From 3db9af97aa679b26435cd129f2fc3b08ee136020 Mon Sep 17 00:00:00 2001 From: Stephen Augustus Date: Mon, 6 Jan 2025 11:51:33 -0500 Subject: [PATCH] governance: Add meeting note archives from 2021 through 2024 Signed-off-by: Stephen Augustus --- governance/meetings/2021.md | 652 +++++++++++++++ governance/meetings/2022.md | 1495 +++++++++++++++++++++++++++++++++++ governance/meetings/2023.md | 1235 +++++++++++++++++++++++++++++ governance/meetings/2024.md | 1491 ++++++++++++++++++++++++++++++++++ 4 files changed, 4873 insertions(+) create mode 100644 governance/meetings/2021.md create mode 100644 governance/meetings/2022.md create mode 100644 governance/meetings/2023.md create mode 100644 governance/meetings/2024.md diff --git a/governance/meetings/2021.md b/governance/meetings/2021.md new file mode 100644 index 000000000000..eab56e860114 --- /dev/null +++ b/governance/meetings/2021.md @@ -0,0 +1,652 @@ +# OpenSSF Scorecard Meeting Archive — 2021 + +## Dec 16, 2021 + +Updates: + +* Azeem + * Scorecard might be getting an intern\! +* Jeff + * Working on doc with long/short term plan for Allstar \+ Scorecard integrations. + * Not planning on implementing: [https://github.com/ossf/allstar/issues/22](https://github.com/ossf/allstar/issues/22) + * Next integration: check for Scorecard GHA + * Further integration: interpret GHA results +* Laurent + * Separating checks from the score policy + * Partnered workflows for GitHub market place [\#1302](https://github.com/actions/starter-workflows/pull/1302) + * +* Naveen + * +* (Chris) + * (11/29) Adding line numbers to results: [\#886](https://github.com/ossf/scorecard/issues/886) and [\#725](https://github.com/ossf/scorecard/issues/725) +* David A. Wheeler \- distracted by Great MFA Distribution project & log4j + * Any more thoughts about taking data on scorecards from .yaml file? SECURITY-INFO.yml, e.g., [https://docs.google.com/document/d/1Hqks2J0wVqS\_YFUQeIyjkLneLfo3\_9A-pbU-7DZpGwM/edit\#](https://docs.google.com/document/d/1Hqks2J0wVqS_YFUQeIyjkLneLfo3_9A-pbU-7DZpGwM/edit#) + * The big issue was how to score it. Could give lower number than 10 (“project says they have it, but we can’t confirm it), or separate numbers (ignore / consider claims from project). Could also add an “asterisk” next to numbers that are from project claims. But it’s important to have an idea on how to do this, or this file is much less useful. + * We have a dependabot warning on scorecard project itself :-) + * LICENSES: Should we score lower if license doesn’t match known OSS license? [https://github.com/ossf/scorecard/issues/1369](https://github.com/ossf/scorecard/issues/1369) +* + +Open issues: + +- [x] ~~Email to Michael Scovetta, cc David A. Wheeler \- [Michael.Scovetta@microsoft.com](mailto:Michael.Scovetta@microsoft.com)~~ +- [x] ~~Create scorecard-webapp repo \- Naveen Srinivasan~~ + +* No meeting on Dec 30th +* V4 release + * Docker image creation [\#15](https://github.com/ossf/scorecard-action/issues/15) + * [Release notes](https://docs.google.com/document/d/1tIBXs801G-d2zLWzr9qBq6uKAXvshMs9wMTpDVwHmMU/preview?resourcekey=0-UlykB-9xEM5wj2aQPHTTMg). Please add list of enhancements there. + * OSSF metrics not up to date, e.g. [https://metrics.openssf.org/search?q=systemd%2Fsystemd](https://metrics.openssf.org/search?q=systemd%2Fsystemd) claims \`last updated 8 months ago\`. The the page says \`Last refreshed 2021-09-13\` [https://metrics.openssf.org/grafana/d/default/metric-dashboard?orgId=1\&var-PackageURL=pkg%3Agithub/systemd/systemd](https://metrics.openssf.org/grafana/d/default/metric-dashboard?orgId=1&var-PackageURL=pkg%3Agithub/systemd/systemd). Is data stale? We want to say we've scaled to 1M in blog post and release notes and point to OSSF metrics dashboard. Can this be done for Jan? Note: should use the new data format. + * “We used to update Google cloud buckets, now we don’t” + * They should be automatically updated somehow +* +* Create a scorecard-webapp repo (azeems) + * Repo name? + * Golang webapp? +* Improving code quality (azeems) +* Reducing number of open issue (azeems) +* Dockerfile pinning from same team (laurent) + +## Dec 2, 2021 + +* Laurent: GH action on PR: disable? + * Laurent: GH action: badges vs runs + +**Please sign yourselves** + +- David A. Wheeler + +Score for pinning dependencies: start with 10, \-1 if any/all of the actions of the platform (forge & CI system) aren’t pinned, \-1 for each additional unpinned dependency, minimum 0\. E.g., CIFuzz is hard to pin, but don’t really want to make an exception because it SHOULD be pinnable (they merge code & configuration, and that really should be separate). This way, the problem is noted without us having to constantly make exceptions. We didn’t do percentages; a project with 50 unpinned dependencies is riskier than one that has 1, even if their percentages are the same. + +David: Let’s make sure we don’t lock requirements to GitHub. There’s GitLab & other forges. + +Naveem demo’d an early-hacked tool to list the transitive dependencies & what’s highest-risk. He’ll switch to prepared statements in his SQL first. This could be contributed to OpenSSF. + +FYI: Security-Threats WG has discussed OSSF-SECURITY.yaml, currently early in discussion \- [https://docs.google.com/document/d/1Hqks2J0wVqS\_YFUQeIyjkLneLfo3\_9A-pbU-7DZpGwM/edit](https://docs.google.com/document/d/1Hqks2J0wVqS_YFUQeIyjkLneLfo3_9A-pbU-7DZpGwM/edit) +Goal: Provide a text file that tries to justify answers for Scorecard & CII Best Practices Badge & other analysis tools like it. Willing to support? Issue: Do you trust the text? Possible solution: cap the score. + +- Azeem: I like having a common format, not sure how much we could trust it. Using it might reduce users’ trust in scorecard. +- Jeff Mendoza: Posting in BitQuery is trusted, needs to be very trustworthy. For actions & badges might accept it. +- David Wheeler: Could report both scores (automated \+ self-assertion) +- Jeff: Some redundancy with future scorecard configuration (disable a check), vs setting this declaration (leave check enabled, declare compliance). +- + +## Nov 15, 2021 + +Attendees: +**Please sign yourselves** + +- Naveen Srinivasan +- Jeff Mendoza + +Updates: + +* (Azeem) + * Mostly working on [https://github.com/ossf/scorecard/issues/1240](https://github.com/ossf/scorecard/issues/1240) +* Jeff + * +* (Laurent) + * Finished GH action support for pull requests + * Drafting a doc for scorecard badges + * Started a PR for raw e2e results, will write a pager for implementation details +* (Naveen) + * Move docker builds to ko \- [https://github.com/ossf/scorecard/pull/1214](https://github.com/ossf/scorecard/pull/1214) + * Working on enabling scorecard to sign releases using cosign and keyless + * [https://github.com/ossf/scorecard/issues/1201](https://github.com/ossf/scorecard/issues/1201) + * Opened a PR in cosign to address one of the pending items which is a blocker [https://github.com/sigstore/cosign/pull/1001](https://github.com/sigstore/cosign/pull/1001). This has been merged + * Rekor has a issue in uploading large binary [https://github.com/sigstore/rekor/issues/481](https://github.com/sigstore/rekor/issues/481) + * Fix the bug [https://github.com/ossf/scorecard/pull/1272](https://github.com/ossf/scorecard/pull/1272) + * +* (Chris) + * (11/29) Adding line numbers to results: [\#886](https://github.com/ossf/scorecard/issues/886) and [\#725](https://github.com/ossf/scorecard/issues/725) + +Open issues: + +* Updated meeting time Thursdays 4PM EST. +* Jose from GH is here. Discuss GH Actions. + * Send Jose a link to the action to get it verified “blue check mark” in market place. Need to rename action + * Custom logo in the marketplace. Need an SVG logo from our side. + * Scorecard logo: + * [https://github.com/ossf/scorecard/blob/main/artwork/openssf\_security.svg](https://github.com/ossf/scorecard/blob/main/artwork/openssf_security.svg) + * [https://github.com/ossf/scorecard/blob/main/artwork/openssf\_security\_alt.svg](https://github.com/ossf/scorecard/blob/main/artwork/openssf_security_alt.svg) + * OpenSSF logo: + * [https://github.com/ossf/artwork](https://github.com/ossf/artwork) + * Can setup a custom workflow like a partner GitHub action. \[2 weeks in advance\] + * [https://partner.github.com/resources](https://partner.github.com/resources) explains the steps +* For v4 release + * Fix branch protection [https://github.com/ossf/scorecard/pull/1252](https://github.com/ossf/scorecard/pull/1252) + * (low prio) Bug \`Resource not accessible\` [https://github.com/ossf/scorecard/issues/1097](https://github.com/ossf/scorecard/issues/1097) + * GH action: + * Test actions more thoroughly (Appu, ask evverx@) + * GH action doc: Asra/Kara + * Action verified: laurent + * Docker image generation: Naveen + * Add line numbers/filenames to more checks (Chris) + * [https://github.com/ossf/scorecard/issues/1128](https://github.com/ossf/scorecard/issues/1128) make token permissions defined at top level mandatory. + * [https://github.com/ossf/scorecard/issues/1257\#issuecomment-968353572](https://github.com/ossf/scorecard/issues/1257#issuecomment-968353572) agrees it's better. + * Vendor dependencies for hermetic builds. [https://github.com/ossf/scorecard/issues/1188](https://github.com/ossf/scorecard/issues/1188) [https://github.com/ossf/scorecard/pull/1208](https://github.com/ossf/scorecard/pull/1208) + * Punting on this for now +* Enable signed commits for this repository. [https://github.com/ossf/scorecard/issues/223](https://github.com/ossf/scorecard/issues/223) + * Only do this for merge +* Should scorecard be forcing users to use a zap.Logger? [https://github.com/ossf/scorecard/issues/1273](https://github.com/ossf/scorecard/issues/1273) + * Keep the issue open and see if we can get to it soon + +## Nov 1, 2021 + +Updates: + +* (Azeem) + * 1M repos now +* (Chris) + * Working on parsing issues. + * Will use actionlint to parse workflows. + * Will also look into adding line info to PinnedDependency check. +* (Jeff) + * AllStar overview: install GH app on repos or orgs. If repos are out of compliance, can file issues and potentially in future fix it for you. + * Allstar is using Scorecard as a library. Only calls BinaryArtifact check. + * Scorecard does not have much input config as of now. Having this helps with applying fine-grained policies. + * AllStar check for Scorecard GH action. + * AI(jeff): one-pager on Scorecard are library or GH Actions. +* (Laurent) + * Finishing up on GH action +* (Naveen) + * Reproducible Builds GoReleaser + * Fixed the Broken e2e tests + * RepoClient e2e is still pending. + * Fixed the e2e tests which weren't running and now it is running part of CI + * Released 3.1.1 with arm builds for Darwin + +Issues that [need discussion](https://github.com/ossf/scorecard/issues?q=is%3Aopen+is%3Aissue+label%3A%22needs+discussion%22): + +* Frido: Project Thoth collaboration \- [https://thoth-station.ninja/](https://thoth-station.ninja/) + * Analysis and recommendations for Python packages + * OSS project + * Uses prescriptions \- [https://github.com/thoth-station/prescriptions](https://github.com/thoth-station/prescriptions) + * Uses Scorecards. Fetches data from BQ and to create prescriptions. + * Eg for Flask repo \- [https://github.com/thoth-station/prescriptions/tree/master/prescriptions/fl\_/flask](https://github.com/thoth-station/prescriptions/tree/master/prescriptions/fl_/flask) + * Having difficulty in using Big Query +* Need decision on \`--repo=file://\` or \`--local\` + * Go with local option for now +* OSSF to discuss guidelines when recommending tools in our documentation (no span, open-source, etc): David suggested we write a doc and he will circulate to his lawyer if tools we recommend are proprietary. For oss tools, it's fine. We can say "Here are tools we are aware of that can help: X, Y, Z". + * Laurent to create an issue and submit a doc discussing this. Will defer to David Wheeler once we have consensus internally. +* Token permissions [https://github.com/ossf/scorecard/issues/1129](https://github.com/ossf/scorecard/issues/1129) + * Outcome: keep opinion out of Scorecard. Create an umbrella bug for separating policy and evaluation. + * AI(naveen): create issues for these. +* Scorecard should sign releases binaries with cosign using keyless option. [https://github.com/ossf/scorecard/issues/1201](https://github.com/ossf/scorecard/issues/1201) + * AI(naveen): Involve Asra, Priya and confirm who the entity will be. And how closely will this map to SLSA builds? +* Record Scorecard scans into Rekor [https://github.com/ossf/scorecard/issues/1200](https://github.com/ossf/scorecard/issues/1200) + * Need more discussion with the Rekor team. May consider it for v5 not for v4. + * AI(naveen): update issue with comments +* GH actions: upload in our action or leave this in the workflow? + * Leave as is, in the workflow. We can add a different action later to do it all at once, without breaking existing users + +## Oct 18, 2021 + +Updates: + +* (Azeem) + * Created Token server and multiple cron workers running now. +* (Laurent) + * Some additional ideas to improve communications/engagement with the community, see [doc](https://docs.google.com/document/d/1rgk7-jnXVpLVvB84YlJ75fqQX32RLn-FI_y5Ko2CeV8/edit). + * Crowdsourcing cron job to client workflows, see draft [here](https://docs.google.com/document/d/1s9xkRM2EasyEf6tBO8a6vGieMNxN9h3I00UoCQOrnw8/edit?resourcekey=0-CuJDKI0Q0A0P6udmVAhSog#). + * SLSA with GiHub, see draft [here](https://docs.google.com/document/d/1JbLFhpCpy6Y607g72W-BekAoBC6djaKz3gbcMcLWhwQ/edit?resourcekey=0-eRujJ1O_5m4_Bt0Z0KugsA#). +* (Naveen) +* (Chris) + +Issues that [need discussion](https://github.com/ossf/scorecard/issues?q=is%3Aopen+is%3Aissue+label%3A%22needs+discussion%22): + +* Milestone for v4 planning [\#1121](https://github.com/ossf/scorecard/issues/1121) + * Resolution reached on \#1121 +* Token permissions [https://github.com/ossf/scorecard/issues/1129](https://github.com/ossf/scorecard/issues/1129) + * We shouldn’t be recommending commercial tools. Ask the bigger community what the guidelines here are. +* Pinning versions: [https://github.com/ossf/scorecard/issues/1014\#issuecomment-943007111](https://github.com/ossf/scorecard/issues/1014#issuecomment-943007111) and [https://cloud.google.com/blog/topics/developers-practitioners/best-practices-dependency-management](https://cloud.google.com/blog/topics/developers-practitioners/best-practices-dependency-management) [https://github.com/ossf/scorecard/issues/427](https://github.com/ossf/scorecard/issues/427) I'm going to start a doc with Rhys from renovabote: inventory and description of lock files options for each package manager. If you know someone from dependabot and other package managers, let me know. +* PGP signing of commits [https://github.com/ossf/scorecard/pull/1123](https://github.com/ossf/scorecard/pull/1123) + * laurentsimon@ to attend the next "Best practices for open source developers" meeting for discussion + * Need to think more on it, not much clarity +* Scorecard meet calendar issues + * azeems@ to ping \#general Slack channel +* AI(Laurent): Ask Asra to join bi-weekly + +## Oct 4, 2021 + +Updates: + +* (Azeem) +* (Laurent) + * GH action for push/cron triggers. You can try it out by following [\#1074](https://github.com/ossf/scorecard/issues/1074) + * We need to add file and line numbers to all checks ([\#886](https://github.com/ossf/scorecard/issues/886), [\#725](https://github.com/ossf/scorecard/issues/725), etc) + * We're ready for a v3 release: + * It provides numeric scoring and risk categories instead of plain Pass/Fail; aggregate scores; and a new repo interface to ease integration with other code versioning systems. We have scaled scanning to 150k GitHub repos (critical ecosystems dependencies from deps.dev) and we continuously make the results publicly available. + * Contributor ack: chrismcgehee, nanikjava, sprabery, neil465, nathan-415, amamoose, asraa , loosebazooka, johanbrandhorst, oliverchang, evalphobia, notanton, ben-moss, olivekl (rough estimate) + * LTS support +* (Naveen) +* (Chris) + +Issues that [need discussion](https://github.com/ossf/scorecard/issues?q=is%3Aopen+is%3Aissue+label%3A%22needs+discussion%22): + +* Rest API instead of BQ table [\#1056](https://github.com/ossf/scorecard/issues/1056) +* Naveen: Improving discussion for scorecard in general. See this [doc](https://docs.google.com/document/d/1J576To36LUb7O01fQJVO_ysRH-H0fulWHCm13gONA-w/edit?resourcekey=0-mkbr-VNWS16HyAZXjha6mw#). (I don't know how to make if world-readable, so request access) + +## Oct 4, 2021 + +Updates: + +* (Azeem) +* (Laurent) + * GH action for push/cron triggers. You can try it out by following [\#1074](https://github.com/ossf/scorecard/issues/1074) + * Some checks fail on PR event. + * For v0 only use checks which use local repo content and not GitHub APIs. + * Enable BranchProtection in PRs? + * Start with source code only and then consider implementing BP check. + * We need to add file and line numbers to all checks ([\#886](https://github.com/ossf/scorecard/issues/886), [\#725](https://github.com/ossf/scorecard/issues/725), etc) + * We're ready for a v3 release: + * It provides numeric scoring and risk categories instead of plain Pass/Fail; aggregate scores; and a new repo interface to ease integration with other code versioning systems. We have scaled scanning to 150k GitHub repos (critical ecosystems dependencies from deps.dev) and we continuously make the results publicly available. + * Contributor ack: chrismcgehee, nanikjava, sprabery, neil465, nathan-415, amamoose, asraa , loosebazooka, johanbrandhorst, oliverchang, evalphobia, notanton, ben-moss, \+ (rough estimate) +* (Naveen) +* (Chris) + +Issues that [need discussion](https://github.com/ossf/scorecard/issues?q=is%3Aopen+is%3Aissue+label%3A%22needs+discussion%22): + +* Naveen: Improving discussion for scorecard in general. See this [doc](https://docs.google.com/document/d/1J576To36LUb7O01fQJVO_ysRH-H0fulWHCm13gONA-w/edit?resourcekey=0-mkbr-VNWS16HyAZXjha6mw#). (I don't know how to make if world-readable, so request access) + * How can the OSS community be better involved in the Scorecard project? + * +* Pinning in vendored directories [\#1095](https://github.com/ossf/scorecard/issues/1095), Linear history and review dismissal [\#1027](https://github.com/ossf/scorecard/issues/1027) +* Support for local folder instead of GitHub online repo. We can support \--repo=file://path/to/source-code, \--repo=path/to/source-codeor create a new option \--source-code=/path/to/code +* REST API: + * As a v0 maybe export BQ data to GCS and expose REST API on top of that. + * A full-fledged REST API is in roadmap further down the road. +* + +## Sep 27, 2021 + +Updates: + +* (Azeem) +* (Laurent) + * Cron JSON, bypassable code-review/BP, policy file (GH actions \= 1st use case) +* (Naveen) +* (Chris) + +Open Issues: + +* (Christie \+ Kim) Demo of using Scorecard for Go dependencies +* Naveen \- Demo of using OSV for Go dependencies \- [https://github.com/naveensrinivasan/stunning-tribble](https://github.com/naveensrinivasan/stunning-tribble) + +* (Laurent) Versioning and letting our users know [https://docs.google.com/document/d/1femVdKsCWAOHJ1cyIskqd-1k9wTDKhrLnXRrOcLeVhc/edit](https://docs.google.com/document/d/1femVdKsCWAOHJ1cyIskqd-1k9wTDKhrLnXRrOcLeVhc/edit), see also [https://github.com/ossf/scorecard/pull/1001\#discussion\_r706943610](https://github.com/ossf/scorecard/pull/1001#discussion_r706943610) thread + TL:DR: we need to define at least a few public facing API/formats (cron JSON) and use these to announce new versions, changelogs, breaking changes, update steps; then adopt a proper channel to tell our users. Defining an SLO on new versions should also be explicitly stated: e.g., any breaking change should have support for N months minimum. +* (Laurent) Thinking about what scorecard badges for GitHub repos would look like: how about badge levels based on score (e.g., score \>= 3 \-\> bronze; score \>= 5 \-\> silver, etc)? do we want more granular badges short-term, long-term? (e.g., a certain branch protection flag is enabled or disabled). Note that for the majority of checks, the distinction between score-based and granular badges is not really important \- it does provide some benefits for branch protection. +* Pinned deps check: is it too large? Shall we split it into smaller ones: + * Docker pinning \- note that would make such check result binary (0 or 10\) + * Workflow pinning \- same note + * Etc +* https://github.com/ossf/scorecard/issues/1027 +* [https://github.com/ossf/scorecard/issues/895](https://github.com/ossf/scorecard/issues/895) and [https://github.com/ossf/scorecard/issues/1005](https://github.com/ossf/scorecard/issues/1005) broken/bypassable check + +## Sep 20, 2021 + +Open Issues: + +* (Christie \+ Kim) Demo of using Scorecard for Go dependencies +* Naveen \- Demo of using OSV for Go dependencies +* (Laurent) Versioning and letting our users know [https://docs.google.com/document/d/1femVdKsCWAOHJ1cyIskqd-1k9wTDKhrLnXRrOcLeVhc/edit](https://docs.google.com/document/d/1femVdKsCWAOHJ1cyIskqd-1k9wTDKhrLnXRrOcLeVhc/edit), see also [https://github.com/ossf/scorecard/pull/1001\#discussion\_r706943610](https://github.com/ossf/scorecard/pull/1001#discussion_r706943610) thread + TL:DR: we need to define at least a few public facing API/formats (cron JSON) and use these to announce new versions, changelogs, breaking changes, update steps; then adopt a proper channel to tell our users. Defining an SLO on new versions should also be explicitly stated: e.g., any breaking change should have support for N months minimum. +* (Laurent) Thinking about what scorecard badges for GitHub repos would look like: how about badge levels based on score (e.g., score \>= 3 \-\> bronze; score \>= 5 \-\> silver, etc)? do we want more granular badges short-term, long-term? (e.g., a certain branch protection flag is enabled or disabled). Note that for the majority of checks, the distinction between score-based and granular badges is not really important \- it does provide some benefits for branch protection. + * Related: [https://github.com/ossf/scorecard/issues/1027](https://github.com/ossf/scorecard/issues/1027) + * Chris: not having scores might break users when a code change changes score calculation + * +* Pinned deps check: is it too large? Shall we split it into smaller ones: + * Docker pinning \- note that would make such check result binary (0 or 10\) + * Workflow pinning \- same note + * Etc +* [https://github.com/ossf/scorecard/issues/1005](https://github.com/ossf/scorecard/issues/1005) broken/bypassable check + * Closed? +* [https://github.com/ossf/scorecard/issues/895](https://github.com/ossf/scorecard/issues/895) and + * azeems@ to look into it + +## Sep 7, 2021 + +Updates: + +* Azeem + * 100k cron repos. + * RepoClient interface implementation complete. +* Laurent + * Cleanup JSON format and added schema validation/unit tests + * David A. Wheeler: Will this impact the OpenSSF metrics dashboard? + * No, it shouldn’t. I talked with Michael Scovetta & all should be fine. +* Naveen + * sigstore cosign had a breaking change, looking into it. +* Chris + +Open Issues: + +* Cleanup JSON format and added schema validation/unit tests +* JWT potential vuln. \- github.com/dgrijalva/jwt-go + * Coming due to github.com/bradleyfalzon/ghinstallation +* [https://github.com/ossf/scorecard/issues/942](https://github.com/ossf/scorecard/issues/942) + * Naveen working on it already +* [https://github.com/ossf/scorecard/issues/967](https://github.com/ossf/scorecard/issues/967) + * Good first issue +* [https://github.com/ossf/scorecard/issues/966](https://github.com/ossf/scorecard/issues/966) + * Scorecard should look for whether certain tools are run and not specifically run those tools. + * Running this can cause false positives which needs to be handled by Scorecard + * Look for whether or not there are security scans + * It’s easy to detect most CI pipelines & check if they do certain things, just by looking at configuration files within the project. Most projects use a small number of CI pipeline systems, which are configured by a small set of config files: + * .github/workflows + * .circleci + * .travis.yml + * .gitlab-ci.yml + * An alternative is actually running the scans & putting in results \- that’s a different topic \- push that option off to the future (if ever), not this year at least. + * Currently in scope of Scorecard is to check configs but in future we might look into +* [https://github.com/ossf/scorecard/issues/965](https://github.com/ossf/scorecard/issues/965) + * This is an idea for hardening the Scorecards project itself +* [https://github.com/ossf/scorecard/issues/950](https://github.com/ossf/scorecard/issues/950) + * Maybe wait until OpenSSF as an organisation decides the policy here and follow the same policy for Scorecard. + * SBOM \- Scorecard can get started, but signing / cosign needs a bigger discussion. + * Signing \- start identifying how to sign packages for OpenSSF? Okay to use cosign? Any particular preferences? +* [https://github.com/ossf/scorecard/issues/859](https://github.com/ossf/scorecard/issues/859) +* Webhook for prod cron job. Volunteers? +* Naveem will look at CII Best Practices badge site to see what it’s missing on Scorecard & talk with David A. Wheeler about that + * https://metrics.openssf.org/grafana/d/default/metric-dashboard?orgId=1\&var-PackageURL=pkg:github%2Fcoreinfrastructure%2Fbest-practices-badge + * https://github.com/coreinfrastructure/best-practices-badge + * Naveem will email [dwheeler@linuxfoundation.org](mailto:dwheeler@linuxfoundation.org) + * E.g.: CII Best Practices badge \*DOES\* have frozen dependencies \- just look for “Gemfile.lock”. + +## Aug 23, 2021 + +Updates: + +* (Azeem) +* (Laurent) SARIF support +* (Naveen) +* (Chris) + +Open Issues: + +* Protobuf is being rebuilt for every check run on PRs, which takes time and delays merging. Can we pull a protobuf binary directly, or use apt-get, or something else? + * Naveen to work on this. +* Go.sum lists the same dependency multiple times (different metadata/hashes). Can this be cleaned? + * This is expected since difference +* e2e tests status [https://github.com/ossf/scorecard/issues/861](https://github.com/ossf/scorecard/issues/861) + * New contributor working on it. If not, Naveen will take it up. +* Note from David A. Wheeler: Hi, I teach classes at George Mason University (GMU) on Monday evenings (4:30-10pm US Eastern Time), starting August 23\. This is the time when the Security Scorecards meetings meet. It'd be awesome if there was a different time things can be scheduled to. If not, I understand, but please understand I can't join in that case. Thanks\!