathy left saying: I will see you there.

A

They're aware it's the same exactly.

B

You put the link and she thought she had to jump somewhere to another Zoom, yeah I hope it's the same.

A

Yeah, it's the same.

B

Then she should show up again.

B

This that okay, we're meeting over there there is she's back. Oh.

A

A

D

Welcome back it.

B

A

B

Same story, yeah confusion, yeah.

A

You are talking because there is difference between the one link that we have zoom call here: yeah and the document and the one that is in the calendar. Yeah.

C

I think it was the same and.

A

Now it's the same I think.

C

So now it's the same yeah.

B

So yeah you jumped off thinking you're ready to go somewhere else right.

C

B

C

Oh, that's a different.

A

And uh uh I don't know, I think that it's no newcomer so far right everybody, it's old here, yes,.

B

Don't rub it in some other. Some of us are older than others.

A

B

Literally, okay,.

A

So uh what I, what I spoke with Melba this morning? She she said that she's not um able to join, because she has two kids at home because inclement weather and then uh I know deal with kids at home. It's especially when I have meetings is a nightmare.

A

I know pretty well this so, uh but she told me that it's what you have to do today is agree on those abstracts, so we can walk in the submission for the next week, so um uh I'm, assuming that you guys attend a I. Think uh Jay was here the last meeting right.

A

Have you attended? I, don't know it looks like no right.

B

Yeah I, actually I was I, think the uh I don't know who's in the last one or the one. Before we were talking about all the titles and we voted and kind of.

A

B

A

For me looks like that happened the last uh in the last meeting, and it was the abstract yeah.

E

We were working on the abstracts, mostly.

A

Yeah, so what I have to do today is just generalize, the abstract, make sure that it's everybody agree, and uh so we can walk to submit those to um open ssf day and I. Think that it's maybe other um events that melbaits also. She told me that it's Target as well, but it mostly open ssf. That's what I understood for her. Let me know if I'm wrong.

C

Yeah, that seems like what you want today, so.

A

Yeah, so uh just just on top of my head, because I'm reading those abstracts right now, um at least when you create those titles, I was assuming that it's, for example, the beginning. It was something for beginner in software supply chain, not only salsa, I, don't know, if that. That's the intention here in this abstract, because I'm ready and say well, if you're in the beginning, maybe I would like to know how s bomb, what with the salsa and work with Vex and things like that.

A

But uh I, don't know what is the intention here just put in for the description.

B

B

I mean this series is all about salsa, not the bigger, not the bigger spectrum of you know the software security or supply chain security, but I think it doesn't hurt, of course, to position salsa when we got to arrest.

A

Yeah, because very complementaries, no, for example, I I, don't know about, for example, especially, for example, um people that it's starting to get into the software supply chain. Sometimes you have to explain oh, but it's South and acid Bond. They they compete with each other. I think that it's as a bonus was all that I need. I, never thought about that. We need to framework, and then people that it's really starting I, don't know if you have the same same uh same challenge explained for someone that it's new.

B

C

Yeah I think the s-bombs or efforts different than the salsa I mean we could do an overview of software supply chain. You know and then talk about the other things you know.

B

Well, it says you know we will cover what salsa is and is not so.

A

I would expect this.

B

Okay, exactly on this right, it should position salsa and say: well, you know others compared to his bones and whatnot and by the way, it's kind of a Hot Topic, because there are discussions right now as to whether you know, what's the difference between Salsa, Providence and and nesbaum, oh and then bomb.

A

C

A

I think yeah I I think that it's just to abstract you, because sometimes people go through keywords. You know yeah I I agree. So if there is no, um if everybody in agree, we can just approve this and move to the next one.

C

Yeah I really like this abstract, the first one I think is really good.

B

I agree: that's the job.

A

Like how can I say.

A

I'm trying to see if we can put something like that, we agree on you.

B

Just put a note exactly Yeah.

A

Final, okay, that's so you can Define. Okay, it's still in draft two world. This is the final, oh, okay, the the next one I. uh If you remember correctly, it's it's not a like a it's done. The presentation, it's more a panel discussion, that's right that will bring uh people that it's try to at least deploy is salsa and they come to share um their experiences.

A

So I, in my opinion, looks like that. It's pretty clear here. What is abstracts I, don't know if you think that we needed to include something else, but.

A

C

Think, like maybe instead of saying if the journey was worth it, maybe something like and their lessons learned or you know something something more knowledgeable in the sense like not equate it with worth, but equate it with knowledge or experience.

