OpenSSF SLSA Biweekly, 3 Jan 2023

Previous Meeting Next Meeting

⏯

youtube image

►

From YouTube: SLSA Positioning Meeting (January 3, 2023)

Description

Meeting notes: https://docs.google.com/document/d/1tpPOXVzNSwtpWA7cXhTPLAO6HIP50obUvoP85XqgVHM/edit#heading=h.yfiy9b23vayj
SLSA repo: https://github.com/slsa-framework/slsa

A

B

Can you hear me.

B

Oh, you don't have audio yet. Okay.

B

Hey Laura, can you hear me.

A

Hey yeah, can you hear me yes, hi.

B

A

I'm good, how are you Happy, New Year, doing yeah.

B

Happy New Year, uh we haven't talked in a while uh at least I think you're the same Laura from red hat right yeah. That's me, yeah, okay, I just want to make sure you're, not a different Laura.

B

um uh Hopefully your uh holidays were okay and your New Year's was fun but somewhat uneventful yeah. Anything too crazy, yeah.

A

um I'm still at the in-law's house, so uh well, I think we're leaving sometime uh by Friday at the latest. Kids go back to school next Mondays.

B

Got it got it? Okay, yeah, uh unfortunately, mine started today, uh and uh it was rough getting up at 5 45 this morning, oh wow yeah, hey Bruno, thanks for joining okay. uh Let me where's the chat I'm. Looking for the chat um when I share my screen, I can't quite see all the features there there. It goes okay, so if you can sign in um for today's agenda, um I didn't have a whole lot. There were a couple things that we did um discuss: uh I can't unmute myself, okay, yeah, no, no worries Bruno.

B

um There were a couple things that we we talked about before the uh the Break, um but we haven't had another Supply chains, Integrity working group meeting or a salsa meeting, and so the outcomes of those two meetings are going to be crucial um to what we do this year.

B

um So we we still are up in the air on roadmap for 2023 right, there's, a lot of dialogue that has to happen, and there wasn't enough people um on those two meetings the week before the break, um and so we have to wait for those but doesn't mean that we have to necessarily wait on doing things.

B

Just the majority of the stuff, um so uh one of the things that we talked about uh Laura um is having more alignment with not only the supply chain, Integrity working group and having them give priorities right like this is what we should be accomplishing um and then each of the working subgroups under supply chain Integrity are all working towards that goal um and then, if like salsa, is special because we have even subgroups under salsa and those three subgroups, tooling specification and and positioning that we should be working together more tightly because one group doesn't know what's happening with the other group um Etc.

B

So there needs to be more communication, more thinking and more alignment on the vision, because, right now the Visions are not in the same direction: um they're all looking one's looking North, the other one's looking South, the old one's looking East and West. So um that's at least my goal and I think I got consensus from some of the folks on this call, as well as supply chain integrity and some of the salsa of some of the folks that were on, for this also call that they agreed right.

B

Let's, let's try to go towards the same vision, um but we again we need consensus uh across the the different working groups. um So questions on that Laura, no.

A

That makes total sense, I.

C

Know we've been struggling.

A

To get um representation in all of the sub groups, and um so something we're doing this month um is we're coming up with a plan like how we can um align our our team objectives to all the various opennesses that working groups and so um and that way we can can focus our efforts and have the right people in the right meetings. So yeah, that's just kind of more internal stuff, but um yeah we're hoping to get more representation by making sure that our contributions, but we're not just you know, live from the wall. Yeah.

B

Yeah make yeah, it makes sense. um I mean I've, not been it to any tooling meeting the first one was right before the break and technically it should have been canceled so like within three minutes. It was canceled, so I was kind of sad. It was my first one of the year, um um but uh I I can understand right, it's very difficult for one person, let alone you know a couple of people to make every single meeting um so um so yeah. So that's one thing.

B

The other thing that um that we could start working on one is the web page revamp not web page revamp. There's a landing page on openssf that oh I forgot, her name already, uh I think I have it in the notes. Where is it um Tracy Miranda um working with Tracy Miranda to start that work um I? She might be back from vacation. So that's like number one on the list is um reach out to Tracy I.

B

Think I'm writing in Miranda for open ssf's landing page for salsa, um because she reached out towards I think in December sometime to help us. So it's not going to replace. Also that Dev, it's just. She showed us a six door, one a six door, nope, sorry open, ssf, six door.

