OpenSSF SLSA Biweekly, 6 Dec 2022

Previous Meeting Next Meeting

⏯

youtube image

►

From YouTube: SLSA Positioning Meeting (December 6, 2022)

Description

Meeting notes: https://docs.google.com/document/d/1tpPOXVzNSwtpWA7cXhTPLAO6HIP50obUvoP85XqgVHM/edit#heading=h.yfiy9b23vayj
SLSA repo: https://github.com/slsa-framework/slsa

A

Hey good afternoon Jay, or maybe it's still morning for you, hey.

B

Mama yeah, it's 11.

A

Oh, it's 11 yeah, yeah, West, Coast, I I, forget how's. It going.

B

You know what coming close to the uh to the end of the year and I'll be we'll be lucky if it's not just us, yeah.

A

It might be, it might be, um I know uh also, people are getting sickness.

C

A

My entire family was sick, uh starting Thanksgiving, so um I was the last one to catch something. uh So it's it's been rough and I see people getting knocked down um slowly but surely uh for us it was RSV, um but uh I know some other people are catching the flu and so between sicknesses and vacation I'm, not sure why people won't join, but they'll probably won't join for one of the two yeah.

B

Yeah I'm all but ready to cancel all my meetings next week, because people are just disappearing. Yeah.

A

Yeah I was gonna um put that on the agenda on what uh what we think we should do for the uh for the positioning meetings, because there's the 13th, the 20th and 27th I think I feel like the 20th and 27th we're not going to have anyone um and actually I see. Most of the meetings are gone so.

B

Oh yeah, most of them even gone that week and you're going to see a lot you're going to see a lot more of these meetings disappear uh next week as well. I mean it's just I I mean I, don't know about you, but when it comes to when it comes time for the I usually disappear like in the middle of next week. I'm here, oh.

D

B

You want to send me a slack. You want to send me a DM or something like that. I'll respond to you, but uh you know I kind of taper off like taper off yeah.

A

So definitely the 27th I I'll still be around the 13th and the 20th.

A

um But you know if it's just going to be at me on the meetings, then there's no point right um so uh and what about the third I feel like people are gonna have that Monday off they're they're, just gonna, be starting back work on on Tuesdays, so I'll.

B

Be around I'll be around on the third I. Don't I don't take that that week, I don't do anything like that! I get I come back and I get back so I'll be back on the third.

A

Hey hey Bruno, thanks for joining.

A

um Okay, so let me for the 27th I actually don't have it on the calendar. So that means that it's not nothing scheduled on the 27th. So it's really just the 20th and the third that we're we're wondering about, and maybe the 13th I'll be here next week. It looks like most of it looks like you all are still having your meeting I wish.

A

I could attend that I have a volunteer session right after this meeting, um so I have to go, drive there um and be there by 2 30 at central time, um so I'm never able to to make those meetings. Unfortunately, um but it looks like you all are, are having that next week, but not the 20th.

A

What do you think Bruno um in terms of canceling uh meetings, because of vacation and stuff like that, coming up.

A

You're on mute, if you try to talk or no.

A

He might have stepped away.

A

A

I'm going to keep for now, I'll keep the 13th and the 20th the third, um unless uh Bruno.

A

Thinks he might be able to cover it, I'm worried about my family. Getting sick, I have visitors coming out and the baby always gets sick. So um it says that the host doesn't allow a mute. What uh I I'm, not the host, so I I, don't know I.

C

B

um Oh geez, I, don't know, I, see yeah.

A

I I'm not host I can't claim host, unfortunately, maybe try to rejoin, because Jay was a muted and I was muted earlier and we were able to unmute.

B

Yeah you gotta sign in to claim host and everything like that. I wish David joined to something like that, because David is always a host but um yeah I'm not a host either.

A

B

Maybe hey Bruno, maybe if you uh joined again, unmuted you'd be you'd, be good to go. um Maybe Jeff. Can you unmute.

A

D

A

Looks yeah okay, I.

B

I think it's just I think I think it's just uh discriminating against you. Bruno.

