OpenSSF SLSA Biweekly, 31 Mar 2023

Previous Meeting Next Meeting

⏯

youtube image

►

From YouTube: SLSA Tooling Meeting (March 31, 2023)

Description

Meeting notes: https://docs.google.com/document/d/15Xp8-0Ff_BPg_LMKr1RIKtwAavXGdrgb1BoX4Cl2bE4/edit#heading=h.yfiy9b23vayj

A

Hello, Mike, hello. How are you all right.

B

Busy very busy, uh thanks for the uh the salsa, the um blog.

A

Post no problem I need your writing, because the data I suppose is that you wrote it a while ago, yeah.

B

Yeah yeah no I I wrote it a while ago, but I only converted it into markdown I guess actually right around the end date, which was I, was like oh right. Right.

B

I forgot about that, because I was uh yeah because I wrote it um beginning of this month mostly, and that I had been asking for the um some of the folks from the positioning group to to uh to help provide some feedback and then a couple folks did and then then I opened up the PR, but I forgot that by the time I got all the feedback in uh the the date was already passed.

A

Yeah I think we should post it anywhere because they're going to be yeah. The second release candidates still.

B

A

I was going through, the I mean, there's been so much changes against salsa that you know there were so many poor requests floating around, and so yesterday I started going back to the bottom of the list and going my way back up and that's when I saw it. I was like wait.

A

This has been posted like four days ago and nobody even looked at it.

B

Yeah yeah um I know that uh some of the folks in the the positioning group have been quite busy so but I've been yeah I've been trying to kind of get some folks to take a look.

B

So it might be a little quiet today. I know some folks have off for the week because I know some folks have you know kids, who are off on spring break and and stuff like that.

B

Let me go and see.

A

If there's, let me just make sure.

A

B

I'm also trying to organize with maybe have a, maybe even have the um openssf help me out a little bit here on on the scheduling of this meeting, because um I've been with the responses I got for um the doodle poll, there seems to be like a pretty even split across um either stuff. That is around this time.

B

That's convenient for folks um in Europe, as well as folks on the East, Coast or stuff that is more convenient for folks on the west coast and uh Asia, so um trying to kind of uh figure that out and I don't think we have enough interest lately to sort of support having two meetings um but.

A

B

Yeah yeah, that's what I was thinking is is maybe do like one week this meeting one week, the next meeting, but that's that's where I was gonna, go and say: I'm, gonna, try and see if I can find somebody who can, um because if some of the meetings might be like I, don't know six or seven p.m. My time um at night and in which case I might want to just kind of get somebody who is um a bit more uh or you know somebody to facilitate that meeting.

B

um Cool yeah I, don't think, there's really um anything. I know a lot of uh stuff. That's happening on Fridays now is trying to kind of go through a bunch of the specifications.

B

um Stuff I've been doing that myself.

B

Yeah uh I don't know if there's anything from the tooling side really.

A

So one thing is we never get. You know it'd, be interesting to see if we can get any of the people involved in like the salsa provenance, generator or verifier to show up to this meaning.

B

Yeah so um they're mostly on the west coast, uh except for Ian Ian, is out in Japan, um so for them that's why I think like a a meeting, that's a bit later.

A

B

Yeah so um with that said, uh was gonna, say.

A

B

But why don't you go back over here.

A

um Good luck with that.

B

Yeah I know uh so so: um yeah I agree with the yeah, the salsa generator and the verifiers and and those things um I know.

B

On my end, uh we might have some stuff that we're going to be open sourcing soon um on some interesting salsa uh stuff, like uh you know, maybe some vs code, plugins that that can you know um highlight like based on a policy like hey, am I using a dependency that that is found to have uh you know is at least claimed to be salsa, compliant um that that sort of thing uh but yeah, I'm, gonna, try and uh because I think like Laurent is, is one of the folks who's um who's.

B

Working on that a lot uh as well as um Ian uh has been working on it a lot, and let me just actually double check here.

A

B

Know because, in terms of.

A

The meeting right I mean it's meant to provide an opportunity for all the people working in different subjects, yeah related tools and it's clearly not we don't have the critical mass yeah I mean it's mostly Fresca, and we already have a phrase.

B

A

It becomes a bit redundant and uh it'd be good to have a broader scope, Okay. So.

B

Yep yep yeah, so um yeah I'll reach back out to them see if one of them will will um run one of those meetings, uh especially if it's, if it ends up being a little later in the day and then I'm also going to still try and get some of the other folks, um because there's some folks out in Europe who've been working on a few things uh like I've been hearing some like Jenkins generator stuff and a few other things that people have been potentially working on.

B

That might be um interesting, but yeah uh I. We don't need to stick on because I think this is. This is uh all we're gonna get for today, but um I'm gonna try and reach out also to the open ssf just to be like hey. Can somebody help me maybe schedule some of this stuff um uh because I think um yeah? We all have a million things going on and myself included, yep.

A

No I understand I think that's reasonable yeah.

B

All right well uh have a good weekend.

A

Well, you too yeah later take care bye-bye bye,.