OpenSSF Supply Chain Integrity WG, 25 Apr 2023

Previous Meeting Next Meeting

⏯

youtube image

►

From YouTube: Supply Chain Integrity WG (April 25, 2023)

Description

Agenda: https://docs.google.com/document/d/1xPs2sSbH3I9Ich7OyLOzl85oJshnK8Q6WoAgREE5-zA/edit

A

B

A

Pass that hoodie yep.

C

Oh yeah, it is uh when I think I got like the last one or one of the last ones and I was like hell. Yeah.

A

I'm, like I love that hoodie I'm, like I'm gonna turn the heat down in my house. So I can wear that more.

B

A

Yeah, it's like is that nice.

A

It's actually sitting right on the back of my chair, foreign.

C

So Melba uh I Melba I know is sick, so I'll be running. The meeting today um give me a few minutes uh to sort out my billions of tabs um to kind of bring up the docs here.

B

B

C

uh Feel free to add your attendance, the meeting list and anything um to the agenda.

B

B

C

We can get started here um just as a reminder. This meeting is being recorded, uh it'll be uploaded to YouTube shortly uh after usually within a few weeks, um and uh your participation in this meeting is an agreement to abide by the uh open, ssf code of conduct and.

C

We can get started, I, don't see anybody new here, um so uh we can sort of skip that um the next up.

C

um So first off I think from the.

B

One second here, yep.

C

First off for the salsa 1.0 stuff um just wanted to extend uh my deepest thanks to Jennifer and the rest of the open, ssf team for for the great announcement and and how well that worked, and that was great, it was. uh It was awesome.

D

Yeah I thought it went really well. Nice nice work. Everyone, especially all of you here, um a true team ever um I think we saw a lot of great press coverage as well a lot of coverage on social media and a lot of positive feedback.

B

C

E

C

Thing here is and I know, this is something we can't control, but.

C

So one of the things I think we noticed and it's it's like sort of I know it's it's part of the the general game here and it's not always.

C

You know we're never going to be able to get um folks who are not involved directly with salsa to always report 100, accurate, but I believe that I remember seeing a couple of the articles that sort of got a couple of the key details um wrong on on salsa and uh like, for example, I think they still were looking at Salsa, V, 0.1 and Reporting on the four levels of salsa.

C

When it's it's three um and I think uh one of the things is just like we would love to in the future is like, at least if any of these folks have questions or whatever, to be able to help answer those questions for them, so that you know um there's a little bit less of that inconsistency, because I know one of the pieces of feedback a little bit from a few Folks at kubecon was like hey, I saw one thing say: there's three levels and another thing say: there's four levels, and um you know uh if we can do stuff to to help prevent that.

C

That would be good moving forward, but I I don't have a great answer outside of like. If, um if we can kind of uh you know, we don't want to do their work for them, but, but if we can, you know help uh help clarify anything for them in in the future. I think that would be useful.

D

Yeah and I will note that we did ask for a correction um for for places where there were inaccuracies um and they and they were corrected to the.

B

D

um So yeah I think potentially maybe we would consider doing an FAQ or something like that like like here woman, pure common um misperceptions or like here's, you know highlighting points that changed um that might uh trip people up.

D

C

Poco, uh so next, actually anybody else have any things that, regarding like the salsa 1.0 announcement generally.

C

um uh Or anything that that they noticed that they wanted to make sure gets sorted out.

A

I think um one of the things that that came up a few times and I put this as like. The last bullet point under here is like who can say what about salsa compliance um like there's, I I saw some people immediately wanted to to claim. There was also level three, and there were questions about like whether or not they really were, um but also there's I, think more questions along the lines of like how do I know.

A

What's also level I am um and like I'm assuming there is um like I know, there's a conformist program coming up, but also like, maybe just a more like procedural like I assume salsa is a trademark trademark thing held by open ssf people can't just go and claim with like free of of any sort of consequences, whatever they want to about salsa um now, I, don't think we want to step in and like be happy candid about any of that, but at the same time, there's like there's a like.

A

We don't want to negatively influence the legitimacy of of The Branding and such so I have all of that's just to say, like there's some urgency around. Having conformance and compliance type stuff delivered.

C

Yeah, so so, there's actually some interesting stuff. That kind of came out of some conversations, also at um kubecon, so uh one of the things was yeah, so I know that there's still work being done on the conformance program. um I know based on some earlier conversations about that conformance program. There is like yes, uh openssf owns the trademark. uh The lawyer said that generally the way that they sort of do it is like.

C

If somebody is very egregiously um lying then yes, we we definitely enforce those rules, um especially when it comes to usage of certain like, like not let's, say, trademarks like you know, hey, you could have the salsa Goose on your thing.

