OpenSSF SLSA Biweekly, 1 May 2023

Previous Meeting Next Meeting

⏯

youtube image

►

From YouTube: SLSA Specifications Meeting (May 1, 2023)

Description

Meeting notes: https://docs.google.com/document/d/1kMP62o3KI0IqjPRSNtUqADodBqpEL_wlL1PEOsl6u20/edit#heading=h.yfiy9b23vayj

A

Hey everybody um thanks for joining. uh As a reminder, please register your attendance uh in the meeting notes, which are just pasted in the chat uh and also, um if you have any agenda items, please go ahead and add them.

A

They're welcome.

A

um First, I'll take the time to welcome any new members. If you want to briefly say hello, you're welcome to do so.

B

Yeah I'm the Victoria I've been joining some other meetings, but then uh having I'm, not a secure expert. That's why I tend just to listen, but as soon as salsa one is now formally announced. It can firmly just I guess, trying to understand salsa and especially in relationship to like uh s2c2f and understand the whole nine yard. From here great welcome.

B

Is there anybody else.

A

I think that might be um so uh welcome. Hector um I think Mike had the first uh item on the agenda.

C

Sure um so I know I spoke about some of this in some of the other salsa meetings last week, but I know we canceled this one uh last week, so for I'll go over at least uh some of the stuff real quick, um so kubecon Europe was I guess about two weeks ago. At this point um uh overall, it's also 1.0 went over very well uh with with Folks at kubecon. um They were very excited uh there as well and uh for folks who didn't see it.

C

um There was a few projects, in particular Argo and Prometheus, that went through salsa V, 0.1 audits um through the cncf, so so that, and that went over uh pretty well as well, which uh which was nice, and then they plan to continue doing that now for salsa 1.0 and then there's some um there's some interesting discussions happening within tag security uh under the cncf about potentially requiring like salsa projects for something like graduation.

C

You must have you know, let's say something like this: you know salsa level, two or salsa level, three for your your build, there's some discussions about like how we might Implement that. So that's that's something! That's kind of coming around um and pretty cool um with that said, uh there was some stuff that that uh people had questions about.

C

One is um uh there's a concern around like really right now: no working 1.0 examples, um and, and how can we start uh uh getting 1.0? um uh You know what what does 1.0 look like? How can we get some examples around there, um uh or rather I should say why 1.0 examples I mean 1.0 for the spec uh for the um Providence. uh uh It's back.

C

um I know that that largely uh you know, stuff is still compliant, even if it is the 0.2 of the provenance spec but um I know folks are like hey I, don't see any uh examples for 1.0 uh of the spec there's uh still lots of questions around conformance and in particular um one of the things that was kind of uh oh actually, before I continue uh mark.

A

uh Do you mean having like real world examples, or just literally on the site, just like a an example Json file.

A

C

My bad uh via the links you can see the 1.0 example um and that's fine um I think the thing that people are trying to say is like hey: what does that kind of look like or or is there like an example here of, let's say taking the social GitHub generator um or or something like that, uh because uh two main reasons for it? One is for end users to better understand like what are they expecting?

C

What should that kind of thing look like and secondarily for folks who are building out tools, they're kind of just sort of saying hey? What does this you know? Is there like a good? You know, example here that I can take a look at for for my own tool, whether it's a generator or validator or verifier, or something like that um so yeah. That was the other thing. uh There was lots of questions around um conformance.

C

uh A lot of folks were just like: hey it's a little unclear to me. You know, there's a few folks who were um had good feedback which I uh you know around like Hey. How do we know that people are actually following salsa and not just claiming to I, said well, there's a conformance program around that um there's, uh uh there's also I, think one of the things that came out both from kubecon as well as some of the discussions right after kubecon.

C

Was this General confusion around what conformance means, um and perhaps it being very, it feels heavily skewed towards SAS right.

