OpenSSF SLSA Biweekly, 4 Nov 2022

Previous Meeting Next Meeting

⏯

youtube image

►

From YouTube: SLSA Tooling Meeting (November 4, 2022)

Description

Meeting notes: https://docs.google.com/document/d/15Xp8-0Ff_BPg_LMKr1RIKtwAavXGdrgb1BoX4Cl2bE4/edit#heading=h.yfiy9b23vayj

A

B

C

You made it back safe.

A

I didn't travel, remember, I was actually in.

C

A

Yeah yeah, it was a 40 minute drive for me right I think it was a much much much longer commute for you know like oh yeah, uh so.

C

But I do think if I remember my statistics right, it's safer to go by airplane than by car.

A

It's true, it's true.

A

Let me post here um so Mike is going to be a little late, so I think you can all sign in here. um I, don't think, there's a lot of agenda items. I put in a couple items that I thought about you know were a bit of interest and if there's anything else that we want to discuss, we can definitely do that.

A

Sorry for the background noise, there's people cutting the the lawn behind us. If you can hear it.

C

That's cool, at least I can't hear it so. Okay,.

A

So maybe maybe the airpods are working in terms of blocking out background noise. I think they should.

A

I think a lot of people might be off or taking a break after kubecon, so it's like it might be a little bit of a quick meeting. I think today.

C

Maybe just people are confused because Europe entered or stopped the daylight time saving period, so maybe you're on one.

A

Hour late, oh, we have it, we haven't yet. Actually that's that's! No!.

C

You haven't, but we did.

A

Oh in Europe, oh that oh I see.

C

I see well maybe of confusion. Every meeting or potentially shifted depending on who created the meeting.

A

Oh, that could be what it is: okay,.

C

A

I posted in the slack Channel I, don't wanna fall asleep. Anybody else joins, but.

A

I think we can get started. um People want people join as they come in we'll see. um Okay,.

A

So um just I think it was a very like people who are coupons, so not a lot of things going on so I think, like the first thing you can just quickly talk about. Is it's like if there's any interesting talks or anything you saw at kubecon that you know worth mentioning here in the group um it is being recorded. So we can, you know some people kind of want to come back to it later. They can definitely take it and see if there's any kind of talks that they miss that were of importance.

C

For me, I think the good one were were the one I watched was like uh there was um s bomb x-ray superpowers by Brandon Lim, and there was a presentation on Fresca, which I think was you and Mike? Yes, and then the presentation of guac was pretty good as well, which was yes.

C

Yeah and then I don't remember, but at least there were a few good one, which I think was very relevant for the topic.

A

A

There's your bud.

D

A

Yeah I think there's some confusion with daylight savings and time.

C

Changing some people.

A

So people are like and Michael is Mike Mike is out this morning and you might I think he said he was running a little bit late, so I'm just running the meeting in the meantime, and it might be pretty quick um if there's any kind. I I posted the document in chat, so you can sign in and if you have any kind of agenda items you want to speak about, we can definitely do that uh right now. We're just kind of talking about you know.

A

Kubecon in terms of you know, if there's anything interesting or people should check out and all those kind of things.

D

Okay, yeah, that sounds good yeah I, don't care any topic, but yeah I think uh as I think Frederick was mentioning. There was some really good topic on that. Clipcon.

A

Yeah I think uh I think tetragon got a lot of Spotlight ebpf day. So there's a lot of talk about tetragon and multiple different talks. You know, I spoke about it, I know, Cole Cole Kennedy spoke about it in terms of integrating it with uh with witness, and there was a whole ebpf day and this people were just very interested in you know, because it makes it so easy to start capturing. You know runtime processes within kubernetes itself, because it all automatically isolates based off pods.

D

A

Namespaces so I think that was also something of interest. um I was going to put tetragon in general.

A

A

Okay, awesome I think we can keep moving forward. um So one of the things that actually we discussed last meeting was like the ability of of uh uh actually no sorry. This is first that's about or for salsa attestations, um but the other thing that we were also looking into was in terms of s-bombs right. How valid are s-bombs in terms of like hey like? Are they capturing their information? Are they worthwhile like? Are they you know? Are they just doing it for compliance sake, or are they actually capturing information?

A

That's actually useful, for you know for Downstream and so forth. um So one of the things we're talking about actually at the CDF was and I think Justin is I.

A

Think he's the California time, so you might not be, uh might not be able to join us, but Justin Abrams from eBay uh had a great suggestion in terms of of generating an s-bomb scorecard, and he actually has that posted in the salsa tooling um stock channel here uh I think he he just publicized one of the things that he was working in working on internally quickly. Just uh and I can post a link to that here in the in the channel or in the chat oops.