C

If you use you know, salsa blah blah as long as you make it sure that it's clear that you are not you know, you're not associated with it you're just like using salsa or whatever, um but the thing is that there, as part of the conformance program, they're most likely will be some sort of badge or something like that, and that logo will require um going through the conformance program and they'll be most likely two things. One is like a self-assessment that folks will be able to go to and then there will also be through.

C

um You know: salsa uh through open, ssf, I should say, there'll be a program around like certifying Auditors or something like that, and those Auditors can come in and say: hey, I inspected this person's. You know internal build system and I believe it to be salsa level three or whatever, based on this criteria and I'm assert, you know I'm making some sort of attestation on that. So that's definitely something that's being um talked through uh along those lines.

C

um I believe a lot of folks are are worried that the conformance program is still kind of not hasn't, really um come together yet and um yes uh I, believe, that's still the latest version um of of the conformance program- and you know, there's some background information regarding the cncf conformance program and in fact, actually I spoke to Chris uh addict from the uh cncf, and he had expressed actually some concerns about us.

C

Basing our conformance program on the kubernetes conformance program, because actually a lot of folks have a lot of issues with that conformance program, but um I think there's not really a great answer. We have right now and I'm sure the lawyers will help us uh sort. Some of this out um so I definitely think we.

C

We want to make sure that that we sort some of the the um salsa conformance um uh stuff out, especially as as soon as possible, because I know a lot of folks are looking to either um get involved uh in the salsa auditing process or the you know: hey I want to release a build and I want to claim it's salsa whatever. How do I do that um without like, while making sure that the community recognizes you know, while following the rules that say, you know I'm actually doing what what I'm claiming to be doing?

C

um Does anybody I and I don't know if anybody else has any um information on that? That's kind of the the last I'd heard.

C

E

I'm not sure there's any other topics, um I'm just being attending a meeting for several months and uh because I'm, not a security person, I try not to bother the experts, um but one thing that I've been uh reading is the um the uh this one, the the next security white paper, which is kind of an introduction to security overall in this in this area.

E

um So one thing I find uh um it probably is going to need to interesting. At least to me is this now sells a 1.0 uh formerly released. um I know, there's previously previously. Some overlap between Salsa and S2 c2f, so it probably is, is good to based on the the standards.

E

It's also standard to understand um what S2 CTF do and what where's overlap, and you know what what's the difference between uh for a a developer, focused source of framework versus the consumer based framework- and you know where's all lap- was a difference and how all this contribute and map back to the original white paper, because in a white paper, um if you see that there there's a couple um uh diagrams that were several pictures. Diagram is pretty useful about build, and you know those things how to understand that.

E

You know that paper from the salsa perspective, um yeah, I, guess using pictures I guess that's probably, is the easier for for newbies like me to understand the whole process.

C

Yeah definitely uh hear you on that. One um I know we have uh some stuff, but it might be useful for um and I wonder if Jay, if, if folks, like Adrian or yourself, would be willing to sort of write um up a Blog for like openssf, either on like the S2 c2f site or or the salsa site, to kind of chat through sort of like the the differences between something like salsa and S2 c2f.

C

uh Je there.

B

C

Okay, um yeah, that's definitely something we can kind of, uh because I know yeah, even um among a lot of folks there's some confusion exactly uh as to um that. I I agree that there probably should be a blog or or also something like a paper that comes out of the SEI group, so that we can kind of explain the larger uh supply chain security picture.

C

um That would be useful that that's a good uh suggestion.

E

So let's say if we add the source of content back to the original executive white paper. I know it's a different organization, but if that's a something can be done. How do you map to the to the pictures uh that the workflows in that in that picture, in that in a texture paper for cncf yeah.

C

So um that's actually something else that that is happening um so I spoke to Chris, also at kubecon, um so I'm also a tag security lead for for cncf and um well one of the things we had discussed because uh something actually that also came out. uh This is for salsa V 0.1, but there were some. um Let me actually put this over here. uh There are some updates um so for salsa, V 0.1.

C

0.1 audits done on cncf projects, uh I believe one was Argo and there was some other one hold on.

B

C

uh And Prometheus.

C

And cncf is ramping up a salsa audit process, which also is something that I I said hey. We need to make sure that kind of comes back into how that is going to work with the conformance process, um and so once the conformance process is done, uh the idea would be you know to have folks um be able to assess that. That's a big thing to Victor what you were saying yeah.

C

So um one of the things right now is that, like the cncf doesn't really have like a you should be doing salsa or whatever as part of its um thing. But one of the things that has been brought up is is potentially to include salsa as like a framework for some of the projects within the cncf to start using and then how would that map to the larger sort of supply chain picture?