C

um One of the big things was based on uh some of the conformance draft stuff and based on some of what we've already seen as the examples um given that somebody who makes a claim about like I I, have a salsa conformance Conformity build system. It is very clearly I have a running system, and this is what it looks like and that's easier to do.

C

When your entire, like you know your GitHub or a git lab, compared to if you're, hey, I'm, a random company I have my own like I, have five or six different Jenkins running? Does that mean I have to have five or six different salsa conformants there, or what does that mean?

C

There's some confusion around what that that is, um there is uh and then what else was there uh yeah and pretty much lots of um questions around self-hosted like how does somebody self-host uh salsa conformant, build system and provide enough data to be conformant, uh especially given that some of the stuff might be hey, I'm, not giving you access to my you know, unlike GitHub, which can be poked around a bit because it's public?

C

um How do you sort of uh do that, and also how do you do that in a way where a smaller company doesn't feel compelled to just use GitHub, let's say or git lab or Circle Ci or you know another SAS? You know they might feel a little bit pushed in that direction, that that's the only viable, you know uh less costly option, um and so that was actually a thing that uh we were talking about.

C

Also in the tooling side that it might, uh if tooling, can make it very easy to at least provide a report or something like that of a salsa compliant build system, and so that folks can just sort of push that out uh that that might be useful. Anyway, that's um I think those were the the main things uh and then there was just some general um thoughts which was like hey they'd love to see more examples.

C

Generally, uh you know more sorts of like hey if you're this sort of company, these are the sorts of things you're doing that kind of thing which I think that'll come with time and then um a lot of questions around hey I. They would love to see examples or demos of like we tried to do a thing. You have salsa three compliance cool. This is how it we detected that thing or we detected or remediated against that that bad. You know that that attack.

C

um Anyway, that's that's pretty much all the feedback uh regarding uh kubecon.

B

A

Thanks Mike yeah I would like to um personally I would like to try to work towards addressing these sorts of things like, because actually this rolls into Andrew's next topic of like. Where do we go next?

A

um I I would like to you know, have active work on I'm kidding, because all these are kind of things we kind of knew about going in, but didn't have time to address. um This could be a like a help us prioritize. What what to work on.

D

And um I talked briefly with um Chris and Michael. Both um I know, Chris is has a um he'll, be at a conference next week.

D

I think and my goal is just one: just went to win and I'll I'll talk to some people tomorrow, um but we're thinking about doing a some type of um salsa 1.0 plus one month type of blog post, to address some of these potential issues and try to clarify some of them just in a blog post, um so maybe being able to shed some light on on some of these types of questions and issues.

D

um To to address your your question trishink, um that was one thing that we are kind of asking or Chris and I are asking each other about whether this might be better for our FAQ.

D

um I was arguing that some of these might be a little bit more long form um to to try and um represent some of the reasoning and logic behind it, um but that's not to say that a blog post couldn't also be um coinciding with FAQ update for some shorter form of these.

D

So I think that's still a valid comment.

D

If nobody else has any other um comments on on what might present I can just talk about what I was looking for, um so I know that there is a road map, but that road map for 2023 is um not specific in terms of what a plan is when we want to try and start um working on the next iteration of of salsa um and and so I I was just curious. What thoughts were around it?

D

um I know that trishank had some comments in slack as well about a common period, And so also kind of maybe trying to to think about what can be done while waiting for comment period. What should we wait to hear back from comments?

D

um Remember your.

E

Your hands up, first yeah, hey Andrew,.

D

E

So um I presented the the road map to this uh specification group, as well as the overall salsa group, and the consensus was that they didn't want to put timelines. They didn't want to make it too specific. They just wanted to say this is what's next and then or this is what we're going to work on next versus you know future, because we haven't been great at timelines, um so that was just the feedback that the group had for the roadmap, which is why it's the way it is, um and so obviously we're all volunteers.

E

So if people want to volunteer for a specific thing, I think the priorities are the ones that are up top. um So I just wanted to give you that that background, if you weren't on those meetings.