\! \<[dwheeler@linuxfoundation.org](mailto:dwheeler@linuxfoundation.org)\> Also: Is there a way to contact the group other than issues? E.g., a mailing list? If so, let me know… + * Azeem to try and reschedule. + +## Aug 9, 2021 + +Updates: + +* Scorecard checks/sarif (Laurent) +* Fixes (Naveen) +* Line numbers in remediation results (Chris) +* [Friction log](https://docs.google.com/document/d/1dPnjpS8SQo8GfqVBkmxwhPCJz4j9YRS7Sr51u4lnysE/edit?resourcekey=0-DBA9jpoXbRB5RSdCvI-xXA#) by Kara + +Open Issues: + +* E2E Integration tests \- Assign to Naveen +* Bubble up results into OSV +* [https://github.com/ossf/scorecard/issues/792](https://github.com/ossf/scorecard/issues/792) +* Security-Policy: add a check for allstar being installed? +* ShiftLeftSecurity +* [https://github.com/ossf/scorecard/issues/759](https://github.com/ossf/scorecard/issues/759) + +## Jul 26, 2021 + +Attendees: + +* David A. Wheeler (Linux Foundation) + +Updates: + +* Cron job/performance (Azeem) + * E2E release testing is setup. Next step is to setup a release procedure. +* RepoInterface (Azeem) + * More checks now use RepoInterface APIs + * Working on replacing Active check +* Scorecard checks (Laurent) + * Score-based result integrated, some nits to fix. Divide by 0 blocking cron job +* Naveen + * Active check using graphQL \- [https://github.com/ossf/scorecard/issues/639](https://github.com/ossf/scorecard/issues/639) + * Scorecard V2 update: [https://github.com/ossf/scorecard/issues/711](https://github.com/ossf/scorecard/issues/711) + * [https://github.com/ossf/scorecard/issues/630](https://github.com/ossf/scorecard/issues/630) + * Removed gitcache + + +Open issues: + +* Weekly cron job blocked on [https://github.com/ossf/scorecard/issues/748](https://github.com/ossf/scorecard/issues/748). +* Constantly breaking e2e tests \- [https://github.com/ossf/scorecard/issues/741](https://github.com/ossf/scorecard/issues/741) + * A 20%-er who might take up mocking RepoClient + * Maintain some fake repos like “ossf/fakerepo” for testing +* Code-Review and PullRequest merge \- [https://github.com/ossf/scorecard/issues/731](https://github.com/ossf/scorecard/issues/731) + * everyone agrees? +* CI-Test check looks for CI test, ie whether some presubmit checks are run. I'm not sure we still need it. no other checks we already look for specific CI tests, like CI-Fuzz, SAST, etc. We should be looking for the corresponding config for other CI systems and add it to other checks. The check, as implemented today, is mostly informational. +* Table does not understand \\n. \-\> need fix. +* Show check description/remediation steps in new command \--explain or \--show-details +* Need monitoring of check errors in cron job to validate/refine check implementation. Relevant previous PR [\#597](https://github.com/ossf/scorecard/pull/597) +* Frozen-Deps \-\> Pinned-Dependencies + * Ok for everyone? +* Use graphQL for SecurityPolicy check [https://github.com/ossf/scorecard/issues/753](https://github.com/ossf/scorecard/issues/753) + +## July 12, 2021 + +Attendees: + +* David A. Wheeler (Linux Foundation) + +Updates: + +* Cron job/performance (Azeem) + * Update to use graphQL +* RepoInterface (Azeem) + * Same as above +* Scorecard checks (Laurent) + * Started a PR for adding check details (why check is passing/failing \+ remediation) \- \#650. + * Add better error handling. Will write a doc for error handling guidelines. +* Gitcache efficiency (Naveen) + * Code doesn’t seem to be using the Gitcache. + * We can remove it. Naveen to work on it. +* Misc (Naveen): + * Working on a graphQL PR for archived repos. + * Fixed some bugs +* Dependabot PRs (Naveen) + * No update +* Remediation (Chris) + +Open Issues: + +* How should Scorecard results be interpreted? + * Oliver: we can have categories like \- critical, ideal to have etc. + * David: CII badge has 3 levels: passing, silver, gold. Having passing in itself is a bug indicator of secure practices being followed. + * [https://bestpractices.coreinfrastructure.org/en/criteria/0](https://bestpractices.coreinfrastructure.org/en/criteria/0) + * David: might be useful to think of this in terms of risk. + * Azeem: merge both ideas and have severity categories and risk scores. + * Oliver: checks do not currently have threat models. Having this may help categorize checks. +* Remediation and Error details: + * [https://github.com/ossf/scorecard/issues/629](https://github.com/ossf/scorecard/issues/629) + * [https://github.com/ossf/scorecard/pull/662](https://github.com/ossf/scorecard/pull/662) + * [https://github.com/ossf/scorecard/pull/650](https://github.com/ossf/scorecard/pull/650) +* Scorecard releases \- [https://github.com/ossf/scorecard/issues/651](https://github.com/ossf/scorecard/issues/651) + +## June 28, 2021 + +Attendees: + +* David A. Wheeler (Linux Foundation) +* Naveen Srinivasan +* Azeem Shaikh +* Oliver Chang +* Laurent Simon +* Matt Rutkowski (IBM) + +Updates: + +* Fixed integration test issues (hooray\!) +* Cron job/performance (Azeem) \- not much of an update. Still planning to scale up eventually. +* RepoInterface (Azeem) \- will change interface for get files list, etc., so it’s not GitHub-specific. +* Scorecard blog post is about to come out. +* Scorecard checks (Laurent) + * https://github.com/ossf/scorecard/pull/611 + * Working to detect pipe-to-shell as a security concern + * Developers might use files other than .txt, e.g., looking for other information. + * Hashing itself of just a package in Python doesn’t lock all the transitive dependencies necessarily. No way to detect that just with hashes. Need to check that out. E.g.., Hash pinning of all transitive dependencies is fine. + * Python: requirements.txt doesn’t have this information. It was never designed to handle locking, it doesn’t enforce it, you have to do it yourself. Perhaps get people to use pipenv instead, it supports lockfiles. + * David W: I suggest that the goal is simply “if you’re using Python you use something that locks transitive dependencies” & allow any reasonable solution. E.g., support: + * [https://python-poetry.org/](https://python-poetry.org/) \- poetry uses pyproject.toml and poetry.lock files. Presencee of “poetry.lock” says there IS a package lockfile for Python. + * pipenv uses Pipfile and Pipfile.lock. Again, presence of Pipfile.lock says there are package locks. + * pip-tools provides pip-compile and pip-sync commands. Here, requirements.in lists your direct dependencies, often with loose version constraints and pip-compile generates locked down requirements.txt files from your .in files. More complex \- need to check if the requirements.txt file is generated with transitive locks. + * If you just have requirements.txt, but don’t meet any of the other requirements, then you have Python that is NOT dependency locked & that’s a risk. + * [https://stackoverflow.com/questions/52665596/equivalent-of-package-json-and-package-lock-json-for-pip](https://stackoverflow.com/questions/52665596/equivalent-of-package-json-and-package-lock-json-for-pip) + * More info on Python dependency locking: + * [https://lincolnloop.com/blog/python-dependency-locking-pip-tools/](https://lincolnloop.com/blog/python-dependency-locking-pip-tools/) + * [https://dev.to/fridex/micropipenv-the-one-installation-tool-that-covers-pipenv-poetry-and-pip-tools-3ee7](https://dev.to/fridex/micropipenv-the-one-installation-tool-that-covers-pipenv-poetry-and-pip-tools-3ee7) + * Also: Check that there’s a language virtual environment (e.g., Python, Go). There could be some double-checks for consistency to make sure that the package versions are consistent (e.g., someone might not have enabled their virtual environment) \- check that files are consistent with the locks. (E.g., “go install” without pinning) +* Gitcache efficiency (Naveen) + * No update here + * Will work on this next week. +* Remediation (Chris) + * No update + +Open Issues: + +* [Needs discussion issues](https://github.com/ossf/scorecard/issues?q=is%3Aissue+is%3Aopen+label%3A%22needs+discussion%22) + * restrict github token for scorecard repo +* Synk test failures + * Removed now. +* ZeroConfidenceErrors and RetryErrors \- + * AI([azeems](https://who.corp.google.com/azeems)): Create issue and assign to Naveen +* ![][image1] + +* BinaryArtifact checks on repos like [https://github.com/Smithsonian/OpenAccess](https://github.com/Smithsonian/OpenAccess) +* Managing dependabot PRs. + * With integration tests fixed, it should be ok to merge. + * Setting weekly PRs may skip 0-day vulnerabilities + * Review process for dependabot PRs: + * Naveen to write a README step-by-step to review PRs. +* How can we maintain code quality? + * Maintain list of fake repos to test the checks on + * Emulator for PubSub exist. We can use that. + * https://www.testcontainers.org/modules/gcloud/ + +## June 14, 2021 + +* Welcome Chris\! +* Donate your tokens to Scorecard. +* Improve implementation of CheckIfFileExists and CheckFileContent \- [https://github.com/ossf/scorecard/issues/578](https://github.com/ossf/scorecard/issues/578) + * +* Should we delete Gitcache and HTTP cache \- [dashboard](https://cloud.google.com/monitoring/dashboards/builder/6d72d8f8-4fab-4904-9f29-62484c85d147?project=openssf&dashboardBuilderState=%257B%2522editModeEnabled%2522:false%257D&timeDomain=6h)? +* curl | bash and other download: new check Non-Pinned-Download or in Frozen-Deps? I think it's part of pinning +* Integration of 3P tools for custom checks results + * Possible options: + * Compile out-of-band and add it to the scorecard via go:embed. Easy, but kinda ugly. We won't be able to receive dependabot's PRs. + * Create a new github project with a shim around shellsheck, e.g. go-shellcheck-wrapper that we regularly update to use a newer version of shellcheck. This would still require the use of go:embed, I think so still kinda ugly. We won't be able to receive dependabot's PRs. + * Have scorecard check that shellcheck is installed. It may be installed on the system or in a dedicated directory, e.g. $HOME/.XXX/ where XXX is the package manager: for shellcheck it's Haskel's cabal. If the tool is installed, run the check, otherwise return an error (and the steps to install) when the check is enabled. + * We can provide an option in scorecard to install dependencies, e.g. scorecard \--install-deps=CheckName + * Download a binary pinned by hash. We won't be able to receive dependabot's PRs. + * For sandboxing, we may need something stronger than have the tool installed on system... but any sandboxing utility will require additional installation for container runtime and setup + * Use a docker container as a weak security boundary and to ease installation of 3P tools. As most tools work on files rather than stdin, this option also helps keep workstation clean. + * Long-term, if we have many 3P tools we need, we can think of having config files for each 3P +* Integration tests for cron job \- [https://github.com/ossf/scorecard/issues/510](https://github.com/ossf/scorecard/issues/510) +* Use regex for quick (though imperfect) analysis, or do deeper AST analysis (which requires a lot more to get going)? Probably start with some regexes +* Updates/blockers + * Azeem + * Naveen + * Integration test broken \- not currently clear why. Will investigate this week. + * Laurent + * Chris +* How can we get people to make changes to produce higher scorecard results? + * David A. Wheeler: The best approach is to make it really easy for the project to accept the change. Turn it into a pull request/merge request. Don’t “just enable whining” \- provide a change that actually implements the change. Some changes aren’t just technical, but are social \- social changes are harder. +* Scorecard scaling: Good news, expect to add scanning of 30K more OSS projects + +## May 24, 2021 + +* Updates/blockers + * Scaling Scorecard (Azeem) + * Scorecard dashboard \- [link](https://pantheon.corp.google.com/monitoring/dashboards/builder/6d72d8f8-4fab-4904-9f29-62484c85d147?project=openssf&dashboardBuilderState=%257B%2522editModeEnabled%2522:false%257D&timeDomain=6h) + * Ideas for reducing token usage + * Cloudbuild + * Scorecard rollouts (Naveen) + * ok-to-test + * Binary artifacts/scorecard UX + * Remediation (Laurent) +* Open issues: + * ? +* Shared calendar + * Move to the OpenSSF calendar meet after this meeting + +## May 17, 2021 + +* Open issues needing discussion: + * Frozen build/install dependencies \- [bug](https://github.com/ossf/scorecard/issues/429) + * Docker file dependencies are left. + * Dependabot might support Dockerfile updates. + * [GitHub token scopes](https://github.com/ossf/scorecard/issues/432) + * We have a solution for Scorecard + * Adding a Scorecard check to do this might be a future improvement to do. + * [Ok-to-test action](https://github.com/ossf/scorecard/issues/316) + * Naveen to take this up + * [Binary artifacts in source repo](https://github.com/ossf/scorecard/issues/400) + * Up for grabs + * Scorecard UX \- [HTML](https://github.com/ossf/scorecard/issues/342), [GitHub Actions](https://github.com/ossf/scorecard/issues/430), [SARIF/CI integration](https://github.com/ossf/scorecard/issues/193) , [badges](https://github.com/ossf/scorecard/issues/271) + * Up for grabs + +## May 10, 2021 + +* Discuss Scorecard and Remediation collaboration + * Attendees: + * Azeem + * Jeff + * Abhishek + * Laurent + * Oliver +* API \- db or lib + * Remediation will run on private repositories, so cannot use Scorecard DB. Will use Scorecard as a library. AI is to confirm that the available Scorecard API is enough to unblock Remediation work. + * Remediation clients will input a policy/config which will be used to run customize and run Scorecards. The schema of this config is TBD and will decide how granular Scorecards API/lib should be to support the Remediation usecase. + * Remediation requires support to run checks on local files using Scorecard. Need development effort on the Scorecard side to enable this. +* CI/CD system + * If Scorecard can be enabled as a GitHub action, it is easy for Remediation to use it. +* List of checks/priority + * AI: Figure out milestones to be reached in terms for new checks to be added or improving check accuracy. + +## May 10, 2021 + +* Discuss Scorecard and Cosign/Sigstore/BinAuth + * Attendees: + * azeems@ + * dlorenc@ +* BinAuthz + * Enforces policies on what to run on Kubernetes. + * Not very well developed yet. Maybe wait for v2, if the issue is not critical. +* Sigstore/Cosign + * Provides an easy way for developers to sign their images and store both image and signature in the same registry. + * Developers publishing binaries/images directly could easily adopt Cosign to make installing and running these binaries more secure. But, this is upto the developer publishing binaries, does not help our case. +* Rollout policies/guidelines + * Using Cloud Build to do automated rollout might be the safest/sanest option available, without maintaining more services. + * No way to restrict local binary pushes. + * For floating point dependencies: provide a “make install” command which downloads all dependencies pinned to a certain hash/digest. + +## May 6, 2021 + +* Discuss Scorecard rollout, non-pinned dependencies + * Attendees: + * azeems@ + * laurentsimon@ + * ochang@ +* Oliver: maybe not always push master branch? +* Oliver: tag commits that we want GCR to pull. +* Any way to avoid manual pushes? GCP BinaryAuth maybe? + +## Apr 26, 2021 + +* Intros +* Focus areas for contributors + * AI([azeems](https://who.corp.google.com/azeems)): Create issues to discuss + * Some open issues: + * [https://github.com/ossf/scorecard/issues/78](https://github.com/ossf/scorecard/issues/78) + * Sigstore + * Test and deploy + * Check quality [https://github.com/ossf/scorecard/pull/347\#discussion\_r616364482](https://github.com/ossf/scorecard/pull/347#discussion_r616364482) +* OpenSSF TownHall \- [https://docs.google.com/presentation/d/1s4Y5pr3drWlx29-Lkio7zWkegJzugWQCqplvV3GiIH0/edit?pli=1\#slide=id.p](https://docs.google.com/presentation/d/1s4Y5pr3drWlx29-Lkio7zWkegJzugWQCqplvV3GiIH0/edit?pli=1#slide=id.p) + * Try in Q3 +* Snyk test + +[image1]: \ No newline at end of file diff --git a/governance/meetings/2022.md b/governance/meetings/2022.md new file mode 100644 index 000000000000..4994990842ed --- /dev/null +++ b/governance/meetings/2022.md @@ -0,0 +1,1495 @@ +# OpenSSF Scorecard Meeting Archive — 2022 + +## Dec 15, 2022 + +Attendees + +* Spencer Schrock (Google) +* Naveen Srinivasan +* Jeff Mendoza (Google) +* Michael Goddard (Google) + +Welcome new faces + +* Michael Goddard (Google) \- deps.dev +* + +Project/Individual updates + +* Naveen: working on Action to use the API for deps. Follow-up to Aiden's summer internship work. Will show a demo next meeting. Some customers asked for "rawer" result + +Agenda + +* Release [https://github.com/ossf/scorecard/releases/tag/v4.10.0](https://github.com/ossf/scorecard/releases/tag/v4.10.0) [https://github.com/ossf/scorecard-action/releases/tag/v2.1.0](https://github.com/ossf/scorecard-action/releases/tag/v2.1.0) include the OSV scanner integration +* \[Jeff\] Criticality score may need reviewer help. Can we have a pool of ossf reviewers? +* Scorecard release 4.10 and Scorecard-action 2.10 + +## Dec 1, 2022 + +Attendees + +* Spencer Schrock (Google) +* Naveen Srinivasan +* Caroline Lee (IBM) +* Lior Kaplan (Checkmarx) +* Jeff Mendoza (Google) +* Laurent Simon (Google) +* Brian Behlendorf (OpenSSF/LF) +* Brian Russell (Google) +* Raghav Kaul (Google) + +Welcome new faces + +* Lior Kaplan +* Matt Spiekerman + +Project/Individual updates + +* BrianB \- news re OpenSSF budget support + * New donation from Amazon close to $500,000 + * Announcement TBD + +Agenda + +* IaC in Scorecards proposal (Lior Kaplan) + * [https://docs.google.com/presentation/d/1\_dy3\_L5c42ZhUeVaAvnF8K3ati5L8ePVgukVt3qqXIw/edit?usp=sharing](https://docs.google.com/presentation/d/1_dy3_L5c42ZhUeVaAvnF8K3ati5L8ePVgukVt3qqXIw/edit?usp=sharing) + * Would be multi phase check to give projects time to fix before scoring + * Phases 1 and 2 could be combined + * Detect IaC files and ensure security checks are in place + * Similar to SAST + * Integration could involve detection of KICS GitHub action detection [https://github.com/ossf/scorecard/pull/1487/files\#](https://github.com/ossf/scorecard/pull/1487/files#) is a PR to improve the SAST check to support Actions, etc which could revive +* Scorecard UX for Annotations and Configuration (Jeff) + * [Scorecard UX for Annotations and Configuration](https://docs.google.com/document/d/1CcJeIr3Uskj84uwFQQHu12wEKRoO55rkCo7FzBA6jsc/edit?usp=sharing) (shared with [https://groups.google.com/g/ossf-scorecard-dev](https://groups.google.com/g/ossf-scorecard-dev)) + * Need to hash out what we do for public facing results + * Bad actor, score inflation + * Related issues: + * [https://github.com/ossf/scorecard/issues/2296](https://github.com/ossf/scorecard/issues/2296) + * Feedback: it would be better to go ahead and define what the score will look like online with this proposal, but that will take a longer discussion to decide +* .gitattributes tarball file evasion (Spencer) + * [https://github.com/ossf/scorecard/issues/2489\#issuecomment-1331377334](https://github.com/ossf/scorecard/issues/2489#issuecomment-1331377334) + * go-git could help, and is receiving patches again [https://github.com/go-git/go-git/pull/620](https://github.com/go-git/go-git/pull/620) +* Next Scorecard release planning (Naveen) + * Resurrection this PR [https://github.com/ossf/scorecard-action/pull/780](https://github.com/ossf/scorecard-action/pull/780) and make changes to use the API for dependency diff + * For this PR specifically, being able to run Scorecard action on PR trigger is needed + * Building great features, but without a new release date, things fall of the schedule + * Similar to other projects, we should be working towards specific goals/features +* Decision on scorecard scan between 2 releases feature (caroline) [https://github.com/ossf/scorecard/issues/2368](https://github.com/ossf/scorecard/issues/2368) + * Is there some vision of this feature that fits the Scorecard vision + * Request to voice comments on + +## Nov 17, 2022 + +Attendees + +* Spencer Schrock (Google) +* Raghav Kaul (Google) \[facilitating meeting\] +* Brian Russell (Google) +* Laurent Simon (Google) +* David A. Wheeler (Linux Foundation) +* Theresa Mammarella (Sonatype) +* Eddie Knight (Sonatype) +* Caroline Lee (IBM) + +Welcome new faces + +* Theresa Mammarella (Sonatype) +* Eddie Knight (Sonatype) +* Big thank you / shout-out to Sonatype for their 2022 report, which analyzed Scorecards’ metrics and is really interesting\!\! + +Project/Individual updates + +* + +Agenda + +* Handling Code Review for automated (bot-generated) commits on a project (Raghav/Spencer/Laurent) ([https://github.com/ossf/scorecard/issues/2302](https://github.com/ossf/scorecard/issues/2302), [https://github.com/ossf/scorecard/issues/2450](https://github.com/ossf/scorecard/issues/2450)) + * Proposal 1: Move to leveled scoring for Code Review rather than proportional scoring (-3 if any bot commits are unreviewed, \-7 if any human commits are unreviewed) + * Sonatype reported the broader context. On single-maintainer repo, if there are bots & external contributors it’ll seem like code reviews. Most people will do explicit reviews of bots. + * Laurent: Can we differentiate projects that are single-maintainer (e.g. by looking at contribution history), and score them differently? + * David: Having a “lesser” penalty for bot commits seems sound because of the different types of risk posed by bots vs. humans + * Proposal 2: Commits from well-known bots (e.g. Dependabot/Renovatebot) will not be penalized + * David: It’s odd to not penalize “well-known” bots \- perhaps just be consistent (all penalized or none penalized) for bots + * Sometimes the proposals are wrong \- having review even in this case seems wise. + * Will possibly get into an allow-list problem, similar to recent Token Permissions changes + * Note: \*SEPARATE\* the idea of \# of maintainers (having more maintainers is good in case one dies) \- that’s a different issue + * If we can’t tell at all, report “insufficient data”? +* Proposal \#1 sounds more sensible, let’s start there. Scott H. (SEI) was running draft Scorecard code against 400 repos \- see if he’d be willing to do this on this proposal to see what happens. + * David: Maybe add this to the Scorecards CI pipeline, so we can form opinions in the future + * Issue: That would affect token usage. Branch protection requires it. + * David: Maybe instead document how to run the test suite? Maybe ask Scott to document his process? +* We don’t want numbers to bounce up & down. We look 30 commits back, but if the commits aren’t squashed, a big merged branch may consume many/all of them. + * N\#umber of commits fetched is configurable w/ GitHub GraphQL API +* Discussion of using the git data (.git) for checks + * Previous discussion: [https://github.com/ossf/scorecard/issues/1709](https://github.com/ossf/scorecard/issues/1709) + +## Nov 3, 2022 + +Attendees + +* Naveen Srinivasan +* Jeff Mendoza (Google) +* Spencer Schrock (Google) +* Caroline Lee (IBM) +* Raghav Kaul (Google) +* Sarah Evans (Dell) + +Welcome new faces + +* Sarah Evans from Dell, interested in contributing. Working on risk dashboards + * Welcome Sarah\!