B

This is the open, ssf, six door landing page, um and so she wants to create something very similar for salsa. um So we can start getting work or working on that. The other thing is around conferences uh and making uh who was it was Laurent. Was it Lawrence Bruno who Laurent I? Think Lawrence was the one that.

C

Oh yeah, I, I, yeah, I I can't remember the name as well. Yeah.

B

Yeah I think it was Laurent. um Let.

C

Me see it wasn't a slack channel right.

B

Yes, it was um all.

A

Right I'm, looking I'm.

B

Looking ah I just saw a thread this morning, because Josh responded, Lawrence, Simon, yeah Laurent Laurent, maybe is how you pronounce it. I might be butchering his name, um Lawrence Simon um I think he might be from Google. He is from Google um he wanted. He was talking about. You know more participation like which conferences are we aiming for again? That's that larger discussion. What's our vision, um but we know that in open source, Summit, North America, which is in Vancouver this year, there's always a supply chain.

B

Security, Pond openssf has their own little thing, um so that would be a good Avenue right to present, not only as a group about salsa um but about different topics regarding salsa, so I think we can brainstorm right on that like how. How many talks do we, as Physician Group as an example or salsa in general as a core? How many talks do we want to submit right? Who is going to be part of those talks? uh We we can plan that, because positioning is all about evangelism right.

B

um We may not be the one talking, but we can still help coordinate that in in essence, right or trying to figure out. If can we have a salsa con right? We would potentially organize that. um So at the very least, we can start working on topics for ossna, which is in May I think this year. Let me see uh open sources.

B

Between three yeah and I think the call for proposals just went live right before the new year.

B

B

Yep and and Sunday February 5th is the last day, so we'll definitely want to start focusing on that. Like what topics we want to consider um in terms of soft, so obviously there's a 1.0 right, 1.0 update, but that would probably be like Josh and um Mark right. Something like that.

B

um There could also be I was thinking about this before the call. It's also for dummies right, I feel like we could have this also for dummies um session right that really like brings in the newbies uh I, find a lot of the times. It's also discussions are just to in depth, and some people don't understand. Salsa number one, um and so first you have to sell it.

B

Then you can start diving deep into it. So potentially we can do a salsa for dummies, um not sure what other thoughts you all have on you know. What can we do in terms of talks at conferences? They could be panel discussions as an example Russian.

A

Yeah I did um a presentation during one of our security topics. uh I did like a salsa overview um back in May.

A

um It was when I like I first started um like dipping my toe in the water and it it actually helped a lot for folks, I'd, never heard of salsa before um yeah.

A

I could let me double check. um I created it um I I, don't.

B

Make sure it's Lots yeah there might.

C

A

C

There might be.

A

Like one slide, that I can scrub out, um but it's and when I say it's basic, it's like the like you're talking about well similar to what you're, referring to as like this. Also the dummies like what does it stand for? What does it mean like who?

A

How is it founded and like what are the different levels so I can um yeah I can send it to you after I um I'll just make sure that it's okay, yeah, yeah I, think there's one hat that a one um slide, that's specific to what does it mean to red hat I'm like um I, can take that out. Yeah.

B

um That's Bruno yeah.

C

I won't think that it's probably you'd be really useful. It's like, for example, kind of uh salsa um Hands-On or to have a demo. Okay, let's show you how to implement. Let's go salsa level, two level, three whatever and you put some tools and you demonstrate how to do it, because when people have this Sense on the the tools to gather in the walking reach in that lab, okay, now I know how to apply my case. Otherwise, the conversations a lot more than the abstraction layer.

B

Yeah no I I love, it um I very much a Hands-On person if I, if I can't physically do it myself I had no idea what's happening. I I need to learn by doing uh so, I I'm I'm with you right there so yeah. We can have like a sample repo right that they can pull. uh You know an application from and then doing you know how to protect or how to be like what it's also level. One maybe uh looks like versus social level two and for social level.

B

Three and four I think we might have to get creative in terms of like the ephemeral environments or something so we could potentially do something like that.

C

um Even if you bring the people to say well, this is a salsa level to to add level three. You can go and discussion, but you demonstrate already what it's the the in the Twin to the flow.

B

Yeah yeah one two uh demo um and then salsa three four things you could do not three-fourths.

B

um Three and four two.