D

Yeah I wasn't on those meetings. um I was a little bit of a late Joiner to the community, so I didn't get that that full background and I I understand that there are no timelines committed for the overall priorities, but that doesn't mean that we can't identify, maybe some shorter timelines, um some shorter common periods or whatnot for being able to help grow the the specification as it's currently presented, Mike.

C

Yeah, so um I can I have one of the things actually I forgot uh to mention was um some of the stuff that that folks had brought up at kubecon some of the feedback I got regarding the build tracks, I'm, sorry regarding the different tracks um and and just to be clear overall, they really appreciated the difference in track so that they understand like why we've pulled out a lot of people. Folks had questions like hey. Why exactly? Did you stop doing two-person code review again? It's like! Well, it's not that it's bad!

C

It's that we want to separate out the build from some of these other pieces. uh I. Think generally um and I know this doesn't help is generally there. There seem to be folks who wanted a little bit of everything like you had folks who were like yeah, I'd love to see the source stuff get um uh fixed up a little bit more. uh You had folks who were asking for you know. I know we had talked about this. Maybe something like a build system track.

C

I can't remember who had brought this up uh previously, but around hey like what? What does it take to make a salsa um a salsa, secure, build system um or a build system that that can you know, uh you know, provide uh secure, uh salsa Providence, that kind of thing, so there was some stuff around that that seemed to be less of a concern.

C

They, you know, sort of felt like a conformance program or whatever would help out there, um but the other big one was uh fossil level four, even if it's like aspirational and not or a spec I. Think folks really want to know that salsa hasn't forgotten about the future steps um and- and some of these other things, because I think they were some of the comments I had gotten were like something akin to oh did was Salsa forced to to lower its standard, because other people can't hit it. I was like no. No, no! No!

C

It's it's more because of confusion around what hermetic means around you know. What does it count like what counts as repeatability versus reproducibility versus whatever um so I think those were the big ones with the two, the two big ones being uh source and like hitting um you know, L4 and then with a secondary thing of like hey, even if folks got pointed in the right direction of look at this other specification for secure builds. We think that if you generally follow these rules, you'll probably be salsa. Conformant um I.

C

Think that that's something else that folks were really asking for.

D

um Just to poke on the the aspirational comment, um I think that that one bit of feedback that I've heard is that um there's really a desire to be able to have um bars, set and metrics to find that are measurable, um so that it can be potentially continuously uh validated. That builds are actually conforming to these build systems.

D

Assuming you have some kind of platform level, maybe conformance, but then any kind of additional um requirements on top of some base platform really should be defined in a way such that proper metadata can be associated with it. In order for it to be automated in its um acceptance.

D

Do you have a comment.

F

Yeah thanks um this. This may be well anyway. I think this might be said somewhere, but, but if not, it might be worth pointing out is that it looks like incorrect me if I'm wrong, so we're certainly focusing on the build track. I think we've sort of implicitly. If you think about it, it's also can be broken into four separate tracks right as Bill. Obviously it is the package drag which I'm not sure we talked about is the dependencies track.

F

If you want to call it that and then the source track which we're planning to maybe go into salsa 2.0, but it might be worth pointing out that, if we're not planning to work on some areas, so, for example, I think dependencies track is one of them. We talk about how you might integrate as bombs into salsa, but we don't mandate. Anything I was just wondering whether it's worth um clarifying that again, we don't have to do it now, but might be worth clarifying following um Michael's comment earlier.

D

But does that speak to a process? I think that, um like what Melba shared now that first bullet process for creating tracks is that kind of what you're you're getting at is it doesn't necessarily only have to be four.

D

It's whatever is, is can be encapsulated in a coherent track, which has progress going from some zero level to to some higher level. It doesn't even have to max out at level four or something like that um is. Is that what you were you're talking about, or was there something else that you were thinking of.

F

No I think we're on the same page right. It doesn't have to be just those four tracks, but at least in my mind those are the four broad tracks and then we can split it as much as we like.

C

Oh I think David had his hand up, but I I know she put.