B

Yeah I I, but at the same time I think we, the the I, remember we talked about this a few weeks ago. I'm there was this notion that okay, we're going to tell the world hey, you need to. You, know, look into this and and get on the bandwagon so to speak, and people when we say okay, but why should I do all this right? And this was about you know, especially if we stopped talking about well. Don't expect this to be easy.

B

It might be hard because of this because of that, but the idea was okay. We should also highlight you know: what's the game so that we can motivate people to actually engage.

D

B

D

B

I I don't know that it's worded the right way right now and there may be a better way to to to turn it around. But I, don't think just saying you know what other Lessons Learned learned uh kind of Hit the point that this was meant to carry.

A

Yeah the problem, it's worth it in my opinion, it looks like oh at the end, it's binary. It's go, no go, maybe something like, for example, the biggest challenges, lesson learned and uh if you can, if you are able to go back in time, what to do differently.

A

B

The benefits, in fact right, yeah I mean we talk about the biggest challenges we could say and what are the benefits.

C

What, if we just change the word, if to why and why the journey was worth it.

B

Yeah, that's a good point yeah. If we have any penalties to go and say it was what, if we have a problem.

A

B

This you're right, that's a good point.

A

So we have Alex under Alexandre right, join us English.

B

I'm, sorry, that's right.

D

It's election, but uh yeah, legendary or just Alex, uh maybe easier.

D

A

Can you can you it's your first time in here.

D

Yeah, it is um I've been um for spending in other meetings from the the next foundation and the cloud native Computing Foundation um for a while now and um yeah I'm checking checking it out trying to see.

A

D

I can um add some some value and because of it, the the community so.

B

um I live in Brazil.

D

And I I started a company last year to facilitate collaboration and and like grow. The open source, community and grow help startups, grow their communities and what not so yeah but.

A

D

Following um following the the group for now,.

C

A

I I put in the link uh the the for this document that you're sharing. If you can kindly put your name here as attendee just so keep we have this memory and uh welcome to the team being viento team.

D

Yep thanks thanks a lot.

A

A

So uh uh we are talking about the good, bad and ugly right, yeah.

C

A

Anything else, I think what would keep it short in switches. It's enough.

C

Yeah I think that's good, because it's just a panel right so um yeah, you know it's an open q, a and stuff so yeah.

A

We know that um I, don't know if you have any panelists already confirming for this I know that I try internally Intel. um You are not at that stage. When you're talking about salsa I know Verizon, it's an option. uh Melbourne was working with um to see if internally, at ABM as well, but um so far, I think that the only one that you have on the lineup, it's a Verizon. That I mean that has potential.

B

I mean we we are, you know we have our own uh offering for like and, and we are actually developed a pipeline. We are trying to figure out what it takes to be well, you know so so-called conformant with salsa and and you know, but we already have been doing work in that space. I mean we. We can definitely participate in this and some of the challenges, like I said you know, I was touching on earlier, for instance, the overlap with his mom on the one end. Where did you put some work into developing?

B

As you know, production of this bombs and then we're like? We look at the salsa or say hey so now we have to do to produce Providence for salsa and guess what there is a big overlap and yeah. They are not exactly the same, but it's a bit like they really have to do this too. Can this be the same anyway yeah so I I wouldn't call it like. You know, I wouldn't say we are done yet, but we definitely uh some experience to share.

A

But it's specifically salsa or soft supply chain, General.

B

Well, like I said, I mean the primary focus has been to produce as bonds, because this is kind of the must-have and naturally it leads us to say, okay, but so this thing salsa how we can. We also claim compliance and what does it mean.

A

B

A

Yeah I I have that discussion internally internally, I didn't tell as well. If you have someone that it's uh focused on the product development at Intel, they would like to come to this panel.

A

But, uh as you mentioned, we are internally focused on one bomb because of course we already have the bomb for Hardware, but it now has a bomb in something that it's I have to come together and uh but uh Salsa's like okay, let's first have the the the one bomb and then later, as you mentioned, but that's the reason that they they said. Well, maybe you are not good of candidates yet for this panel, not this year, not for this time frame but looking forward. Sales is something that you it's in. Your roadmap.

B

Yeah, so I think you know some of it. Maybe you know like we were saying: is it? Was it worth it I mean? Did you put it that way? I wouldn't be able to answer it fully because I'd say well. We are it's still working progress, but I could still share what I think about it, whether it's worth it or not, right I, think so. I did somebody. You could probably do the same for Intel I. Don't think that necessarily should stop you from participating. I mean, let's face it.