B

Okay, so I think that's a good one, um social for dummies. The this would be like you know this right. What's the business problem is trying to solve right, like you know, kind of, like our block right as a developer, why do I care yeah, right um Dev? Why do I care maybe see so what why do I care? Maybe there's like a couple of personas that you put on a slide or something it's like.

B

This is why you care this is this is what it's going to help you with um and potentially we could have the blogs done by then I, don't remember! When Mark I had it's been a while, since I've been to a specification meeting, um I, don't remember when spec one is due or when they want to Launch.

B

um So when is 1.0 launching, because then we can have the blogs to reference right, that they go more in depth per persona, um but at least we can reference them um in in here. In a talk like this, um I need to can I at Mark Mark uh nope I cannot.

B

B

B

And this is the other thing Laura um what we're trying to make sure that the Sig leads and salsa are connected right. We have no idea what each other's doing. So we need to be more in alignment um or at least have a representative from each of the uh the uh the groups be in each other's meetings so that they can carry the message back kind of thing, um because once a month in the salsa high-level meeting is just not enough right, uh so many things happen.

B

So many things change uh it's just it's too late, um okay, uh okay, what do we think about a panel discussion? What can we potentially?

B

Maybe the panel discussion- would be organizations that have gone from level one to level two that are part of the social Community right now.

B

um I think so I think Aaron Aaron from Verizon yeah.

C

That's the only one that I remember.

B

um I forget what he but there's others, because I've seen demos.

C

B

uh Panel discussion like we could facilitate the questions right to say you know what was it like going on your journey through XYZ blah blah right? So we can do something like that.

C

Yeah I know that it's internally or Intel uh there is a discussion group about to implement cells as well, but I I'm, not sure that it's UB prime time for that time frame. Yeah.

B

That's a good good point: um um I I know that there's been efforts in turn, I know: Red Hat had an effort um Laura, so it's possible that red hat could be part of the panel discussion.

B

um I know we have something internal and I know that something was achieved in December, I, just don't know and I, don't know if it's public yet um so I. You know we can definitely try to figure that out in an Intel. Will it be ready right.

B

um So we can have like you know five I'm guessing Google is going to want to be part of this. Oh.

C

B

C

I I, don't know if you saw as well I think that was Google next I think that was November. Last year they announced that uh there was one Services they have in the gcp that it's uh salsa level through level. Three I don't know. If you remember that if you saw that.

B

I I didn't get to look at it, but I saw Jay shared it with us. I remember it was in this meeting that he shared it. So I didn't get to look at it yeah, um but um you know now that I think about it, because Google created salsa, initially right, yeah, so I I feel like their their lens. Although it's valid, um they started it, and so they had kind of a a leg up um versus people that had their their supply chain, security or their pipelines kind of situated.

C

Because the the product that they developed, that you have the the developer desktop, is sit in the cloud and all everything that you need. It's also in this bubble. That's the reason that we're calling themselves salsa level three, but uh they didn't share enough uh details why they, because, as far as I know salsa level, three, it's not well defined. Yet that discussion.

B

C

B

Yeah, it's not, um we can say salsa level version 0.1 right so.

A

B

Like early like early adopters, early adopters could be like Google right, um but then uh uh I don't know what to call the rest.

B

um I mean they're still early adopters right, but they're they're, really the the company that started it. um So let me let me take out early adopters. I'll have to think about how we want to word that right um because I know Verizon has one I can see if the IBM folks want to talk talk to it, um I don't know not sure and then I think uh no actually I'll vote. Chuck and Laura. Will you be able to check for a red hat.

A

Yeah I can check your record, and um this is for um the deadline is February 5th, where submissions companies yeah.

B

So we don't have to have the content by February 5th. We just need to submit the proposal, and so if they do want to participate- um or they know that they can share stuff, um then it would be easy to just add them to to the participant list. But I know a lot of times uh things get swapped in panel discussions, um so I, don't I, don't think it's going to be a big deal.

B

If, like you know, one person from Red Hat was going to do it and then all of a sudden somebody else I think it's more. Adding a new new company might be difficult, but I'm, not 100, sure, okay, yeah, um all right well I'll, be ready uh and then I need to ask Aaron I need to ask Aaron if he is willing to be part of the panel okay.

B

What else what other topics do we think we can talk about? Oh, oh um I was starting to write it and then I I can't I can't remember. I was come. Sorry I was confusing the acronym for the nist S uh cyber security scrm. My cyber security supply chain risk management framework.

