Ortelius Open Source Ortelius Governing Board, 25 May 2023

Previous Meeting

Next Meeting

⏯

youtube image

►

From YouTube: Ortelius Governing Board May 25, 2023

Description

A discussion around the TOC nominations, new competitive tooling around Evidence Stores, and architecture are the topics of this Ortelius Governing Board Meeting.

A

B

So welcome everybody to the May 25th ortelius governing board meeting uh go ahead. Take it away Tracy.

C

So we do have corn now that Kat is here. Thank you, Kat for bringing us up to Quorum. um So uh the one thing we have we're working on is the technology oversight committee, which apparently is beginning to become more important than I thought.

C

um There are potentially five nominees right now, which includes uh Vincent Dannon from Red Hat, who is pretty much um Andy's boss, uh Brian Fox who's, the CTO of sonotype uh Steve, uh garima bhajpai, who was uh she's I, don't know. Is she on the TLC for the CDF Steve.

C

C

Yeah you're muted, yes, he is, she does. She runs the ambassador program for the CDF and uh and Andy Gardner, who is with dynatrace and is working on um City events and Captain.

C

So we have five positions and we have five nominees um I'm thinking that, instead of doing an election, we just have the board nominate them, since all of them would be elected anyway. Yeah.

B

um I think we just to get in the habit of it. I would go the other way and just do a mailing list, plus one.

C

Well, if I do one, if I'm going to do a proper vote, I have to run it through Opa and do a regular vote. It would be great if they I didn't have to do that. Just okay.

B

I can go either way on that.

C

Hey Sergio.

C

And I think it's an interesting um having uh Brian Fox and Vincent Dannon on the board is and Andy uh from dynatrace uh I think it's an interesting combination of people and then we get garima. So we have at least one woman on there uh and and Steve.

C

Seems like a pretty good board. I have I spoke to both Vincent and uh let me see if I got anything yeah and Brian when we were at uh cdcon and both of them indicated that they would be willing to do that.

C

I I've reached out to uh Brian Fox uh yesterday to confirm that he was still okay with that I think that he'll be uh he was. He was interested. He thought as long as it wasn't something that they were he'd have to do every month and Vincent was the same way.

C

So the way we have it written up is that we would uh hold meetings once a quarter unless there was a one-off that needed to be held and I think having that Cadence uh opens it up to bringing in uh these higher level, uh VPS and ctOS from other companies and.

B

How how long were nominations open to are they or are they closed now.

C

um I was We were supposed to get nominations. um I think I'd have to look at the email, but June 1st is when we were going to start uh voting.

B

So I would motion that if we do not have any new nominations uh before June 1st that we go ahead and approve um the five folks that are on the list.

C

Otherwise, we'll run an election we'll.

B

Run election, otherwise, okay,.

C

That would be great.

D

A second it works for me.

D

B

Discussion, well, we don't have saddarth here, so any any discussion on this I think we kind of pretty much talked about it.

B

All right, uh anybody against.

B

All right motion passes unanimously, all.

C

Right and I will send out June 1st um I'll send out a uh of email to the dev group. That uh indicates that we had five nominations and all five will be because a vote's not required.

C

Seems redundant to do it exactly.

B

And I I, don't I I I'm, assuming by next five days or six days that we'll have um the list is going to stand, as is I.

C

Think so, I don't think that we'll you know, I think that we've got people who are interested in um being part of it have have raised their hand and worked out that there's five.

E

At least it's going to be easier. Yes,.

B

I like it when things go easy, yeah.

E

Exactly no complaints.

C

And in terms of these meetings, we probably need to get in the habit of approving the ministry of the previous meeting. We haven't done that um just a point of.

F

D

Yes, we should.

B

You wanna go ahead and do that Anne-Marie.

D

Yeah sure so uh I'll put a motion to prove the minutes from the previous meeting.

B

I will second that.

D

B

And any discussion, any corrections that we need to make to the minutes.

B

Okay, let's go ahead and anybody against.

B

All right there motion passes.