B

I mean salsa is still in the works. We're still developing the spec. Who has the you know who is in the position to say yeah, we've done it and I can tell you all about what it takes to get there. It's like. Well, nobody has done it per se, I mean maybe Google is a bit more. You know experienced because they started this early and it's based on some of the internal Works.

B

They did, but you know I think some of this is good to be about sharing how much we already know, and it I think it's not I I. Don't think we can limit ourselves to people who've done it already, because it doesn't really mean anything given that the spec is not even final. Yet oh yeah.

A

Yeah, but you know I can send you the link. It was uh I think that was November. Last year it was Google. Next uh they announced a product that it's, of course their pipeline in gcp and they claimed they are salsa level. Three.

B

But of course, but you know I I'm on the specification work group- and you know with this discussion that I said: oh maybe you know there are discussions and then you hear Google person say: hey I, don't know if we can have that requirement, because maybe you know I don't know if you would be comfortable with having this in the spec and mean which means that Google is not performant on day one Google, Cloud and I'm like well. Sorry, you know this is what happens in it during the standardization process.

B

Sometimes you don't get everything you want, and maybe you need a little bit more work than you've already done.

A

Yeah absolutely.

B

So I mean I mean those things guys. So for me those things is like well, hello, that's just the way it is, but so yeah I I know the you know, Google and I'm sure there are other companies that will claim they already are compliant, but I don't think we should take this for granted. Then it doesn't matter we shouldn't I mean if otherwise, you know. Maybe there is like two people, we're gonna be on the stage. I don't know yeah. So I don't think this. This qualifies what I'm trying to say.

A

Yeah but at least.

B

Looked into it and get already a sense of what that means and what why what's motivating you to look into it and all these things, and that alone, in my opinion, is worth you know, cutting it to air on the panel.

A

So uh just come back here.

B

A

Let's, let's say everybody agree with this uh abstract. Can you Market.

B

Maybe, given what we just talked about, maybe instead of was worth it, which is makes it is worth it why the journey is worth it.

A

Why the journey it's.

B

E

Make it praise actually I actually like that? A lot based on uh based on what we just talked about the journey is worth it. I like the line I.

C

Like that, I, like.

E

A

C

B

C

E

Okay, I have to agree, I have to agree with Arnold, so you see like I I.

E

These are things like way back last year um when, when things started to uh change, you know it's like I I, it's such is the land of developing a speck right, you're, always gonna, uh find gaps, discover gaps, fill those gaps, things like that, but then, when things start to split off now, you're now you're dealing with a situation where you, where you you can't it's what what does it mean to be level one and then, of course, now it's level one by which, by which spec the build, the provenance, The Source or the conformance, because that's where we're at now right.

E

um You know that that these are all things that need to be discussed and break them apart, pull them back together, I mean all done and Earnest of course, but but now we, you know now we're really dealing with a situation of what does it mean to be level three and is last year's level. Three, today's level three or two or one no.

C

A

Yeah makes sense.

A

Okay, if that is.

B

A

Okay, let's, let's shift the gears to the next one salsa with us: the dance of absec I love those titles.

A

Okay, so this is what I have one two three cells in action join open ssf. It's also group four live Hands-On demonstration of how to betin has also compliant building with simple Ripple, who it's going to to put in this together, just what just abstract that you're putting out, and uh if you gotta approve it we try to to do it.

A

C

We even have a live Hands-On demo I mean I know we have some places that are presented um but in the meetings, but are they willing to do a live Hands-On demo or make one.

E

I think this one so first 1.0 needs to be ratified before anything else. I think with this one it unless that doesn't happen, I think that a thing we probably could still do something like this, but I think it. We really do need to qualify it yeah before before it happens, right so exactly what what do we mean by salsa and action to this point? What does that look like to this point, um especially if 1.0 isn't ratified and we can't say according to 1.0, this is you you know we have.

E

We have to qualify and then say what that actually, uh what that actually looks like and what it actually means, I.

B

Agree with you, Jay I mean it's got to have all the right disclaimers, not brought to say you know what it's not exactly all done and ready yet, but you know this is where things stand and I mean I. Wasn't part of the group that put that together initially uh I can imagine they want to leverage some of the tools that are available today and that will need to be indeed revised and updated as the spec progresses. There was one zero.

A

Yeah just just bring here, because if you go to the salsa website, we have this I, don't know. If many of you have seen this reaching salsa level one they have the guidance.