G

It down I was debating putting it down I I I'm, going back to the conformance the program and talking about all this tooling and and as I just at my first joined joined. The group here I've been listening a lot over the last few months, um I think I stressed I was a former auditor and that's one of the reasons why I joined salsa is to kind of talk about. How do we do the access stations? How do we?

G

How do we actually get to a point where people now like trust, what salsa is, but what people are saying about their their environments like if they say, they're, they're, three or four? What does that really mean and I'm part of me, and this will put my hand down because I'm not sure how to bring it up?

G

Yet it's concerned that we're solving the how versus the why or the what first- and it just feels like we're- you know- we've got a great we've got one of those out now and there's some questions around well, how do well? What does this really mean and we're talking about tooling and various things without actually talking about?

G

What is how do we establish the trust? So that's what I put my hand out, because I wasn't sure how to express what I was what I was feeling there when we were talking about that, um so we can just drop it for now, I'll bring it back up when I can think better about it.

E

A

That's a good point um personally, I foreign I think a lot of emphasis and questions seem to be on like how do we transfer trust across organizations like you know, you have a vendor and they are doing something, and how do you verify that they are definitely technically doing this um and you know there's: can we do attestations or like trusted Computing or something like that?

A

A

I would lean towards like that is a hard problem and there's kind of lower hanging fruit to solve that like doing and I I. Don't think we do a good job of this on the site now and I want to figure out how we could better do this I want to get more.

A

We actually we currently have the salsa that they have Slash use cases um and I would like to better emphasize that, like you could use salsa just within your organization, you don't have to convince anyone else, you're only trying to convince yourself, and so that's like um a valid thing and like organizations can do that today and you don't have to solve any of those problems, um and you know if you yeah yeah.

G

um I love security, I I think everyone should be doing security because it's the best thing to do, and this is the security versus compliance discussion in a moment, um as as the federal mandate is driving, s-bombs I see sausage me picked up speed when I saw well okay with responsible. What are we gonna do about it? Why are we doing it? How do we attest to that?

G

Salsa is answering that question for me if we're, but we can't trust people we're going to do softly because the best thing to do honestly I, don't there are organizations and teams that will um you know I I, just there's going to be driven into it. People are busy and we need to give them an incentive to. Why should they do this because somebody's gonna mandate somewhere- and we want to make sure we're alignment source- is the answer for that?

G

Why at least that's what I'm seeing I I'm, not altruistic, I love security, I, just don't think people are going to do it in the goodness of their heart.

G

Let's talk about thumbs up so.

F

Yeah, if I, if I, could add to that yeah I I, second David's, Point um I, think it might be worth taking the time. Maybe this is a blog post, but might be worth taking the time looking at ssdf requirements and how it's also I can help meet that, especially the provenance.

F

Miss something thanks thanks Melba.

E

So so there is a a blog post. We have to update it for 1.0, but there was at least one or two around that that topic of well there's this White House Executive Order, there's ssdf. How does salsa map to that? uh So one of the the tracks on the positioning group is updating that blog post, so that it is mapping to the current 1.0, because right now that blog post is for version 0.1.

E

um So potentially we can do that in this next round.

A

Kind of kind of bring it back to um Andrew's original point about what we are. You know like plans and roadmap I think um it would. It seems like it would probably be a good idea if we had a place where we could iterate on stuff. That's like not ready to be published.

A

Like the you know, the future source track higher, build levels, a future dependency track um and all those kind of like half-baked versions.

A

um That seems like that might be a good approach. Just from like a like. How do we present this information? So people kind of see like what is the current work in progress um and uh then folks that kind of work you know as as as people um you know, have an interest in working on something like oh I want to try to resolve the source track.

A

um You know we could make progress there and people can see it.

D

Yeah I think that makes sense because um just having a scratch pad or a development space to to work, maybe somebody wants to try and clarify um well, like I opened an issue where I feel like there might be some, we might have to figure out something with the the Builder ID being unique between the different salsa levels, because it could be possible that you would fall back to salsa 3 if some user specific input for self support doesn't work um so like.