C

Cool and I think that is pretty much all I had in my notes that we needed to take care of, for this call we did have it. We did have like really great for those of you who have not uh been on the call Sergio, uh Anne-Marie and Kat. We had a. We had a really good um visibility at cdcon this year. uh It's pretty cool, that's that uh both Sim and Steve got uh CDF level. Awards uh Sasha got his award, uh it was a fun show.

C

uh I got to do a keynote at open source Summit, um which is kind of cool being on the big stage um where I I promoted both uh I, promoted uh ortilius talked about an Evidence, catalog and I. Think one of the most interesting things that I learned that that really you know piqued my interest and we're going to do a follow-up call with Fidelity Investments. They built their own evidence, store um I will I'm going to share with you all the link really quick here.

C

Actually yeah I'll share it with you, but then I'll be sure and email it to you, because it talks about.

C

B

We just need a like a one or two paragraph, blog post, that links over to it.

C

Yeah I need I've got a lot of I've got to do a press.

B

C

Everybody's stuff, so yes, I'll, try to do that, but just for those so the for the board's knowledge I'll share my screen really quick here and show you their image of what they built, which I find it pretty fascinating.

C

So here is how they see the world in terms of being able to have a mature software delivery platform. I think I need to.

C

You can see it so here you notice, there's a pipe that says pipeline Intelligence coming from the pipeline, and then they put it in an Evidence store.

C

I have reached out to the individual who wrote this I'm scheduling a call with that individual for the architecture, team and I'll make sure that the governing board is invited to that call and I asked them if we could compare notes on what what we're storing.

C

So, if this is the first time, I've seen a and they talk about it in here that they wrote. You know this is this is homegrown I, don't know if they're doing versioning of it I would kind of doubt that but you'd never know how they're how they felt it I'm very curious how they built it. But the reason why I bring it up is because it it's.

C

It bodes well for us considering um it's what now, the CD Foundation is pushing out there in terms of a a good use, a good user story around a mature software delivery model.

C

The other hilarious thing that happened was I was on a s-bomb panel at openssf, and um a person from checkmark asked the question: how do you, how do you aggregate application, Level s-bombs in a microservice environment I almost jumped off my stool I wondered if Steve paid him to ask the question um and in that I was able to say check out artillius, that's exactly what we're doing so.

C

Overall, we had a really fun time at cdcon and, like I, said, ortelius got a really some really good exposure and there was some a real interest in this idea of an Evidence catalog. So the team is in a good place. uh Bhati demagrichi said that in terms of activity, uh ortilius is their most active project, so kudos to us all for building this and keeping it going.

B

And then also, um we met with I can't remember their name, but from they're from Google, and they work on the guac project, which is the dependency graphing um in that meetings. I think next, Friday.

C

I believe so yeah.

B

Like the fifth or something like that, um I don't know the time, but uh we'll make sure if everybody knows about it and uh we're going to compare notes with them as well.

C

Yeah and what Brendan told me was that they're interested in possibly integrating where they would uh provide the graphs for the dependencies and we would provide the data, so we might be, you know, we're starting to create a power. You know a power station here with uh bringing in other open source tools, because that's that is the way. That's the way to win. No doubt if you get we had. We have red hat now and already now committed and if we add some teams from Google doing some work to help us too it'd be great.

E

I I have something around it. um Let me share something. Another thing is gonna pull off what we were talking about here, um so news from Redcat. We have now at some it launches something that is called throughout the software supply chain it. It sounds something for you like having pipelines and doing in a secure way like checking s-bombs and images and other stuff. So this is like a well. This was presented by burn. Sutter is like the director of product management, Global and I, already told, like hey I love the presentation.

E

uh We are already doing some stuff like that in the open source, even we are already working with empowers. That is already something Italian from Red Hat, so like make a little sense that maybe we can like I, don't know just check like at what point. Maybe we can do stuff together? Maybe utilize improve I, don't know, but it's just opening the conversation.

E

So uh he asked me just like wait until this or I had something is ended because they are like today with customers in the in the conference, but uh I know um a meeting with him uh with the, of course, the the architect that is working on this solution to maybe just check like whatever.

E

If, if it's something like similar, maybe we can do more together more than over on purpose, so yeah I will schedule.

D

E

Think you should invite.

D

Me I think you shouldn't.