C

That's definitely something um that that that we're thinking about but I think one of the things that that, um if there's something unclear, I, definitely recommend if you can to like open up like the issue under the salsa GitHub to kind of say: hey, like here's, some things that that are not super, clear and it'll be great. If, like you had something like this diagram in this um uh uh cncf security white paper, for you know where salsa fits in or something like that and where it maps in.

E

C

um Cool so yeah uh uh what else um looking through here? Oh so, um some other kubecon updates, uh so I opened up a GitHub issue. For this. We got some good feedback.

C

Regarding uh generally, regarding um uh was gonna, say generally regarding um salsa um I posted this also in the in the document. uh The general things were folks are very excited for salsa. um There's, no examples or not enough examples for 1.0 compliance. um I know that a lot of the build tools as far as I know right now, don't support it quite yet, but they will very very soon, um there's still confusion around the change to tracks. uh Why did we remove the two-person code review?

C

um There may be some things. We can be a little bit louder about to say: hey, we have the source track and the source track uh includes the two-person code, review and yayada like I, think the sooner we can kind of get something like that out, even just to say this is what we're working on right, the second the easier it will be for folks to um recognize like. Oh, we, we just sort of separated it out and we were focused on the build track.

C

um But that's that's a big thing, a big piece of feedback, um a lot of folks confused about what is required for a 1.0 salsa build system, and how does that conformance? Look like how do I make sure I do it without you know uh doing something wrong: yeah yada, um there is General worry, given that pretty much all the examples today are using GitHub actions um and hosted SAS providers and that people are saying hey is salsa only a SAS like.

C

Can you only be salsa compliant with SAS and um that's obviously not the intention by any means, but I think that's kind of the perception um uh and so I think that there's some worry there uh and then yeah and there's just some general worry about at least some general confusion about what is the conformance program? How is it supposed to work? How do folks get involved? How do folks um provide feedback all that good stuff?

C

uh With all that said, though, overall though um people seem to be very keen on, like the laser focus that that open that uh salsa provides like compared to a lot of the other Frameworks, they like the fact that hey you are super focused on the build you're, not talking about how you know here, you need to do these 12 million things before you're secure. It's like here are some specific things. You can do and then we can broaden the scope over time and you can be.

C

You can focus on the areas that you think you need to focus on, as opposed to just saying.

C

You must do these million things in order to even get started um so overall, great uh great feedback uh there um and a lot of folks also seemed very interested, especially from the Europe side, is if we could have some more um Europe friendly meetings that would be convenient for them um because they want to get a lot of folks from from Europe, especially like Eastern Europe want to get more involved, but uh I believe that this, like a lot of our meetings, happen around this time, uh which is, is a little inconvenient for them.

C

Any uh questions, feedback, questions, uh I'm, sorry, any questions or feedback on that.

C

Okie dokie, so the only other thing I had on the agenda here before us, maybe going back to the list of blogs and seeing um what other things we can do and what other things uh uh from the general um day-to-day SCI work was um upcoming announcements regarding salsa and I. Don't know if anybody, because I know we had uh Jennifer correct me if I'm wrong pretty much tomorrow at 9 00 a.m.

C

um The companies who who had all been involved in the pr push are allowed to now so they say, hey here is maybe something we are announcing. um You know, salsa 1.0 was released last week and here is a thing that we're releasing.

C

um You know uh as part of salsa 1.0 or here's our blog sort of talking through um the details of salsa 1.0. Is that correct, correct.

D

Yep the whole release is tomorrow morning, yep.

C

Okay, all right uh so just a reminder: um 9 A.M Eastern on.

B

April 26th is when folks involved.

B

Great blogs about yourself, so cool.

C

uh Well, my you know myself and my company will have something interesting to announce tomorrow um tomorrow morning, which should be cool. um Okay,.

C

um Specifically related around some of the things that that folks have been expressing some concerns or some confusion about.

B

B

C

Any any other questions about the announcements or or anything like that.

B

C

B

B

Business but okay.

B

C

So uh any other sort of business regarding um updates on some of the salsa blogs or s2c2f um updates I know that uh I believe um Jay. Correct me. If I'm wrong Adrian is at RSA to talk about s2c12.

F

So I'm doing I'm doing double time here. I have I got one uh one me no and then one meeting in this meeting here. What was the question again.

C

I was just curious. Is there any updates on any of the S2 c2f um things that I know.

F

uh Yeah Adrian's here at RSA, with it it'll, be given the presentation tomorrow: okay, cool um and, of course, we'll be doing uh another.