A

So Jeff I know Bruno will come back and he'll, probably chime in um we're talking about the next couple meetings. If we should keep them or cancel them, I'll be here the 13th and the 20th, um the 27th there's nothing on, but then there's a third so we're just trying to figure out. You know who's going to be around. Are they actually going to join? If not, we can cancel some of the meetings and give people you.

C

A

Vacation or whatnot right are you there Bruno, no.

E

A

E

Was getting a weird message that the host is not allow participants to mute themselves? Is he what yeah.

A

Yeah I'm not I, yeah I'm, not a host, so I can't start the recording I can't stop. The recording. I can't do anything. Okay,.

D

I was going to say you could have a lot of fun with this at this point, just mute them really quick.

A

So and I can't expel people either um so uh so yeah from Bruno and Jeff like what are your thoughts on the next couple of meetings and whether or not we should keep them or or um cancel them.

E

I mean the couple of meetings of working sessions or positioning.

A

uh The 13th, the 20th and the third, the 27th there's nothing um but the 13th 20th and the third. There are meetings but I, don't know how many people are going to be around well.

E

13 I will be here so for me there is no problem. um 20 I do not know, to be honest, still.

A

E

27Th I I doubt that it's you're going to have anyone. Oh.

A

If there, if there's nothing scheduled.

E

Okay, nothing's.

A

On that calendar that week so.

E

Yeah and the third uh I mean I I'll, be here: I can't attend this wow I can also uh host that meeting. If you need it, but.

D

Yeah personally, I think the third is going to be kind of tough just because for most of us, I think it's gonna be our first day back. Yeah.

E

A

E

Way, I'm good I'm.

A

E

That was not able to attend the last week, but I I realized that I got a H1N1 flu. So oh.

A

Don't worry, I wasn't yeah I wasn't around last week, unfortunately, because uh my entire family caught RSV and.

E

A

He was quite sick.

E

um The same here, everybody in my house was sick as well with H1N1 and uh I. I saw your message, but it was too late because it was.

A

E

A

Yeah yeah um no, no worries it. You know it happens, um so the Third we could potentially cancel the third. um It looks like even the the well Monday's a holiday, so it makes sense why, on the second there's, nothing even there's not even a tooling meeting on that on that Friday. So maybe we give people actually I, don't see any tooling meeting over here. Oh, it looks like stuff expires because I don't see positioning meeting, that's weird. I only see the working sessions.

A

I'm, looking there's nothing on the 10 there's something on the 17th. Okay, I'll have to fix a calendar. It looks like only the working sessions are on the calendars now, um so I'll have to to revisit that. um So there's something wrong with the calendar. Maybe that's. Why there's nothing on the 20th, maybe no no 27.

A

yeah! It looks like it um okay, so let me let me cancel this one.

A

Does anybody know how to properly cancel, because if I delete the event I think it deletes it all.

D

I think when you, when you go to delete It'll, ask you if you only want to do this one yeah this.

A

A

Submit okay so canceling that one! um What about the 20th.

A

I'll still be here.

D

Yeah I'll still be around.

A

Okay so no meeting on the 27th and the third, but we'll keep the rest of the meetings. Okay sounds good. Let me write that down. uh Cancel uh 27th and January 3rd excuse. The meeting.

A

A

um Oh, if you haven't signed in please sign in yeah here.

E

A

um One of the things that Josh those two things that came up in the slack channel one was from Josh about the definition of you know: packaging ecosystems, um so I thought this was a good one for us to go through, because it's somewhat about positioning right. If we think about the different um personas right packaging ecosystem, they mean something different, and so we we should probably chime in on this of like.

A

Do we like package, ecosystem or packaging ecosystem Mark suggested you know, maybe distribution, um I, I didn't like distribution because of you can distribute software right like once. You have something right as a software vendor, you can distribute it, and that means something different um than a build environment right um and then the software development.

A

um So I was not a fan of the distribution, but it looks like there's also because Linux distribution, python distribution right right um that that could be misconstrued, so try to get thoughts on you know is there.