B

A

And the salsa level three, you have the guidance as well. I was reading a little bit more just skeptical I said wow I, don't think that it's right, but uh it's in our website. Maybe it's! If it's! If it's wrong, we have to.

B

Raise a flag request: there's a pull request already submitted yesterday against this page. That provides a lot more details and shows this. You know not quite as easy, but there are submissions yeah, but I think it does highlight some of the things they probably want to to demo at the at the event. I don't know so I, don't know that and there's any one of you is familiar with this. Maybe we cannot deal with this now.

A

You haven't put this on hold the number three until we will have.

B

To be finalized, I mean with people who will do this, I, don't know who is going to, but maybe maybe like holyberman, for instance, or some cesca wants to show how you might do this with Fresno I. Don't know, I, don't know what volunteers to do this.

A

Like um waiting salsa, if you won't be published first.

B

No I don't know that I would not make that sort of stuff. I think there are people working in tools. We have civilian, open, ss7 I think it could be okay to demo.

C

B

Ones that are within open, ssf I would want against demoing a specific product.

B

But if it's based on sub open resource tool, why not I mean? And with the proper disclaimer that says you know, the spec is still not finalized. Those tokens are still very much work in progress. We will keep updating them as expect progresses. People have the proper information. They can still get a sense of what we're talking about right. I think it could still be useful, but.

E

But just just need to qualify it. That's all you just need to qualify to say hey. This is so according to this, what the spec is currently and the current available tools to reach uh this level according to where the spec is currently. This is how it can be done, and then you can be fully transparent with that. Yes,.

B

I agree and- and it's got to be like okay- this is just one way of doing it, because obviously the the expectation they will be mainly right offerings.

A

Okay, okay, but we have to submit those abstracts for next week and just make sure that you finalize.

B

E

I think yeah I think yeah I think this one needs to be put on a hold I I I I. uh We could do it I just think it did, because because the preparation behind it yeah that's.

C

B

C

That's my concern. Yeah.

B

But you can always submit it and and figure out the details after her.

C

Well, it's one thing to figure out a presentation and then it's another thing to figure out a demo.

E

With not finalized.

C

Spec, you know.

E

Who wants to be on that stage? I'm just saying who wants.

B

Me I mean I'm telling you there are people like Michael Lieberman who works on Fresca. He already has something: it's not you know, production ready by any means, but I'm sure he would then mind to run this duel and say hey absolutely, so you can enable it and it's worth what it's worth, but you know so I know I'm I'm, personally, I, don't see a problem with putting submitting it and you know I I assume not apparently none of us here today uh can do it.

B

You know or is willing to put to put the demo together, but I assume the somebody volunteer to do that.

E

To uh put Fresca out there as a tool I mean he does it. During the during the Fresca meetings, I mean he he'll jump at the chance to pull that tool out and uh okay.

A

I reach out to Michael and the other people in the other groups to see if it's someone raised their hands to make this demo, because.

B

A

To push it but yeah.

B

Just ask me: Albert, do you know who is the volunteering to do this demo.

C

That sounds good.

A

B

And you could put a note saying you know a little bit of the the concerns we are saying and proper disclaimer should be based on open. So it's really available tools that kind of stuff I think it might be worth pointing out.

A

Okay and you have the last one- the ketchup, mustard and release to softer supply chain security, but from it's almost lunch time right hmm so uh I, don't know what it means skip to soccer and join the open, ssf Integrity working group. We will discuss how to improve and standardize this software Supply it was it was. You are abstract to Jay I, don't.

E

Know um well, we we all worked on it, but the the title was, the title was still in denial came with it. I think this right here is something a bit more, uh dare I, say easier for us to do right, because we all can you know having a especially when you when you're at the working group uh level in your in your in all of these meetings, you can clearly draw the lines between s2c2f Salsa, Fresca, hell even guacin, and everything else, and you see where they all have relevance and they all fit together.

E

So this is a. This is a better discussion holistically um across everything that we're working on in the working group um and then, of course, using uh you know the the the idea of of positioning right where you know where we're talking about you know having an umbrella positioning Sig for for S2, c2f, salsa and and Fresca together. This this is. This is a a good win, not just for uh salsa and and but for s2c2f for Fresco hell.

E

This is a good win for the supply chain, Integrity working group um to highlight what we're working on period right. We could even discuss after you know, we talk about these things right and we can even then discuss the broader um supply chain security framework being worked on that incorporates um all of these things. So I I think this one is a is a is a great win for uh open ssf um supply chain, Integrity working group just.

A

To make it clear, because I I'm not sure what it's the the format it's you're, going to be a panel discussion or you'll be a lecturer because.