\! +* + +Project/Individual updates + +* [https://lfms22.sched.com/event/1BKDO/do-you-know-the-health-of-your-oss-dependencies-introducing-ossf-scorecard-naveen-srinivasan-endor-labs-brian-russell-google?iframe=no](https://lfms22.sched.com/event/1BKDO/do-you-know-the-health-of-your-oss-dependencies-introducing-ossf-scorecard-naveen-srinivasan-endor-labs-brian-russell-google?iframe=no) + * Brian Russel and Naveen Srinivasan presenting in Linux Foundation Member summit + +Agenda + +* Scorecard to check for Git commit signing ([https://github.com/ossf/scorecard/issues/379](https://github.com/ossf/scorecard/issues/379), [https://github.com/ossf/scorecard/issues/779](https://github.com/ossf/scorecard/issues/779)) \- Raghav +* + +## Oct 20, 2022 + +Attendees: + +- Caroline Lee +- Spencer Schrock (google) +- Raghav Kaul (Google) +- Azeem Shaikh (Google) + +Project/Individual updates: +Agenda + +- Moving scorecard to Firestore [https://github.com/ossf/scorecard/issues/2066](https://github.com/ossf/scorecard/issues/2066) Naveen Srinivasan + + - [https://docs.google.com/document/d/176LTMrCfkAkj8Kv2AlSy8xBBWXq6p5S4gNONro1uYmA/edit?usp=sharing](https://docs.google.com/document/d/176LTMrCfkAkj8Kv2AlSy8xBBWXq6p5S4gNONro1uYmA/edit?usp=sharing) +- [https://github.com/ossf/scorecard/issues/2374](https://github.com/ossf/scorecard/issues/2374) Naveen Srinivasan + - We would also need to add to the API metrics to know how the API is being used. +- scan between two releases: [https://github.com/ossf/scorecard/issues/2368](https://github.com/ossf/scorecard/issues/2368) (Caroline) + - Potential related “release lag” check which takes in + - Number of versions from the current version + - Number of major versions from the current version + - Time between latest and current version +- Discuss about the Scorecard action v2.0.5 issue in release Naveen Srinivasan + - Should have broken [https://github.com/ossf-tests/scorecard-action/actions/workflows/scorecards-latest-release.yml](https://github.com/ossf-tests/scorecard-action/actions/workflows/scorecards-latest-release.yml) + - Run \#103 pulled v2.0.4 \- [https://github.com/ossf-tests/scorecard-action/actions/workflows/scorecards-latest-release.yml](https://github.com/ossf-tests/scorecard-action/actions/workflows/scorecards-latest-release.yml) and run \#104 pulled v2.0.6 \- [https://github.com/ossf-tests/scorecard-action/actions/runs/3278398635/jobs/5396740050](https://github.com/ossf-tests/scorecard-action/actions/runs/3278398635/jobs/5396740050) so looks like v2.0.5 was never tested :( + +## Oct 6, 2022 + +Attendees: + +* Spencer Schrock (Google) +* Jeff Mendoza (Google) +* Raghav Kaul (Google) +* Varun Sharma (StepSecurity) +* Caroline Lee (IBM) +* Saurabh Singh(IBM) +* Naveen Srinivasan +* David A. Wheeler (Linux Foundation) +* Azeem Shaikh (Google) +* Brian Russell (Google) + +Project/Individual updates: + +- Scorecard gets an official twitter account [https://twitter.com/scorecards\_dev](https://twitter.com/scorecards_dev) + +Agenda + +* Scorecard releases should include human readable release notes. We have a section on release notes in every PR and is not being utilized. [https://github.com/ossf/scorecard/issues/2329](https://github.com/ossf/scorecard/issues/2329) Naveen Srinivasan + * Might be able to use [https://github.com/googleapis/release-please](https://github.com/googleapis/release-please) ? +* David: Question: What do people think about pretty-printing the JSON output so it’s easier for humans to read in addition to be being machine readable? (FIrefox formats JSON in a pretty way, but Chrome does not) + * Seems reasonable, just do it for the web application API. + * Should break nothing. If it does, the pretty-printer or reader is badly broken. +* Scorecard participate in hacktoberfest? [https://hacktoberfest.com/](https://hacktoberfest.com/) (Caroline) +* Security controls mapping(i.e.NIST/OWASP) to Scorecard Checks?(Saurabh)[https://www.cybersaint.io/blog/nist-800-53-control-families](https://www.cybersaint.io/blog/nist-800-53-control-families) , [https://csrc.nist.gov/Projects/risk-management/sp800-53-controls/release-search\#/](https://csrc.nist.gov/Projects/risk-management/sp800-53-controls/release-search#/), https://owasp.org/projects/ +* Add more options for SAST tools [https://github.com/ossf/scorecard/issues/2318](https://github.com/ossf/scorecard/issues/2318) (Varun) +* David: It’s *fine* to make changes to Scorecards that changes the final score. Just make sure you version the Scorecard code so you identify which tool version gave the result. The point is to provide an estimate of risk \- added measures, improved detection code, etc., will all modify the final score. In theory you’re improving your estimate over time. +* There are many kinds of tools: [https://github.com/ossf/wg-security-tooling/blob/main/guide.md\#readme](https://github.com/ossf/wg-security-tooling/blob/main/guide.md#readme) + * David: It’s better to detect different categories with different measures. That will make it much easier to determine where a program is and isn’t doing well. +* David: It’s going to take time to detect more & more tools. Just because Scorecards *currently* detects a tool isn’t an endorsement of that specific tool, it just means that Scorecards isn’t omniscient & we’d like people to help us improve its measurement (detection) system. +* Creating GitHub issue for bad scores for correction/enhancement (Just an idea ) :-) (Saurabh) + +## Sep 22, 2022 + +Attendees: + +* Spencer Schrock (Google) +* Jeff Mendoza (Google) +* Christopher Alonso (IBM) +* Naveen Srinivasan +* Rich Heironimus (IBM) +* Shripad Nadgowda (Intel) +* Raghav Kaul (Google) + +Project/Individual updates: + +- Scorecard talk has been accepted at the Linux foundation member summit [https://lfms22.sched.com/event/1BKDO/do-you-know-the-health-of-your-oss-dependencies-introducing-ossf-scorecard-naveen-srinivasan-endor-labs-brian-russell-google?iframe=no](https://lfms22.sched.com/event/1BKDO/do-you-know-the-health-of-your-oss-dependencies-introducing-ossf-scorecard-naveen-srinivasan-endor-labs-brian-russell-google?iframe=no) + - Naveen Srinivasan and Brian Russell would be presenting it. + +Agenda + +- [https://github.com/ossf/scorecard/issues/2270](https://github.com/ossf/scorecard/issues/2270) Naveen Srinivasan +- [https://github.com/ossf/scorecard/pull/2077](https://github.com/ossf/scorecard/pull/2077) Naveen Srinivasan + - And related PR's [https://github.com/ossf/scorecard-action/pull/780](https://github.com/ossf/scorecard-action/pull/780) + - What needs to be done to get this merged in? + - Now that we have a Scorecard API this will be helpful + - +- Demo of https://app.stepsecurity.io/securerepo to fix Scorecard issues (Varun) +- [https://github.com/ossf/scorecard/issues/2285](https://github.com/ossf/scorecard/issues/2285) (discuss Zombie commits \- Christopher Alonso) +- Renovate [https://github.com/ossf/scorecard/issues/2053](https://github.com/ossf/scorecard/issues/2053) Spencer + +## Sep 8, 2022 + +Attendees: + +* David A. Wheeler (Linux Foundation) +* Spencer Schrock (Google) +* Caroline Lee (IBM) +* Luigi Gubello +* Naveen Srinivasan +* Shripad Nadgowda (Intel) +* Varun Sharma (StepSecurity) +* Raghav Kaul (Google) +* Ethan Davis (Google) +* Rich Heironimus (IBM) + +Project/Individual updates: + +* \[Azeem\]: Scorecard/Gauge collaboration update: [https://github.com/ossf/scorecard/issues/2224](https://github.com/ossf/scorecard/issues/2224) +* \[Naveen\]: Scorecard web app is fuzzed [https://github.com/google/oss-fuzz/pull/8388](https://github.com/google/oss-fuzz/pull/8388) + * [https://github.com/ossf/scorecard-webapp/pull/194](https://github.com/ossf/scorecard-webapp/pull/194) +* \[Naveen\] [https://github.com/sigstore/community/issues/125\#issuecomment-1240965050](https://github.com/sigstore/community/issues/125#issuecomment-1240965050) + * Sigstore Nomination for Best User Adopter Award 2022 +* Scorecard action v2 release [https://openssf.org/blog/2022/09/08/show-off-your-security-score-announcing-scorecards-badges/](https://openssf.org/blog/2022/09/08/show-off-your-security-score-announcing-scorecards-badges/) + * [https://github.com/ossf/scorecard-action/releases/tag/v2.0.0](https://github.com/ossf/scorecard-action/releases/tag/v2.0.0) + * [https://github.com/ossf/scorecard-webapp/releases/tag/v1.0.0](https://github.com/ossf/scorecard-webapp/releases/tag/v1.0.0) + * [https://securityscorecards.dev](https://securityscorecards.dev) + * David: Q: Do the links work for anyone, or only if you have a GitHub action enabled? + * A: On repos with the action enabled, or projects in the weekly cron as a fallback + * David: Sounds like we should move those instructions earlier, it’s easier to use (if you’re on GitHub) + +Agenda: + +* Scorecard blog \- [https://github.com/ossf/scorecard/issues/2204](https://github.com/ossf/scorecard/issues/2204) Naveen Srinivasan + * Have a place to put updates, such as pypi using Scorecard + * Matter of practicality, is it worth it? + * Identify a few things we want to post, have someone look it over. Decide if we should work on a post + * Intended for cases where posting elsewhere doesn’t make sense, e.g., highly technical, or want to post more often than others + * Similarly, would a Twitter account make sense? + * If desired, need to contact operations@openssf.org. +* Code coverage metrics for the Scorecard-related projects \- [https://github.com/ossf/scorecard/issues/2203](https://github.com/ossf/scorecard/issues/2203) Naveen Srinivasan + * Proposal: Enable mechanisms to fail PRs that reduce code coverage + * Can cause false+... could add new tests without checking anything + * Suspect Code coverage tool can’t include end-to-end (E2E) tests for go + * David: That’s a really unfortunate weakness. + * Naveen: Need to check on that \- maybe it’s included\! + * There’s an updated number after a few minutes \- maybe that’s an update from E2E testing + * In theory Could allow “can drop up to 1% code coverage” + * But we don’t know of an option to implement that + * See [https://github.com/sigstore/sigstore/pull/587](https://st1.zoom.us/web_client/6orpgrb/html/externalLinkPage.html?ref=https://github.com/sigstore/sigstore/pull/587) for details + * There’s a risk that someone may be willing to write code to implement a feature but not a test, and we’d lose the feature + * Seems unlikely + * We want to ensure that we don’t get worse + * Let’s enable “fail PR if test coverage is reduced”; we’ll separately investigate if E2E testing is included in the test coverage + * We can override in specific cases if warranted, but normally shouldn’t need to override + * Proposal: Enable mechanisms to show code coverage on each PR + * Already there except for scorecard webapp – will need to add that. +* \[David A. Wheeler\]: CHAOSS Risk WG would like to briefly present in two weeks (Sep 22\) \- Sean Goggins is lead. + * CHAOSS is a Linux Foundation foundation focusing on developing metrics. + * CHAOSS RIsk WG would explain what they do, metrics they’ve developed, & wants to understand what kinds of metrics definitions might be useful for Scorecards (etc.) needs. + * \[David may not be able to attend next meeting, but it should go on\] +* \[Luigi\] Feature request regarding consuming SECURITY-INSIGHTS.yml (Security Insights schema) in some checks + * [https://github.com/ossf/security-insights-spec](https://github.com/ossf/security-insights-spec) + * Unlike a README, SECURITY-INSIGHTS is machine-readable & the goal is to put all security info in one place. + * Some discussion: hard around trust and risk + * Will open an issue for further discussion + +## Aug 25, 2022 + +Attendees: + +* Naveen Srinivasan +* Brian Russell (Google) +* Spencer Schrock (Google) +* Rich Heironimus (IBM) +* Caroline Lee (IBM) +* Jeff Mendoza (Google) +* Laurent Simon (Google) +* Azeem Shaikh (Google) +* Ethan Davis (Google) +* Scott Hissam (Software Engineering Institute (SEI)) +* Aiden Wang (Rice University) +* Stephen Augustus (Cisco) + +Project/Individual updates: + +* \[Azeem\] scorecard-action:v2 updates: + * Staging site: [securityscorecards.dev](http://securityscorecards.dev), API: [api.security scorecards.dev](http://api.securityscorecards.dev), badge: [https://api.securityscorecards.dev/projects/github.com/ossf/scorecard/badge](https://api.securityscorecards.dev/projects/github.com/ossf/scorecard/badge) + * Targeting launch and OpenSSF blog post on Sept 8th. + * The blog post will be featured during the OpenSSF day announcement. + * Pending tasks update: + * Can someone from LF please help move the domains? dwheeler@linuxfoundation.org + * API throttling: Azeem Shaikh + * Installer tool: augustus@cisco.com +* \[Azeem\]: Heads-up \- criticality score projects want to use Scorecard cron library. Expect some PRs in the coming weeks. +* \[Caroline\] issue 2092 ([https://github.com/ossf/scorecard/issues/2092](https://github.com/ossf/scorecard/issues/2092)) to get more info, cron documentation missing? Section empty here: [https://github.com/ossf/scorecard/blob/main/CONTRIBUTING.md\#contributing-to-security-scorecards](https://github.com/ossf/scorecard/blob/main/CONTRIBUTING.md#contributing-to-security-scorecards) + * Engage over slack + * List of missing documentation on cron + +Agenda: + +* \[azeems\] Bug bounty for Scorecard issues. +* \[azeems\] Meeting recordings? + * [operations@openssf.org](mailto:operations@openssf.org) +* \[ethan\] + * Update on Allstar GitHub Actions Policy + * Issues get updated/edited when status changes +* \[Stephen\] scorecard v5 + * Bugs with \`score reporting\` might be a good to include in v5 +* Bot account? One password? + * No update +* Docs maintainer team + * Naveen created the team +* Settings bot, codeowners + * Took a look at probot / settings +* PRs from forks + * No branches please + * Two reasons: + * Cleanup (can do setting?) + * Contributor experience + * Documentation? yes +* + +Summary (last 3-5 minutes) + +* Facilitator transfer for next meeting + +## Aug 11, 2022 + +Attendees: + +* Naveen Srinivasan +* Yehuda Gelb (Checkmarx) +* Spencer Schrock (Google) +* Jeff Mendoza (Google) +* David A. Wheeler (Linux Foundation) +* Azeem Shaikh (Google) +* Caroline Lee (IBM) +* Ethan Davis (Google) +* Scott Hissam (Software Engineering Institute (SEI)) +* Aiden Wang (Rice University) +* Raghav Kaul (Google) +* Stephen Augustus (Cisco) + +Standing Agenda + +* Welcome + * Add your attendance to the meeting notes + * Anyone new to this meeting (Welcome new friends\!) + * Scott Hissam (Software Engineering Institute (SEI)) + * + * Updates on the Project + * OSS Summit Video \- Scorecard and AllStar + * [OpenSSF Day at OSS NA - Automated Techniques for Measuring Trustworthiness of OSS Code & Communities](https://www.youtube.com/watch?v=2ZnDu-rDrP4&t=1s) + * [Assessing the Risk of Open-source Components Using OpenSSF's Scorecard](https://www.youtube.com/watch?v=x4bOTqdSRH8) + * [Using OpenSSF's Allstar to Secure Your Organizations GitHub Repositories - Jeff Mendoza, Google](https://youtu.be/zg21ddTRWvY) + * Scorecard action v2.0.0 beta release + * [https://github.com/ossf/scorecard-action/releases/tag/v2.0.0-beta.1](https://github.com/ossf/scorecard-action/releases/tag/v2.0.0-beta.1) + * Enables Scorecard badges and REST API for your repository. + * Scorecard v4.5.0 release + * [https://github.com/ossf/scorecard/releases/tag/v4.5.0](https://github.com/ossf/scorecard/releases/tag/v4.5.0) + * Bin-Art no more complains on gradle jar files + * SLSA release + +* Still working on scorecards.dev \- hopefully release by next meeting? +* Scorecard API results Naveen Srinivasan + * [https://github.com/ossf/scorecard/issues/2092](https://github.com/ossf/scorecard/issues/2092) + * How do we handle cached/old data? Checks like Branch-Protection and Best-Practices and CII-BestPracitices may get old. + * No problem, they’ll still get re-run weekly + * naveensrinivasan@yahoo.com to pick this up. +* Allstar: Action policy proposal Ethan Davis + * See issue [allstar\#246](https://github.com/ossf/allstar/issues/246) for proposal + * Suggestion: Add priority field (number based) to rules to set the order in which they are applied, some allow/blocks may conflict + * Order is proposed to be the implicitly the order in the conf file + * Needs to be clear, as people tend to add rules to end + * What is the default to allow/deny? (if not specified?) + * Would be good to specify priorities in categories (critical/high/medium/etc.) + * Better for priority to be explicit rather than order in conf, maybe someone alphabetizes the rules… + * David: Do we have an organization to try this (to get real-world use feedback)? Maybe Stephen, maybe angular + * Should the repo/action selector use regex vs glob? + * How can the code work with Scorecards as well? + * K8s uses a similar thing: zeitgeist, ex: [https://github.com/kubernetes/release/blob/master/dependencies.yaml](https://github.com/kubernetes/release/blob/master/dependencies.yaml) Ensures all references to a dependency is an expected version @stephen + * [https://github.com/kubernetes-sigs/zeitgeist](https://github.com/kubernetes-sigs/zeitgeist) + * How can you pin allowed actions by hash? Or does the version match hash in a rep o + * Yes, plan to reverse lookup hashes in repos to what version they are + * [https://github.com/kubernetes-sigs/zeitgeist](https://github.com/kubernetes-sigs/zeitgeist) + * AI: Ethan will take feedback above and put into his GitHub issue proposal. +* [~~Scorecard gets dependabot warnings~~](https://github.com/ossf/scorecard/security/dependabot) ~~\- who will pick those up? \- David A. Wheeler~~ + * ~~Have to update go first for some of them, and that is work in progress. The PR to do this has had problems due to indirect dependencies that make things unresolvable. Newer versions of go significantly fix this, but we have to get there first.~~ + * Stephen will look at the newest report that was flagged yesterday +* Invite [https://github.com/olivekl](https://github.com/olivekl) to scorecard-actions and the webapp as code owner for markdown similar to Scorecard Naveen Srinivasan + * [https://github.com/ossf/scorecard-webapp/pull/148/files](https://github.com/ossf/scorecard-webapp/pull/148/files) +* Meta-discussion: OpenSSF should have instructions on becoming maintainers, maintainer ladder, GitHub permissions. CNCF has info that could be reused, esp. On maintainer experience. Talk with Stephen Augustus (Cisco) +* [https://github.com/ossf/scorecard/issues/2102](https://github.com/ossf/scorecard/issues/2102) laurentsimon@google.com Ethan Davis + * Which check would this be a part of? + * There would be a separate action that verifies the files + * The binary artifacts check could then ignore those + * Where would this action come from? Openssf? + * Not clear, first proposing the format that Scorecard will ingest + * Are we providing the action? + * Scorecard will look at the check runs on a repo, and look for annotations? That match the proposed format + * The action would be separate and not decided where it comes from: One needed is to verify Microsoft-signed binaries for example + * Scorecards should report if it was exempted or not + * Does it make sense to build a generalized solution for a single specific use case? + * Adding third-party requirements to using Scorecards is an adoption blocker + * Agree it shouldn’t be Scorecards responsibility to verify binaries (signature or other) + * External actions make sense for verification of binaries + * Context: Scorecard ignores gradle-wrapper if the gradle verification action exists + * There should be a defined format for actions to opt-out verified binaries in scorecard + * +* Allstar feedback request: [https://github.com/ossf/allstar/issues/253](https://github.com/ossf/allstar/issues/253) + * +* Feature \- scorecard policy for GCP Binary Authorization \- [https://github.com/ossf/scorecard/issues/2136](https://github.com/ossf/scorecard/issues/2136) + * Ragav: Proposes more of a “settings based” policy. +* Summary (last 3-5 minutes) + * Facilitator transfer for next meeting + +## Jul 28, 2022 + +Attendees: + +* Naveen Srinivasan +* Yehuda Gelb (Checkmarx) +* Christine Abernathy (F5) +* Aiden Wang (Google) +* Ethan Davis (Google) +* Randall T. Vasquez (Gentoo/Homebrew) +* Rahul Gupta (Microsoft) + +Standing Agenda + +* Welcome + * Add your attendance to the meeting notes + * Anyone new to this meeting (Welcome new friends\!) +* Making scorecard scores more predictable Raghav Kaul + * [Feature: map checks to CIS supply-chain security benchmark · Issue \#2028 · ossf/scorecard](https://github.com/ossf/scorecard/issues/2028) +* Scorecard API results Naveen Srinivasan + * [https://github.com/ossf/scorecard/pull/2081](https://github.com/ossf/scorecard/pull/2081) + * [https://github.com/ossf/scorecard/issues/2092](https://github.com/ossf/scorecard/issues/2092) \- + * Discuss about this new feature +* Two quick e2e demo Aiden Wang: + * The Dependency-diff API is in position: + * [https://github.com/ossf/scorecard/blob/main/dependencydiff/dependencydiff.go\#L53-L59](https://github.com/ossf/scorecard/blob/main/dependencydiff/dependencydiff.go#L53-L59) + * Scorecard Dependency-diff CLI + * Mostly likely for program calls, rather than using it in a cmd? + * Are the two flags \`--base\` and \`--head\` clear enough? Other flag names? + * \`–start-commit\` and \`–end-commit\`? + * \`--start-ref\` and \`--end-ref\`? + * The CLI PR: [https://github.com/ossf/scorecard/pull/2077](https://github.com/ossf/scorecard/pull/2077) + * Dependency-diff Visualization in the Scorecard Action + * Visualization in a PR comment (see Jun 30’s agenda) + * How to make this configurable / should we make it configurable? + * CodeCov runs on every commit to compute the coverage-diff + * What’s our concern? + * Hitting the api rate limiting? + * Overuse of GH tokens? + * Spamming the PR with our workflow-generated comments? + * Visualization in check run annotations (an additional one) + * The visualization PR: + * [https://github.com/ossf/scorecard-action/pull/780](https://github.com/ossf/scorecard-action/pull/780) (part1, as a PR comment) + * [https://github.com/ossf/scorecard-action/pull/781](https://github.com/ossf/scorecard-action/pull/781) (part2, as annotations) + * TODO: (Aiden) add unit tests coverage + +## Jul 14, 2022 + +Attendees: + +* Naveen Srinivasan +* Jeff Mendoza (Google) +* Azeem Shaikh (Google) +* Varun Sharma (StepSecurity) +* Brian Russell (Google) +* Laurent Simon (Google) \<- leading meeting +* Aiden Wang (Google) +* Shripad Nadgowda (IBM) +* Spencer Schrock (Google) +* David A. Wheeler (Linux Foundation) +* Raghav Kaul (Google) +* Ethan Davis (Google) +* CRob (Intel, OSSF, TAC) + +Standing Agenda: + +* Welcome + * Add your attendance to the meeting notes + * Anyone new to this meeting (Welcome new friends\!) +* Enable DCO for all scorecard and allstar repositories (Naveen) + * [https://github.com/ossf/scorecard/issues/2042](https://github.com/ossf/scorecard/issues/2042) + * [https://github.com/apps/dco](https://github.com/apps/dco) \<- the app OpenSSF intends to use + * [https://github.com/ossf/tac/pull/115](https://github.com/ossf/tac/pull/115) \<- pending addition to TAC site + * Basically, just use “git \-s commit”, or add “Signed-off-by: NAME \” to the end of the commit message text. That shows that the commit you’re adding is something you’re legally allowed to add. + * We’ll start using signoffs and checking for signoff manually, but will not install the GitHub App at the repo level, and wait until it is enabled at the org level. +* Present and Demonstrate scorecard big query data as a HTTP get endpoint as a feature (Naveen) + * [https://docs.google.com/document/d/13Uy6PGNudL9ha-LtSJGLmdBFF1qj6gGoPbs6WyxHy8A/edit?usp=sharing](https://docs.google.com/document/d/13Uy6PGNudL9ha-LtSJGLmdBFF1qj6gGoPbs6WyxHy8A/edit?usp=sharing) + * [https://github.com/ossf/scorecard/issues/1056](https://github.com/ossf/scorecard/issues/1056) + * ![][image1] + * [https://github.com/ossf/scorecard/issues/1056\#issuecomment-1183395411](https://github.com/ossf/scorecard/issues/1056#issuecomment-1183395411) + +* The Scorecard protobuf error (Laurent) + * The PR check “build/validate-projects (pull\_request)” keeps failing + * Hit rate limiting? + * [https://github.com/ossf/scorecard/issues/2052](https://github.com/ossf/scorecard/issues/2052) and [https://github.com/ossf/scorecard/issues/2053](https://github.com/ossf/scorecard/issues/2053) ( Naveen) + * Naveen \- to follow up password manager for scorecard bot with David and CRob \- talk to Jenn Bonner (who is covering while Jory is out) + * +* Contributor ladder definitions? (Jeff / Brian) + * [https://github.com/ossf/allstar/issues/238](https://github.com/ossf/allstar/issues/238) + * [https://github.com/ossf/scorecard/issues/1553](https://github.com/ossf/scorecard/issues/1553) + * [https://github.com/ossf/foundation/issues/17](https://github.com/ossf/foundation/issues/17) + * Ex: How do I become a maintainer? + + +* Quick update on the dependency-diff feature (Aiden): + * Adding unit tests and e2e tests to the [API](https://github.com/ossf/scorecard/pull/2046/files#diff-eabcfd77a28fdc286c9f470bf892b3eef91bf40f2d2e027e8c371e8059527782R33-R36) in PR [\#2046](https://github.com/ossf/scorecard/pull/2046) + * Version zero will be merged into the scorecard repo soon + * Next steps: + * finish the visualization in the Action (in 1-2 weeks) \[[example](https://github.com/aidenwang9867/my_workflow_test/pull/59#issuecomment-1171633469)\] + * Please see the design doc and figure in June 30, 2022’s agenda + * Iterate to v1 using Naveen’s API + * Replace running scorecard checks on HEAD → stateless query by commitSHA + * Find the src repo for dependencies with null srcRepo URLs (GH API) + * Replace the current dependency-diff source API with better ones? + * Issues of the current one: + * Confuse direct and transitive dependencies \[[issue to GH](https://github.com/github/docs/issues/18831)\] + * Give null fields such as the src repo url +* Summary (last 3-5 minutes) + * Facilitator transfer for next meeting + +## Jun 30, 2022 + +Attendees: + +* Naveen Srinivasan (leading meeting) +* Laurent Simon (Google) +* Aiden Wang (Google) +* Spencer Schrock (Google) +* David A. Wheeler (Linux Foundation) +* Raghav Kaul (Google) +* Ethan Davis (Google) + +Standing Agenda: + +* Welcome + * Add your attendance to the meeting notes + * Anyone new to this meeting (Welcome new friends\!) + * Spencer (new to Scorecard team @ Google) + * Raghav (new to Scorecard team @ Google) +* \[Jeff / Naveen / Laurent\] Scorecard/Allstar presented at Open Source Summit North America last week +* Dependency Diff Visualization In Action (Aiden Wang) \- visualize changes in a pull request + * Design doc (in progress): [Scorecard Feature Design: Dependency-diff Visualization](https://docs.google.com/document/d/1k4qzFeCpXF_FEZAzFZnXdcQsEYLB1tqiRUVgFug1bPY/edit?usp=sharing) + * Design figure: [Fig. Dependency-diff Visualization In Action](https://docs.google.com/presentation/d/1Ihvwtfeh112FomdPPlmdYrVlAqbD-bftvg1QjVolgAM/edit?usp=sharing) + * Quick demo of **version-zero**: + * [Repo1](https://github.com/aidenwang9867/my_workflow_test/blob/main/.github/workflows/scorecarddepsdiffvis.yaml) (workflow\_test) + * [Repo2](https://github.com/aidenwang9867/DependencyDiffVisualizationInAction) (the testing code for dependency-diff fetching and visualizing) + * Plans on the [BigQuery Auth issue](https://github.com/ossf/scorecard/issues/2008#issuecomment-1169341164): + * Implement a REST API server on a GKE for Scorecard to query statelessly; + * GKE stores the credentials of the BQ service account and does the auth; + * A simple local Web server demo here \[[Repo3](https://github.com/aidenwang9867/scorecard-bigquery-auth)\] + * Now it has interfaces to query: + * Dependencies of a dependency (given ecosys, pkg\_name, pkg\_version) at **/query/dependencies (GET/POST)** + * Vulnerabilities of a dependency (given ecosys, pkg\_name, pkg\_version) at **/query/vulnerabilities (GET/POST)** + * Arbitrary SQL queries at **/query/arbitrary (POST)** + * Questions: + * Where to put the code to? Scorecard or Scorecard Action? + * About the GH Dependency Review API: see the issue [here](https://github.com/github/docs/issues/18831) + * ~~TODO \- Naveen to add the concerns to the GitHub issue [\#2008](https://github.com/ossf/scorecard/issues/2008)~~ +* Allstar: Making compliance more convenient, reducing scope of exemptions \- Ethan Davis + * We should allow more specific exemptions so that Allstar users don’t employ very broad exemptions (eg. disabling entire policies) [Ethan Davis](mailto:etdavis@google.com) + * Binary artifacts / spam: [https://github.com/ossf/allstar/issues/227](https://github.com/ossf/allstar/issues/227) + * Question to consider: + * Can we provide some accountability for binary artifacts that do need to exist? + * Outside Collaborators Exemptions: [https://github.com/ossf/allstar/pull/229](https://github.com/ossf/allstar/pull/229) + * Weekend: [https://github.com/ossf/allstar/issues/201](https://github.com/ossf/allstar/issues/201) + * Ping duration configurable: [https://github.com/ossf/allstar/issues/117](https://github.com/ossf/allstar/issues/117) + +## Jun 16, 2022 + +Attendees: + +* Naveen Srinivasan +* Jeff Mendoza (Google) +* Stephen Augustus (Cisco) +* Brian Russell (Google) +* Yehuda Gelb (Checkmarx) +* Aiden Wang (Google) +* Caroline Lee (IBM) +* Shripad Nadgowda (IBM) + +Standing Agenda: + +* Welcome + * Add your attendance to the meeting notes + * Anyone new to this meeting +* Announcements + * Project updates + * Allstar: + * [Load key from env var \#207](https://github.com/ossf/allstar/pull/207) + * [Make notice ping duration configurable \#206](https://github.com/ossf/allstar/pull/206) + * [New feature: Log summary of enforce results \#204](https://github.com/ossf/allstar/pull/204) + * [Update logic in getting config files to avoid hitting 404s. \#197](https://github.com/ossf/allstar/pull/197) + * Roadmap updates + * Meet at Austin (June 21st, OSS’ 22\) in person to discuss + * Announce location to meet on slack + * Slack channel for in-person communication? [\#osssummit-onsite](https://openssf.slack.com/archives/C03L0TMT22X) + * Jeff and Stephen [talk on openssf day](https://sched.co/135wg) Monday + * Laurent and Naveen [talk on Tuesday](https://sched.co/11NgG) + * Jeff \- [Allstar talk \- Wed](https://ossna2022.sched.com/event/11Ntx/using-openssfs-allstar-to-secure-your-organizations-github-repositories-jeff-mendoza-google) + * +* Open Issues & One-off discussion topics (e.g. pull request to be merged, feature request, etc.) + * Allstar: [Proposal: don't allow appending enforceBranches on repo level if disableRepoOverride is true \#211](https://github.com/ossf/allstar/issues/211) + * Allstar: [When should issues be closed? \#159](https://github.com/ossf/allstar/issues/159) + * Scorecard [golang action](https://github.com/ossf/scorecard/pull/1962) discussion + * Trying to preserve git history from code moving from action repo to main repo + * Going to Go 1.18 may be not worth the work at the moment + * Open an issue for dep update problems + * Discuss more in Austin + * Shripad: Proposal Issues opened: + * [https://github.com/ossf/scorecard/issues/1985](https://github.com/ossf/scorecard/issues/1985) + * [https://github.com/ossf/scorecard/issues/1984](https://github.com/ossf/scorecard/issues/1984) + * Discuss Austin meetup \- Done above in roadmap +* Summary (last 3-5 minutes) + * Facilitator transfer for next meeting + +## Jun 2, 2022 + +Attendees: + +* Naveen Srinivasan +* Jeff Mendoza (Google) +* Azeem Shaikh (Google) +* Brian Russell (Google) +* Eric Tice (Wipro) +* Laurent Simon (Google) +* Rich Heironimus (IBM) +* Caroline Lee (IBM) +* Shripad Nadgowda (IBM) + +Standing Agenda: + +* Welcome + * Add your attendance to the meeting notes + * Anyone new to this meeting + * Shripad Nadgowda + * Sebastian + * Caroline +* Announcements + * Project updates + * Allstar: + * [https://github.com/ossf/allstar\#repo-policy-configurations-in-the-org-repo](https://github.com/ossf/allstar#repo-policy-configurations-in-the-org-repo) + * [https://github.com/ossf/allstar\#org-level-base-and-merge-configuration-location](https://github.com/ossf/allstar#org-level-base-and-merge-configuration-location) + * Scorecard Action release: support for GITHUB\_TOKEN + * Scorecard v4.3.0 / v 4.3.1 + * Run dependencies on scorecard (intern project) + * Move discussion to GitHub issue before design doc is written + * Roadmap updates +* Open Issues & One-off discussion topics (e.g. pull request to be merged, feature request, etc.) + * Shripad Nadgowda: Would like to present some work I am doing around OSS release assessment and see how it can be aligned with scorecard + * The request was made to if scorecard could check for additional checks like tfsec similar to fuzzing. This is not just tfsec, but have suite of tools that scorecard could check for the ecosystem. + * Discuss about dependencies with the tool chain [https://github.com/ossf/scorecard/pull/1969](https://github.com/ossf/scorecard/pull/1969) and [https://github.com/ossf/scorecard/pull/1949](https://github.com/ossf/scorecard/pull/1949) + * +* Summary (last 3-5 minutes) + * Facilitator transfer for next meeting + +## May 19, 2022 + +Attendees: + +* David A. Wheeler (Linux Foundation) +* Naveen Srinivasan +* Jeff Mendoza (Google) +* Azeem Shaikh (Google) +* Eric Tice (Wipro) +* Laurent Simon (Google) +* Christine Abernathy (F5) +* Aiden Wang (Google) +* Arnaud Le Hors (IBM) +* Caroline Lee (IBM) + +Standing Agenda: + +* Welcome + * Mission and vision for group (WIP on 4/7) + * Anyone new to this meeting (Welcome new friends\!) + * Aiden Wang (new to Scorecard team @ Google) +* Announcements + * Introductions + * David: Open Source Software Security Summit II happened last week in Washington, DC \- lots more focus on OSS security + * Scorecards is important for that, so we need to keep working on what we’re working on. E.g., greatly improve the ability of Scorecards to detect tool usage. + * Good news: Much more attention to OSS security\! + * Is there an LFX “merge/take-over” of scorecards? + * No. The idea is that the scorecards project continues to write the tool. LFX implements a data lake where that data can be stored, and LFX can the display a lot of data about an OSS project including scorecards results. + * There will probably be a small delay due to Shubhra Kar’s unexpected & sudden recent death. He was the LF CTO & lead on LFX. + * Project updates + * The older JSON format would not be supported in the cron job as well as in the scorecard CLI.This was mentioned in the [https://github.com/ossf/scorecard/releases/tag/v3.0.0](https://github.com/ossf/scorecard/releases/tag/v3.0.0) + * Scorecard version 4.2.0 was released [https://github.com/ossf/scorecard/releases/tag/v4.2.0](https://github.com/ossf/scorecard/releases/tag/v4.2.0) + * New patch release coming in the next week or two. Potentially with more CheckResult changes. + * Roadmap updates +* Open Issues & One-off discussion topics (e.g. pull request to be merged, feature request, etc.) + * [https://github.com/ossf/scorecard/issues/1774](https://github.com/ossf/scorecard/issues/1774) + * How to handle invalid config? [https://github.com/ossf/allstar/issues/158](https://github.com/ossf/allstar/issues/158) + * +* Summary (last 3-5 minutes) + * Facilitator transfer for next meeting + +## May 5, 2022 + +Attendees: + +* Jeff Mendoza (Google) +* Azeem Shaikh (Google) +* Stephen Augustus (Cisco) +* Godofredo Contreras (Google) +* Brian Russell (Google) +* John Naulty (Coinbase) +* Nusrat Zahan (NCSU) +* Jason DeTiberus (Cisco) +* Julia Ferraioli (Cisco) + +Standing Agenda: + +* Welcome + * Mission and vision for group (WIP on 5/5) +* Announcements + * Introductions (New attendees) + * John Naulty (Coinbase) \- Promoting Scorecard with crypto community + * Presentation: [\[External\] ETHPortland - Defense Against the Dark Arts: Measuring and Improving Security Posture of Open Source Projects](https://docs.google.com/presentation/d/1rYJ3-58mHBYIlK3o29Vpm3TY7YCCNUkl8FWk4q6rn0k/edit?usp=sharing) + * Nusrat Zahan (NCSU) \- Researching scorecard on npm and pypi + * Parth \- NCSU + * Julia \- Cisco + * CRob \- + * Jason \- Cisco + * Project updates + * Scorecard/Allstar presentation: (Laurent & Jeff) [https://opensourcelive.withgoogle.com/events/security-day-2022](https://opensourcelive.withgoogle.com/events/security-day-2022) [https://opensourcelive.withgoogle.com/events/security-day-2022/watch?talk=session-1](https://opensourcelive.withgoogle.com/events/security-day-2022/watch?talk=session-1) To be posted on youtube directly at a later date. + * Upcoming Scorecards/Allstar session (Stephen & Jeff) at OpenSSF Day [https://events.linuxfoundation.org/open-source-summit-north-america/features/openssf-day/](https://events.linuxfoundation.org/open-source-summit-north-america/features/openssf-day/) + * Roadmap updates + * +* Open Issues & One-off discussion topics (e.g. pull request to be merged, feature request, etc.) + * Mission and Vision working time + * [Allstar GH Tracking Issue](https://github.com/ossf/allstar/issues/164) + * [Scorecards GH Tracking Issue](https://github.com/ossf/scorecard/issues/1824) + * Criteria + * Brian: + * Mission that can be used to make decisions + * Vision that paints a picture of project successful + * Stephen: work backwards to figure out the alignment about the criteria. + * Start with Best Practices WG \- **[https://github.com/ossf/wg-best-practices-os-developers](https://github.com/ossf/wg-best-practices-os-developers)** + * CRob: Diagram of how all Best Practices tool fit together: [https://raw.githubusercontent.com/ossf/wg-best-practices-os-developers/main/img/OpenSSF%20Dev%20Best%20Practices%20Projects%20Relations.png](https://raw.githubusercontent.com/ossf/wg-best-practices-os-developers/main/img/OpenSSF%20Dev%20Best%20Practices%20Projects%20Relations.png) + * Proto unsanctioned one-year-old OSSF Reference Architecture + * ![][image2] + * ^ (Needs updated) + * Jeff: Scorecard also identifies weaknesses which can be automated. + * Massaged Scorecard Purpose: + * (Adopt) Automate analysis and trust decisions on the security posture of open source projects. + * +* OSV vulnerability scanning integration question (godofredo) + * +* Scorecards [PR issues](https://github.com/ossf/scorecard/pull/1886) (Parth) + * +* Summary (last 3-5 minutes) + * Facilitator transfer for next meeting + +## BEGIN WORKING AREA + +* Current purpose from WG readme: + * Purpose \- (Adopt) Automate analysis and trust decisions on the security posture of open source projects. +* Draft: [https://github.com/ossf/scorecard/issues/1824](https://github.com/ossf/scorecard/issues/1824) + * Scorecards Mission Draft \- v0.1 + * Assess the software development security posture of open-source projects. + * Scorecards Vision Draft \- v0.1 + * With Scorecards, open-source projects’ secure development practices become accessible and understandable to consumers. + * Draft (John Naulty): + * Vision: Provide visibility of security posture of open source projects. + * Mission: Build a tool that unifies the measurement of security posture for open source projects. + * Strategy: + * Identify best practices and signals of security posture + * Incorporate those measurements into the scorecard utility + * Incentivize projects to adopt scorecard measurements to improve OSS security posture +* \[CRob\]: what is “security posture” defn? + * (Jeff) Security posture \- Adherence to known security best practices. + * \[CRob\] \- Provide visibility of secure development and management practices of open source projects ? + * \[Stephen\]: Scorecard is looking at overall “community health”. Should we incorporate that in the mission/vision statement? + * \[Brian\]: have a Scorecard specific wording but also show how this rolls up to Best Practices MVS. + * \[John\]: Security Posture would be accumulated measurement of potential risk vectors--measured against the potential mitigations for those risks (e.g., branch-protections to ensure certain aspects of [safety/security of the system](https://www.usenix.org/conference/srecon19emea/presentation/leveson)) + * Where safety practices: + * Prevent losses due to unintentional actions by benevolent actors + * And security practices: + * Prevent losses due to intentional actions by malevolent actors + * \[Stephen\]: figure out the different “personas” of Scorecard users \- maintainers, developers, enterprises etc. and find a MSV which fits those personas. + * \[Stephen\]: example from an enterprise perspective (e.g Cisco) \- have a tool for compliance for the packages which the enterprise published to OSS. + * \[Stephen\] Ideas + * Consumer + * Developer + * Contributor + * Maintainer + * AIs \[for the Scorecard group\]: + * Detail out the personas and their user story. + * Prioritize who will be Scorecard’s primary audience. + * Figure out what will be Scorecard specific and how these specific MSV roll up to Best Practices WG MSV. + +From **[https://github.com/ossf/wg-best-practices-os-developers](https://github.com/ossf/wg-best-practices-os-developers)**: + +**WG-level Objectives** + +Our objective is to provide open source developers with best practices recommendations, and with an easy way to learn and apply them. + +Unlike other existing best practices list, we want it to be widely distributed to open source developers and community-sourced. And we want these practices to stick, thanks to an effective learning platform. + +**WG-level Vision** + +Our vision is to make it easy for developers to adopt these best practices, thanks to: + +* \*Identifying\* good practices, requirements, and tools that help open source developers create and maintain more secure software +* Helping maintainers \*Learn\* to write secure software +* **Provide tools to help developers \*Adopt\* these good practices into their daily work** – WE ARE HERE + +**WG-level Scope** + +The Developer Best Practices group wants to help identify and curate an accessible \[inventory\](https://github.com/ossf/wg-best-practices-os-developers/blob/main/docs/inventory.md) of best practices + +* Prioritized according to ROI for open source developers +* Categorized per technology, language, framework +* Community-curated + +**Help build a community** + +* Program to attract open source contributors and incentivize them to use and contribute to the inventory + +*Scorecards Project* \- [https://github.com/ossf/scorecard](https://github.com/ossf/scorecard) + +* Purpose \- (Adopt) Automate analysis and trust decisions on the security posture of open source projects. + +## END WORKING AREA + +Updates: + +* David A. Wheeler + * +* Azeem + * +* Naveen + * +* Jeff + * Binary Artifact ignore list: [https://github.com/ossf/allstar/pull/176](https://github.com/ossf/allstar/pull/176) +* Laurent +* Chris + * +* Stephen + * +* Rohan + +## Upcoming Template: + +Attendees: + +* David A. Wheeler (Linux Foundation) +* Naveen Srinivasan +* Jeff Mendoza (Google) +* Azeem Shaikh (Google) +* Aditya Sirish (NYU, in-toto) +* Jonathan Metzman (Google) +* Varun Sharma (StepSecurity) +* Jonathan Leitschuh (Dan Kaminsky Fellowship \- Human Security) +* VM Brasseur (Wipro) +* Stephen Augustus (Cisco) +* Godofredo Contreras (Google) +* Brian Russell (Google) +* Eric Tice (Wipro) +* Georg Kunz (Ericsson) +* Yehuda Gelb (Checkmarx) +* Saurabh Singh(IBM) +* Laurent Simon (Google) +* Rich Heironimus (IBM) +* Rohan Khandelwal +* Abhishek Arya +* Alan Gonzalez + +Standing Agenda: + +* Welcome + * Mission and vision for group (WIP on 4/7) +* Announcements + * Introductions + * Project updates + * Roadmap updates +* Open Issues & One-off discussion topics (e.g. pull request to be merged, feature request, etc.) + * \[add here\] +* Summary (last 3-5 minutes) + * Facilitator transfer for next meeting + +Updates: + +* David A. Wheeler + * +* Azeem + * +* Naveen + * +* Jeff +* Laurent +* Chris + * +* Stephen + * +* Rohan +* + +Open Issues & One-off Discussion Topics: + +## Apr 21, 2022 + +Attendees: + +* David A. Wheeler (Linux Foundation) \[I will have to leave early\] +* Naveen Srinivasan +* Jeff Mendoza (Google) +* Stephen Augustus (Cisco) +* Brian Russell (Google) +* Rich Heironimus (IBM) +* Christine Abernathy (F5) +* Jack Aboutboul (AlmaLinux) + +Standing Agenda: + +* Welcome + * Mission and vision for group (WIP on 4/7) +* Announcements + * Introductions + * Project updates + * Roadmap updates +* Open Issues & One-off discussion topics (e.g. pull request to be merged, feature request, etc.) + * Add a check/include in existing one for the dependency review actions [https://github.com/ossf/scorecard/issues/1828](https://github.com/ossf/scorecard/issues/1828) (Naveen) + * \[Brian Russell\] Mission and vision update (since 4/7/2022) + * [Allstar GH Tracking Issue](https://github.com/ossf/allstar/issues/164) + * [Scorecards GH Tracking Issue](https://github.com/ossf/scorecard/issues/1824) + * \[laurent\] + * Action release: [https://github.com/ossf/scorecard-action/issues/97](https://github.com/ossf/scorecard-action/issues/97) + * Release process [https://github.com/ossf/scorecard-action/issues/33](https://github.com/ossf/scorecard-action/issues/33) + * [https://github.com/ossf/scorecard/issues/1667](https://github.com/ossf/scorecard/issues/1667) shall we stop altering/reducing score for secevents, checks, status permissions? +* Who’s attending Open Source Summit? (We could meet then) + * David A. Wheeler + * Laurent simon + * Naveen Srinivasan + * Jack Aboutboul + * Jeff Mendoza + * Stephen Augustus +* Summary (last 3-5 minutes) + * Facilitator transfer for next meeting + +Updates: + +* David A. Wheeler \[sadly I have to leave at 4:15pm ET, I suddenly have to pick up my son\!\] + * I gave a presentation to Linux Foundation Networking; they’re interested in what they can do to improve security. I specifically mentioned Scorecards + * LFX is investigating integrating scorecards results. Goal: If you look up a project on LFX, it’ll show the scorecards results + * We do need to eventually rename “CII” to “OpenSSF” on best practices badge (this changes a key name): [https://github.com/ossf/scorecard/issues/1549](https://github.com/ossf/scorecard/issues/1549) + * I have contacted Jonathan Hunt (GitLab) to see if GitLab would be willing to help in some way so scorecard would work with GitLab (currently scorecard only works for projects hosted by GitHub). He wanted to know exactly what that might entail. I said: + * “I think a first step would be someone looking at their existing scorecards metrics & posting (e.g., via an issue) how to get that data via the GitLab API. Ideally someone could also present & discuss this at one of their meetings (they meet alternating Thursdays 4pm US Eastern Time, see the OpenSSF calendar). Big bonus would be help in implementing that, but I wouldn't expect anyone to commit to that until you knew how hard it was to do anyway.” + * I haven’t had a further response yet, but I have hopes. +* Azeem + * +* Naveen + * +* Jeff + * Dangerous Workflow check [https://github.com/ossf/allstar/pull/169](https://github.com/ossf/allstar/pull/169) + * New operator config: DO\_NOTHING\_ON\_OPT\_OUT [https://github.com/ossf/allstar/pull/172](https://github.com/ossf/allstar/pull/172) + * Moving forward with Smart Code Review feature [https://github.com/ossf/allstar/issues/161](https://github.com/ossf/allstar/issues/161) +* Laurent +* Chris + * +* Stephen + * +* Rohan + * + +Open Issues & One-off Discussion Topics: + +## April 7, 2022 + +Attendees: + +* David A. Wheeler (Linux Foundation) +* Naveen Srinivasan +* Jeff Mendoza (Google) +* Azeem Shaikh (Google) +* VM Brasseur (Wipro) +* Stephen Augustus (Cisco) +* Godofredo Contreras (Google) +* Brian Russell (Google) +* Eric Tice (Wipro) +* Georg Kunz (Ericsson) +* Yehuda Gelb (Checkmarx) +* Saurabh Singh(IBM) +* Laurent Simon (Google) +* Rich Heironimus (IBM) +* Rohan Khandelwal +* Abhishek Arya +* Alan Gonzalez + +Standing Agenda: + +* Welcome + * New attendees (no new friends today) +* Announcements + * Introductions + * Project updates + * Allstar v2.0: [https://github.com/ossf/allstar/releases/tag/v2.0](https://github.com/ossf/allstar/releases/tag/v2.0) + * Release process proposal: [https://github.com/ossf/allstar/issues/145](https://github.com/ossf/allstar/issues/145) + * Scorecard + * Actions release planned in the next two weeks + * Roadmap updates +* Demo/discussion + * +* Open Issues & One-off discussion topics (e.g. pull request to be merged, feature request, etc.) + * \[Brian Russell\] Mission and vision update + * [Allstar GH Tracking Issue](https://github.com/ossf/allstar/issues/164) + * [Scorecards GH Tracking Issue](https://github.com/ossf/scorecard/issues/1824) + * Volunteers for writing in a working group meeting? + * \[laurent\]: remove low-risk token permission [https://github.com/ossf/scorecard/issues/1667](https://github.com/ossf/scorecard/issues/1667) [https://github.com/ossf/scorecard/blob/main/checks/permissions.go\#L311-L336](https://github.com/ossf/scorecard/blob/main/checks/permissions.go#L311-L336) + * GitHub has made some new announcements \- should we use some of it? + * [https://github.blog/2022-04-06-prevent-introduction-known-vulnerabilities-into-your-code/](https://github.blog/2022-04-06-prevent-introduction-known-vulnerabilities-into-your-code/) + * New API for dependency: [https://docs.github.com/en/rest/reference/dependency-graph\#get-a-diff-of-the-dependencies-between-commits](https://docs.github.com/en/rest/reference/dependency-graph#get-a-diff-of-the-dependencies-between-commits) + * Kubernetes about to announce \- new signing mechanism using sigstore for container images + * [https://github.com/kubernetes-sigs/promo-tools/issues/523](https://github.com/kubernetes-sigs/promo-tools/issues/523) + * Kubernetes has some questions about pinned dependencies, which impacts use of scorecards (when should & shouldn’t it be done) + * Kubernetes has a best practices badge, badges are a CNCF graduated project requirement. + * Allstar \- allow individual binaries to be opt-out instead of full repos (Godofredo, on Dart/Flutter team) + * Third party dependency management checks (Godofredo) + * [https://opensource.google/documentation/reference/releasing/preparing\#third-party\_components](https://opensource.google/documentation/reference/releasing/preparing#third-party_components) + * [https://github.com/ossf/allstar/issues/157](https://github.com/ossf/allstar/issues/157) + * [https://github.com/ossf/scorecard/issues/1815](https://github.com/ossf/scorecard/issues/1815) + * David W: I think we need to support an .artifact-ignore file or similar, like .gitignore (see [https://github.com/ossf/allstar/issues/157](https://github.com/ossf/allstar/issues/157)). All tools have false positives, we need to handle that well. Maybe we need with two scores: “ignore project claims” & “accept project claims”. E.g., for use as test components. + * ?: You could put test components into a container. + * ?: \-1 on trying to id specific files across all systems & embedding that in scorecard. There’s no end to trying to create that list. Allowing an individual repo to specify them is fine + * We keep seeing the “do we trust claims from the project or not”. It’s useful to allow projects to allow some things, it enables incremental improvements & detect/prevent regressions. + * E.g., “Permissive” vs. Pessimistic” or some other names. Permissive accepts the claims from the project on why something is okay, pessimistic has the “raw” results & ignores project claims such as any .artifact-ignore files & similar. Maybe warn if the difference is too great. + * David W: This “permissive vs. pessimistic” idea would also enable use of SECURITY-INSIGHTS.yml. + * David W: Let’s contact GitLab via Jonathan Hunt\! Ask him or someone else to come visit/join us\! + * Jonathan Hunt (who works at GitLab) has formally joined the OpenSSF governing board (GB) & was at the GB meeting earlier today. (GitLab is a general member of OpenSSF, and he’s one of the general member