A

Is this the way we should call it, which is I, think he said package a packaging ecosystem and I can zoom in um this is a definition in the in the GitHub issue.

A

So is this good or do we think there's something that should be.

A

um Should be included, or maybe reworded in here.

A

A

I feel like most of the time when I hear ecosystem I. Think of you know npm right or uh python: I, don't consider GitHub an ecosystem, um but I think someone from GitHub said that they do use.

A

A

This person from GitHub they landed on package ecosystem as the least bad option.

A

So GitHub calls it a package ecosystem.

A

um So if you get a GitHub URL, does that mean GitHub is considered a package ecosystem.

B

Oh God I feel like I feel like the word ecosystem is too ambiguous like I I got I, don't I I, don't I I can't I I cannot get with ecosystem in this. In this context,.

E

I agree, but do you have a better term.

B

Honestly, I I, don't but but I but I think, but but if like, if I'm, if I'm walking down the hall and so and I hear somebody say: distribution, ecosystem or package ecosystem, uh the the natural course of action is well. What do you mean by that and then, when they tell you what they meant it's like? Well, why don't you just say that then, because I I.

E

Agree: yeah I read it I, read it twice and say: wow what it's exact mean: I have to come back and try to read again yeah, but.

D

E

Cannot come up with a better name as well yeah.

D

Because to me ecosystem means tight-knit, Partnerships and I. Everything is really contained.

E

A

Network or interconnected system yeah.

B

You see it's like something that can't be explained well enough. You just throw the term ecosystem in there and I think this needs to be very. uh It doesn't have to be super specific, but it's got to be specific enough. That there's no I mean we're talking about something that people are going to um uh attest to right about me again. You can't attest to an equal I mean that's that could be any damn thing: Jesus the testing to an ecosystem.

A

So this is the example that they gave online a complex, Network or interconnected system, see.

B

Even even in even in that word in there right, a packaging ecosystem is a set of conventions and tooling for package distribution. Every packet has an ecosystem, whether it's formal or ad-hoc, those two sentences right there. They can't that can't be more ambiguous than that.

B

So you're talking about a formal or ad hoc set of conventions or tooling for package distribution. That's not even that's not even secure by Nate, but by the nature of that there's, not there's no security. There there's no security in an ad hoc or formal right. You need to be able to build controls around them. You can't how can the same controls be used for a formal or ad hoc?

B

That's right, I mean. Do you understand what I'm saying like I like that, like that's? Not you, you've got you've got to get a little bit more uh specific as a little bit more specific than that, um especially when you then define whether formal and then what an informal one is and they're both extremes convention used within the company such an informal as a language distribution.

B

Well, what? If a company decides that their formal um ecosystem in terms of the language distribution being used, maybe they have a policy in place that says that this package, this language distribution, is this so This versus versus that and then what, if um a company's ecosystem isn't informal? Maybe it is a convention used to come. Maybe that's that's formal, I, I, I, don't I, don't know I. Think I. Think do we decide that amongst ourselves, though, what that means, I I, think that's something that we go back uh back to Speck with I.

B

Don't know that we decide that here ultimately,.

A

No, but we we can comment on this and.

C

That's what he's.

A

Asking for he's asking for comments.

B

Yeah I say all I mean: maybe we go back to openness and stuff with this right? Maybe we go back to the um I I and I'll. Keep saying this too I I said this before I'll say it again and while I will also say, we can give as much as we get with this one, meaning they have a whole glossary of terms that they're working on under the best practices working with.

B

We can provide them terms that we come up with so that the spec team comes up with that can go in that glossary, but we can get stuff from them as well. Maybe we bring this to the table and say hey for the purposes of what we're doing in the openness itself. What does what is?

B

What is a packaging ecosystem is a packaging ecosystem in the right term or what term should? What should we be using.

A

I forget the gentleman's name um that leads that group. It's not.

B

Cool I think well, I think crop leads the best practices group as far as the crowd yeah. He leads the uh best practices group see.