E

A

This looks like that. It's a panel I.

E

Think it's a panel, okay, I, think I. Think it's a panel right because I think um taking uh people for you. You'd have to have everyone from each one of these sigs uh sitting on stage together, feeding off one another discussing how they all fit and then taking questions from um the audience about the direction that each of these are heading in hell and then and then you know, like I, said full transparency.

E

What the gaps are, how we're addressing those gaps, um how we're addressing those gaps together right, what we're, what we're doing as a community to address those gaps right so so does that I mean that that's this is definitely a a panel. You know, I, don't think you can I, don't think you can do this. Just just uh one person or two people up the election. I think this really does need to be a panel and.

A

Do you have already identify who would be in this panel.

E

uh I I I, don't I mean uh logically I I mean I'd, be there or or uh my um coach here on the on the s2c2f Sig um Adrian will be there, um but I sit there. I sit in the salsa ones and I sit in the Fresca as well.

B

Yeah, you can no, but you I agree with you Jay you can have, but you don't face to listen to yes, a little sauce, Fine, Fresh cow, fresh cat would be my call for sure. Absolutely we just need you know salsa somebody else, foreign.

A

So help me how to do with this: it's a the abstract is finalized. We just have to find who would at least the three people that you'll be in this in this panel, that I understand it at least three right.

E

At least three no.

B

Yeah but I think it's a bit short I mean I. You know.

B

I yeah, you wonder if you're just a judge on the program committee uh of the summit, you read this, you say: oh yeah, sure that sounds like a great idea. I, don't know.

B

And I don't know for a fact that this was meant to be a panel. Do you uh Jay.

E

uh Do I uh no I mean I, I, think I, don't even know if we uh I don't even know if we, if we I, think we're working on the abstract but I don't even know. If we settled on.

A

Oh for this one I that what I understood that was a discussion with at least three panels. uh Three panelists right, yeah.

B

A

Seems that makes sense because it.

B

Says it says we will discuss so that's right that kind of hints towards uh panel. You know.

E

Yeah I think what I think where, where uh we're settling on that right now right now on this call, which makes perfect sense, I know that we were more concerned with just the abstract for submission um yeah. Last time, yeah.

A

But my concern, if you, if you, if you, if you send an abstract, but you have no idea how you're going to deliver it's just.

E

Okay I mean yeah that yeah, that that I mean that yeah that that's a yeah.

B

I mean no, but in fact I mean when you submit. Typically, you have to indicate what kind of you know.

B

You have to specify that when you submit it but- and you do have to specify who the core plan, if you saw if you have some typically, although that might be changeable after but.

A

I, don't know how long you'll be those sessions as well, because usually for piano discussion. You cannot do this like a 20 minutes, 25 minutes, if you, if we have short sessions right.

B

He needs at least 30 minutes or more for Penance. Discussion like this I think at least I agree with you, but at least at least because I mean think about it. You have three people, it's just 10 minutes per person plus use the body writer needs to kind.

E

B

An introduction, so it's very short, even if you have no presentation.

B

A

Do you agree that it's a panel discussion or not that's.

B

Right I haven't heard anybody disagree with. So let's do this, let's call it. Okay,.

A

But we have candidates for to be in a panel I I heard that Jay will be one of those right.

E

I I don't mind, I I would I would love to be one of them. I I don't mind that at all um I'll be I I'm assuming I'll, be there because I do have a Deni stuff. So yeah I'll sit on the panel.

A

So we need to identify another two you're Andy, probably you're sitting in the other two committees probably will know who it should be invited as well.

E

um But it's also be hard. There I would say Mark ledetto, yeah.

B

Yes, probably the best person but.

E

B

Not sure he wants to be tagged on every one of those sessions, but we can try to he's not here, so he cannot reject it for now and I. Think Michael Lieberman would be the leadership person. Okay, I mean.

B

A

A

So I don't know what is this. This is something that that we we discussed as well as another uh abstract.

B

Yeah so I don't know I.

A

Mean this I don't know either.

B

They they were talking about.

A

B

I was not dating in the last meeting, and you know right I remember we made we discussed it before. There was really among the lines of like well. You know the goal is that someone's ear will be out by then, but in me case we could.

B

You know somebody ought to go there and give a presentation as to what the status is, what it's providing what's covering, what not and how it compares to what has been out here, I published so far, which is salsa one zero, zero one but I, don't know who said May introduce a kind of rules, yeah.