E

uh For sure yeah I need more, we can be more the more.

D

E

Will be better.

D

I'm an architect working on this solution. Okay,.

E

A

E

That that's a lot of better yeah.

D

E

Thought it will be great to have you, but I now is yeah. It's like definitely I'm going to yeah in the meeting. So.

C

Yeah, that's interesting that they're taught that we're talking now about a store right. How do you store this information and start using it consuming it? You know acting on it, enabling it leveraging it using Opa for policies around it and ultimately AI That's, where that's going to come from, so that that's super, exciting and I'm. So happy Ann Marie that you're from that project.

D

Yeah I mean we had to kind of be a little quiet about it until now, but hey now, it's public no.

E

It's public yeah, I, I, I, didn't it was yeah well I I think we were in the similar situation manually like well you're wearing the project, but I mean I was looking at, but I couldn't say anything I was just like waiting for this public uh because the internal presentation was a few weeks ago releases. But uh now we can talk about this. So it's going to be interesting. It's super extensive I mean this is not one thing. It's like a lot of a lot of things going on.

E

It's like a lot of different open source projects and different stuff like just glue in one Maybe like a pre-fabricate process, something like that. But uh yeah. There is a lot of opportunity to to to participate because uh there is a lot of moving Parts here. So I think it's going to be a great conversation. I.

C

B

uh Just one quick question: Tracy was the was Fidelity calling it evidence or evidence catalog.

C

Evidence store, okay,.

B

Because I'm wondering if we should shift our wording slightly because right now we call it an Evidence catalog.

C

B

Change since since this red hat presentation is talking about a store, Fidelity is talking about a store. Maybe we should get on that bandwagon as well. Okay, I, don't know.

D

Ibm IBM calls it an Evidence store as well. They wrote their own from scratch. um This solutions using recore some tecton.

B

Not familiar with that one: what's.

D

It called Anne-Marie record r e k, o r I'm, not sure, like we should map functionality um to see where it overlaps with the retalias and where it doesn't. But basically it's it's storing evidence of when you do certain checks in your pipeline, like have you done a static application security test? Are your images signed things like that?

D

It's storing all that as well as a record that the build happened, that this was the build system and that we generated the s-bomb and then later when you go to deploy, they call it the Enterprise contract, where it's checking that all these things happened and you can't deploy to production until all the checks that you have turned on.

B

Yeah, it sounds similar to the openssf scorecard, where you have certain things that have to be checked off. To make sure your supply chain is secure, excuse, secure.

E

I will share the links because the links the solution is mounted in the in the in in the glow service. So you just create an account. You can go into openshift and you can look at these working. That is mainly a lot of microservices.

B

Yes share the link I'd like to dive into it.

D

Yeah, our goal is to have like a salsa level, three compliant.

E

Yeah system size to go sounds funny. That sounds like the goal. Yeah.

C

Well, the conversation has begun right. I'm.

E

E

Everywhere, it's like.

C

We I know- and we've been we've been working on this now, for you know as an open source project for two years and as a project that we were trying to get to an open source level for one year. So I'd say we had some Vision on that. That's where people would finally figure out, and then you know the thing about it is in Microsoft microservices. It just makes it harder, because when you have an application, you have all of the components together that you can do a check at the application organizational level with microservices.

C

You have to do it for every single one, so you don't get it you, you lose that organizational picture, and that is what we do bring to the table is being able to create that organizational picture, and that is indeed what the salsa folks with guac was interested in.

C

Is that ability to aggregate snapshot, inversion.

D

Yeah, there's probably some good Synergy there, um so the thing that I've been working on is the red hat trusted application pipeline, which is kind of half of this announcement, which is you know the CI CD and the Enterprise contract side of things.

D

um It's would right now just treat each microservices as a standalone application, I think right um and if you had onboarded several into one workspace, you would see the you know. The same team was working on them, but it doesn't it's not really designed for any kind of global enterprise-wide view right so kind of kind of not what it's trying to do.

C

So I'm, looking forward to having a discussion with those that team I think comparing notes will be great because we are now in we have now I. We have we're now at a new, a new market laughs and we're the open source tool in that market. So it's pretty exciting and you might feel like having these. Other tools are competitive, but I can tell you, as a company open make software, we struggled being the I used to call us the lonely furniture store at the end of a road that had no street lights laughs.