C

A

But I'm not seeing him and.

C

uh Christopher.

B

A

Real stuff, no.

B

Yeah, it's just c-rob, c-r-o-b I mean that's his handle. That's.

A

The only handle I know of maybe not on GitHub.

B

A

He's on GitHub.

B

um Hold on one second he's definitely on GitHub. Let me let me see I'll give you his uh his handle in in two seconds here. We just opened up one of his uh one of his repos.

A

Okay, yeah or maybe he's not part of ish I guess, if he's not part of the salsa community, still be able to tag him.

B

A

B

May not um let me try to pull up where, where he's at anyway,.

A

Because I see his email on slack but I don't see.

B

Oh, it's security, see Rob, so security see Rob.

A

Security see Rob like that.

B

A

B

Heck, that's not even showing up that's what yeah yeah I'll uh just have.

B

I'll show I'll, show you here: um oh.

A

Yeah there he is right there, yeah Twitter.

B

That's his Twitter. Yes, so he so I mean c-rob security. See Rob. Just you know. That's.

A

um I would think it's just syrup, but but you know, let me go back. Go back, go back.

A

I, don't know why it's not showing I think because he's not part of it. uh It's also a a repo or something.

A

A

um So that's that's pretty much stuff. You want right um see if they have something, but if they don't, um it sounds like we don't necessarily like the word ecosystem and so I was trying to see if there was a different word that we could use.

B

So what whether we? uh Maybe that's, because what are we trying to say whether we, whether we uh are we trying to say they're,.

A

Trying to uh Define, you know, I think it's for the purposes of obviously the spec to say this is what a package ecosystem means and.

B

Yeah but why? But why does it need to be a package ecosystem.

A

Why does it need to be? It doesn't have to be named that, if that's the question well.

B

Yeah well, yeah I mean I got you know to say well what, when you say, package ecosystem? What do you actually uh referring to it, because it can't just be a formal or informal that the me you immediately well you'll lose me immediately. If you say formal and informal, I'm going to say dude pick a struggle like you know, I mean I did but but but but to say what? What exactly are you referring to as a package? And you say: well, it's a convention of tools.

C

B

Well then, let's, let's draw back like instead of saying a package ecosystem, let's say a package tool case, a package toolbox right, I I mean like.

C

B

Mean if that, if that's what you, if that's what you say, it's a it's, a it's, a a set of tools or just a tools, distribution and then you can say: uh I, don't know you uh a distribution toolbox. You call it just called the toolbox. I, don't I.

B

To sound over overly uh overly educated, using terms that that are that well they're, using terms that are ambiguous, fluff, I, I, don't I mean I'm I'm talking a lot with that one, let's say it's: fluff, I I, think I. Think I think you can get smaller and more concise and more literal without having to sound super hello.

A

Is that Pikachu or Yoda I'm, not sure I can't see it.

B

Okay, it's a little.

C

E

A

It looked yellow, so I was like. Oh, it looks like Pikachu's ears.

B

I mean we I think you know I think we can ask them to get a bit more. um You know in an effort to sound super techie. You can just call it. What it is I mean I doesn't take away from, doesn't take away from the the smartness of its application. It just makes it so that everyone can understand it. You know.

A

B

A

I don't know saying.

B

A lot of words here.

A

uh Jeff and Bruno on on this one.

D

D

ah I I well, I definitely agree. The ecosystem is is wrong. We just can't use that, um but whether we use I I kind of agree with Jay, you know, maybe toolkit or or something like that. um You know to make matters more confusing. uh I know what what our company is has done is. Is we've actually called it uh consume, but but let's not go there, because that makes it even even harder, um but yeah I, think I.

D

Think um if we're going, if we're going to use the term package I think that's better than distribute, because not always for distribution, sometimes or it sometimes is for consumption, but um but definitely definitely I. Think ecosystem is, is nebulous and Broad.

A

E

I agree with the comments about air conditioning for true: it's not a good one, but at the same time we have to try to figure out what what could be a better term, because it looks like that. Everything that you look you come out like, for example, two key to you or something like that. You can also lead to a different direction.

