OpenSSF SLSA Biweekly, 28 Nov 2022

Previous Meeting Next Meeting

⏯

youtube image

►

From YouTube: SLSA Specifications Meeting (November 28, 2022)

Description

Meeting notes: https://docs.google.com/document/d/1kMP62o3KI0IqjPRSNtUqADodBqpEL_wlL1PEOsl6u20/edit#heading=h.yfiy9b23vayj

A

B

A

All right, so it seems like the trickle of people is about it. um Hey everyone welcome back uh Happy Thanksgiving to those of you in the US. um Sorry I still have noise next door um I. The um so uh quick updates the Providence 1.0 pull request. I haven't um there's a bunch of outstanding comments.

A

I just haven't had time to address them, I'm hoping to get to that this week, or next, um the spec 1.0, as promised I sent out for review last week, it's in a very draft state with a bunch of to-do's um Joshua, already commented on it, uh suggesting that we merge it um and then iterate on it in subsequent pull requests. uh It would be good.

A

You know, I'm happy to do that. I, just you know always like to leave comment periods open because I feel like once something is submitted. It's kind of a larger barrier to comment on, and so I just want to make sure it's there's enough period that people can comment. um But if, if everyone here is okay with that, then then I'll just do that um and probably the provenance one well The Province I think needs a little bit more work.

A

um There's also I think a question of like when do we when, uh uh when.

C

A

um Unhide the spec, uh because, right now it's I have like the thing it's hidden, so it doesn't show up in the drop down list like you have to literally type in the URL bar.

A

um At some point we should do that, so people could Discover it um I, don't know what the bar should be for for that right now, I still think it's kind of like we still have some old text, it's not coherent, but eventually we should do that soon.

A

Yeah and uh the other, the other topic is within the 536. One of the here I can present.

A

A

There's a preview um one of the so the main thing. This is an update from from last week that the main idea is that break it down between the software producer, the build system, the packaging ecosystem and the consumer have some set of responsibilities. uh I brought back the check boxes, um I.

C

Kind of basically did.

A

A hybrid of what we discussed last time, where it shows that the requirement and there's still degrees, but the check boxes, do kind of convey the message nicely um and the uh there's some notion that, like the we need a better term for this, like the ecosystem does stuff, because each individual consumer, ideally this, is incomplete by the way Joshua already had some comment on this: um that the ecosystem takes care of stuff or infrastructure, or something so like with an open source, um something like npm or Pi, Pi or Maven.

A

uh Maybe takes care of things of like there's a convention for how you distribute provenance, there's just a convention for how you set what expectations of what the province ought to look like, there's, maybe tooling, to automatically verify it. So, every time you do an installer and upgrade it just happens for you, um I, don't think we want to have every individual consumer Implement their own or run their own thing, and so shifting it to infrastructure.

A

um I think is what we kind of want to suggest, not that it's required but suggested, and so framing it. In this way, um we've already had feedback changing package. Instead of packaging but other than that little nitpick, um one other term I posted today was maybe distribution ecosystem or something like that, but um because I'm afraid that package ecosystem implies too much like it has to be Pi Pi, say, whereas in reality I think it's more of like some sort of convention infrastructure that happens automatically Joshua.

D

Yeah I I think every time he's going to suffer similar issues like distribution is a a term in Pi Pi, that's what they call their packages, but also Linux distributions are a thing. So those that's super overloaded as well.

D

um I yeah, unfortunately, uh I I, don't have any I only have um and negative observations that I have any suggestions at this point. But I I've been struggling with this one. A lot I think uh package ecosystem may be well, it's the best one. We've had so far, I think um on the um there's.

D

A bit of a follow-up, I I started trying to write something and create a diagram for the um the kind of ecosystem that you described with kind of build out effects and provenance going in and um like declaring expectations and things so I could maybe show the diagram. um That's the next discussion.

A

All right, yeah.

D

Sure you just uh so this is It's um well I have so far. It's just started playing around we're trying to indicate this piece of the um software uh and at least and expectations, but that's a term on the diagram for this Church myself up um yeah.

D

uh This whole notion, anyway, of how what we've got the a lot of text and diagrams about the build model and how you produce uh provenance, but we don't have much yet in the way of descriptions about how this fits into the larger ecosystem of Distributing the provenance and then having some expectations about the Providence content and how you evaluate that to um make a decision uh kind of use time. So I started playing around with some words and pictures for that last week, and this is this: is the picture I've got so far.

A

Yeah I wonder if um so the direction of the arrows is always difficult, because I guess you're using and then to be like the direction of the action as opposed to the information flow yeah, because at the top they're the same direction, but at the bottom they're the opposite directions: yeah yeah,.