D

If, if you want to try and figure out what it means to be build salsa for and maybe what that has, what effect that has in the provenance Builder ID, um then you have a space to do that without modifying the the published um specification.

G

I want to go back a little bit to the comments from kubecon tie into this a little bit um and the fact that people felt this was a SAS or be hard for the on-prem or, and it feels almost like you know we went from that into a tooling conversation, but um I'm I'm, going through as we're talking I'm kind of going through this. This spec kind of reading things from like a.

G

How would somebody attest to this, and um it got me thinking about in my my experience- was one of the PCI space I referred that a lot and things, but the PCSB says here's the evidence. You need to gather now, PCI messed up, because they didn't allow for a digital way of gathering it and having and having tools for Automation, and we can solve that piece. But if we're looking at this, the spec is there and I apologize. I missed a couple meetings with traveling things over the last few few weeks.

G

um Where are we with actually turning some of these things into? You know: how do we? How do we go from saying how you do something to? How do you say you've done that? You know how what sort of evidence is a minimum level of evidence to specify that, with or without a tool to gather it? You know how do we because I I I'm concerned people are thinking the Zone can be done with SAS, because they can they, but again, SAS providers don't share how they do the back end.

G

So I I'm, I'm, I'm, curious of that.

C

Yeah so I think that's actually one of the questions about how uh some of the stuff in the conformance program um and- and this was also something that was brought up a couple of weeks ago- I'm blanking on the name of the the person who brought this up around uh the build like something like a build system track or a build Service track, something like hey. You meet these sorts of requirements based on.

C

Let's say this evidence um uh you know, and, and that kind of thing um uh ghost you know uh like whatever is required to to do that, um and we haven't really defined really outside of saying you know, run run it in a uh trusted, control, plane and- and you should be doing some of these basic things- I think the thing that has kind of come out of that, though, was a little bit of like if I'm a giant company and I sell CI as a service.

C

It's very easy for me, as a provider to provide you know, somebody came in, did an audit or whatever, however, I provide that information I provide that to the public. um You know, whereas a lot of folks were like wait. Does that mean me as an Enterprise I need to use one of these sasses, because I can't provide enough information publicly for some reason or another, like that? That's kind of where I think a lot of the confusion lies and then also for a lot of folks who said like hey I run a small company.

C

My CI system is something I run internally, but in order for me to do you know all this reporting we're a small company. I can't do all this reporting blah blah like what does that look like? How do you make that easier for the for the end user, I think for first for these smaller organizations that are like selling software or whatever.

A

Yeah I, um like I'm I'm, coming at this from a big company perspective, um so I realize I'm, biased here, um I guess when I think about this of like when we consume software uh like what would it take for us to be confident that someone is doing this um I mean there's also better is the anime of good here um that, like right now we don't have anything and so putting it into contracts.

A

Probably goes a long way that, like you, should you must do this and like when I guess it's you know, I also think it's probably similar to how you select a vendor for anything else like if you, for example, if you're going to use a cloud hosting provider, um many customers uh want some sort of documentation or other claims from the company that they are following certain practices. This is how we architect our system. These are our procedures. This is how we do this.

A

They, you know, they'll respond to specific customer requests um to give them confidence that you know they're they're meeting all their security needs um and you're able to do that without actually letting the customer come in and like query things and look at source code, so I guess I, maybe naively, was imagining at least a good start out sort of like that.

A

um Not as much of a you know. We could start simply as a informal thing um and then um you know make it more rigid as needed.

A

And also Chris I, don't know if you want to kind of goes into the performance program.

H

uh Yeah I'm here uh yeah I'm, listening to this conversation, I'm not entirely sure what to say, because I I believe that securing a build platform is a fundamentally hard task and it will not be easy, especially for small companies and sometimes it's worth paying other companies for a service. um I. Don't I find it odd to shy away from that.