E

So I I agree with the package that it's better than distribution I. Think that it's something that uh we all agree.

A

A

So something like toolkit, sorry, packet, yeah and and Mark here had voiced the concerns that we were kind of voicing here, which is why he he chose distribution instead, um where you know, ecosystem has too much emphasis on formal Packaging Systems like npm. This is kind of what we were talking about earlier right and then that whole company Central infrastructure right um but I'm, not a fan of the distribution, so I think Mark had the right mindset of hey.

A

Let's try to pick a different word like what we're doing, um but distribution is distribution, ecosystem, build.

A

And somebody mentioned artifactory our artifact repository, which I don't like, because when it comes to evidence, collection and you talking about compliance, artifact means something completely different. Artifact means evidence um not uh like a package I think artifact is used very much from a software development. Standpoint of you know, there's just package repository, but not in the compliance world.

A

um Sorry I'm, not a fan of that word either. Repository.

A

Well, what what about package repository, yeah, okay package, go ahead.

D

Well, yeah, no I think if, if we use repository by itself, it might be okay um because it could be a public repo. uh But if we, if we say the words artifact repository, then it gets loaded with that. That to me implies a vendor solution.

A

Worry we should.

C

A

A

If you do, reposit I see the source control here right, which assume or implies Source control repository and you build.

A

Is this distribution supposed to be okay after the build?

A

It is okay, here's a package and then the consumer can grab it, or is this more of pay I'm going Upstream to go grab my dependencies because I'm seeing this right, I'm, not sure what this means right here when it comes to distribution, because Josh didn't put a picture um only marked it so I'm trying to understand this. This part right here is this purely just once everything's built, including the dependencies it's being distributed to the consumer, yeah.

D

You know we we've used a graphic very, very similar to this, and what that dependencies means you know. The reason it's kind of circular is that dependency management is ongoing and continuous. So, even even when you've got a distribution, you always have to continue with that. With that dependency management.

C

D

Intended to me, um but so whether whether you know Source control Bill distributes- and maybe it's just distributes versus distribution, because to me once it's built, you've got a package yeah I, guess it depends on how how granular we want to get because you can build it and then package it. But to me when you've, when you've actually built it, you have a package so now you're ready to distribute.

D

Or consuming, and and that's why, like, what we've, what we've always used and when we talk about source code, we talk about import, um so we'll say: import build consume as as the three steps but consume is kind of loaded. Also.

A

Yeah I'm, not a fan of consume.

A

But I do I. Do like these comments, though, because then we can kind of and actually or forget, Jeff do you have a handle.

D

uh Not not again, though,.

A

uh Jay, what's your handle I, don't see it.

B

um Ca nope c-a-m-a, -l-e-o-n 2016.

A

2016., that's interesting! It's not showing you.

B

um A shrug yeah.

A

So Jeff, you said you don't think you have a GitHub handle no.

D

A

So I'll just put your formation.

A

A

Distribute your word ah okay uh and let me copy and paste this somewhere else, so I don't lose it um because I would hate for GitHub to time me out and then there goes uh all these comments. Okay,.

A

um So that's number actually I should put it in here. Oh that's, ugly. um I'll fix that later. Okay, um so I think we've beat that one to death. um The other thing that came up was about to have a open, ssf landing page for salsa, um so Tracy seems to have done that with six store.

A

um So if you click on this- and she was saying that she could help us and yeah see I, don't know open, ssf landing page for six store, but I'm trying to figure out where Community, okay, aha I see. So she wants to do one for salsa, so I feel like this is part of our domain because of positioning.

A

It's not part of the specification.

A

um It's not part of tooling so I think it's part of our domain to to work on this. So not sure what folks thoughts are on trying to take this on um to kind of help, broaden the visibility of salsa.

A

Anybody at home.

C

A

And she said that she could help.

C

A

Right, um we would just have to work with her, but.