B

um It's the Microsoft thing that it's S2 c2s is that right.

B

I think it's F2 c2f yeah.

C

It's something like that.

B

Yeah, um so that's going to be a good discussion, um but it could also be plus Fresca right. Basically, this is a supply supply chain, Integrity working group session right.

B

um You know what what it is, how it overlaps Etc. um The other thing that I was just thinking as I was writing that maybe there's a deep dive.

B

um Well, not a deep type, a road map session. Do you think that would be helpful for people to see where we're going? If we do like kind of align ourselves properly for 2023 to try to recruit more people to kind of, join us and help out.

C

Yeah as if you have enough to fuel a session- yes but um I'm, I'm, trying to figure out if it's not something that should be in another section like, for example, it's also for dummies, maybe another name like a social review in the future, but uh just try not to create too.

A

C

A

Tracks yeah, maybe you could- that could be um like the closing of that salsa overview dot next or.

B

And actually, the road map could be technically a slide at the end of almost.

C

B

Of these talks right um so we're not ah okay um code map slide.

B

So we can add that to like all of these, uh not the panel discussion, though um Hands-On demo.

B

About my roadmaps, like.

B

I think this is going to be like the vision, slash overlap for the salsa, S2, c2f and Fresca overlap, and to use one versus the other, which is part of the overlap right like how do you right?

B

How do you use salsa versus when, when should you use salsa versus S2 c2fs? And you know uh it's not Fresca, that's not how you pronounce it. Is it like this? Let's go frsca.

B

Yeah, of course, let's see um what else do you think.

B

I know they have those um they're not talks, but they're like ask me anything sessions or something or they're like kind of on the side or like you, have the expert lounge or something like that, and people talk about that topic.

B

I'm not sure I remembered that, because it they they had it at ossna in Austin. Here.

B

um And so we would have to have like expert Lounge. We would have to have participants participants.

B

um Participant list right, basically, volunteers to be present right so that anybody can, if there's an expert Lounge that is right, um but I. Remember there being one uh this past year.

A

So that um that's different than the panel discussion, because it's like an open Forum of like q, a is that the.

B

Expert Lounge is more of um like anybody can go, it's not a dedicated room just for that person. It's a room full of experts for different topics and they had like a table sign. That said what topic it was and then you can just go to that table and you can just have a random conversation and then other people can listen and then you.

C

B

And go as you please um that's what I remember it being um I, don't remember why I know that I just remember that I was there but I, don't remember what who I asked or what I asked. But I was there. um So if they do have one that that could be uh something to consider.

B

B

What about have either of you been to open as a soft day.

C

B

Usually it's yeah I I. Did it virtually uh it's the day before open source, Summit um I, don't know if they're gonna do it this year again, but it's literally just open, ssf and like there's, you know different presentations, so potentially uh either supply chain, Integrity working group or you know, salsa- could have a talk.

B

um I just don't know what that talk would be.

B

But I I feel like there has to be one I. Just I'll have to go: ask. um Will there be an open, ssfd.

B

ah I forget who, who should I ask for that? Does anybody know.

B

um It's like, oh, uh what's his name.

A

Would it be like on the on the agenda? Is it attached to like the event itself or is it like a separate yeah? It's.

B

It's like a separate event like when you go to register um I. Obviously, I haven't registered.

A

I don't know what this micro conference events are, but I I wonder if it would fall under that category.

B

No I, don't see. Oh let me let me look for open ssf. Oh, uh is there another one? That's only one um supply chain security con yeah last year, when you registered for the event you could register or open ssf during that, and so then your tag would say that you were registered for open ssf day, um but I never saw it on the website. The only reason why I found out was because somebody mentioned it on a salsa meeting and I'm like this is really badly advertised.

B

You would think that it would be on the main page, but it was not um so I, don't know and I don't think they have registration open. Yet, no, they don't so I can't tell um open source leadership. So I wonder if it's this or is this just a subtract.

B

That's just a subtract so we'll have to ask: maybe we ask the tech I think that or maybe they make the decision they.

A

Had this Linux con, the precursor to open source Summit and the event for Linux Developers.

B

Oh, where did you find that.

A

Linux con this says the precursor to opens or Summit and the event Berlin, but that's for developers. No, that doesn't sound like um what year.