C

Nobody wanted to go down there because nobody else was doing it and people would say well. If this is so important, why isn't anybody else doing it and I'd be like I? Don't know I wish they were I wish they were doing it so I'm glad that artillius is gonna. It's been down a lonely road with no street lights, and now we've put street lights in and there's another furniture store next to us, which creates a Marketplace, and that is what we've been missing as a Marketplace.

C

So now that that's announced I think I'm going to probably do a Blog on this new Marketplace of evidence, doors and what the what the industry is working on and let ortilius be part of that story. There's nothing, absolutely nothing wrong with competition. It's actually super healthy.

D

Also relevant I was gonna, say, is the backstage I would say, um I think I heard that you were looking into that a little bit too. So red hat just announced that red hat supported uh version of Backstage and that's another place where a microservices catalog.

C

Yeah so like so backstage what backstage is really really good at it's also, it's a problem backstage is really really good at generating a pipeline for the microservice. So you as a developer, you've got a python module. You need to, you know, start working on, you can go in and you can say these are the tools I want and it's going to generate for you a pipeline um for like a Jenkins pipeline.

C

The problem with backstage is it generates a Jenkins pipeline and the industry needs to start again I'm. Looking the future, the industry needs to start getting away from Pipelines. So, for example, in Steve's chat at open source Summit. He pointed out that Jenkins alone has 20 million known Pipelines.

C

If we want to add s-bomb generation to it, we have to go and manually edit those pipelines backstage just creates more pipelines. If you once you create your pipeline, if you want to uh update it, you have to go update your pipeline, but it does create a catalog of microservices and their tools that they're using but.

E

Yeah I think it's, it's maybe a way to to see it or maybe like the initial. The way that boxing was like, maybe putting in the.

B

Head in the house of developer.

E

Today, yes right at the list in the in the developer, Hub is like an Enterprise version. It's more about like one page integration and encapsulating complexity uh is not necessarily like doing pipeline is more like hey I'm, just like putting in a view like capturing all that data I need, like inputs and stuff like that and after that probably is going to be other thing. But it's more like a one page to say: hey I can check the dependency I can check the status.

E

I can check it, it's more about like having in one place all the information needed, the personal responsibility and stuff like that. So at least in the pipeline side we are at least a lot of the folks are like not trying to relate that much backstage with pipeline itself is more about encapsulating, encapsulating any complexes and be like a self-service more and more than that.

E

So and that way now there is a lot of people doing plugins the the concept of pipeline is less because they spear the the the the range of plugins are what you can do so it's at the beginning. Maybe it works like five plugins, and maybe that was like top of one day. You use it, but right right now, it's like a small part, and you have like um a more white a picture about what to do with with uh with active. So it's going to evolve a little bit and I.

E

Wasn't a guild account like looking at the release and the new future, and it's more about it to be more simple to the to the companies to adapt it like more modularity independency like less builds, are more uh or on on the slide, change and stuff like that, so I think it's going to now is going to have the capability to uh be more flexible and I have adaptability for how you want to be backstage in your company.

E

So this is a little change and maybe we can revisit how we can maybe like even use it I, don't know or compliment.

C

Yeah I've always said that if we, if we could- uh and we and Brad McCoy worked on this and I, don't know how far he got with it. But the idea would be to bolt into uh backstage to do all the back-end versioning and the aggregation.

E

Even we can do our own plugins from just taking the best of our deals. I put it in just inside of uh that's that's the thing at the end for black stage, it's like what you want to uh you need this. We have it. We have a days on octelius and you get just rid of a plugin and bring this information that is valuable on our daily into vaccine and that's all.

C

Yeah so we've had discussions with uh I can't think of her last name. Maria is her first name who's, the CTO of roadie yeah.

C

So yes, all things to think about, but again um it's all good and I think that back I think that backstage is about to graduate. Did they graduate yet does anybody know um foreign.

E

At least so far, yeah.

C

It would be great if it did graduate.