C

A

First question is: should we right um do we think it's within our scope um and then we can kind of get the ball rolling with her.

B

um Well, given that there are already like two or three different um blogs are landing places for salsa, who, who did those and should there be someone that we consult, that did those um like the salsa.dev? Whoever did this I mean? Should we be Consulting that those individuals or that person did this.

A

I think Google created this okay yeah, and so we can always uh consult with remember creative yeah, I'm, pretty sure Google created it, because it's not notice it's not under open ssf right. So this was before they became part of uh open, SSL um and I. Think maybe yeah. Let's see if I put a sixth score, okay and it goes to the GitHub page. So it's almost like uh it almost seems like it wants to be a replacement, maybe um but I'm not 100 sure is there. Do we know if there's a six door.dev website.

A

Let me see if there there is, there is a six door, so it's not necessarily replacement. Oh, this is the status okay.

A

Let's see what the sixth reductive website says, yeah I was wondering about that. It almost seems like it's supposed to replace the salsa Dev, because I suspect that six door also had a regular dip, which is why they have the dot done, but it looks like it's not being used for anything but the status right now. Does anybody have any contacts in six store? Oh there, it goes I, don't know what happened. I, don't mind.

A

So they still have it so I think it's just more visibility, then um to say these are the pieces of salsa.

A

um One would be the specification that we're working on right, there's a few tools that we have in salsa. uh Where is it.

A

Github issues.

A

This salsa GitHub generator um and then there's also this salsa verifier right. So there's a couple of things: I don't know if we want to put that there, but maybe maybe we talk about it in the next overall social media.

A

Also community meeting.

A

Which is once a month, I, don't know when the next one ends.

A

Not this week, it's next week, it's the 15th okay, foreign.

A

That sound, like a plan.

C

A

Okay, okay and then there's this lovely salsa and S2 c2fj that got sidetracked because of the last five weeks being nothing but sickness. On my side.

B

But we've gotten some uh traction on that, also from the end user's working group, who's interested in understanding the work that we've done as well um as a matter of fact, they're working on some type of a pitch to the attack on some work that they want to do.

C

B

And, of course, I told them well, that's excellent. Have your people talk to our people come come join the sake come get involved and and uh enjoying these conversations.

B

B

I think I need the link to this document again. I couldn't even find the link to this.

A

uh Yeah I think I put it on there on the notes, but here here's, the link, um yeah I, know you had commented on it: um I didn't get to like go through it. I mean it's very short, um but yeah.

B

But we do, we definitely need to come back to it and do more and and do more work uh more work on it, um especially with the changes that are occurring um with the with the salsa spec I was in the uh meaning. I was like yeah I mean you. Were there too, when.

C

A

Were breaking off.

B

And they were breaking off Providence as well.

A

B

That that's a that's believe it or not. That's a huge change um hell, that's a huge change that affects our our blog post.

A

A

It was isip right.

A

uh For our future discussions, um yeah we'll have to cut I feel like if we, if we don't come up with like a regular Cadence, we're gonna get uh meetings running over um yeah, so I think we need to just come up with something, but the provenance uh salsa window, spec split.

A

Okay! Is there anybody else that we need to bring in for this discussion, I see, Adrian was commenting um on some of this work and I. Believe Adrian was the one that did some of the blogs on this right on your side.

A

B

Was that oh yeah, we uh well, we what we put out blogs from both internal uh to Microsoft, and then we put out one over the SS open, that's the stuff as well. Okay, that was just to announce the contribution. That's all that was got.

A

It got it: okay,.

B

um But we also inside of the one from the openness itself we mentioned um it being uh in parallel and being being, you know, being able to be bridged with salsa. We mentioned that in that blog post as well. um So this so there's a lot of there's a lot of uh Pathways and ways to play. I did that on purpose.

A

Yeah, okay, um so I don't know Bruno or Jeff. If you want to be part of these conversations, this happened because of the supply chain Integrity meeting, um but this obviously is part of the salsa positioning, also right, because we're trying to position salsa in comparison to S2 c2f.