D

I think I tried it both ways and I've even got different arrowheads in places because it was, but this was I hadn't intended to show this today, because this was very much like playing around with it lasting on Friday and then haven't looked at it again today. um So yeah not particularly coherent.

A

But yeah something that I think shows like the three pieces. I don't even know. If I would do the Box around the three as expectations, but rather just have three boxes: there's expectations, provenance and artifacts, and just you kind of effectively compare all three right.

D

Yeah the reason I have it straddling that line uh is because in the text, I'm writing I emphasized that uh some of the expectations can be or like. We should expect some.

D

There should be implicit Expectations by the packaging or package ecosystem, but then a user can set their own expectations, so the ecosystem might Define, like we've talked a lot about how um there's a canonical kind of source repository and builder for most um like projects and the ecosystem would Define that, but your user might still say: yeah I'm, okay, with taking sales level, three things from Pipi, but salsa level. One thing from IPI I'm not going to touch so I I wanted to uh indicate that there's um two places where expectations can be set.

D

C

Don't know yeah I'd just like to reiterate revisiting looking at um dfds data flow diagrams as a model for this, because they Define things about what the direction of arrows mean and where security boundaries are, and things like that I can't remember. I can't remember where the best reference for them is but I learned about them from um Adam sure Stack's threat, modeling book, fair model book, yeah, okay,.

D

Might be a cyber monday present to myself, then I appreciate the tip, though thanks.

D

um Unless anyone else has anything else, I'll just stop sharing this now I just brought it up, because it was relevant to the discussion we were having.

A

Thanks I think that's that's helpful, um so our data flow diagrams um is that like an official notation or is it just a general idea.

C

No I think it's an official notation and if you look at things like uh Lucid charts, they have specific um sets of Icon iconography for um dfds.

C

So yeah I'm not sure if there's an official standard anywhere, but certainly you know all the ones I've seen seem to follow the same sort of pattern. So.

C

Yeah, like I, don't know whether there is an official reference there probably is somewhere, but.

B

C

See grab modeling was where I came across them.

A

C

A

That's valuable um I want to make sure that we like the graph or the diagram, still makes sense, even if you're unfamiliar with, like you, don't even have to know that that exists. But that way it's it's a convention, yeah.

C

But it seems like just looking at like.

A

The Wikipedia article, it seems simple enough, um but I- think I, assume there's like more of a it's, not just notation, but rather a whole process for how you create one process, meaning not like a program but rather like a work like philosophy. Yes,.

C

Yeah yeah I've certainly found them very useful for modeling, even just if you want to do a diagram of a kind of a big, you know a big system, it's useful to think about it in that way, um just because it shows you where the data is going.

A

Yeah, let's definitely consider that and.

C

A

Think we could also consider other diagrams too, and maybe we should do that for all our all. Our diagrams.

A

Yeah, that's good thanks. Sean.

A

In terms of the other pull request, 536, uh which I just presented earlier, um if you could either comment or just give like a thumbs up or something if you're, okay merging it um or obviously, if you have comments like that, that's even better.

A

um uh That would just be good just together. Well, I! Guess, if you do how about this, I will plan to merge it like tomorrow um or Wednesday, unless I hear other comments, and we can always address in future comments. Yeah Arna.

B

Yeah hi, uh I I, think you know, I would suggest to other status section I know you have a pop-up that says hey. This is just the draft, but it's fairly common. If you look like him directly see, there's a status section, the beginning document that clearly states what you're expecting what the expectation of the reader should be about the status of the document and whether you're actually inviting comments or not and I, think that would actually uh you know, uh address some of the challenges you seem to be.

B

You know you don't want to look like you're pushing too hard on. This is the where we're going and whether you actually inviting comments from the broader you know, uh Community I think you can address this in the section. That's a bit. You know more verbors than what you have in that little puppet that says hey. This is just a draft, but otherwise I think you should go ahead and merge.

B

A

That's a really good idea, uh so maybe to flesh it out a little bit more um like each page could have that thing of like status, and maybe it's like a link where, like it.

B

A

B

Can have at the beginning of the document yeah the status section that clearly states everything you want to say. You know what people should expect about the status of the document, what it means for the group and whether you're inviting comments from the border or not. Yet you might say, hey we're, still very much. You know trying to figure this out. Maybe it's not worth your travel. Unless you really want to be part of the group and and then you can indeed have a link to that section from the different pages with your pop-up.

A

So you think just like one have that just done like the the top level page and.

C

Everything just.