C

So I I, so to be clear, I I agree with with that General premise of hey it's hard to secure I, don't think it's necessarily that I think the thing is when you look at a lot of smaller companies that are like hey I'm, doing all the right things, but it's I don't have a whole team that can run a conformance program or or yada yada to kind of prove that to the world or how do I prove that to the world um is kind of a bigger thing and I also like one of the things that was a very clear perception from a lot of the folks at kubecon was Salsa is something that can only be handled by like they look at the you know.

C

I don't mean this like as an accusation, but like a lot of folks sort of look at a lot of the the people who are key contributors here and they go and they go and say: oh you have folks from you know: GitHub you have folks from Google. Oh great, it's I see it's something to push GCB or something to push GitHub actions.

C

That's not, you know, I recognize that that's not the case right. It's all about actual security, I think the thing here, though, is I think we have a um almost like a duty to make it sure that it's easy enough for other folks to still do.

A

I guess, like you know, kind of coming back to what I was saying about the how you select a vendor.

A

I I think if I were selecting a vendor and they were a small company um that probably switching to a cloud. Well, that's a smaller big it matters, but like there are some advantages to having a a single hosted, build provider right because, like has I as a customer, don't have to evaluate each one individually. I could just say: okay, I've already added XYZ company, if you're using them. I just know that that they're doing the right thing, um I think also.

A

I I wonder if, like especially for small organizations like.

B

A

The you know on the order of like two-digit number of people um I.

A

I'm not sure how much value there is in switching that, because a lot of this is around how we could scale security, um because, like you're trying to remove trust and like not have to trust everything for individual developers because, like I, you know across like many organizations many people it's hard to know that everyone's doing the right thing. But in a small company where you know everyone I'm not sure.

A

How much well yeah I guess: I, don't know what I'm talking about go ahead. Chris.

H

uh So, following the chat uh it, it sounds like I I should say: I'm not familiar with PCI, but it sounds like the my proposal, for the conformance program is uh sorry. Josh is in my proposal, for the conformance program uh is somewhat similar in that there there is a survey, you can fill it out yourself and publish it on your website or you can pay somebody to inspect your system and fill it out for you and give it their stamp of approval um it.

H

uh So it maybe it's worth uh look looking at the proposal and because I did in all fairness drop it Friday afternoon, so I assume nobody's read it, um but maybe that would be a good place to ground a few future discussions about conformance.

F

I should should all make a point of reading it. um I just wanted to add the point that you know between talking about like big shops and small shops. We should also not forget, maybe there's something in between like open source communities like let's say Debian um Dave probably will continue to maintain their own private bill servers. I know, Pipi has talked about um someday building their own um Wheels Bill farm. So we have to keep those in mind also.

C

Yeah and just to be clear, I actually think that that Chris's um proposal is mostly um there and I think the thing really is like yeah, as somebody who's also done.

C

Pci compliance right like there's certain things that absolutely right, if you are a payment like if you're one of the big payment processors like a Visa or a MasterCard right, you're, going to be under a much stricter sort of set of requirements compared to hey I'm, a small shop that just so happens to accept credit card payments right um I think the thing is from our end: I just think there is it's more, it's less about the actual content and more about how we message and communicate that content.

C

And how do we make sure that folks recognize through something like examples or similar so that they don't just assume? Oh I, can only do this via GitHub right um or you know in a lot of it, has less to do with uh anything other than just like. If you look at the blogs or you look at the um the projects under salsa framework, people go and say: oh everything seems to be geared towards GitHub.

C

I was like no, this there's other ones out there right um and I pointed folks in the direction of some of the other things like, because we have that Jenkins plugin that Samsung had contributed and and there's Fresca and there's tecton chains and there's all that sort of stuff. I just think um it's. It's I, think more of a communication and messaging problem.

A

Any more thoughts.

A

um All right so sounds like we should call it it again.

A

Okay, um all right! Well, it's good, seeing everyone uh we'll talk to you later online or see you next week, foreign.