F

That panel discussion there at um at open Summit uh we're currently working on the explanatory report, stuff like that for s2c2f and, of course, we'll be meeting again so because of RSA and and all the upcoming stuff where, where uh the meetings have have taken a break until we come back so um we'll be meeting again once once, uh once we get through this conference cycle, um was our meetings will start up again?

F

um Do need to get keep getting the word out uh as our Focus shifts. um It's also 1.0 is out I'm gonna. Let that breathe a little bit, but as our Focus shifts um dive on into uh s2c2 up and get that uh get that ramped up as well.

C

Well, yeah, no I and I know definitely from from our end, we're very interested in seeing you know something like a presentation or a demo of a current state of it, because I know one of the pieces of feedback also from kubecon was um at least from a few folks who were there, who had seen some of the stuff from S2 ctuf they had assumed. It was just a white paper um and I was like no.

C

No, it's a framework, it's a whole bunch of stuff in there, um but I think they were kind of confused by by some of those, maybe the layout of the repo or something like that.

F

Yep, so what what's? What we'll definitely do? And, of course, like I, said we have to get back and then ramp up, but we definitely want to bring it before the the working group again. I know that we talked about that at the last working group meeting as a matter of fact, but definitely bring it before the working group again yep.

F

um You know just just to do a good presentation on it and bring that before so. Yeah we'll definitely put that on the agenda um once the dust clears on all these conferences.

F

Yeah it'll probably be sometime in the next uh sometime right after open Summit. The meeting we have after open Summit, we'll be able to dive right back in and to that, and what's great about that is we'll- have a a bit more uh uh content to use from the talks in the conferences at that time. So the presentation is pretty much are already written and already done just need to polish them up and shape them up and trim them down a little bit just for the for the working group. But we'll definitely do that.

C

Oh yeah, no yeah definitely um interested there, uh hoping to start uh being able to attend, or at least have somebody um from my side be able to start attending the S2 c2f meetings when they're once they're back um cool.

C

All right um on uh the Fresca side, there was also some feedback from kubecon. Largely some folks seemed uh you know they liked the general idea of hey here's, a thing that can do um salsa III, it's it's something that you can run yourself: yada, yada yada.

C

um The problem uh still is hey without folks maintaining um Fresca, it's just gonna sit there and not do anything um and I know. From my end, uh you know: I keep seeing Fresca show up in other people's uh presentations um and they say: hey Mike. We we really want. You know this thing to be maintained, but given that you know, there's been really not a lot of interest in as far as actually contributing um to Fresca.

C

uh You know I think um at least from my end, um I'm, probably gonna, be pushing stuff in in a slightly different direction um and we'll kind of go see from there, but uh I reached out also once again to a few Folks at open ssf who had reached out to me a rich generally asking like hey. What can they do to help out with Fresca and so far none of them have responded.

C

So uh after I sort of replied so I'm gonna keep trying to you know poke here and there but um I it doesn't look like there's a lot of interest, so uh probably gonna go in a different direction. With that.

B

C

All right um and now uh regarding additional sort of salsa blogs, so I know folks who haven't seen it. Yet um there is uh an npm salsa blog that um Ian has made uh so npm Builder salsa blog. uh Let me get the pull request up for that. All.

B

C

Watch this, so there is a sorry, a node.js builder, and this is part of the announcements that Google had um made as well.

C

uh Sorry GitHub handmade as well, um so that so GitHub has this provenance thing. um It's also as part of that part of that picture, um and so there is an npm Builder. um The idea is to also contribute it. It looks like to GitHub itself, so you'd have an official um Builder that is supported by npm itself, and that would be a GitHub action that could then be used uh to for for salsa, 1.0, Providence and and all that good stuff, and so that I posted in the chat. Here.

C

uh It's not chat um inside of uh the notes, with information about that PR uh so feel free to add feedback. There.

C

Cool um any other updates or anything else, um I know that there is a lot of I see still that there's a lot of um potential um blogs, but I, don't know uh kind of what has kind of come out of there.

C

um uh So I know that there's the build versus Source blog I know Melba, is out and I don't see. Chris on um I know that there was a kind of a broader supply chain, Integrity positioning blog stuff that that some folks had had brought up uh yeah I, don't know if there's anything else uh folks have on any of the blog side or things that folks are planning to contribute to. You know some of the stuff that we're working with SEI.

C

You know whether it's Fresca, uh uh uh whether it's presca, S2, c2f or salta, related or anything just generally about the supply chain, integrity.

C

C

um If there's nothing else, we can end a half hour early.

B

All right well.

C

I'll see you all next week.

B