A

Links to it instead of having that blurb copied every time. That's right, um yeah, that's a really good idea! um Yeah I'll do that. That sounds really good. Then I'd be less concerned about well. We still have to like figure out when to like unhide it of like. When is it good enough that leave a link to it, but but.

B

I think it does kind of lessen the issue with you know, keeping it hidden it's like well, we are clearly stating what this is about. Then you know as long as the group here is comfortable, saying yeah. We are happy to share where we are, then there's no real issue.

C

B

Very common to you know: working groups share publicly how you know they never hide anything from the get-go. The the draft is in GitHub and it's available and it's a leading document, but they have this status section that clearly states what to expect.

A

Yeah yeah and and to be clear high, is maybe not the best word like it's.

B

In GitHub it's just like, if you see the pull request you can get to it, so it's not really hidden, but.

A

Yeah we just type the URL, it's just like yeah I, don't want people to land on it. That, like think, oh, this is the next version, and this is like what's going to be published in a week, but rather like this is like a total rough yeah, um but yeah an explanation thing and maybe we could use terminology that makes it clear, like different statuses, of like draft means like it's totally being edited it's half written and then in review, or something like that.

A

Yeah kind of help.

A

Like what do you have? Is there a link for what terminology other groups use.

B

Yeah direct3c uses working draft, which makes it very clear that this is something you are actually working on, but you.

A

Can WPC did you.

B

Say: yeah w3c um you can look at any specular. Pc you'll find that's not working. There. I mean you don't want to inherit the whole Pro. You know specification that the recommendation track of directvc is a bit too much. You don't want all of that, but there is like uh you know. There's working draft is the key first thing that you can hang on to to communicate. This is still work in progress.

D

I, like this suggestion, because there's there's kind of there's multiple considerations before it's ready for like General feedback like whether we've hit all of the features or whether we've made sure we're consistent in terminology or whatever else we need to do before we get that like General feedback, but there's definitely some use in getting uh more feedback as long as the reader is prepared for what kind of feedback uh we need at this point, that's a great suggestion. Thanks.

A

Yeah, so they use working draft candidate recommendation proposed recommendation and w3c recommendation.

B

um Yeah I mean the historically there to see, didn't want to call whether it produced uh as standards, because they don't want to look like they were infringing on formal, dangerous standards, organization, ISO and so on. So they use recommendation. That's Timber, Nancy, being too humble in my opinion, but that's how it is, and so, uh but you know you can call it whatever you want. You know my recommendation is to not call it standard.

B

You can stick with specifications a good term because it doesn't carry any kind of you know, meeting with regard to the formal status. But so you can, you could say, working draft and then propose specification and specification. For instance, it's short enough that you get three levels when you have settled all these issues internally, you feel like hey. This is good right and you just want to give a final period of review. You say proper specification and then, when it's final you say specific test. You could call it final, but you don't have to.

A

So working I like working draft.

B

um You can again, you use the status doc. The status section can give you that you know opportunity to very clearly explain what you mean by the status of this document. So.

A

Yeah, that's that's good, uh so maybe three things working draft proposed specification specification, something.

B

Like this I think is good enough now, yeah, you can explain if you really feel later on, but you know I would say those three steps. That's probably good enough to get a good sign.

A

We have something similar in the solstice, but uh proposals repo, which we kind of don't use very much, um but it doesn't, it won't fit here. I think what you suggested is good thumbs up for me.

D

I was going to suggest we document this in the proposals, repo.

A

Should we just I mean, should we just document it directly on the site.

D

Yeah I mean that makes plenty of sense.

B

A

B

A

All right, uh since we have time we don't have other topics um just to flesh it out more uh to save time for, like someone sends it and then we twitch later um right now we have a bunch of different specifications that are all independently versioned.

A

um Any suggestions, I guess I, feel like this- should maybe just be at the top level, because I think it all references the same.

B

Documents, that's kind of like your specification life cycle kind of thing and you define that once and for all and I mean if we feel like we need to change it at some point. Probably you should change it across the board. Yes, so I think it is a top level kind of thing okay like, but it is orthogonal to the versions right I mean.

A

Yeah each version would effectively have one of these exactly um any thoughts on the URL like salsa Dev, slash.

A

Common slash maturity or something.

B

I I, you know when you get into URLs policies and uh it's like it becomes a bit religious territory. In my experience.

B

Other you know, I was raised with the r3c, where you know URLs what's important, is they never change and uh they don't necessarily should built any to them anything that has to do with the status of the document which can change, and so it's a little bit up to you. But you want to tackle that part.