reps) + * We should ask him to try to get GitLab to help us expand Scorecard so it works on GitLab-hosted projects at least; Scorecards shouldn’t be tied to GitHub alone. + * Ideally they’d be code contributions, but at least guidance on how to find information & also potential added Scorecards measures based on GitLab experiences (what can THEY report/enforce, e.g., [https://docs.gitlab.com/ee/user/application\_security/](https://docs.gitlab.com/ee/user/application_security/) ?). + * Sensible, want people to provide code, ideally we’ll have more generic interfaces, we’re just not focusing on them due to limited resources. That’d be great. + * Long-term create a scorecards mailing list for maintainers. + * David W. will contact Jonathan Hunt. + * Alan Gonzalez: is there a thought about to store proof attestations of certain checks being run out of band without needing manual overrides to bring the score up? That way the results can be reviewed more easily, so that they can be fixed more easily. There’s a lot of noise in the raw score. + * Need to determine what the remediation step is. + * Need to expose more information so that it’s easier to determine what should be fixed. + * Tell us where it was hard to figure out \- we want to modify scorecards so it’s easy to determine what you need to know so you can fix it (or at least know why you can’t easily do it) + * Quick plug: Need to formalize mission/vision. If you want to help, see issues for each project, see below. + * David W: We need to revisit pinned dependencies. (pick up later) +* Summary (last 3-5 minutes) + * Facilitator transfer for next meeting: Brian (Google) + +Updates: + +* David A. Wheeler + * +* Azeem + * +* Naveen + * +* Jeff + * Allstar feature proposal issues open: + * Smart Code Review feature [https://github.com/ossf/allstar/issues/161](https://github.com/ossf/allstar/issues/161) +* Laurent +* Chris + * +* Stephen + * +* Rohan + * + +Open Issues & One-off Discussion Topics: + +* \[Brian Russell\] Mission and vision update + * [Allstar GH Tracking Issue](https://github.com/ossf/allstar/issues/164) + * [Scorecards GH Tracking Issue](https://github.com/ossf/scorecard/issues/1824) + * Volunteers for writing in a working group meeting? +* + +## Mar 24, 2022 + +Attendees: + +* David A. Wheeler (Linux Foundation) +* Azeem Shaikh (Google) +* VM Brasseur (Wipro) +* Brian Russell (Google) +* Georg Kunz (Ericsson) +* Rich Heironimus (IBM) + +Updates: + +* David A. Wheeler + * +* Azeem + * +* Naveen + * +* Jeff + * Allstar has a few process proposal issues open: + * [Process to roll out functionality changes \#144](https://github.com/ossf/allstar/issues/144) + * [Releases (and versioning) \#145](https://github.com/ossf/allstar/issues/145) + * Input/comments appreciated +* Laurent +* Chris + * +* Stephen + * +* Rohan + * + +Open Issues: + +* \[Brian\] Mission and vision for Scorecards + * Motivation for creating a mission and vision + * Google Open Source Security Team Example + * Mision + * Making Google’s OSS more secure by creating tools that help manage repository policies at scale and allow projects’ security state to be evaluated. + * Vision + * Google can manage OSS at the scale it develops it (Allstar) and can help developers quickly evaluate a project’s security (Scorecards). + * Project Example + * Mission \- make OSS more secure by creating tools that help assess and manage the security of individual OSS projects + * Vision \- transparent OSS development processes that individual organizations can enforce by policy +* \[Azeem\]: MalOSS talk/intro +* \[laurent\]Scorecard action release [https://github.com/ossf/scorecard-action/issues/97](https://github.com/ossf/scorecard-action/issues/97) ? + * GITHUB\_TOKEN support [https://github.com/ossf/scorecard-action/issues/78\#issuecomment-1073317664](https://github.com/ossf/scorecard-action/issues/78#issuecomment-1073317664) + * Config to disable checks [https://github.com/ossf/scorecard-action/issues/143](https://github.com/ossf/scorecard-action/issues/143) +* \[laurent\] dep vuln alert check [https://github.com/ossf/scorecard/issues/1371](https://github.com/ossf/scorecard/issues/1371). Inside Dependency-Update-Tool and rename to Dependency-Management-Tool? +* \[laurent\]: remove low-risk token permission [https://github.com/ossf/scorecard/issues/1667](https://github.com/ossf/scorecard/issues/1667) [https://github.com/ossf/scorecard/blob/main/checks/permissions.go\#L311-L336](https://github.com/ossf/scorecard/blob/main/checks/permissions.go#L311-L336) ? +* \[Azeem\] Design discussions for large changes +* Dependency tree vulnerability \- should scorecard include “no known vulnerabilities in dependencies” or similar \- [https://github.com/ossf/scorecard/issues/1508](https://github.com/ossf/scorecard/issues/1508) +* \[Vicky\]: Is there a key leader for this group? + * ?: I don’t think we need a leader, but perhaps we could use a rotating facilitator for meetings + +## March 10, 2022 + +Attendees: + +* David A. Wheeler (Linux Foundation) +* Naveen Srinivasan +* Jeff Mendoza (Google) +* Azeem Shaikh (Google) +* Jonathan Leitschuh (Dan Kaminsky Fellowship \- Human Security) +* Stephen Augustus (Cisco) +* Laurent Simon (Google) +* Godofredo Contreras (Google) +* Brian Russell (Google) +* VM Brasseur (Wipro) +* Rich Heironimus (IBM) +* Saurabh Singh +* David Sastre (Red Hat) +* Eric Tice (Wipro) +* Rohan Khandelwal (Google) +* Yehuda Gelb (Checkmarx) +* Alan Gonzalez + +Updates: + +* David A. Wheeler + * +* Azeem + * +* Naveen + * +* Jeff + * +* Laurent +* Chris + * +* Stephen + * What’s an API? + * scorecard-action + * Repo management + * Proposals +* Rohan + * [Crowdsourcing Scorecard Runs Design - PUBLIC](https://docs.google.com/document/d/18KgkR-5GCkPvcT-wxxSsbsEYQYDbReLM5jBOofwT0l4/edit?usp=sharing&resourcekey=0-tKZEPEifHPHL15-zTACn1Q) + +Open Issues: + +* \[laurent\] web hook check: any additional thoughts [https://github.com/ossf/scorecard/issues/1655](https://github.com/ossf/scorecard/issues/1655) ? +* \[laurent\] dep vuln alert check [https://github.com/ossf/scorecard/issues/1371](https://github.com/ossf/scorecard/issues/1371). Inside Dependency-Update-Tool and rename to Dependency-Management-Tool? +* \[laurent\]: remove low-risk token permission [https://github.com/ossf/scorecard/issues/1667](https://github.com/ossf/scorecard/issues/1667) [https://github.com/ossf/scorecard/blob/main/checks/permissions.go\#L311-L336](https://github.com/ossf/scorecard/blob/main/checks/permissions.go#L311-L336) ? +* \[Azeem\] Design discussions for large changes +* \[Azeem\] Make this meet to officially say Scorecard/AllStar bi-weekly. +* \[GOSST\] Scorecard badges plan +* \[Azeem\] Scorecard REST API +* Dependency tree vulnerability \- should scorecard include “no known vulnerabilities in dependencies” or similar \- [https://github.com/ossf/scorecard/issues/1508](https://github.com/ossf/scorecard/issues/1508) + +## Feb 24, 2022 ([recording](https://youtu.be/KQv7CBm03QU)) + +Attendees: + +* Azeem Shaikh (Google) +* Stephen Augustus (Cisco / Kubernetes / TODO Group / dex) +* Varun Sharma (StepSecurity) +* Jonathan Leitschuh (Dan Kaminsky Fellowship \- Human Security) +* Laurent Simon (Google) +* Godofredo Contreras (Google) +* VM (Vicky) Brasseur (Wipro) +* Abhishek Arya (Google) +* Brian Russell (Google) +* Sauragh Singh (IBM) + +Updates: + +* David A. Wheeler (not here today) + * Any update on scorecard.dev website? +* Azeem + * +* Naveen + * Porting the Scorecards action to go with high tests coverage + * Currently many in shell; porting to golang will allow for test coverage (yay\!) + * Builds are parallel + * Scorecard v4.1.0 released + * SA: Is the release process documented? + * Nope, not yet + * SA will add to the docs punchlist + * Scorecard dependabot Vulnerability issue addressed + * Non-issue, but dealt with so it won’t come up again + * Codecoverage tracking enabled for Scorecards action +* Jeff + * +* Laurent +* Chris + * +* Stephen + * Created a [project board](https://github.com/orgs/ossf/projects/5) + * Walkthrough of Github project boards + * Copyright? (issue \#1534) + * Year? + * VMB: Not needed + * “OpenSSF authors” ? “Scorecard authors” ? + * VMB: Ask the LF lawyers which it should be +* Rohan + * + +Open Issues: + +* Demo of [https://github.com/step-security/harden-runner](https://github.com/step-security/harden-runner). 5 minutes for demo and then a few minutes for feedback. + * Purpose built agent for build servers + * Security monitoring of the build server (runner) + * Currently runs against the runner on Github’s CI + * Installs an agent on the runner VM then monitors all outbound calls + * Can set policy to restrict outbound endpoints + * Discuss request to donate project to Open SSF + * Where should this go within OpenSSF? + * Tooling? Best Practices? + * Part of automatic remediation +* V5 milestone discussion \- [https://github.com/ossf/scorecard/issues/1490](https://github.com/ossf/scorecard/issues/1490) +* Stephen’s walk through about project planning/tracking. + * Azeem: should we lay out a standard about how Scorecard does project planning/tracking so that new users know where to look? +* Dependency tree vulnerability \- should scorecard include “no known vulnerabilities in dependencies” or similar \- [https://github.com/ossf/scorecard/issues/1508](https://github.com/ossf/scorecard/issues/1508) +* \[laurent\] dep vuln alert check [https://github.com/ossf/scorecard/issues/1371](https://github.com/ossf/scorecard/issues/1371). Inside Dependency-Update-Tool and rename to Dependency-Management-Tool? +* \[laurent\]: remove low-risk token permission [https://github.com/ossf/scorecard/issues/1667](https://github.com/ossf/scorecard/issues/1667) [https://github.com/ossf/scorecard/blob/main/checks/permissions.go\#L311-L336](https://github.com/ossf/scorecard/blob/main/checks/permissions.go#L311-L336) ? +* Copyright header handling \- [https://github.com/ossf/scorecard/issues/1534](https://github.com/ossf/scorecard/issues/1534) + +* ~~\[laurent\] Move to v5 after [https://github.com/ossf/scorecard/pull/1516](https://github.com/ossf/scorecard/pull/1516)?~~ +* ~~\[laurent\] codecov low coverage? Remove cron/ files?~~ + +## Feb 10, 2022 + +Attendees: + +* David A. Wheeler (Linux Foundation) +* Naveen Srinivasan +* Jeff Mendoza (Google) +* Azeem Shaikh (Google) +* Stephen Augustus (Cisco / Kubernetes / TODO Group / dex) +* Jonathan Leitschuh (Dan Kaminsky Fellowship \- Human Security) +* VM Brasseur (Wipro) +* David Deal (LFX) +* Brian Behlendorf (OpenSSF / LF) +* Godofredo Contreras(Google) +* Laurent +* Rohan Khandelwal +* Shubhra Kar (CTO Linux Foundation) +* Yotam Perkal (Rezilion) + +Updates: + +* David A. Wheeler +* Azeem +* Naveen + * +* Jeff + * +* Laurent + * Code-review check split (raw/score policy) + * SAST check rehaul WIP [https://github.com/ossf/scorecard/pull/1487\#issuecomment-1028556509](https://github.com/ossf/scorecard/pull/1487#issuecomment-1028556509) +* Chris +* Stephen +* Rohan + +Open Issues: + +* [https://github.com/ossf/scorecard/issues/1597](https://github.com/ossf/scorecard/issues/1597) + * Running a Python script in Go might be complex and also pose a security risk. + * [gclient](https://www.chromium.org/developers/how-tos/depottools/#gclient) is used by Chromium and also by Flutter \+ Dart. + * 3 options: + * Pre-flatten the DEPS file + * Python as subprocess in Golang + * Use a Golang parser of Python +* \[laurent\] dep vuln alert check [https://github.com/ossf/scorecard/issues/1371](https://github.com/ossf/scorecard/issues/1371). Inside Dependency-Update-Tool and rename to Dependency-Management-Tool? +* \[laurent\] Move to v5 after [https://github.com/ossf/scorecard/pull/1516](https://github.com/ossf/scorecard/pull/1516)? + * +* \[laurent\] codecov low coverage? Remove cron/ files? +* Dependency tree vulnerability \- should scorecard include “no known vulnerabilities in dependencies” or similar \- [https://github.com/ossf/scorecard/issues/1508](https://github.com/ossf/scorecard/issues/1508) + +## Jan 27, 2022 + +Attendees: + +* David A. Wheeler (Linux Foundation) +* Naveen Srinivasan +* Jeff Mendoza (Google) +* Azeem Shaikh (Google) +* Stephen Augustus (Cisco / Kubernetes / TODO Group / dex) +* Aditya Sirish (NYU, in-toto) +* Jonathan Metzman (Google) +* Varun Sharma (StepSecurity) +* Jonathan Leitschuh (Dan Kaminsky Fellowship \- Human Security) + +Updates: + +* David A. Wheeler +* Azeem +* Naveen + * Continue to work on tests for scorecard + * +* Jeff + * Allstar staging env deployed, working on CONTRIBUTOR.md to help folks test contributions +* Laurent + * Scorecard v4 is launched [https://openssf.org/blog/2022/01/19/reducing-security-risks-in-open-source-software-at-scale-scorecards-launches-v4/](https://openssf.org/blog/2022/01/19/reducing-security-risks-in-open-source-software-at-scale-scorecards-launches-v4/) + * Continuing splitting check and scoring +* Chris +* Stephen + * Scorecard logging + * allstar scorecard updates + * contribution guidelines + * planning + +Open Issues: + +* renamed to Dependency-Management-Tool? +* Move to v5 after [https://github.com/ossf/scorecard/pull/1516](https://github.com/ossf/scorecard/pull/1516)? +* OSS-fuzz wants an exception for GitHub Action pinning. + * OSS-fuzz adds build file & Docker script to add a new project + * So to build the actual project, need up-to-date version of source repo + * Wheeler: better to refine the criteria than make some specific exception + * Jonathan L: It’s okay if it can’t affect production (other than providing an accept/reject) + * Rationale for pinning: Prevent a malicious later version that wasn’t necessarily reviewed ending up in a production version, and makes it easier to determine exactly what was changed. + * SHA-1 having collisions is a bigger problem. + * What is the harm of a rogue GitHub action? Can we lock it down so we can limit damage? Don’t think so, e.g., a GitHub action has access to secrets unless there’s specific limits on the access token. + * Wheeler: We need a rationale for every criterion, e.g., why pin? + * Proposal: Don’t need to pin something if an unpinned version cannot reveal secrets AND it cannot change a generated artifact that could be used in production. + * Proposal: Per-repo “This is okay”. Security-insights.yml has discussed this. Issue, it’s an open door for people to lie about that \- how can we vet it? + * Jonathan L: Gradle users don’t lock dependencies, and there are good reasons for it. + * Currently only npm & pip are checked + * Wheeler: If pinning only applies to some ecosystems, it needs to be explained why. Just “we don’t implement that” is understable, but any written criterion should apply whether or not it’s implemented today. +* Wheeler: I’ve created “every criteria needs a rationale” as an issue: [https://github.com/ossf/scorecard/issues/1550](https://github.com/ossf/scorecard/issues/1550) +* \[laurent\] [https://github.com/ossf/scorecard/issues/1371](https://github.com/ossf/scorecard/issues/1371) within Update-Management-Tool +* Dependency tree vulnerability \- should scorecard include “no known vulnerabilities in dependencies” or similar \- [https://github.com/ossf/scorecard/issues/1508](https://github.com/ossf/scorecard/issues/1508) +* Unit tests for SecurityPolicy [https://github.com/ossf/scorecard/issues/1491](https://github.com/ossf/scorecard/issues/1491) +* V5 milestone \- [https://github.com/ossf/scorecard/issues/1490](https://github.com/ossf/scorecard/issues/1490) please chime in +* Policy enforcement [https://github.com/ossf/scorecard/pull/1505](https://github.com/ossf/scorecard/pull/1505) + * Context: we want to allow users to write policies on top of scorecard results (allstar, slsa, binary authorization). This requires more structure output than the ones we use today (which are aimed for human consumption). The current score we currently provide can be seen as a policy + * See my rambling in [https://github.com/ossf/scorecard/pull/1505\#discussion\_r792265997](https://github.com/ossf/scorecard/pull/1505#discussion_r792265997) +* [https://github.com/ossf/scorecard/issues/1529](https://github.com/ossf/scorecard/issues/1529) +* In some cases we should add gradations, not just 0 or 10\. +* scorecard.dev \- (Wheeler) \- the transfer Google-\>LF was incomplete, it had started but Kim L. left Google before everything had completed. I think we’ve worked out what happened & how to fix it, & I expect the LF will set its “A” record soon so the domain is under the scorecard project’s control. + +## Jan 13, 2022 + +Attendees: + +* David A. Wheeler (Linux Foundation) +* Naveen Srinivasan +* Jeff Mendoza (Google) +* Azeem Shaikh (Google) + +Updates: + +* David A. Wheeler + * White House meeting. Scorecards mentioned many times, some to be done: + * Need to support \> GitHub \- many projects aren’t on GitHub (GitLab, etc.) + * Auto-id many more tools [https://github.com/ossf/scorecard/issues/1420](https://github.com/ossf/scorecard/issues/1420) + * US has Executive Order on Cybersecurity \- it’s high level, but see if there are criteria Scorecards can support +* Azeem + * Trying to solve scorecard(s).dev site issues + * V4 blog + * Working on automating metric.openssf.org +* Jeff + * Planning on Allstar policy to ensure Scorecard action is installed and then verify results. Goal is Q1. Design is just starting, will share. + * Probably most interesting design is format of policy config + * Will deprecate existing Binary Artifacts policy + * Need to update some issues +* Laurent + * Action release: + * Blog post w/ OSSF/Google/GitHub + * Disabled Signed-Release and Contributors for GH action (not actionable) +* Naveen + + 1\. Refactored the Vulnerabilities codebase to be testable. [https://github.com/ossf/scorecard/pull/1432](https://github.com/ossf/scorecard/pull/1432) + + + 2\. Created Codeql Analysis for scorecard-webapp [https://github.com/ossf/scorecard-webapp/pull/5](https://github.com/ossf/scorecard-webapp/pull/5) + + + 3\. Create codeql badge for scorecard-action [https://github.com/ossf/scorecard-action/pull/43](https://github.com/ossf/scorecard-action/pull/43) + + + 4\. Unit tests for signed releases [https://github.com/ossf/scorecard/pull/1446](https://github.com/ossf/scorecard/pull/1446) + + + 5\. Migrate to v4 of scorecard [https://github.com/ossf/scorecard/pull/1441](https://github.com/ossf/scorecard/pull/1441) + + + 6\. Unit test for Maintained check [https://github.com/ossf/scorecard/pull/1449](https://github.com/ossf/scorecard/pull/1449) + + + 7\. Unit tests for CheckFileContainsCommands [https://github.com/ossf/scorecard/pull/1450](https://github.com/ossf/scorecard/pull/1450) + + + 8\. Unit tests for github workflow [https://github.com/ossf/scorecard/pull/1452](https://github.com/ossf/scorecard/pull/1452) + + + 9\. Unit tests for contributors [https://github.com/ossf/scorecard/pull/1453](https://github.com/ossf/scorecard/pull/1453) + + + 10\. Upgraded the dependency to fix the vulnerability [https://github.com/ossf/scorecard/pull/1454](https://github.com/ossf/scorecard/pull/1454) + + 11\. Dependabot config for scorecard-webapp [https://github.com/ossf/scorecard-webapp/pull/7](https://github.com/ossf/scorecard-webapp/pull/7) + + + 12\. Unit test for Security Policy checks [https://github.com/ossf/scorecard/pull/1455](https://github.com/ossf/scorecard/pull/1455) + + + 13\. Unit test for CI Test [https://github.com/ossf/scorecard/pull/1467](https://github.com/ossf/scorecard/pull/1467) + + + And a few more PR's. Most of my work has been with increasing tests coverage across scorecard. I am primarily focusing on checks as of now. + + + * +* (Chris) + * + +Open issues: + +* Suggest using [https://app.stepsecurity.io/](https://app.stepsecurity.io/) (open-source and free) to remediate token permission issues? +* Codecov + * David A. Wheeler will grant repo rights to Codecov, see Jan 7 docs +* Create tool to drive scorecard action's adoption (PAT creation, secrets definition, PR) for large orgs/multi-repo owners [https://github.com/ossf/scorecard-action/issues/52](https://github.com/ossf/scorecard-action/issues/52) + +[image1]: + +[image2]: diff --git a/governance/meetings/2023.md b/governance/meetings/2023.md new file mode 100644 index 000000000000..c47432281b99 --- /dev/null +++ b/governance/meetings/2023.md @@ -0,0 +1,1235 @@ +# OpenSSF Scorecard Meeting Archive — 2023 + +## 2023-12-14 + +Attendees: + +* Adrianne Marcum (OpenSSF) +* Jeff Mendoza (Kusari) +* Stephen Augustus (Cisco) +* Pedro Nacht (Google) +* David A. Wheeler (OperSSF) +* Raghav Kaul (Google) +* Sarah Elder (NCSU) + + + +Regrets + +* + +New Attendees + +* Lauri Apple + +Agenda + +* There’s been some repo sprawl (multiple Scorecard-related repos). Some blocked because we don’t have a project charter so we “don’t exist” \- being fixed +* Scootrs \- tries to do “all you should do when creating a project” + * URL: [https://github.com/kusaridev/skootrs](https://github.com/kusaridev/skootrs) +* Stephen: There is interest in getting people involved in Scorecard dev/ tackling backlog +* Backlog refinement, prioritization, and roadmapping + * Work done so far (review of 100 issues, starting with oldest): [https://docs.google.com/spreadsheets/d/1UuKvZLlWyIMVkXIz1CqGWPYV\_\_f0xssldbayUOqIs04/edit](https://docs.google.com/spreadsheets/d/1UuKvZLlWyIMVkXIz1CqGWPYV__f0xssldbayUOqIs04/edit) + * Needed: a few volunteers to help review items together (will probably take 2-3 hour-long sessions) to generate more “why”/what problem are we solving-related context. Then we can shape a roadmap. + * Would be helpful to have existing architecture diagrams and overview of what is intended to be accomplished with Scorecard + * Would be helpful to have improved Issue templates to better pull out the why/problem being solved from the request + * Adrianne will post Doodle poll in Slack channel for initial review session in the new year +* CRob & David A. Wheeler suggested measuring knowledge on how to develop secure software + * [https://github.com/ossf/scorecard/issues/3534](https://github.com/ossf/scorecard/issues/3534) + * We intend to research to see how to automatically determine educational knowledge \- there’s at least one REST interface + * Looking for ways to checking for certification without compromising developer privacy + * There was 1 person originally resisting this, but that person seems to have been satisfied & we don’t need unanimous agreement anyway. + * David intends to start investigating this (probably Jan 2024\) + * Stephen: Supportive in principle but the devil is in the details + * Key issue: We want equity, let’s find multiple test/courses so we’re agnostic / not requiring just one system. Also; many developers are self-taught, don’t want to exclude them. + * + +## 2023-12-11 + +Attendees: + +* Adrianne Marcum (OpenSSF) +* Ian Dunbar-Hall (Lockheed Martin) +* Allen Shearin (Lockheed Martin) +* Joe Coyle (Lockheed Martin) +* Juanita Gomez (UCSC) +* Sarah Elder (NCSU) +* David A. Wheeler (OpenSSF) + + + +Regrets + +* + +Announcements + +* Thursday 1-2pm PST meeting has been restored to Biweekly + +Agenda & Meeting Notes + +* Ian Dunbar-Hall: Between Security-Insights doc & SBOM Naming convention document, this is a good time to have a uniform approach \- e.g., how do we make these projects work together + * E.g., should we measure SBOM quality? E.g., sbom-scorecard? Not sure + * We now have 2 different ways to record SBOMs \- we should be consistent. + * IT’d be nice to have a way to measure impact. + * Need to get a group together to identify & hash out any issues + * [https://github.com/ossf/scorecard/issues/3574](https://github.com/ossf/scorecard/issues/3574) + * Ian will work with SBOM Everywhere SIG to determine recommendations on what to implement + * Adrianne can coordinate a cross-group meeting once recommendations are determined +* CRob & David A. Wheeler suggested measuring knowledge on how to develop secure software + * [https://github.com/ossf/scorecard/issues/3534](https://github.com/ossf/scorecard/issues/3534) + * We intend to research to see how to automatically determine educational knowledge + +## 2023-11-30 + +Attendees: + +* Spencer Schrock (Google) +* Bennett Pursell (OpenSSF) +* Gabriela Gutierrez (Google) +* Pedro Nacht (Google) +* Joyce Brum (Google) +* Georg Kunz (Ericsson) +* Ryan Ware (Intel) +* Allen Shearin (Lockheed Martin) +* Jeremy Katz (Tidelift) +* Brian Crooks (Datalytica) + +Regrets + +* Adrianne Marcum (OpenSSF) \- will be late if I can attend + +Announcements + +* Thursday 1-2pm PST meeting has been restored to Biweekly; will continue to monitor attendance for monthly EMEA Monday 7-8am PST meetings +* In an effort to trademark the project as “OpenSSF Scorecard,” the domain will be updated to scorecard.dev and other uses of the name will be changed to the singular form (ex: slack channel). Timeline is still being determined and more details will be shared. + * Goal is to give ample time for migration, e.g. redirects + +Agenda + +* \[Gabriella\] Maintainer Annotations + * [Maintainers annotation](https://docs.google.com/document/d/1-5NKRciF3qU-vLS4xPk48EDfC8isz0Z9vnvL4OVjwpQ/edit) + * Similar to CNCF CLOMonitor exemptions [link](https://github.com/cilium/cilium/pull/22371/files) + * Comments to the [tracking issue](https://github.com/ossf/scorecard/issues/1907) +* + +## 2023-11-13 + +Attendees: + +* Adrianne Marcum (OpenSSF) +* Georg Kunz (Ericsson) +* Allen Shearin (Lockheed Martin) +* + +Regrets + +* + +Announcements + +* Adrianne proposes including the EMEA Monday instance as a once/monthly meeting and moving the Thursday afternoon instance