A

This is that scorecard piece.

A

um So what so? What this is basically is meant to do. Is kind of act like you know how scorecard acts for repos and so forth is like hey. Can we can we grade how how good s-bombs are in terms of? Are they valid to the spec? Are they capturing information that that we need um you know of the containing hashes and so forth, like how you know? How good are they um so this this?

A

This gives us an ability to you know if they, we kind of know like yes, some of these tools are generating better s-bombs than others. How do we fix them and so forth, and we can you know grade those uh keep adding features to it and keep creating different things like spdx and Cyclone DX I. Think for now what he did in his this POC is just like start capturing an xpdx one and just see okay. What information is it is there and um what is missing?

A

Basically, so that's the POC I'm, nothing that I'm interested in helping him out. So we're discussing and I'm going to work on it. Probably this afternoon and start adding in some more features, start capturing other information and then I think we definitely want to have some kind of a grading schema. So I think we'll take a initial stab at figuring out what kind of a grading scheme we would want and then and then go and then you know come back to the community kind of review that and see.

A

If people think that, if that makes sense.

D

So is it the idea, is you need to have a validator kind of thing like validate the s-bomb eventually so.

A

Now validate I think yeah more of a scorecard. You know how scorecard kind of does works right now.

D

Yeah kind of do the same exactly based on that information right, it says. Let's say 50 have license, and this thing right, so it should be. What do we do? What action do we take.

A

So uh what I think what we want is either you can start creating issues or or start you know, fixing those Upstream projects be like hey look. This is not creating the proper things, maybe there's something so there's an issue with the Upstream project or right. It kind of gives us more evidence to push back on some of the projects. Being like hey look, you guys are generating s-bombs, but they're, not they're, not as complete or as accurate as we need them to be kind of thing.

A

So maybe we can make some kind of um right. We can make evidence-based requests to improve it, uh improve open source projects, yeah.

D

That would be awesome. Yeah yeah, we at least know that we'll at least know the gaps right like exactly.

A

D

I'm just saying 80 percent have cpes, so we know which doesn't have CP right right now, yeah right.

A

So if you can start like hey, just have an automated way of just validating which this just starts, throwing a bunch of s-bombs in there and see what it looks like right. Then we can have a much deeper understanding and that's I think that's that's what we're trying to get to so and yeah like we can start fixing them I.

A

Think because I think the more quality data we have right, the better things we can do with it and if they're just s-bombs are being generated just for compliance sake and not including much information, then it's not helping anybody right. So but that's that's the overall goal for this project, um so it's very much in his infancy, like I, think uh Johnny Abrams is literally started working on it on uh you know yesterday or something so we're I'm.

A

Definitely gonna help him out with that and if anybody else on the call is interested, you can definitely join up um and there's a start, hacking or hacking our way through it.

A

Any other questions on that.

A

All right, any other topics that we want to discuss. That's all I had actually um so it can keep it short. If there's any other topics, we can definitely chat about it. Quick.

C

Nothing for me.

A

And I apologize, maybe I should have done this in the beginning. um I'm, not sure if you are new to the call. But if you would like to do a quick introduction and we can do a quick intro sure.

B

I win Microsoft for more than five years now and uh I recently joined this open source security group, so I'm just exploring my various security groups right now. So this is my first meeting here actually here.

A

Yes, okay, awesome, perfect uh yeah! This is this. This there's a bunch of salsa meetings, so this is one of them um and there's there's also an overall salsa community meeting that happens.

A

uh I, don't have it on my calendar, like someone else knows exactly when the community meeting happens. Oh uh salsa, bi-weekly, sync, okay, yes, there! It is so that's gonna happen. Next Thursday, okay at 12, 12 p.m. Eastern.

A

um So that that's a more overarching meeting that people kind of come together um and talk about, you know the various things that they're working on from these various different working groups right. This is a salsa, tooling group, and then there are positioning and and so forth, there's a bunch of other ones that that people kind of join and talk through different topics.

A

um So this one is specifically on the actual tooling around it in terms of generating salsa, and you know how we can improve it and so forth what our gaps are.

B

Sure, okay, thanks.

A

Okay, all right I think we can end this early. uh Thank you. Thank you. Everyone for joining you know get I. Think we'll definitely be have a much greater attendance next time uh once everyone's clocks are in order and keep confit is out. So all right, everybody have a good day.

C

Thank you, bye.