B

Yeah I, don't no I I want to say: was it jewelry, uh jewelry, um David, wheeler, David wheeler um need to ask someone um if it's being held again, I, don't know if it was decided or not um so we'll have to ask.

B

What other thoughts do you all have foreign.

A

Open ssf Summit site, so no no additional amounts just uh well.

A

Circle back around um the next time, with a name if we are going to be um submitting for a panel as a panel member, get that conversation going on.

B

B

Oh tell us: your journey I'll just say tell us your journey.

B

B

I think this is good uh for now for the conference topics. Now we are on January 3rd, so I'm uh I need to look at a calendar.

B

Foreign ask me later: um actually this meeting wasn't on the calendar. It was on my calendar, so maybe there might be a reason why some people aren't here, um which beg? Is there other? Oh there's not one for next week, yeah.

C

B

C

Don't have my agenda as well for next week. There is another point.

B

Okay, uh okay, this.

A

One's bi-weekly, though, right.

B

This working session- one is um uh one of the things I wanted to do- was do a new vote for positioning timeline time day um to see time to see if this time and day still works for people I know. Originally, this was not the majority time.

B

The majority time was another day another time, but there was one or two individuals that um they wanted to include because they participate a lot, and so they decided on this time. um So I think we need to do like a new boat for time and day. uh So I'll have to ask Mark to help me out with with that survey, he did last time um and then create a calendar invite for next week.

B

Okay, so these are to do's.

B

um I didn't yeah I, didn't notice, I saw it in pink and I. Just didn't. Think I I really did not think about it and until I just unclicked. This I'm, like oh we're, technically not supposed to be meeting um so not now, I feel bad uh if I think was it the third Sunday February 5th, so in reality the third January 3rd is kind of the the last day that we could. You know, work as a group during business hours, kind of thing.

B

B

I would think that's enough to create those proposals. um When would we want to have the first draft?

B

Do we think oh I'm, in the wrong number hold on? uh Do we want to have the first draft by the 24th, or do you think that's too late too early, because the third doesn't give us much fun way.

C

I think 24, it's uh the right time, so this doesn't work. We still have time.

B

Yes, like a week and a half Okay, so I'm gonna have first.

C

B

B

Okay uh and then submit.

A

So we would submit it uh as one or if we were doing something as a panel would what I had would we have to submit that separately?.

B

No uh so the panel discussion, when you go to sign up for a talk, it'll ask you: if it's a panel discussion or not and and who are the other attendees, um so it'll it'll ask when you go to submit um okay, yeah so yeah. Let me see.

B

uh Review final review.

B

How do we want the final review to be.

B

Done by the 31st, because there might be changes that have to be made by the Third.

B

Line by 131 submission uh one three: oh two, three.

B

I'll put that look: okay, um Okay.

A

B

What uh so, I think that that's good dates to remember schedule, announcement, March, 14th and then, if the topic is chosen right mid-march, we would know if, if it's a go, a no-go um I still think um some of these topics are good to still develop, um maybe for other conferences, even if it doesn't uh pan out, we could still reuse the material um in, in my mind, right we would probably prioritize some or over the other, like I.

B

Think that's also Hands-On demo is a really good one like if we were to record it like different YouTube videos or something to say Hey. You know, let's, let's go through it this time or with this repo try to do it on your laptop go with this repo try to do it on your laptop, so we could potentially still do something like this I know they have um code for salsa, it's like a salsa demo, but it doesn't really walk you through it.

B

um Unless there's something I'm missing, uh there might be a Blog somewhere that I didn't see, um but it would be good to have like you know, a demo kind of like for dummies, also for beginners, and things like that right.

B

B

B

Any other thoughts or concerns questions to reach out to Tracy.

B

B

Okay, well, there's nothing else, and we can end today's meeting early um I'll probably go in and see if Tracy is available on slack and start reaching out to her for this ossf landing page.

A

Yeah um I will I'm noticing now that everything is branded um for the overview I made a copy of it. So I can I'll take a stab it just like making it a more generic slide deck, and uh do you guys use Google slides, go to the top.

B

Yeah yeah, you can just you post it somewhere and then uh you can send us the link.

A

Okay, yeah I'll um uh work on cleaning it up and I'll before we meet it again,.

A

I can just build on it. I guess yeah.

B

Awesome well thanks folks for joining happy, New, Year and uh hope you're, nice and refreshed uh for the rest of your work day. Thanks. Okay, bye.