back to biweekly + +Agenda + +* ~~\[Gabriella\] Maintainer Annotations~~ Moved to Nov 30? +* Request for available tooling to ease widespread adoption in large organizations [https://openssf.slack.com/archives/C0235AR8N2C/p1698669830558059](https://openssf.slack.com/archives/C0235AR8N2C/p1698669830558059) + * Planning to look into Scorecard Monitor and Scorecard API Visualizer + +## 2023-11-02 + +Attendees: + +* Spencer Schrock (Google) +* Jeff Mendoza (Kusari) +* Ian Dunbar-Hall (Lockheed Martin) +* Allen Shearin (Lockheed Martin) +* Sarah Elder (NCSU) +* Keith Ganger (Lockheed Martin) +* Michael Goddard (Google) +* Adrianne Marcum (OpenSSF) + + +Regrets: + +* David A. Wheeler (burial) + +Agenda: + +* \[Spencer\] scdiff demo of draft PR [https://github.com/ossf/scorecard/pull/3640](https://github.com/ossf/scorecard/pull/3640) +* \[Spencer\] Contributor.md and ladder changes + * Looking at all of our issues labels + * Trying to make it easier for new contributors to be added, if ready + +## 2023-10-16 + +Attendees: + +* David A. Wheeler +* Daniel Appelquist (Snyk) +* Dana Wang (OpenSSF) +* Joseph Coyle (Lockheed Martin) +* Caroline Lee (IBM) +* Ian Dunbar-Hall (Lockheed Martin) + +Agenda: + +* Welcome new friends + * Joe \- arrived last time, developing Hopper (under Ian). Trying to re-engage + * +* Education (SOSS follow-on) + * In SOSS meeting \- Meeting in DC \- US Govt [https://openssf.org/press-release/2023/09/13/openssf-gathers-us-government-and-industry-leaders-at-secure-open-source-software-summit-2023/](https://openssf.org/press-release/2023/09/13/openssf-gathers-us-government-and-industry-leaders-at-secure-open-source-software-summit-2023/) + * [https://github.com/ossf/scorecard/issues/3534](https://github.com/ossf/scorecard/issues/3534) + * Education a key topic \- lots of developers don’t know how to write secure software .. how can we measure how many developers know how to write secure software … look for credentials, etc… How can we get that into ScoreCard? + * DW: Look for “did developer complete something”... look at “who are the maintainers” then call API to find if developers have certifications… Could be an intermediate step \- if it’s on github or gitlab \- you can get the email address and query for credentials… + * Dana: do we plan to have certificates like AWS \- + * DW: yes they already exist \- i’m thinking of cert of completion of the “fundamentals” course.. Other certifications exist… + * Dan: worried about false negatives… + * DW: yes false \+ and \- are a concern… a way to solve this in many cases … We have another database \- the LF’s database \- if you’ve logged into the LF platform (events, etc…) you can identify personal and work email addresses… Can answer “do they have a cert” in the LF database… + * Dan: *concerns about data protection \- primary uses, etc…* + * DW: totally agree we need to keep in mind \- however much of this data is public by design… + * DW: course I’m thinking about \- fundamentals course \- has zero cost… not “pay to play”... + * Dan: what’s the process? Is there a scorecard sandbox? + * Ian: we’ve always worked locally and then one of the maintainers validates the work… Not a separate processing queue for items we want to track but not to be incorporated into scoring yet… + * Ian: i like this idea \- we brought up a similar experimental feature… ties into training, etc… we need to come to an understanding with maintainers… there’s a good amount of stuff that scorecard could track \- recommendations \- how do we track these? There’s some resistance to adopting things … + * Dan: i can understand reluctance to adopt things \- e.g. SBOm \- into scorecard if they are not sufficiently mature… + * Dana: could we still track it and collect that data but make it an optional reporting… + * DW: if it’s not included in the measure than it doesn’t exist… if it’s measured but ignored, why? I think we’re measuring things that are overly narrow. Only process things. + * \[Dan: maybe score it but not include it in the aggregate score until “out of beta”?\] + * New check process \- [https://github.com/ossf/scorecard/blob/main/checks/write.md](https://github.com/ossf/scorecard/blob/main/checks/write.md) + * Dana: measuring people vs. measuring projects.. Scorecard is measuring the project. + * DW: trying to determine an answer to a risk question… “is this safe?” which is a broader question… + * Ian: really interested in seeing SBOM included in Scorecard… Now solving that issue with the naming conventions thing… Reading the process \- talks about high level requirements \- but doesn’t talk about it’s voted in or rejected… + * DW: usually you have to convince the maintainers… often in a github issue. + * Dan: sounds like it’s based on project \- an aggregate score of the maintainers of a project rather than a score about individual developers/maintainers. + * DW: could even be “at least one maintainer has xyz certification” Opening it up : what do people think of education…? Appreciate SBOM is a little more complicated… + * Dan: i do think it’s worth tracking… + * Ian: i think it’s a good idea \- in line with other activities in OpenSSF \- also concerned about data protection. + * DW: I can talk to data protection officer and legal. + * Dana: if we look at build process or release process we look at project itself \- project achieving the maturity level \- all around the project itself \- and the people are behind it. +* Hoppr \- (Joseph Coyle) \- Allen Shearin + * Maybe an SBOM-Scorecard effort as well + * We’d done work on GitLab. Working on O\&M. They’re known issues that are being tracked already. + * Ian: with sbom everywhere coming out with naming conventions … specific place to check for SBOMs… becomes more machine-readable. Very interested in seeing that happen and will dedicate resources to see it happen. Would be great to show coordination across workstreams. We can bring the issue and start the discussion going. + * DW: I think some pushback will happen because this is so new… developers not seeing value yet… we’re trying to get basic agreement… Should we have SBOMs included in the source code at all? Challenge to come up with something people can agree on. But it might be the right time. I suggest writing a doc “this is what we intend to look for”... probably need to figure out the requirements. + * Ian: SBOM everywhere SIG has written it \- and may take it to the TAC for informal approval \- it outlines the \- and security insights spec. We’ll have specific guidance on where to look to find SBOMs…Would love to see this be a common thread across OpenSSF… To help encourage best practices across the industry… We should check even if take up is low at this time… But could be experimental… + * Dan: there’s a runway… also build processes / CICD pipeline needs updated + * Dana: we have to start from somewhere… Using SLSA maturity level \- level 1 is “it exists” and where does it exist \- lower hanging fruit \- then mature to the more advanced level… then advance to next stages of maturity. + * Ian: project to help OSS projects to adopt SBOMs \- +* Question on event-based mechanism for changes for API (pub/sub)? \- Dan + * Is there a way to be notified about a change to a Scorecard result? + * E.g., “well-known package X has a lower score now” (hijacked?) + * We could create a query, but looking more for a callback. + * David: I don’t know of one + * Dan: will bring this up in the github issues for the project. ✨ +* Any other business (AOB) + +## Oct 5, 2023 + +Attendees: + +* Ian Dunbar-Hall (Lockheed Martin) +* Sarah Elder (NC State University) +* Allen Shearin (Lockheed Martin) +* Joe Coyle (Lockheed Martin) +* Jeff Mendoza (Kusari) +* Keith Ganger (Lockheed Martin) +* Spencer Schrock (Google) +* Evan Anderson (Stacklok) +* Victor Lu (?) +* Caroline Lee (IBM) +* Laurent (?) + +Agenda: + +* Welcome new friends + * Allen Shearin + * Joe Coyle +* Discuss adding a new check that detects if a project has an SBOM. (see previous discussion in this document from April, May and June) + * [SBOM Everywhere SIG \- SBOM Naming Conventions Document](https://docs.google.com/document/d/1-jFoh_R7FV4NhHuUkt4Atz3h4K9b4bnmolntSbytspE/edit) + * If Scorecard can confidently say something is not a library, people are more amenable to having it as a check for release artifacts + * For libraries, there is a discussion needed. Laurent to discuss with WG +* On a similar point to unity across the OpenSSF, Security Insights + * See, related issues in scorecard [https://github.com/ossf/scorecard-webapp/issues/478](https://github.com/ossf/scorecard-webapp/issues/478) + * FYI: Security Insights \+ CLOMonitor ([https://clomonitor.io/docs/topics/checks/\#security-insights](https://clomonitor.io/docs/topics/checks/#security-insights)) +* For future discussion (with David \+ CRob) [https://github.com/ossf/scorecard/issues/3534](https://github.com/ossf/scorecard/issues/3534) +* +* GitTuf ([https://github.com/gittuf/gittuf](https://github.com/gittuf/gittuf)) is moving to OpenSSF (SCI wg?). Makes sense to have as an Allstar policy ([https://github.com/ossf/allstar/issues/459](https://github.com/ossf/allstar/issues/459)) + * Branch Protection audit at the git level (as opposed to GitHub/ GitLab preventing something) +* + +## Sep 18, 2023 + +Attendees: + +* Adrianne Marcum (Linux Foundation) +* Sarah Elder (NC State University) + +Agenda: + +* Welcome new friends + * Sarah Elder \- interested in validation of metrics +* No other attendees due to OSS-EU \- convened after 10 min + +## Sep 7, 2023 + +Attendees: + +* Jeff Mendoza (Kusari) +* David A. Wheeler (Linux Foundation) +* Spencer Schrock (Google) +* Andres Orbe (graduate / Alpha-Omega project) +* Adrianne Marcum (Linux Foundation) +* Raghav Kaul (Google) +* Evan Anderson (Stacklok) +* Caroline Lee + +Agenda: + +* Welcome new friends + * Welcome Andres\! Has worked on Alpha Omega, and learning about the rest of the OpenSSF +* Announcements / Updates + * Allstar: looking into a couple of issues: + * [https://github.com/ossf/allstar/issues/442\#issuecomment-1702520347](https://github.com/ossf/allstar/issues/442#issuecomment-1702520347) + * [https://github.com/ossf/allstar/issues/445](https://github.com/ossf/allstar/issues/445) + * Scorecard: + * Blog: [OpenSSF Scorecard Launches v4.12 with Support for GitLab](https://openssf.org/blog/2023/08/28/openssf-scorecard-launches-v4-12-with-support-for-gitlab/) + * More GitLab contributions welcome\! Especially with Dangerous-Workflows and Pinned-Dependencies checks, or adding repos to scan in the cron to gitlab-projects.csv. + * +* David A .Wheeler: Best Practices badge: + * Badge website has now moved to [https://www.bestpractices.dev](https://www.bestpractices.dev), Scorecard probably ought to change the URL where we get best practices info from (the old URL is being redirected so there’s no rush, but it’d be a tiny performance boost). + * Someone has opened a [PR](https://github.com/ossf/scorecard/pull/3448), waiting on DCO + * Also, the badge project intends to bring data from Scorecard to automate some of our questions, per this mapping: [https://github.com/coreinfrastructure/best-practices-badge/blob/main/docs/scorecard-map.md](https://github.com/coreinfrastructure/best-practices-badge/blob/main/docs/scorecard-map.md) + * CRob & I will talk about Scorecard & Best Practices badge at conference in Spain in 2 weeks + * Link? + * Question: What is the difference between the badges? + * BP is a “badge”, Scorecard is a “scorecard” \- but you can have a badge that shows the scorecard + * Will continue to have both “badges”, Scorecard for automated, BP includes non-automated + * Q: Could scorecard read some kind of human-generated yaml-file to address non-automated attestations? + * Q: Would like to point devs to a single place to get better at security, and different BP and scorecard are different + * Starting point is Secure software guide: [https://best.openssf.org/Concise-Guide-for-Developing-More-Secure-Software](https://best.openssf.org/Concise-Guide-for-Developing-More-Secure-Software) Recommend this as a single “Staring point” for devs. + * Scorecard is an easy single point to direct devs to get better at security as it is fully automated. + * BP should be just as easy, even if there are many questions, can just do some + * Scorecard does give a score on having BP badge + * Q: Which order, is it right to start with scorecard? + * Either order is good. + * Q: We should have a good place to start, elevator pitch, easy then continue with more advanced things + * **How about: “start with scorecards”? BP is included in scorecards, so that will lead folks there** + * Scorecards is adding a “remediation effort” estimate so people can sort by amount of effort to achieve an improved score. + * Can we make it easy to get scorecard information without needing to install / run / modify CI, since we have a lot of the scores already? + * Aka point to [https://securityscorecards.dev/viewer/?uri=github.com/ossf/scorecard](https://securityscorecards.dev/viewer/?uri=github.com/ossf/scorecard) + * ~~Put this at top of README.md, e.g.~~ viewer instead, form not allowed + * \
URL: \\\ + * [https://github.com/ossf/scorecard-webapp/tree/main/scorecards-site/static/viewer](https://github.com/ossf/scorecard-webapp/tree/main/scorecards-site/static/viewer) + * +* Vendor news + * Officially started last week, roadmap defined and approved. + * [Scorecard Community Roadmap](https://docs.google.com/document/d/1ttLH1U4BRZkgVukBltLxKyP7UmFSLIyPtUUe1G86Sv0/edit#heading=h.ou02ukhsja30) + * Working on moving checks structured results? + * Also, false positives and negatives +* + +## Aug 24, 2023 + +Attendees: + +* David A. Wheeler (LF) +* Ian Dunbar-Hall (Lockheed Martin) +* Raghav Kaul (Google) +* Evan Anderson (Stacklok) + +Agenda: + +* GitLab Namespace Squatting + * [https://gitlab.com/ossf](https://gitlab.com/ossf) + * [https://gitlab.com/openssf](https://gitlab.com/openssf) +* GitHub Namespace squatting recently resolved (it’s why we’ve been using “ossf” organization) + * Slack conversation \- [https://openssf.slack.com/archives/C05BETTLHEE/p1690586545571689](https://openssf.slack.com/archives/C05BETTLHEE/p1690586545571689) + * Sam White is GitLab product manager for “security product line”. We asked about GitLab squatting. + * [https://openssf.slack.com/archives/C052Z3A3FQA](https://openssf.slack.com/archives/C052Z3A3FQA) +* The blog post announcing Scorecard 4.12, including GitLab support, is basically done. Need a bio from Keith Ganger & Jim Robison. Ian is trying to reach Keith & Jim now. +* + +Actions: + +- Ian Dunbar-Hall \- provide Sam White contact info to David Wheeler. David’s email: dwheeler @ linuxfoundation . org +- Ian Dunbar-Hall \- track down keith and jim’s bios for blog post. + +## Aug 21, 2023 + +Attendees: + +* Dan Appelquist (Snyk) +* David A. Wheeler (LF) +* Adrianne Marcum (LF) +* Cheuk Ho (LF) + +Agenda: + +* Announcements + * Vendor contract process underway for [work outlined in the roadmap](https://docs.google.com/document/d/1ttLH1U4BRZkgVukBltLxKyP7UmFSLIyPtUUe1G86Sv0/edit#heading=h.ou02ukhsja30), we’ve interviewed potential contractors +* [https://github.com/ossf/scorecard/pull/3107](https://github.com/ossf/scorecard/pull/3107) + * All resolved, we just need to make sure the checks all pass + * David W. to merge once the checks run + +## Aug 10, 2023 + +Attendees: + +* Jeff Mendoza (Kusari) +* Spencer Schrock (Google) +* Pedro Nacht (Google) +* Diogo Teles (Google) +* David A. Wheeler (LF) +* Adrianne Marcum (LF) +* Cheuk Ho (LF) +* Evan Anderson (Stacklok) + +Agenda: + +* Announcements + * New meeting link\! Should be updated on the calendar. More details in slack [\[link\]](https://openssf.slack.com/archives/C019M98JSHK/p1691174555715859) + * \[Evan\] calendar seems to still have old link + * \[Evan\] Need LFX account to join + * [Join Link](#meeting-info) + * \[Spencer\] First contributor ladder nomination: Invited Gabriela as Triager [\[link\]](https://github.com/ossf/scorecard/issues/3375) + * \[Spencer\] WIP: GitHub support for Repository Rules [\[link\]](https://github.com/ossf/scorecard/pull/3354) + * Still working with author, but should help with Branch-Protection permissions in cron/action + * Allstar: [https://github.com/ossf/allstar/releases/tag/v4.0](https://github.com/ossf/allstar/releases/tag/v4.0) was released, includes an alternative container that includes busybox image for easy use as a GitHub Action. ([https://github.com/ossf/allstar/pull/441](https://github.com/ossf/allstar/pull/441)) + * Roadmap approved by Best Practices WG, reviewing issues in backlog, vendor selection in process +* \[Spencer\] Re DNS problem from last meeting: + * Two new health checks for the API and website added in GCP. + * Notification channel currently \#security\_scorecards\_cron in Slack + * Any other emails? Maybe a new Scorecard monitoring google group people can sign up to? +* Alternating meeting times decided: + * Pacific time stays the same as current + * Europe time Monday at 2pm GMT (Aug 21\) + +## Jul 27, 2023 + +Attendees: + +* Jeremy Katz (Tidelift) +* Ian Dunbar-Hall (Lockheed Martin) +* Keith Ganger (Lockheed Martin) +* Adrianne Marcum (LF) +* Spencer Schrock (Google) +* Brian Russell (Google) +* Caroline Lee (IBM) +* Jeff Mendoza (Kusari) +* Eddie Knight (Sonatype) +* David A. Wheeler (Linux Foundation) +* Sammy Gonzalez (Lockheed Martin) +* Raghav Kaul (Google) + +Agenda + +* DNS Problem + * For \~13 hours there was a disconnect. If you had any Scorecard Action runs fail, that’s why, everything should be good now. I imagine there will be a postmortem. +* Scorecard Mentioned in [https://resources.snyk.io/state-of-open-source-2023](https://resources.snyk.io/state-of-open-source-2023). +* Should we have a “Scorecard in the news” page? Yes, but not that name. “Notable references to Scorecard”? +* Eddie Knight: Through education SIG etc., will be making a “Scorecard course” \- need someone to review it. It’s not complex, it mostly translates docs to another format. Want someone to review before sending it back to LF Training. + * Spencer: I’ll volunteer + * David A. Wheeler: I’d like to also look, especially to make sure it connects to other materials. +* What about personal access tokens? I’ve always done the GitHub action before. But now that I’m describing how to use the CLI, I get a lot of errors. See issue \#1097, [https://github.com/ossf/scorecard/issues/1097](https://github.com/ossf/scorecard/issues/1097) + * Branch Protection in particular + * With transition to fine-grained permissions of tokens, we think this works well if you have admin access to the repo, it’s trickier if you don’t have that level access. If you do a classic token it’ll work, the problem with these tokens is that they give write access which many people won’t be comfortable with. See the README on tokens. See the scorecard-action info. +* Take the doodle poll on meeting times, we are looking at alternating time slots for more globally friendly timezones + * Pacific \+ US west [poll](https://doodle.com/meeting/participate/id/dN0nO5za) + * Europe \+ US East [poll](https://doodle.com/meeting/participate/id/bD87qJnb) +* GitLab release incoming + * Any documentation for GitLab auth token + * Doc to hook up to GitLab cicd system? It’d be good to document the basics (how to hook into CI/CD & how to show that from the README) \- it’s probably just a few lines of config in each, but people are more likely to do it if we explain it directly. + +## Jul 13, 2023 + +Attendees: + +* Spencer Schrock (Google) +* Pedro Nacht (Google) +* Diogo Teles (Google) +* Laurent Simon (Google) +* Caroline Lee (IBM) +* Ian Dunbar-Hall (Lockheed Martin) +* Jonathan Howard (Lockheed Martin) +* Evan Anderson (Stacklok) +* Jeff Mendoza (Kusari) +* Adrianne Marcum (LF) +* Keith Ganger (Lockheed Martin) +* David A. Wheeler (LF) +* Joyce Brum +* Brian Russell (Google) +* Raghav Kaul + +Regrets: + +* + +Agenda: + +* Welcome new friends + * Adrianne Marcum \- OpenSSF Tech PM + * Jonathan Howard (Lockheed Martin) +* Announcements +* \[Spencer\] Change in Dangerous-Workflow and Token-Permissions scores for repos with no workflows ([issue link](https://github.com/ossf/scorecard/issues/3205)) + * David \- at least score somewhere on the 0 \- 10 scale + * Dangerous CI/CD on other platforms is something that could happen in the future + * Possibly through structured results +* \[Pedro\] Should Dependency-Update-Tool require a dependabot.yml file to detect Dependabot? Or should having Dependabot security updates be sufficient? ([issue link](https://github.com/ossf/scorecard/issues/2845)) + * Dependabot.yml is currently optional, used as a detection signal in addition to commit activity + * Problem is repos that have enabled dependabot once X years ago and havent since + * Score decay? + * If required, does it change what the D-U-T check is checking? + * Dependency tool to mitigate security vulns + * Dependency tool to keep all dependencies up-to-date where reasonably possible + * What happens with an empty dependabot.yml? + * Need to test +* \[From Stephen Augustus via Slack\] In-person meeting w/ Adrianne Marcum & Brian Russell tomorrow to strawman the community roadmap +* \[Laurent\] Status on alternating times for different timezones? Doodle shared? + +## Jun 29, 2023 + +**Attendees:** + +Please add an “X” for those present. + +| Present? | Name | Organization | +| ----- | :---- | :---- | +| X | Brian Russell | Google | +| X | David A. Wheeler | Linux Foundation | +| X | Raghav Kaul | Google | +| X | Evan Anderson | Stacklok | +| X | Laurent Simon | Google | +| X | Dan Appelquist (Snyk) | Snyk | +| X | Christine Abernathy | F5 | +| X | Victor Lu | | +| X | Sanket Naik | Palosade | +| X | Stephen Augustus | Cisco | + +Attendees: + +* Evan Anderson +* David Wheeler +* Christine Abernathy +* Laurent +* Victor Lu +* Christine Abernathy (F5) +* Sanket Naik (Palosade) + +Regrets: + +* Jeff Mendoza (Kusari) \- Under the weather +* Jeremy Katz (Tidelift) \- Vacation +* Spencer Schrock (Google) \- Vacation + +Agenda: + +* Welcome new friends + * Dan Appelquist + * Evan Anderson +* Announcements + * Introductions + * + * Project updates + * Announcement: Donation of visualizer [https://github.com/ossf/scorecard/issues/3204](https://github.com/ossf/scorecard/issues/3204) by nodejs team. +* ✅ Possible to alternate call times to accommodate European time zones? \- Dan Appelquist (resident troublemaker) + * Dan: We’re heavily EU-centered. I chatted with Laurent re: remediation links. This is currently 9pm London time. + * Stephen Augustus: + * Thursdays are triply booked for me\! + * Kubernetes release team ended up switching to Eastern / EMEA for one and Pacific / APAC for the other + * The hardest is that we need to overlay times with maintainer facilitation availability. + * [https://www.timeanddate.com/worldclock/meeting.html](https://www.timeanddate.com/worldclock/meeting.html) + * Two Doodle polls: + * For the Pacific / US-West audience (incl. Sydney) we have now + * For the Europe / US-East (incl Israel) +* ✅ Remediation of [links to external commercial sites](https://github.com/search?q=repo%3Aossf%2Fscorecard%20stepsecurity&type=code)… \- Dan Appelquist + * Someone saw a trace of Scorecard run, raised alarm for [https://stepsecurity.io/](https://stepsecurity.io/) (product) URL. + * In the SCM best practices WG, we’re working with Legitify who developed many remediation steps for SCM which were contributed & those are sitting in GitHub. + * It would be good for Scorecard to NOT send people to commercial sites. Instead, refer to the OSS site. + * It’s happening within the \*remediation\* text. Legity can process & do a “hardened” repo. + * Let’s create an issue to id & resolve this. Dan will create the issue. + * SCM Best practices can be found here: [wg-best-practices-os-developers/docs/SCM-BestPractices at main · ossf/wg-best-practices-os-developers · GitHub](https://github.com/ossf/wg-best-practices-os-developers/tree/main/docs/SCM-BestPractices) and at its new home .. somewhere. +* ✅ Announcement: Donation of visualizer [https://github.com/ossf/scorecard/issues/3204](https://github.com/ossf/scorecard/issues/3204) by nodejs team. + * Stephen Augustus will follow up on this with the TAC + * May not have a well-defined / easy process +* ✅ Licensing of API Data \- [https://github.com/ossf/scorecard/pull/3107](https://github.com/ossf/scorecard/pull/3107) \- Dan Appelquist + * Just noting I’m happy to clarify this issue or help in any way if needed… + * In the Legal Jira world + * David has re-contacted LF legal to get more info +* ✅ (Brian Russell) [project roadmap](https://drive.google.com/file/d/1DJJh-9XyLPtSIdcBZZrMg0G4tNlOzxqc/view?usp=sharing) (first pass / discussion kickoff) + * TL;DR: Known contributions \+ Google (GOSST) team commitments \+ OpenSSF contracted vendors + * Addition: OpenSSF Raising test coverage to 80%+ statement coverage + * Additions: Integrating BigQuery & project-run results + * How can we show “gradual improvements” \- handle/detect more CI/CD (CircleCI, Jenkins, etc), more test frameworks, more SAST tools \- maybe show the “by this point” milestone +* ✅ \[Christine Abernathy\] Thoughts on publishing Scorecard results in places other than BigQuery? + * What formats / locations? + * Have a transfer job that weekly transfers data from 1.XM repos from GCS to a BigQuery table which is publicly queryable + * Could probably support other transfer mechanisms + * They can run up a bill somewhere in GCP when copying / querying\!