E

I think so, even now, what is an Enterprise I think at some point it's going to happen. Yeah well, Lisa Enterprise, plug-in stuff, not the backstage itself, but that for sure is going to happen.

C

And that and that's what artillius lacks ortilius would be doing better in terms of adoption. If we had a larger company adopting it, and that's that's what that's what the community looks for in terms of adoption, um they look for who else is using it?

C

Backstage was written. That Spotify is that right, correct, yeah, yeah.

E

They may maintainer are still from Spotify yeah.

F

So crazy on the AI print that you're talking about right, so I've shared a document and like the Cisco already has this, uh you know pipeline security thing. They call it like a Corona scan or something and uh they're like also working on the eie fund. So like there was one idea: I don't like. If that is being worked upon or not so like once, you fix some, you know CVS or something.

F

So there are like multiple micro services, so there can be like a notification or something that can tell like other microservices like you should do this to fix this vulnerability. So I think that perspective. We we miss out today in our careers, if we can think about on those Horizons Etc right.

C

F

Because um they're, like already thinking of AI, integrating with these security things as bomb and other things,.

F

And there is a lot of redundancy as well right. Steve uh Steve will agree on this. He has to do like the same work um when, when the security report goes back right right.

B

C

Hey Anne-Marie, could you uh snag that um link that wood cart just put in the chat and put it in the notes, yep I will do and then um Sergio. Can you share that document that you uh showed.

E

Yeah put on this car I'm, going to put it here too, uh I just put in one link, because the one link had like the links for the other stuff. So this is like the main one: okay,.

D

Existing developments in the news, yeah.

B

Is there any like examples of uh the output for like the corona reports and stuff.

F

um I'll see if I can find like that. I know that that is there, but that is not public. So yeah.

B

That's what I was curious if they have anything public yet.

F

Yeah so when, like Sergio started talking about this pipeline right, I I I, like like part of searching this- if that is some things like, if that is online public or somewhere so I found like this document, but they haven't mentioned some anything there. So it's like very sophisticated tool they have created, they are using like in the back end, they are using black bug, um saved TV they're using a lot many other. You know open source to to generate all these reports.

B

Right I'm just curious how they're sorting the data- and me you know in the visualization, so that's the hardest part is.

C

Yeah right now, Texas oag is having us work on that. The dashboard that we've built out for them um and it's a lot of data.

B

Especially when you talk about versioning, because a lot of people don't understand the the versioning aspect of it, like, oh just show me what production is well. If you want to compare to what production was today in two days ago, we need to version it.

C

I think it's identified based on like a build number, but it doesn't uh create the hierarchy.

B

F

Okay, so in that one, like we maintained the hierarchy based on the stable chart version that we create for our microservice. So everything correlate with that um and obviously the build ID and for like every stable chart version. We have like um different set of all these reports generated.

B

A lot going on.

D

B

D

Would say in our red hat, offering we have something called I, think it's the snapshot environment, binding. That essentially gives you a version and what it is is it's like uh essentially storing, like all the git hashes, of all the components that you've deployed together and what environments they're on and when.

B

So you sound like get bomb.

D

It's not something. That's like super user. um You know you're, not.

B

D

Friendly at service, but it's there so we.

B

D

Back, for example,.

B

Yeah and that's the part where we need to, hopefully when we find out what the guac theme is doing um being able to actually make sense of all these hashes, because that's all we have is just a hash pointing to another hash and all that so.

B

Making this data navigatable is going to be interesting.

F

D

Mean it's true: it is just the hashes, that's what the version is but yeah unless something puts a reasonable version number on it.

B

Well, you can never trust the version number, because you can. You can fake that.

C

Are you being sarcastic well.

B

It's true, you can go and re-tag a version to any version. Number that you want and you know, take a.

C

B

It's uh version numbers are not immutable immutable like a hash. That's all I'm, saying yeah.

D

That's why we went with hashes everywhere, because they're very specific yeah.

B

I cat I have a quick question for you. On the emperor side, um have you worked with any oci Registries that are backed by ipfs.

A

um I have not I, think Alex has done a little bit with it, um I'll ping him and then I can Circle back. Okay.