B

You can put like WG to make working draft. You know into the URL either yeah.

A

So I meant like where, where do we um that's actually a separate question? That's a good question. I meant like where the the definition.

A

B

All right, we call it like the specification life cycle or something like this.

B

Specification status.

A

Yeah I think that's separate question is like the in the URL. Should you indicate that it's a draft or not? Yes, that's what I thought you were asking yeah um include. It says um so one thing I did in um in the Providence 1.0 full request was added a query parameter for that, because in the past we've added it like a separate page, but that's just a pain. It's a pain for that to step redirects to the new one.

A

um What we could do is just have a query program. It just gets ignored, but this part is a form of documentation um because it might be it kind of would be useful. To note like when you link to like spec 1.0, that whoever linked to it was linking to a draft at the time um you could have like JavaScript that just appends the question mark uh draft or whatever.

A

Or am I overthinking is that over engineering.

B

uh I I'm honestly I'm trying not to bring in all the baggage that I have with WTC, which has a fairly complex model with URLs that uh you know always point to the letters and each each new specification version. You know, has its own URL, but it always points to letters, and you can always see it. You can kind of they have the whole chain. You can walk through all the different versions of drafts they had and stuff I. Don't basically want to produce. All of this. There is some.

B

You know, good aspect to it, but I think I'm trying you know, I I would say we're trying to keep it simple and on the ads additional mechanisms. If we feel really the need for them.

D

I I somewhat like the idea of having a parameter that indicates your optic interviewing this preview kind of like previewing, something in a Content management system or something so that where, if people are sharing the URL around um there's additional context in there. But I yeah I haven't thought about this long and heard like someone who's scarred by w3c processes. So.

A

Yeah I think if we had like an official release process where we tag each one or either nightly build or tag. Ideally, we would have a permanent URL that that specific version and then like a latest thing that is floating, um but we don't have that right now. um So I'm not sure it's worth the trouble of.

B

So I will add another piece on that because you know, if you look at the HTML spec, for instance, right I mean everything we see used to be a strong believer in providing stable versions that you could point to and clearly the jury you know has concluded that no, this doesn't matter what you know. The industry now is settling on.

B

What's called living standards right which, because if there is a bug you find you're gonna fix it, then you want everybody to use the fixed version, so the value of pointing to old version doesn't really get off. It isn't very high I mean for archaeologists, maybe it just I don't need. But what really matters is to be able to point to the letters version and have people use that as much as possible.

A

Yeah, I, okay, so that's that's basically I I kind of come to a conclusion on my mind as well. um Okay, so it's good it's useful to know that other orgs are doing that, um maybe as like a side project.

A

um If anyone or myself like we could add like little, we could document the convention of like using question mark draft or working draft, or something like that just to indicate of like if you're linking to that you're really like. You know that this is completely unstable versus once we have something we're guaranteeing it's mostly stable.

A

We might have bug, fixes and clarifications, but it's mostly um it was effectively like a branch uh but like the early draft you know all bets are off I'm, not making any guarantees that when you look at it again tomorrow, it's going to look anything like this right.

B

Yeah I don't know if she's in the chats and people who they suggested maturity, level, which sounds good too.

A

Although Joshua said maybe avoid the term level, because we already have.

D

Maturity level, exactly fewer levels, is better foreign.

B

Stages, I, don't know we can come up with a whole bunch of nurses.

A

Is it worth also noting the status of like outdated, where there's like there is, there exists, say newer version so like if you're looking at 0.1 and 1.0 is out. That might be valuable in the same spot, I'd like into spec, but there exists a newer version.

B

Yeah I wouldn't bother for the drafts, but for the the the actual specs. Yes, the the released version. I think it is useful to do that and there let me see I did that after quite a few years. But now, if you go to an old version of HTML, I will say this has been. This is Obsolete and it's been superseded by and it provides your pointer to the newer version.

B

I think that is scary.

A

Okay, thanks uh yeah Brandon I agree, but ultimately we have to choose something. So it's easier just to have a 10-minute conversation now than to like one.

C

A

Something and then go back and forth and interview comments. um Okay, um that sounds good uh I'll create an I will create an well if you want to create an issue. Do you want me to create an issue just to keep track of this.

B

For the metrics yeah stages status.

B

A

That's perfect um uh yeah. uh Do you yeah I'll, put actually.

B

Yeah, that's fine.

B

B

Yeah, that's great thanks. Sure.

A

Sure um any other topics.

A

Okay sounds good I think then we could um End early uh as always any you know we can do discussion on the issues so uh good to everyone. Talk to you next week, bye foreign.