►
From YouTube: SLSA Positioning Meeting (February 21, 2023)
Description
Meeting notes: https://docs.google.com/document/d/1tpPOXVzNSwtpWA7cXhTPLAO6HIP50obUvoP85XqgVHM/edit#heading=h.yfiy9b23vayj
SLSA repo: https://github.com/slsa-framework/slsa
A
B
B
B
A
C
A
D
B
B
D
D
D
B
B
D
B
You
don't
have
many
opportunities
to
change
when
it
becomes
public.
You
don't
have
many
opportunities
to
change
the
scope
of
the
spec,
because
then
it
stops
being
a
specification
yeah.
It
starts
just
being
a
a
great
idea.
Like
you
like
you
it
it's
a
great
idea.
That
becomes
a
specification
when
it's
adopted,
but
if
you
keep
changing
the
scope
of
it,
you're
not
going
to
get
much
adoption
and
the
people
who
have
adopted
it
and
then
be
like
dude
come
on
what
am
I
supposed
to
do
now.
B
C
B
B
We
need
to
you,
know,
you're,
making
some
bold
statements
on
stuff
that
ain't
done
yet,
and
you
know
just
just
the
the
just
the
fact
alone
that
you
have
some
people
that
say
that
they've
adopted
salsa
well,
I,
don't
know
what's
hot,
what's
also
you're
adopting,
because
things
have
been
split
off
into
four
or
five
different
tracks,
which
track
did
you
adopt
because
the
last
time
I
checked
we're
not
even
on
version
one
yet,
and
that
is
the
build
track.
It
ain't
nothing
else.
Yeah.
C
D
D
B
B
D
B
B
B
I
mean
like
Isis
out
there.
You
should
see
I
when
I
saw
I
was
like
who
I
was
like.
Where
did
the
conversation
about
s-bomb
versus
salsa
Province
and
they
were
like
Jay?
Please
don't
get
started,
don't
they
shut
up
because
I,
because
I
came
in
on
the
tail
end,
it
was
like
they're
like
Jay.
We
please,
please
don't
bring
that
back
up.
Just
I
was
like
what
the
hell
I
couldn't
believe
it
I
was
like
what
are
they
talking
about?
Oh
thank
you,
but
that's
the
kind
of
stuff
that's
happening.
B
You
know
that's
kind
of
stuff,
that's
happening
behind
the
scenes
that
we
don't
hear
about
until
it
comes
up
and
a
lot
of
this
stuff
I
mean
like
look
I
I
I've
said
before
I'm.
Like
you
know,
I,
you
know:
okay,
I
I,
don't
I'm
not
terribly
sure
how
the
scope
of
salsa
keeps
changing,
and
that's,
and
once
again
in
that
blog
I
said
the
same
thing.
I
said
we
got
to
be
careful
about
scope
creep
here.
B
B
D
B
I
mean
look,
I
still
think
it's
a
I
still
think
it's
a
good
effort,
I
think
it's
a
good
effort.
I
think
the
right
people
in
the
room
to
talk
about
it
and
help
fix
and
help
get
it
moved
along
and
then
do
all
that
kind
of
stuff.
I.
Just
think
that
that
we
need
to
make
a
decision
on
something
and
stick
with
it
so
that
we
can
get
to
a
1.0
I
think
that's
preventing
us
from
1.0.
B
D
C
B
You
know
it's
it's
just
it's
just
a
it's
just
a
a
form
of
of
writing
of
writing.
S-Bombs!
It's
not
it's!
Not
it's
not
a
it's!
Not
it's!
It's
a
form
of
it's
a
form
of
a
written
s-bomb,
but
it's
not
I
mean
I
I.
Don't
know
that
like
a
lot
of
these
conversations
are
a
lot
of
these
conversations.
Are
a
real
man,
we're
like
late
in
the
game
to
be
having
a
lot
of
these
conversations.
B
I
want
to
say
late
in
the
game.
I'll
just
think
that
I
just
think
in
terms
of
the
spec
that's
being
written.
A
lot
of
this
stuff
is
like
you.