A

That's the one that I was not in the previous meeting, so I don't know if it's like a tentative or whatever I don't know.

B

And uh I see, the note saying is to ask Mark or Josh whether they're already working on this, they may have provided some of submitted something on their own. So I think this is what's. This is different.

B

B

Probably you need to reach out to them and figure this out.

A

B

A

That's also you.

B

Know I mean you at times. Can you tag mark.

A

B

A

So but but by the way we discussed this as a as I be a panel, but uh I don't know if you agree on the on the abstract as well.

B

So I was saying.

A

Now that it's something not.

B

Too short, but I I think what it says is fine, I just don't know if it's not a bit short. Maybe we should expand a bit.

A

Short to mean what the the abstractor of this session.

B

Yeah I don't know the abstract.

A

E

What would we uh well.

B

E

Mean think about it. That's what we include I mean all of these they're too large in very early stages,.

B

Yes, I agree, but there are two audiences right.

B

The first one is going to be the the the program committee who's going to review this and decide based on this, whether they even want to care giving it time or not, and then the other is once you pass that assuming it's accepted, you know what would a play appear on the program and whether people will it will make people want to come and listen in or not so, I think for those of us who live in that space, it's it seems fine, but for those who are not in that space, it's a bit short.

A

In my opinion on in that description, with those three front walks, you should be aware at least two of those otherwise you'll be completely lost.

B

Yeah I think we- uh and maybe this is true, but some of the other ones too ought to at least talk about the software supply chain. Security in this.

A

B

So, like standardize yourself for a supply chain, we should say security there. Yes,.

B

And so on, yeah sure.

B

At least you know that kind of brains what this is about, and then you may not know anything about those acronyms but you're like okay. This is about so first impression: security, fine.

A

A

So that's what I have for the order of the day.

A

Is there anything else, because if you agree with the abstractus I think are good to move on.

A

Any other topics future agenda.

B

So I'm I'm sorry I'm, going to release it a little bit the other ones, because I think they all need to talk about software supply chain security. They should all include that somewhere.

A

I mean I mean the the wording.

B

The other abstracts, yes, the wording. So if you go back to the good, bad and ugly yeah, we should have you know and their salsa adoption journey two worlds: uh okay,.

A

B

Two Worlds software to.

A

Us towards the secure software supply chain.

A

B

At least it kind of you know people who have no idea what this is about, they get, they get an understanding of what the topic is about, and so, let's see the third one probably ought to have that also somewhere.

A

Are you planning to add something else or to salsa with us.

B

Yeah I'm trying to figure out where I'm done with that, where.

C

B

This, if you have ideas, go ahead and.

B

A

Or maybe maybe a Hands-On demonstration how to secure your softest supply chain.

B

And obtain a salsa compliant build with simple I.

A

B

Would work yeah.

A

A

A

B

Yeah you're missing out too secure of the soft person. Okay,.

A

B

Obtain, well, you could say you're right.

A

Yeah yeah I'm, just better yeah.

B

To secure your software supply chain and obtain the cells are compliant build with sample repo with a sample repo.

B

And actually, we want to say conformant I'll create a detail, but there is something yeah.

A

Compliance, it's is a strong word. No.

B

But yeah there's some legal implication and stuff we don't want to get into and performance is a better word for what we mean here.

B

I think that's better.

A

B

I think that is, software supply chain security, which kind of frames, those things and um I think that's good.

A

A

That's the order of the day for today.

B

Any other opinions or ideas.

A

A

You are planning to submit this for for the event, so you'll be the defining the final wording.

B

So who's actually doing this.

A

Well uh mama. She brought me to another description: is lack about this I'm still trying to decode this man, uh but I think that.

A

I think that it's next week, it's the deadline. If.

B

I'm not wrong, that's correct, yeah! So that's why I'm asking because we need to make sure that not you know it doesn't fall through the cracks where everybody thinks somebody else is doing it. Yeah.

A

I saw that it's uh in a discussion that it's Jennifer jury man I have to the quote. That is a big threat.

B

Is that on slack yeah.

A

And it's like yeah.

A

uh Let me I, don't know.

A

Okay, let me bring it to this description as well or not.

B

Yeah I'm happy to help okay, okay and I. Work with Melba, so I mean we're not part of the same organization within IBM, but still talk to each other.

A

Yeah, there's no secrets here: no.

B

A

B

Sounds good sounds.

A

Good have a great day, I think, if that it's no other topics, we are good for today, all.

B

Right. Thank you. Thank you. Everyone, okay,.

A

Thank you have a good day.