A

um So if you want to be part of the meetings you know, let me know, and so, whenever I set up the meeting, I.

E

A

Send the link your way sign.

E

A

What do you mean this? What about you Jeff? Yes,.

D

C

A

And you're on slack right, Jeff, yes,.

D

A

So I can get your email from from slack. Yes, okay, foreign.

A

Okay, um we have 15 minutes left. The last thing I wanted to talk about Jay was that supply chain security ecosystem diagram. You gave me.

B

Yeah, the the one from uh uh Jonathan right.

A

Right yeah, let me find I know it's part of it was in our our red. Let me find it.

A

A

Oh, wait did I find it yes here. Let me let me open it up and then well. Let me download it because it's not gonna.

C

A

Did it go, let me stop share and find it right.

A

A

Okay, so this lovely diagram.

B

Yeah, my my uh ping, my my reach out to Jonathan, was to uh was to get him to give me the other part to this.

B

um That had spelled that spelled out the numbers.

A

Yeah yeah I think that was my. My biggest question was okay. Well, where are these numbers coming from right? How are they calculated, uh because I think we were trying to use this? Also for that as us also versus S2 c2f right.

B

Yeah one one starts one one finishes: uh there are also a couple of other diagrams that I'm pulling um that that we've done uh in terms of the Microsoft on all of the Frameworks together to see where they're see where the overlaps are.

C

B

There gaps and where they're overlaps is some fantastic stuff that some people have done, I'm still trying to gather that stuff, but once I gather that I'll share with the with the with the uh with the group here as well.

B

um Okay, so we said, we can clearly see that as well, because because there was, there was a lot of work done, especially uh I. Think uh Fresco was part of that too, um and and guac was part of this particular uh diagram, along with a couple of others to say what the well. These are, where the overlaps are, where everybody seems to be overlapping- and this is what's still not covered and all that kind of stuff yeah.

A

Yeah, if we can get more more info from on this, um that would be really helpful, um because I think when I was looking at this too I was also seeing I think duplicates of something it's been a long time. I think it was, you know, is this compiled libraries here the same thing as this compiled libraries over here right? Is it different?

A

um So there was a couple of other questions. I had I'll have to look look through it again.

B

um I know I probably will do one better and see if I can't get Jonathan just to join the meetings and have- and uh oh yes, talk to it- talk to it himself. I I, one of the things that I'm really working on for the next year- and this is something I I've taken as part of my notes. um This is open. This is up at large.

B

That's one of my charges, I'm looking at the open stuff, all as a whole, uh we really do need to start doing more cross-working group uh collaboration and talks and part of what's happening on the um the diagram of society. Our reference architecture group that we meet is really understanding how um all of these working groups fit together under the open ssf.

B

uh What are the gaps that each working group is trying to address, and then how can each working group kind of you know work together to address a lot of these things, because we're all doing great things and some of these things that we're doing actually blend over into one another on purpose?

B

um The end user's working group is one of these working groups. That's a blend over on purpose. They he should be involved in these conversations because of stuff they're working on salsa and s2c2f. They both impact, you know or have an impact on on consumers on the end users, so you should be involved right, so so I I think. uh My next thing is to get him to join uh these meetings and talk to these Frameworks yeah that'll be that'll, be great for us and good for.

A

B

A

Yeah, let's see so what was the gentleman's name.

B

uh Jonathan Meadows, oh.

A

Yes, yes, yes,.

A

To discuss diagram.

A

S came from okay.

A

um That was the last thing I had I know: we've been working on the development blog, um but given some of the changes in uh that's been happening, it's also over the past couple weeks, uh we'll have to revisit to make sure nothing. Nothing significant um is missing or needs to be removed, uh but we'll we'll do that some other time I know we kind of be working on that blog for a while. Now um any other topics, questions concerns things that maybe we should be focusing on sometime 2023.

D

I think we're good.

A

Okay, well, I will give you a few minutes back to your day and uh for those of you that are still here next week. I'll see you next week.

E

A

Bye, everyone bye.