You
can't
be
talking
about
that
at
this
late
stage,
we're
talking
about
1.0,
you
shouldn't
be
trying
to
adjudicate
what
is
or
isn't
an
s-bomb
I.
Don't
even
know
like
what
what
what.
B
C
B
B
Exactly
exactly
I
mean,
like
all
things
that
are
still
up
in
the
air
right
I
mean
like
you
know
what
what
is
the
and
that
and
that's
a
big,
that's
a
large
part
of
this
tool.
A
large
part
of
this
is
the
ambiguity
and
and
I
guess
we
work
through
you
know
so
so
that
that's
why
I
say
I
mean
I,
don't
know
about
a
a
Blog
that
just
talks
about
spdx
in
relation
to
to
salsa
I.
Think
that
we
do
need
to
have
a
discussion
and
then
see
where
we
want
to
go.
C
D
B
B
B
It
includes
vert,
note
stuff
from
Burj
Providence
version,
0.1
I
might
do
that's
that
is,
you
know,
I
mean
so
so
I
that
being
the
case,
I
I,
don't
I
think
that
no
I
I
don't
I,
don't
because
I
think
to
even
introduce
an
argument
about
it's,
not
an
s-bomb
I
think
to
even
do
that
creates
more
questions
than
it
does
answers
sure
right,
yeah.
If
you
have
to
go
out
and
say
salsa
is
not
an
s-bomb
well.
B
Why
is
that
even
a
conversation
to
begin
with,
let's
look
deeper
into
any
similarities
or
or
differences,
and
now
you're
saying
well,
why
would
they
even
mention
you
know
I
mean
like
it
creates
it
creates
more
that
that
was
my
whole
thing
about
salsa
Providence
and
that's
what
I'm
like?
Why
would
you
even
do
that
like
yeah
like
and
that's
Farmer's
Nest
bomb,
it's
also
Providence
South,
but
why
would
you
even
put
those
two
together
and
say
verses?
Why
would
you
even
put
a
verses
in
there.
D
B
Mean
s-bomb
versus
salsa
problem.
Why
would
you
even
do
that
like
that,
like
that,
like
what?
What
doesn't
even
make
any
sense
to
me,
but
so
so
I
would
say:
no,
no,
don't
even
they
played
this.
An
s-bomb
should
help
meet
certain
salsa
requirements.
Sure,
but
but
I
think
for
the
purposes
of
that
blog,
that
that's
not
that's,
not
something
you
were
mentioned
in
that
blog
unless
it's
somewhere
benefits
of
the
build
track.
D
Yeah
yeah
I
I've
noticed
not
just
not
just
even
in
the
salsa
meetings
but
internally
and
talking
to
other
folks
in
other
communities.
There's
still
a
lot
of
this
sort
of
opposing
mentality
of
like
I
mean
people
have
asked
me
like
Why
Can't,
This
Be,
instead
of
an
s-bomb,
that's
not
when
s-bomb
is
for
and.
D
B
D
B
Next
document
exactly
right
and
then
you
know,
there's
a
there's,
a
a
large
contingent.
That
is
still
unaware
of
what
these
things
actually
are,
what
they're
actually
used
for
and
then
there
are
a
lot
of
people
who
there
are
a
lot
of
different
thoughts
around
an
s-bomb
and
what
an
s-bomb,
and
then
you
have
P
bombs
and
e-bombs
and
yeah
the
all
kinds
of
bombs.
I
I
mean
it's
like
they.
We
didn't
even
get
s-bomb
out
the
door.
Yet
before
now
you
got
all
these
other
bombs.
Yeah.
B
B
There
is
nothing
else
there
other
than
the
ingredients
of
your
build
and,
and
all
that
will
do
is
help
you
prioritize
vulnerability,
vulnerability
remediation.
Should
the
next
document
tell
you
that
there
is
a
component
that
was
used
that
is
affected
by
a
certain
vulnerability.
Now
you
have
to
go
into
your
s-bomb
identify
which
component?
That
is,
if
it's
there,
the
version
number
Etc,
is
it
vulnerable?
Is
it
not
vulnerable?
Okay?