B

Perfect, because the reason why I'm asking is um there's another open source project that I was involved with, it's called Persia and um they're part of the CDF as well and I have a meeting with tomorrow with Stephen chin from jfrog that started the project and the whole concept behind uh Persia.

B

uh One of the things that they're doing was a distributed.

B

um Artifact, Repository and now, with the way emporis, is adding on the search capabilities and all the all the fun stuff into the oci registry. It would be make make sense if that could be applied on top of an ipfs. So you have the distributed network of the artifacts, the impora search capabilities and then the ortelius on top of that Gathering and all uh together.

B

um If that's possible, then it would take a huge chunk of the burden away from Persia building that artifact registry from scratch, using a compliant.

A

One out there I know: we've talked about ipfs um as early as the the very beginnings of conceptual stage um and how that really fits well with the entire picture, because of what you're describing so I know that that's part of the goal, okay cool.

A

um But all of that comes down to the fact that it's just we're working on the oci spec in the background and anything that is ocially compliant just inherits all of those benefits right right.

B

Right, so that's why I was just curious because I know you can you can back the you can do your own back-end implementation of the storage and that's why.

A

I was curious if.

B

You've, if you've, if you thought about, if you've run into the an ipfs implementation.

A

Yeah, um it's not something. I personally have experimented with yet, but Alex.

B

A

I know that he's looked closer at the very least, and if it's something we want to kind of test out, it's something that I could throw together. Probably.

B

uh Don't worry about it yet um I need to get some more details and more direction from Steven Chin.

B

um So the other side of Persia is the build consensus Network, which I think they should focus on on that part, and that's gonna, be my pitch tomorrow is: let's focus on the build consensus, so you you build from the same git commit um on five different nodes and then they all come up and say: yeah I created the same thing and you get a consensus and then after you have consensus, then you add it to the to the registry, um so I want them to move away from creating a brand new artifact registry uh use what's out there and focus on the the the area of the build Network that nobody else is doing foreign fit between the three projects.

A

um I like where your heads at uh one of the biggest concerns that I have about how all of the different projects uh are progressing right now is just the fact that so many people are needing to distribute new kinds of artifacts, whether it's awesome or whatever, and these Solutions silos are coming up with independent things that meet just their small Niche cakes without like taking on consideration of how we're trying to make sure that it's a healthy solution for The, Wider industry.

A

So um like solo and their wasm, only registry and things like that right, like not calling you know, companies, but just an example where I see that happening. Yeah.

B

All right cool that gives me something to go on for at least tomorrow's meeting.

B

Anybody of anything else.

B

F

Yeah so on the cons like um since you're, like already building that uh uh consensus part right in Persia.

F

um Is there any plan like to have a consistency on on a hard side as well, because uh that is like one of the like main property right or blockchain?.

B

Right so for us, because we're going through the xrpl Ledger um that has a consensus built into it um um already. So when we add our records to um The Ledger, uh the xrpl layer will handle the consensus for us. um So we don't have to reinvent any of that.

F

B

So that's the nice thing about that, and also um because the the xrpl implementation I think it's not uh I had to double check. I looked into it before, but I believe it's proof of consensus.

B

Instead of like proof of stake, or um was the other proof of ownership, there there's a bunch of um different uh like approval models for lack of proof, proof models um that are used in uh blockchain and uh the xrpl is one of the the fastest ones, because at the very every block in the blockchain knows the the state of it.

B

um So the state is persisted, so you don't have to go through and rebuild from the very beginning of time um to come up with the right uh uh state. So that's one of the things in the xrpl that makes it very efficient, um especially for like what we're doing uh being able to get that proof of consensus, um something like Bitcoin.

B

If you that's, why they talk about mining, a Bitcoin that it takes so much resources, because if you want to add a new thing to the um to the blockchain and if you're, not you, you actually have to go from the beginning of time and and calculate the the state which is just ridiculous.

C

Hey Steve: um can we go ahead and move this discussion over to the architecture, call we're doing in 30 15 minutes, so everybody else can be honest.

B

We're losing everybody, you guys can go.

C

Yes, thank you. Oh.

B

My God anything else.

D

Close our meeting yeah.

B

All right, let's go, anybody else, have anything nope all right, all right! Thanks all right, we'll see ya.