\! + * `Api.securityscorecards.dev` \- where does it pull data? We believe it reads from GCS blobs, not from BigQuery. + * Or maybe somewhere else + * Where do we pass costs off to the consumer? + * May need to create an issue to work out use cases \- Christine will file + * ​​Dan created this demonstrator: [https://github.com/torgo/Scorecard4Purl](https://github.com/torgo/Scorecard4Purl) + * [https://github.com/ossf/wg-best-practices-os-developers/tree/main/docs/SCM-BestPractices](https://github.com/ossf/wg-best-practices-os-developers/tree/main/docs/SCM-BestPractices) +* Evan Anderson Where does the infrastructure (particularly `allstar`) run? + * Want to be able to verify that community-run public benefit instances are being managed consistently + * `allstar`: Google runs an instance, not clear who runs the public instance + * Evan Anderson to file an issue + +## Jun 15, 2023 + +Attendees: + +* Spencer Schrock (Google) \- a Scorecard maintainer\! +* Pedro Nacht (Google) +* Diogo Sant Anna (Google) +* Brian Russell (Google) +* Jeremy Katz (Tidelift) +* Ashish Kurmi (StepSecurity) +* Jim Robison (Lockheed Martin) +* Lucas Gonze (eBay) +* Jeff Mendoza (Kusari) +* David A. Wheeler (Linux Foundation) +* Ian Dunbar-Hall (Lockheed Martin) +* Michael Goddard (Google) +* Raghav Kaul (Google) +* Caroline Lee (IBM) + +Agenda: + +* \[Spencer\] Golden test tool proposal + * GitHub issue: [CI: Report scoring differences for PRs that modify scorecard checks](https://github.com/ossf/scorecard/issues/2462) + * [Scorecard Golden Testing Design Document](https://docs.google.com/document/d/1xbk036RCVr5yUCU2NfjDzNAkT8oSRcDFmucUAXjQgaQ/edit?usp=sharing) +* \[Diogo\] [Allow unpinned dependencies in the selection of unprivileged workflows](https://github.com/ossf/scorecard/issues/2018) – workflows with read-only permissions and no secrets + * Current blocker is that actions/upload-artifacts can still be called with read-only permissions and the artifacts can be used for critical processes, e.g. builds. Example: [This](https://github.com/pyca/cryptography/blob/main/.github/workflows/wheel-builder.yml#L43) piece of code uploads a python build artifact that is used by [this other workflow](https://github.com/pyca/cryptography/blob/main/.github/workflows/pypi-publish.yml#LL28C56-L28C56) to publish it. + * “Don't punish but throw a warning.” + * Who is this for? Developers? Auditors? + * Should there be a confidence level for analysis to switch between permissive/restrictive? + * We should DOCUMENT what we do when we’re not sure, in particular, the general rule. Should we err on caution or permissive? + * False positives negatively affect people’s view on Scorecard + * Proposed documented statement: “When we aren’t sure if there’s a problem or not, by default we presume it’s okay, and we’ll output a warning that we can’t determine something” + * Maybe have a flag for “only give credit when there’s confidence in it” + * Raghav Kaul: “Structured results feel like they'd go a long way here, we'd create findings and a maintainer can choose what to ignore. I wish there were a threat mapping/threat model of GitHub API permission levels and what a given permission allows you to do. If someone knows of something like this, it would really help to encode it into scorecard.” + * Not very elegant, but this shows what endpoints are accessible: + * for a classic token: [https://docs.github.com/en/rest/overview/permissions-required-for-github-apps?apiVersion=2022-11-28](https://docs.github.com/en/rest/overview/permissions-required-for-github-apps?apiVersion=2022-11-28) + * for fine-grained tokens: [https://docs.github.com/en/rest/overview/permissions-required-for-fine-grained-personal-access-tokens?apiVersion=2022-11-28](https://docs.github.com/en/rest/overview/permissions-required-for-fine-grained-personal-access-tokens?apiVersion=2022-11-28#actions) + * The decision doesn't need to be binary, as either restrictive or permissive. We could decrease at least a low amount of score (e.g. 0.2 or 0.5) for unpinned read-only actions. That would keep scorecard impartial on possible security risks, and maintainers that'd rather not hash-pin safe dependencies could still be cool with a 9/10 score. +* \[Ashish\] Potential updates in StepSecurity remediation page + * We have noticed that open-source maintainers get confused when they visit the current StepSecurity remediation page from scorecard findings. We have an alternate workflow that we can enable on the current page to simplify the user experience. + * Proposing sending people towards the PR generating tool + * Maybe switch up which remediations are enabled by default + * I.e. if coming from a token permission issue, only have the token permissions on by default. But other remediations are available to enable. + * Is there functionality remaining for people not logged in? Even if it’s the same landing page +* \[Jeff\] [https://github.com/ossf/allstar/issues/422](https://github.com/ossf/allstar/issues/422) + * [https://github.com/ossf/allstar/pull/424](https://github.com/ossf/allstar/pull/424) +* \[MichaelG\] Contributor ladder (see draft in [\#1529 (comment)](https://github.com/ossf/scorecard/issues/1529#issuecomment-1572664893)) + * Feedback / next steps? + * TAC feedback + * Contributor ladder is nice to have for all ossf projects, and how people can become maintainers + * But the proposal is too detailed to apply to all projects, especially smaller ones. So the proposal in question should be viewed as scorecard specific. +* \[DavidW\] I’d like to change our Scorecard meeting note permissions; currently they are “edit by all”. I want to switch to “comment by all” to prevent problems from trolls. Can everyone share your email address so we can set everyone here can edit? + * Do you want to limit edit permissions to the [https://groups.google.com/g/ossf-scorecard-dev](https://groups.google.com/g/ossf-scorecard-dev)? + * I’m not sure I can do that now that it’s moved to OpenSSF’s drive. Pointers? + * I shared it as “editor” to: [ossf-scorecard-dev@googlegroups.com](mailto:ossf-scorecard-dev@googlegroups.com) \- if that’s enough then we’re done, not sure that’s enough. + * \[Brian Russell\] I think that should work + * Looks like it works\! Now everyone can “suggest” but we’re more careful about who can edit. + * David: I’m not worried about the people present. +* David: The OpenSSF critical projects WG has developed a draft updated list of “critical OSS projects” for 2023\. Can we make sure that all projects in their list (where specific GitHub repos are referenced) is included in the weekly run? Below is the list of repos. I expect many are already there, but possibly not all. + * MichaelG: looks like they are all there + * Thanks for checking\!\! + +Here is the list that was checked: +https://github.com/angular/angular +https://github.com/ansible/ansible +https://github.com/ant-design/ant-design +https://github.com/caolan/async +https://github.com/babel/babel +https://github.com/twbs/bootstrap +https://github.com/Homebrew/brew +https://github.com/ceph/ceph +https://github.com/chromium/chromium +https://github.com/Kitware/CMake +https://github.com/veged/coa +https://github.com/apache/commons-codec +https://github.com/apache/commons-io +https://github.com/apache/commons-lang +https://github.com/home-assistant/core +https://github.com/python/cpython +https://github.com/curl/curl +https://github.com/DefinitelyTyped/DefinitelyTyped +https://github.com/drupal/drupal +https://github.com/electron/electron +https://github.com/flutter/flutter +https://github.com/laravel/framework +https://github.com/gatsbyjs/gatsby +https://github.com/gradle/gradle +https://github.com/grafana/grafana +https://github.com/google/guava +https://github.com/Homebrew/homebrew-cask +https://github.com/Homebrew/homebrew-core +https://github.com/apache/httpcomponents-client +https://github.com/apache/httpcomponents-core +https://github.com/isaacs/inherits +https://github.com/juliangruber/isarray +https://github.com/FasterXML/jackson-core +https://github.com/FasterXML/jackson-databind +https://github.com/joomla/joomla-cms +https://github.com/JuliaLang/julia +https://github.com/jonschlinkert/kind-of +https://github.com/knative/community +https://github.com/kubernetes/kubernetes +https://github.com/laravel/framework +https://github.com/lodash/lodash +https://github.com/apache/logging-log4j2 +https://github.com/qos-ch/logback +https://github.com/magento/magento2 +https://github.com/mui-org/material-ui +https://github.com/apache/maven +https://github.com/mesonbuild/meson +https://github.com/substack/minimist +https://github.com/addaleax/natives +https://github.com/nginx/nginx +https://github.com/NixOS/nixpkgs +https://github.com/nodejs/node +https://github.com/numpy/numpy +https://github.com/openssl/openssl +https://github.com/OpenVPN/openvpn +https://github.com/pandas-dev/pandas +https://github.com/symfony/symfony +https://github.com/php/php-src +https://github.com/postgres/postgres +https://github.com/PowerShell/PowerShell +https://github.com/PrestaShop/PrestaShop +https://github.com/puppetlabs/puppet +https://github.com/pytorch/pytorch +https://github.com/ljharb/qs +https://github.com/rails/rails +https://github.com/dominictarr/rc +https://github.com/facebook/react-native +https://github.com/nodejs/readable-stream +https://github.com/ruby/ruby +https://github.com/rubygems/rubygems +https://github.com/rust-lang/rust +https://github.com/saltstack/salt +https://github.com/qos-ch/slf4j +https://github.com/apache/spark +https://github.com/storybookjs/storybook +https://github.com/nodejs/string\_decoder +https://github.com/systemd/systemd +https://github.com/tensorflow/tensorflow +https://github.com/mrdoob/three.js +https://github.com/torproject/tor +https://github.com/microsoft/TypeScript +https://github.com/faisalman/ua-parser-js +https://github.com/microsoft/vscode +https://github.com/webpack/webpack +https://github.com/WordPress/WordPress +https://github.com/zephyrproject-rtos/zephyr + +## Jun 1, 2023 + +Attendees: + +* Diogo Sant'Anna (Google, GOSST Upstream team) +* Gabriela Gutierrez (Google, GOSST Upstream team) +* Joyce Brum (Google, GOSST Upstream team) +* Pedro Nacht (Google, GOSST Upstream team) +* Spencer Schrock (Google) +* Jeremy Katz (Tidelift) +* Jeff Mendoza (Kusari) +* Brian Russell (Google) +* Raghav Kaul (Google) +* Caroline Lee (IBM) +* Brian Behlendorf (OpenSSF/LF) +* Josh Clements (ADI) +* Ian Dunbar-Hall (Lockheed Martin) +* Justin Abrahms (hire me?) + +Regrets: + +* Michael Goddard (Google) \- SYD this time. NYC next time\! + +Agenda: + +* Announcements + * Introductions + * Pedro, from GOSST Upstream team. Work full time on external contributions + * Josh, OSPO at Analog Devices. Interested in implementing Scorecard at ADI + * Project updates + * GitHub access changed to teams, check that access is correct. +* \[Raghav\] Code Review proportional scoring changes: [https://github.com/ossf/scorecard/pull/2882](https://github.com/ossf/scorecard/pull/2882) + * How to avoid this scoring whiplash in the future? + * Score change visualizer being designed, will be presented here when ready +* \[Brian Russell\] FYI putting together launch plan for GitLab support +* \[GOSST Upstream team\] Suggest adoption of a contributor ladder (see draft in [\#1529 (comment)](https://github.com/ossf/scorecard/issues/1529#issuecomment-1572664893)) + * Current draft is focused on overall openssf contributor ladder, to do so should propose to the TAC with an issue in the TAC repository and then discussion there +* \[GOSST Upstream team\] CLO-Monitor viewer of Scorecard scores ([\#2979](https://github.com/ossf/scorecard/issues/2979)) + * General acceptance of the idea of hosting in the scorecard site, awaiting PR from the CLO monitor team +* \[GOSST Upstream team\] [List of priority issues](https://docs.google.com/spreadsheets/d/1QrpD85bUbnKIWp7UMjrl8nwUcLeCytirMV_UXPR1sEE/edit#gid=0) we believe are important for maintainer satisfaction and Scorecard adoption, that we are willing to contribute with. Example: + * ~~Code-Review: Review change made on version 4.10.5 that caused large reduction of scores ([issue](https://github.com/ossf/scorecard/issues/2812))~~ (covered on Raghav first point) + * Token-Permissions: Only low-risk permissions are punished at the job-level ([issue](https://github.com/ossf/scorecard/issues/3045)) + * Pinned-Deps: allow unpinned deps in unprivileged workflows ([issue](https://github.com/ossf/scorecard/issues/2018)) +* \[Justin Abrahms\] [sboms](https://github.com/ossf/scorecard/issues/3043) + * [There's a way](https://gist.github.com/lucasgonze/b84a2c52c697bf8f686a005080c369dd) to find if they're generated based on looking through github actions + * Github itself [has a way to generate SBOMs](https://docs.github.com/en/rest/dependency-graph/sboms?apiVersion=2022-11-28) + +## May 18, 2023 + +Attendees: + +* Justin Abrahms (Hire me?) +* Ian Dunbar-Hall (Lockheed Martin) +* Jeff Mendoza (Kusari) +* Ashish Kurmi (StepSecurity) +* David A. Wheeler (Linux Foundation) +* Lucas Gonze (eBay OSPO) \- works on OSPOs, uses Scorecard +* Jim Robison (Lockheed Martin) +* Keith Ganger (Lockheed Martin) +* Andrew Brinker (MITRE) +* Jeremy Katz (Tidelift) +* Raghav Kaul (Contributor, Google) +* Caroline Lee (IBM) +* Sanket Naik (Palosade) +* Brian Russell (Google) + +Regrets: + +* Naveen Srinivasan +* \[Spencer Schrock (Google)\] +* Michael Goddard (Google) \- sorry, in SYD, timezones :( + +Agenda: + +* Announcements + * Introductions + * Project updates + * +* Open Issues & One-off discussion topics (e.g. pull request to be merged, feature request, etc.) + * [Add support for SBOM analyzing](https://github.com/ossf/scorecard/issues/2605) + * Bigger issue: Where do the SBOMs go? SBOMs are often \*generated\* from source code (e.g., during build) \- how do we find them? + * Also: [Issue \#1476](https://github.com/ossf/scorecard/issues/1476) + * Question of implementation + * Where does the score go \- release, binary artifacts, new check, etc? + * How would we score this? + * Where does sbom live? + * Write proposal and invite feedback + * Q: How/where does one write a proposal? + * A: Create a GitHub issue + * So.. we have one. :) What next? + * More details on code implementation, and how score is calculated + * Needs to propose an implementation, not ask + * Lot of end users and organizations want this + * If scorecard can find sbom, maybe use rest api to show location of sbom? + * Utilize related ossf groups for their expertise: sbom everywhere (under tooling, \#stream-09-sbom-everywhere) and repos working group (\#wg\_securing\_software\_repos) + * David: This is important, but it is challenging. OSS NA presentation showed that different JavaScript package managers produced very different sets of packages to be installed given the same inputs. + * \[Jeff\]Who are the scorecard core maintainers? Is there a contributor ladder? + * [https://github.com/ossf/scorecard/blob/main/.github/CODEOWNERS](https://github.com/ossf/scorecard/blob/main/.github/CODEOWNERS) + * [https://github.com/ossf/scorecard/pull/3039](https://github.com/ossf/scorecard/pull/3039) + * Contributor ladder: ? + * New mitre tool similar to scorecard called “hipcheck”: [https://github.com/mitre/hipcheck](https://github.com/mitre/hipcheck) (written in Rust) + * What’s the diff? + * Originally focused on software supply chain risks. + * Focuses on typosquatting \- looks for dependencies that are probably typosquatting. Repos are also countering this, maybe that’s less important. + * Concerning contributions: Packed malware, etc. + * What about false+? + * We’d love to validate this. + * We found it hard to find malicious code sample. Looked for patches to fix CVEs, then went backwards to see what contributions were especially likely to be problematic. + * David: There’s a group that has a collection. + * There are also some UI differences, trying to make it easier to use. It’d be possible for scorecard’s JSON output to be sent into something that could build on the UI ideas. + * Probably would just re-implement (Rust vs. Go) + * They’ll come back & identify the specific criteria that (1) are especially useful and (2) not already in scorecard. + * Guide to analyses, slightly out of date, but still useful: [https://github.com/mitre/hipcheck/blob/main/docs/book/src/using/analyses.md](https://github.com/mitre/hipcheck/blob/main/docs/book/src/using/analyses.md) +* Summary (last 3-5 minutes) + * Facilitator transfer for next meeting + * + +Note: A lot of the Scorecard work now is being done by Raghav Kaul, Spencer Schrock, and Naveen Srinivasan. + +## May 4, 2023 + +Attendees: + +* David A. Wheeler (Linux Foundation) +* Jeff Mendoza (Kusari) +* Brian Russell (Google) +* Ashish Kurmi (StepSecurity) +* Ian Dunbar-Hall (Lockheed Martin) +* Jim Robison (Lockheed Martin) +* Caroline Lee (IBM) +* Jeremy Katz (Tidelift) +* Amber Webb (Shell) +* + +Agenda: + +* Announcements + * Introductions + * Project updates + * +* Open Issues & One-off discussion topics (e.g. pull request to be merged, feature request, etc.) + * Code Review Check: Use of AI to review code to help projects with single maintainers + * David: AI shouldn’t count as a human review. It’s a static analysis, sure, and it could count that way. But we’d need strong evidence that AI is as good as human reviews in general before they’d count. + * Jeff: Single-maintainers have a risk, if the maintainer disappears the project stops. AI doesn’t solve that either, so no, AI shouldn’t counter. + * So overall, no, AI doesn’t count for this. + * David: I can draft a tweak to Scorecard to clarify this + * If we ever evaluate the quality of (static analysis) tools, the quality of the AI would matter & we’d need to evaluate. +* Summary (last 3-5 minutes) + * Facilitator transfer for next meeting + * Caroline Lee: I can take it\! + +## Apr 20, 2023 + +Attendees: + +* David A. Wheeler (Linux Foundation) +* Jeff Mendoza (Kusari) +* Brian Russell (Google) +* Justin Abrahms (hire me?) +* Spencer Schrock (Google) +* Ashish Kurmi (StepSecurity) +* Ian Dunbar-Hall (Lockheed Martin) +* Jim Robison (Lockheed Martin) + +Agenda: + +* Announcements + * Introductions + * Project updates + * Allstar + * Could use some help here: [https://github.com/ossf/allstar/issues/381\#issuecomment-1509513138](https://github.com/ossf/allstar/issues/381#issuecomment-1509513138) + * Using cached-transport but tarball download is too big +* Open Issues & One-off discussion topics (e.g. pull request to be merged, feature request, etc.) + * \[Abrahms\] [sbom-scorecard](https://github.com/justinabrahms/sbom-scorecard) inclusion. ([Issue](https://github.com/ossf/scorecard/issues/2605)) + * Seems promising. What’s the vision on how to integrate overall? + * How would you include this with Scorecard, since SBOM might not be in version control of source code? Scorecard is currently very based on repo + * Can look at GitHub releases, see if there are artifacts in its release, so could infer it from that. + * It seems to fit better with the Signed Releases or Packaging check, but that’s okay. + * Publishing workflow (vs. packaging) + * Sounds reasonable. + * How do we find the SBOM? Probably first check filename extension, look in certain places, verify if they’re SBOMs. + * Google’s osv-scanner uses some naming conventions to find SBOMs, we can use similar ones. + * [https://github.com/google/osv-scanner/pull/258](https://github.com/google/osv-scanner/pull/258) which references + * Cyclonedx [https://cyclonedx.org/specification/overview/\#recognized-file-patterns](https://cyclonedx.org/specification/overview/#recognized-file-patterns) + * SPDX [https://spdx.github.io/spdx-spec/v2.3/conformance/](https://spdx.github.io/spdx-spec/v2.3/conformance/) + * Issue updated: [https://github.com/ossf/scorecard/issues/2605\#issuecomment-1516899502](https://github.com/ossf/scorecard/issues/2605#issuecomment-1516899502) + * OpenSSF Scorecard and Best Practices badges + * David Wheeler will co-present these with crob @ OpenSSF Day + * Is there any guidance between the three ways to pull scorecard data? + * BQ directly / REST API / Deps.dev + * Deps.dev does temporarily filter some data out (currently \-1s, SAST, Dependency-Update-Tool and Code-Review) while Scorecard is re-enabling some checks + * And how is the data licensed [https://github.com/ossf/scorecard/issues/2713](https://github.com/ossf/scorecard/issues/2713) + * ? +* Quick heads-up \- will present on Scorecard @ OpenSSF Day + * Naveen \+ Spencer also presenting a Scorecard \+ Sigstore talk, not ready for feedback, maybe next week +* Summary (last 3-5 minutes) + * Facilitator transfer for next meeting + +## Apr 6, 2023 + +Attendees + +* Jeremy Katz (Tidelift) +* Ian Dunbar-Hall (Lockheed Martin) +* Ashish Kurmi (StepSecurity) +* Spencer Schrock (Google) +* Brian Russell (Google) +* Jim Robison (Lockheed Martin) +* Jeff Mendoza (Kusari) +* Keith Ganger (Lockheed Martin) +* David A. Wheeler (Linux Foundation) +* Azeem Shaikh (Google) +* Raghav Kaul (Google) + +Project Updates + +* Allstar (Jeff) + * Two new policies contributed: + * Administrator \- are individuals allowed or only teams, with exceptions + * Codeowners \- settings for if required, or optional and if it is there does it have errors + * Looking to fix a memory leak (previously rolled-back) + * Next will cut a release. +* Scorecard Action new release + * [https://github.com/ossf/scorecard-action/releases/tag/v2.1.3](https://github.com/ossf/scorecard-action/releases/tag/v2.1.3) + +Agenda + +* FYI: OpenSSF \- we’re working on funding more maintenance (Naveem, 25 hours/week, reporting to David A. Wheeler), scorecard improvements +* FYI: MITRE has “hipcheck” which has some similarities to Scorecard, it might be useful to review it & see if has ideas to reuse. See: [https://github.com/ossf/scorecard/issues/2816](https://github.com/ossf/scorecard/issues/2816) + * Hipcheck: [https://github.com/mitre/hipcheck](https://github.com/mitre/hipcheck) + * *AI: David to reach out to Andrew who led the work and see if he’s up to join and share* +* Gitlab discussion + * Plan to use cron to loadtest. Have a list of 25K-30K GitLab repos that we’ll add to the cron list soon. We plan to start by adding just a few GitLab repos to make sure it works before “fulling turning it on”. + * When we talked with Sam & ? from GitLab, they suggested the best thing is to use GitLab service accounts, for now we have a stub account & we’ll switch over once the service account is available. That’s a construct that doesn’t QUITE exist yet in GitLab, but is about to: [https://gitlab.com/groups/gitlab-org/-/epics/9573](https://gitlab.com/groups/gitlab-org/-/epics/9573) . So the idea is to use a normal account, then switch. +* Process for proposing scoring changes + * Bug(?): Large changes to Code-Review scores between 4.10.2 and 4.10.5 + * [https://github.com/ossf/scorecard/issues/2812](https://github.com/ossf/scorecard/issues/2812) + * Changes proposed during Nov 17, 2022 meeting drastically changed scoring. Having 2 unreviewed PRs (out of \~30) gives a 0 + * Number of repos scoring 0 went from 905,973 \-\> 1,058,062 + * David W: Might want to borrow the approach from the best practices badge + * When we add new criteria, we mark them as “future” \- we measure them, but report them as “future” & don’t include their values in the final value + * That way, we can add new criteria but give people time to implement them. + * Later the “future” criteria have the “future” marking removed, and thus are included in the final score. + * Maybe for tweaking checks, can create a variant of the check + * Could do the same thing, mark the new variant as “future” + * Planning on Golden tests, details not solidified yet + * Basically, before creating changes, run it against a subset with expected results to see if it does what we expect. + * Is something anyone can do to move that along? Spencer:We can bring things once further along. + * Wheeler: Can add “future: true” property to each criterion, final scoring ignores the criteria with future:true. +* Brian will moderate in 2 weeks + +## Mar 23, 2023 + +Attendees + +* Jeremy Katz (Tidelift) +* Spencer Schrock (Google) +* Ashish Kurmi (StepSecurity) +* Azeem Shaikh (Google) +* Naveen Srinivasan +* Theresa Mammarella (Sonatype) +* Sanket Naik (Palosade) +* Namita Madhira (Comcast) +* Brian Russell (Google) +* Caroline Lee (IBM) +* Raghav Kaul (Google) + +Project Updates + +* Scorecard v4.10.4 released [https://github.com/ossf/scorecard/releases/tag/v4.10.4](https://github.com/ossf/scorecard/releases/tag/v4.10.4) + * Scorecard action release needed +* Scorecard talk at [SCALE](https://www.socallinuxexpo.org/scale/20x) + +Agenda + +* Ashish discuss StepSecurity using Scorecard, provide remediation steps, add to automation to sbom +* Gitlab support timeline question + * There is a Software supply chain security WG [https://gitlab.com/gitlab-com/www-gitlab-com/-/merge\_requests/120855](https://gitlab.com/gitlab-com/www-gitlab-com/-/merge_requests/120855) + * Gitlab repos slowly integrating into cron results, check by check + * Security Policy: [https://github.com/ossf/scorecard/pull/2754](https://github.com/ossf/scorecard/pull/2754) + * Issue tracker: [https://github.com/ossf/scorecard/issues/2775](https://github.com/ossf/scorecard/issues/2775) + * + +## Mar 9, 2023 + +Attendees + +* Naveen Srinivasan +* Spencer Schrock (Google) +* Jim Robison (Lockheed Martin) +* Caroline Lee (IBM) +* Keith Ganger (Lockheed Martin) +* Sammy Gonzalez (Lockheed Martin) +* Ian Dunbar-Hall (Lockheed Martin) +* Raghav Kaul (Google) +* Michael Goddard (Google) + +Agenda + +- [https://github.com/ossf/scorecard-action/pull/1095](https://github.com/ossf/scorecard-action/pull/1095) Naveen Srinivasan + - Discuss about the blocking issue + - Naveen is blocked on the PR + - This issue was opened and presente + - Bus factor + - Try to resolve next steps by next meeting +- Code Review scoring changes Raghav Kaul + - Some big (negative) changes in prominent projects (e.g. numpy) + - Change between previous cron results, to recent restarted run + - Change/release policy for score changes needed? + - Better communication about changes (e.g. versioned releases with release notes?) + - Add emoji on PR \[like sapling etc\] + - E2E tests? + - On canary cohort? (to minimize token usage) + - Cron job + - Has a canary, but only that the binary itself works, does not check score variance +- Blog on Scorecard published [https://developer.ibm.com/blogs/ibm-works-with-openssf-scorecard-to-improve-supply-chain-security/](https://developer.ibm.com/blogs/ibm-works-with-openssf-scorecard-to-improve-supply-chain-security/) Caroline Lee +- + +## Feb 23, 2023 + +Attendees + +* Naveen Srinivasan +* Jeff Mendoza +* Spencer Schrock (Google) +* Ian Dunbar-Hall (Lockheed Martin) +* Keith Ganger (Lockheed Martin) +* Ashish Kurmi (StepSecurity) +* Michael Goddard (Google) +* Raghav Kaul (Google) +* Matt Rutkowski (IBM) +* Caroline Lee (IBM) +* Jerod Heck (Lockheed Martin) +* Brian Russell (Google) + +Welcome new faces + +* Ashish Kurmi \- Welcome Ashish\! +* Keith Ganger \- Welcome Keith\! + +Project Updates + +* Allstar + * Did a release [https://github.com/ossf/allstar/releases/tag/v3.0](https://github.com/ossf/allstar/releases/tag/v3.0) + * Operations funding secured + * Working on a memory leak + * Will merge contributor ladder PR. [https://github.com/ossf/allstar/pull/339](https://github.com/ossf/allstar/pull/339) +* Scorecard + * Upcoming talks: + * [SCaLE March](https://www.socallinuxexpo.org/scale/20x/presentations/how-do-you-trust-your-open-source-software) + * [RSA](https://www.rsaconference.com/usa/agenda/session/How%20Do%20You%20Trust%20Open%20Source%20Software) + +Agenda + +* Matt Rutkowski would like to describe CycloneDX efforts on Formulation (v1.5, RFC pending) (i.e., CI/CD Workflow) and its artifact capture from tasks/tools and how to reference them in future SBOMs (and delta from v1.4) with interactive Q\&A +* Fuzzing check \- read OSS Fuzz logs instead of GitHub project YAMLs? + * Add RepoURL to schema: [https://github.com/google/oss-fuzz/issues/9782](https://github.com/google/oss-fuzz/issues/9782) + * [https://github.com/ossf/scorecard/issues/2670](https://github.com/ossf/scorecard/issues/2670) + * Naveen provided information for Raghav to check with Oliver in GOOST +* Demo \- Implement Scorecard action for dependencies \- [https://github.com/ossf/scorecard-action/issues/1070](https://github.com/ossf/scorecard-action/issues/1070) \- Naveen Srinivasan + * Naveen will open a PR + * It was recommended that we include policy as to what makes the action fail. + * Naveen \-The Policy checks will be added later when scorecard comes up with a policy framework. + * [Scorecard action for dependencies](https://docs.google.com/presentation/d/1QOBO4AGsXT7hddLY0HOyO6evfLvVvQ0fIdnzXiMsN_c/edit?usp=sharing) +* + +## Feb 9, 2023 + +Attendees + +* Jeremy Katz (Tidelift) +* Spencer Schrock (Google) +* Ian Dunbar-Hall (Lockheed Martin) +* Jerod Heck (Lockheed Martin) +* Keith Ganger (Lockheed Martin) +* David A. Wheeler (Linux Foundation) +* Jeff Mendoza +* Kara Olive (Google) +* Bob Callaway (Google) +* Brian Russell (Google) +* Raghav Kaul (Google) + +Welcome new faces + +* Ian Dunbar-Hall, Jerod Heck, Keith Ganger (Lockheed Martin) + * Working on GitLab support on Scorecard +* Justin Abrahms (eBay) + * Working on SBOM Scorecard + +Laurant is on travel, can’t lead meeting. Spencer will lead today. + +Project/Individual updates + +* Allstar + * Contributor ladder: [https://github.com/ossf/allstar/pull/339](https://github.com/ossf/allstar/pull/339) + * Planning on release soon. +* Scorecard + * Probably also need a release for bug fixes + +Agenda + +* Allstar request for neutral infrastructure (funding). + * Any donations? + * SCP WG will petition TAC for funding otherwise: [https://github.com/ossf/tac/blob/main/working-group-abilities.md\#technical-infrastructure](https://github.com/ossf/tac/blob/main/working-group-abilities.md#technical-infrastructure) + * Access to repositories through privileged GitHub app is under the image of the OpenSSF + * Administration of the project should be under LF IT + * Jeff to open ticket with TAC +* Lockheed-Martin is interested in adding support for GitLab (welcome\!) + * Ian Dunbar-Hall, Jerod Heck, Keith Ganger (Keith not on today) (Lockheed Martin) + * Ragav has been working to get this PR across the finish line. + * Should have a discussion in the relevant issues + * We’re using Scorecard topic & bringing it in, happy to help support + * Local git analysis improvements are also benefit other ecosystems + * David: We’d love improvements to the criteria so they’re more general, if they aren’t, per [https://github.com/ossf/scorecard\#scorecard-checks](https://github.com/ossf/scorecard#scorecard-checks) + * In general, please discuss in the issues. +* SBOM Scorecard project (Justin Abrams) + * It scores SBOMs. An “SBOM” can be useless, e.g,. Doesn’t list dependencies or doesn’t list their versions. My project attempts to evaluate them. + * [https://github.com/eBay/sbom-scorecard](https://github.com/eBay/sbom-scorecard) + * David: Have you looked at the US list of “minimum viable” fields? + * The document is here: [https://www.ntia.gov/sites/default/files/publications/sbom\_minimum\_elements\_report\_0.pdf](https://www.ntia.gov/sites/default/files/publications/sbom_minimum_elements_report_0.pdf) + * Supplier Name The name of an entity that creates, defines, and identifies components. + * Component Name Designation assigned to a unit of software defined by the original supplier. + * Version of the Component Identifier used by the supplier to specify a change in software from a previously identified version. + * Other Unique Identifiers Other identifiers that are used to identify a component, or serve as a look-up key for relevant databases. + * Dependency Relationship Characterizing the relationship that an X is included in software Y. + * Author of SBOM Data upstream component The name of the entity that creates the SBOM data for this component. + * Time stamp Record of the date and time of the SBOM data assembly . + * David: have you considered identifying missing sub-dependencies? + * Doesn’t verify if correct, it just makes sure that the data there is useful & certain kinds of data are present: licenses, version\#s, etc. + * Let’s get the other scorecards maintainers to review the proposed issue: [https://github.com/ossf/scorecard/issues/2605](https://github.com/ossf/scorecard/issues/2605) + * [https://sbom-scorecard.dev/](https://sbom-scorecard.dev/) if y’all wanna try it out. +* Docs mini-fixit plans + * Proposed plan of scheduling a doc session every 6 months to speed read docs and identify problems + * Support from previous meeting around this frequency +* + +## Jan 26, 2023 + +Attendees + +* Jeff Mendoza +* Spencer Schrock (Google) +* Jeremy Katz (Tidelift) +* Stephen Augustus (he/him) (Cisco) +* Raghav Kaul (Google) + +Welcome new faces + +* Jeremy Katz (Tidelift) + +Project/Individual updates + +* Allstar + * Update contribution guidelines [https://github.com/ossf/allstar/pull/339](https://github.com/ossf/allstar/pull/339) + * Contributing.md and ladder + * Working on quickstart and other docs updates +* Scorecard + * Doc freshness also planned [https://github.com/ossf/scorecard/issues/2579](https://github.com/ossf/scorecard/issues/2579) + * Overarching Issue TBD + +Agenda + +* CI/CD rate limit improvements. Comments welcome + * [https://github.com/ossf/scorecard/issues/2603](https://github.com/ossf/scorecard/issues/2603) +* Comments still welcome on Laurent’s structured results + * [https://github.com/ossf/scorecard/pull/2584](https://github.com/ossf/scorecard/pull/2584) + * Make sure SARIF output we’re producing for GitHub is good with these changes +* What is doc freshness? + * Doing these discussions as a community meeting + * 6 month sync good for re-evaluating +* SemVer: [https://github.com/ossf/scorecard/issues/1683](https://github.com/ossf/scorecard/issues/1683) + * Discussion over what is a major/minor change. E.g. [https://github.com/ossf/scorecard/pull/2195](https://github.com/ossf/scorecard/pull/2195) + * Score calculation changed, result format stays the same + * Also needs a discussion on the API / public data + +## Jan 12, 2023 + +Attendees + +* Naveen Srinivasan +* Spencer Schrock (Google) +* Caroline Lee (IBM) +* Jeff Mendoza (Google) +* Michael Goddard (Google) +* Stephen Augustus (Cisco) +* Varun Sharma (StepSecurity) + +Welcome new faces + +* + +Project/Individual updates + +* Jeff / Allstar: Planning some docs overhaul + * Ex: [https://github.com/ossf/allstar/issues/336](https://github.com/ossf/allstar/issues/336) + * More updates are coming as well. +* + +Agenda + +* Laurent: structured results first PR [https://github.com/ossf/scorecard/pull/2584](https://github.com/ossf/scorecard/pull/2584) + * Reference (on convo re: API guarantees): [https://github.com/ossf/scorecard/issues/1683](https://github.com/ossf/scorecard/issues/1683) + * Question from Varun on use an existing standard of SARIF instead of a new format + * [https://docs.github.com/en/code-security/code-scanning/integrating-with-code-scanning/sarif-support-for-code-scanning](https://docs.github.com/en/code-security/code-scanning/integrating-with-code-scanning/sarif-support-for-code-scanning) + * +* Naveen : Action to the use API to get comments on updates on the dependencies changes. diff --git a/governance/meetings/2024.md b/governance/meetings/2024.md new file mode 100644 index 000000000000..f7c02b484ee3 --- /dev/null +++ b/governance/meetings/2024.md @@ -0,0 +1,1491 @@ +# OpenSSF Scorecard Meeting Archive — 2024 + +## Dec 12, 2024 + +Attendees + +* Spencer Schrock (Google) +* Jeff Mendoza (Kusari) +* Jeff Diecks (OpenSSF) +* Stephen Augustus (???) +* Avishay Balter (Microsoft) +* Kevin Dix (Boeing) + +New Attendees + +* Jeff Diecks + +Regrets + +* + +Announcements + +* Expect a minor or patch release upcoming with a collection of minor updates and fixes + * Scorecard \+ action +* + +Agenda + +* \[Spencer\] Using email for contributor data when organizations unavailable + * Trusts user-supplied git data, but the existing usage isnt much better + * Both GitLab and Azure DevOps suffer from this + * [https://github.com/ossf/scorecard/pull/4415](https://github.com/ossf/scorecard/pull/4415) + * [https://github.com/ossf/scorecard/pull/4437\#issuecomment-2521080469](https://github.com/ossf/scorecard/pull/4437#issuecomment-2521080469) + * Explore what forge alternatives look like + * Different behavior on different forges is reasonable +* \[Avishay\]: question about probes implementation ([https://github.com/ossf/scorecard/issues/3736](https://github.com/ossf/scorecard/issues/3736)) + * Proposal: Memory Safety Scorecard Checks — [https://github.com/ossf/Memory-Safety/issues/33](https://github.com/ossf/Memory-Safety/issues/33) + * Data isn’t purely binary, but on a continuum + * Probes support a `Values` map for more open ended data + * [https://github.com/ossf/scorecard/blob/2409124a2d48753e8030597f8ae85b6dbb275838/finding/finding.go\#L76-L80](https://github.com/ossf/scorecard/blob/2409124a2d48753e8030597f8ae85b6dbb275838/finding/finding.go#L76-L80) + * [https://github.com/ossf/scorecard/blob/2409124a2d48753e8030597f8ae85b6dbb275838/probes/hasRecentCommits/impl.go\#L76](https://github.com/ossf/scorecard/blob/2409124a2d48753e8030597f8ae85b6dbb275838/probes/hasRecentCommits/impl.go#L76) +* Release cadence: + * Aiming to have a maximum time between releases as 2 months if there are no pressing fixes/features to release + * Thumbs up +* Meeting discussion + * Next meeting is 26th \- will cancel \- Jeff D will send a message to Reden + * EMEA is on Jan 6 Spencer is available. + * After that is Jan 9, seems ok. +* \[Jamie maybe?\] Azure DevOps e2e testing + * 2nd half. Sorry, I have a conflict the 1st half + * Working on implementation, almost all of client implemented, Spencer has reviewed + * E2e testing: should be an Azure sub in OpenSSF that we can create and Azdo org for free (5 user) + * Need to track down who on OpenSSF has access \- Jeff D will ask around and report back in Slack + * Azure Devops task \- equivalent to GitHub action, PoC working for running Scorecard + * Main focus is completing client and hoping for a release + * Would be good to update the issue([https://github.com/ossf/scorecard/issues/4177](https://github.com/ossf/scorecard/issues/4177)) with an update (this update) to also get any feedback from those following it. + * We may wish to get the code merged before complete to attract contributors, Jamie is close to completion. + * What check is being targeted with Azure Pileines? + * The task is for running Scorecard as a part of the build + * A Pipeline check (such as pinned deps in pipeline yaml) would be a subsequent effort + +## Dec 9, 2024 + +Attendees + +* Spencer Schrock (Google) +* + +New Attendees + +* M Atif Ali (Coder) + +Regrets + +* + +Announcements + +* + +Agenda + +* StepSecurity harden runner paid license? + * Make sure we aren’t scoring based on paid products +* Vuln check + * Some vulns in dev dependencies vs production + * Some indirect dependencies we cant patch directly + * May be able to ignore it with osv-scanner config + * [https://google.github.io/osv-scanner/configuration/](https://google.github.io/osv-scanner/configuration/) +* Fuzzing Check (question) + * What about in Go? + [https://go.dev/doc/tutorial/fuzz](https://go.dev/doc/tutorial/fuzz) +* + +## Nov 14, 2024 + +Attendees + +* Raghav Kaul (Google) +* Allen Shearin (Lockheed Martin) +* Spencer Schrock (Google) +* Hannah Sutor (GitLab) + +New Attendees + +* Amar Takhar (RTEMS Project) + +Regrets + +* + +Announcements + +* Moving scorecard-action image from GCR \-\> GHCR + +Agenda + +* Roadmap/Status +* Overzealous stale issue bot ran this week + * Closed a few open PRs, including one Spencer needs to unblock +* Publishing Scorecard results from GitLab + * Contributors Check doing searching? + * [https://github.com/ossf/scorecard/blob/fee8bcf77eff639b1be4272f11b1bc66de8594a3/clients/gitlabrepo/contributors.go\#L78-L85](https://github.com/ossf/scorecard/blob/fee8bcf77eff639b1be4272f11b1bc66de8594a3/clients/gitlabrepo/contributors.go#L78-L85) + * We need to explore CI Components, but that wouldn’t help with self hosted GitLab? + * [https://github.com/ossf/scorecard-webapp/issues/561](https://github.com/ossf/scorecard-webapp/issues/561) + * API struggles with subroutes, but our library has limitations here + * [https://github.com/ossf/scorecard-webapp/issues/511](https://github.com/ossf/scorecard-webapp/issues/511) + * How to visualize a bunch of projects? + * There is some markdown \+ json tooling meant for GitHub, maybe can be adapted? + * [https://github.com/ossf/scorecard-monitor](https://github.com/ossf/scorecard-monitor) + * Previous subgroup fix (due to owner/repo splitting around `/`) + * [https://github.com/ossf/scorecard-webapp/pull/701](https://github.com/ossf/scorecard-webapp/pull/701) + * What is the end goal with submitting Scores? + * Anything to selfhost? + * [https://github.com/ossf/scorecard-webapp](https://github.com/ossf/scorecard-webapp) + * How to deal with regressions? + * Scorecard Action uploads some SARIF to GitHub’s security dashboard + * Allstar as GitHub app supports filing issues, but again GitHub specific + * GitLab SARIF upload in the works?: + * [https://gitlab.com/gitlab-org/gitlab/-/issues/452042](https://gitlab.com/gitlab-org/gitlab/-/issues/452042) + * Conformance reports + * What’s the output format like? + * Here’s a blog on custom policy, but light on concrete details [https://openssf.org/blog/2024/04/17/beyond-scores-with-openssf-scorecard-granular-structured-results-for-custom-policy-enforcement/](https://openssf.org/blog/2024/04/17/beyond-scores-with-openssf-scorecard-granular-structured-results-for-custom-policy-enforcement/) + * Video form + * [Structured Scorecard Results: Tailor Your Own Supply-Chain... - Adam Korczynski & David Korczynski](https://www.youtube.com/watch?v=ZT3XdMF6U5A) + * + +## Nov 11, 2024 + +Attendees + +* Spencer Schrock (Google) +* Michael Winser (Eclipse Foundation) + +New Attendees + +* + +Regrets + +* + +Announcements + +* + +Agenda + +* What is Scorecard’s roadmap and status today? +* What is Allstar story, and alignment with Otterdog and Minder +* Lots of data sets out there, between osv.dev deps.dev, scorecard, etc. + * Produce some csv dump to location to enable analysis at scale. + * Has happened for research partners before, could happen again + * Would need to talk to OpenSSF + * Relatively easy to join them together + * Attestations of these data +* + +## Oct 31, 2024 + +Attendees + +* Jeff Mendoza (Kusari) +* Allen Shearin (Lockheed Martin) +* Evan Anderson (Stacklok) +* Eddie Knight (Sonatype) +* Raghav Kaul (Google) +* Kevin Dix (Boeing) + +New Attendees + +* + +Regrets + +* + +Announcements + +* + +Agenda + +* [https://github.com/ossf/scorecard/pull/4391](https://github.com/ossf/scorecard/pull/4391) + * LFX insights needs to consume output of probes + * Related: [https://github.com/ossf/scorecard/pull/4020](https://github.com/ossf/scorecard/pull/4020) + * Related issue: do we always know if the result of a probe is true or false equals bad or good? Not currently? Depends on name of probe? + * Usually having a “remediation” is bad + * +* [https://github.com/ossf/scorecard/pull/4398](https://github.com/ossf/scorecard/pull/4398) + * Will rebase after the above is merged, as this includes those changes + * + +## Oct 17, 2024 + +Attendees + +* Allen Shearin (Lockheed Martin) +* Spencer Schrock (Google) +* Jeff Mendoza (Kusari) +* Jamie Magee (Microsoft) +* Stephen Augustus (Cisco) +* Kevin Dix (Boeing) + +New Attendees + +* Tom Hennen (Google) + +Regrets + +* + +Announcements + +* + +Agenda + +* \[Tom Hennen\] [SLSA and Scorecards](https://github.com/ossf/scorecard/issues/3352#issuecomment-2417737004)?? + * SLSA source track attestations + * Attestations are forge/VCS agnostic + * Refer to specific revisions (for git is a ref either commit or branch) + * Scorecard is very git and GitHub/GitLab specific. Is that a problem? + * No, there can be multiple attestors + * Differences/similarities to OpenSSF security baseline? + * Would a derivative VSA work, if Scorecard has their own predicate type? + * Not really, we need some sort of authority to be producing these VSAs + * SLSA also wants the VSA to be a standard predicate type so that downstream users don’t need to understand every possible predicate type that might attest to these things ([some background here](https://docs.google.com/presentation/d/1_1ikfSaja87-Qx2ev26DYdiNgS6AEvVFO92oSwNGvJ8/edit)). + * CLI could produce a VSA, signed with Sigstore (OIDC?) + * Better than what exists today (nothing) + * Trusted workflow, which calls scorecard, and does the mapping to L2, and produces a VSA? +* Need review: [https://github.com/ossf/allstar/pull/582](https://github.com/ossf/allstar/pull/582) (thanks) +* \[Jamie Magee\] Azure DevOps + * [https://github.com/ossf/scorecard/issues/4177](https://github.com/ossf/scorecard/issues/4177) + * [https://github.com/ossf/scorecard/pull/4377](https://github.com/ossf/scorecard/pull/4377) + * How do we handle these self hosted and non-standard configurations? + * AZDO Tasks / GitHub Actions analogue + * Running Scorecard in a pipeline, to produce SARIF output + * Container specific logic, unique to GitHub Actions + * But SARIF is supported + * But AZDO specific analysis is an angle too + * [https://github.com/ossf/scorecard/issues/4380](https://github.com/ossf/scorecard/issues/4380) + * And similar for DangerousWorkflows + * Can the task be in the marketplace? + * Discoverability is one thing, from the OpenSSF + * [Extensions for Visual Studio family of products | Visual Studio Marketplace](https://marketplace.visualstudio.com/azuredevops) + +## Oct 14, 2024 + +Attendees + +* CRob (OpenSSF) +* Zach Steindler (GitHub) +* Edward Thomson (Stacklok) +* Jakub Hrozek (Stacklok) +* Raghav Kaul (Google) + +New Attendees + +* CRob \- new OSSF architect and BEST WG rep; seeking to get better engaged with project +* Edward Thomson \- PM for Minder; looking to foster closer collab with Scorecard team +* Jakub Hrozek \- project member of Minder, here to answer technical questions +* Zach S \- new TAC chair + +Regrets + +* + +Announcements + +* SOSS Fusion \- Scorecard workshop +* Two talks at Fusion about Scorecard + +Agenda + +* Welcome / Introductions +* How are things going? What’s going well? What help do you need? + * High-level \- released v5 w/ structured results and maintainer annotations ; still looking for feedback. Structured Results may be a feature users don’t fully understand yet. Hopefully will help it easier to write a new probe or to pick-and-choose probes to use (narrow focus for viewer) + * Can now accept new probes (SBOM probe, as an example). + * Not sure users are getting value out of this feature yet though + * Zach \- notices that there are lots of open issues; this is a sign that the project is generating a lot of interest. Does the project feel they have enough folks to help with new features/work backlog? + * Raghav \- feels backlog is a nice indicator the project is useful and liked (RFEs, and other suggestions). We could use more help in addressing some of those. Can we build the community (this is the intent of the Scorecard Workshops). A PM would be very useful to help the team. + * Did backlog grooming last year and did a batch of updates, but the queue continues to grow. Not sure how to catch up with the pace of interest. + * Zach \- community demand might be outstripping team’s capacity + * CRob \- could leverage TAC’s TI Funding process to see about getting a project manager to assist in getting the backlog wrangled. [https://github.com/ossf/tac/blob/main/process/TI%20Funding%20Request%20Process.md](https://github.com/ossf/tac/blob/main/process/TI%20Funding%20Request%20Process.md) +* TAC PR for Scorecard moving up to Incubating Status [https://github.com/ossf/tac/pull/390](https://github.com/ossf/tac/pull/390) + * 15Oct TAC call at 11am ET this will be discussed + * +* + +## Oct 3, 2024 + +Attendees + +* Evan Anderson (Stacklok) +* Jeff Mendoza (Kusari) +* Spencer Schrock (Google) +* Hannah Sutor (GitLab) +* Eddie Knight (Sonatype) +* Jeff Diecks (OpenSSF) +* Kevin Dix (Boeing) +* Raghav Kaul (Google) +* + +New Attendees + +* + +Regrets + +* + +Announcements + +* + +Agenda + +* OpenSSF GCP budget, lots of container egress costs + * GitHub package registry + * Container egress comes from pulling down the image from GCR(GCP) + * Idea: try using GHCR instead of GCR + * New action version will contain the change +* Webapp + * Better imposter commit verification in the works ([PR](https://github.com/ossf/scorecard-webapp/pull/682)) +* Updates on adding probes to replace clomonitor + * Steering committee met and are ok with accepting these probes, see slack messages in \#scorecard +* [Minder contribution](https://github.com/ossf/tac/pull/386) – hello, and how do we relate (vis-a-vis Scorecard and AllStar)? + * ([overview](https://docs.google.com/presentation/d/1em0pdt-h-ghPdkmbklXw8_LvuQzo-gAxZ8NFVPQKkpQ/edit?usp=drive_link) presented to TAC) + * Q: possibility for app to be “read-only” + * Yes, some design and possibilities here + * Split remediation app from scanning app + * Possibly even keep queue of remediations and apply async from a GitHub Action or even from desktop + * Evan: Scorecard is a measuring stick + * Spencer: scorecard is trying to be a home for analyses, and then you can choose which ones to measure yourself from + * Evan: Scorecards also has the “public observations” data set, which seems like it’s been useful from e.g. Tidelift + * Jeff: If a user approaches OpenSSF and says “how do I strengthen my security”, how do they decide between Minder and Scorecards? + * Need a clear rubric between the two. + * How does Scorecards relate to private repos? + * Doesn’t centrally report on private repos, but can run a lot of the checks locally. + * Would be nice to have a flow chart or wizard to help choose + * Jeff: AllStar and Minder – harder to square the message here + * How to choose between installing AllStar and Minder on an org I manage. + * What does the Venn Diagram of these three projects look like? + * Scorecard Universe (CLI, action, API, monitor, visualizer) + * Allstar + * Minder + +## Sep 19, 2024 (Pacific) + +Attendees + +* Jeff Mendoza (Kusari) +* Raghav Kaul (Google) +* Spencer Schrock (Google) +* Eddie Knight (Sonatype) + +New Attendees + +* + +Regrets + +* (many are at OSS EU \- Vienna) + +Announcements + +* + +Agenda + +* CNCF usage of Scorecard + * Clomonitor is being sunset + * Needing to work with LFX insights + * LF Baseline SIG + * Good starting point from OpenJS foundation + * Scorecard is already checking for many things on the baseline + * (and some things which aren’t in the baseline) + * LFX Insights question: Hard to check things that are not already in Scorecard + * Adding things to scorecard. Lots of checks, may not agree with everything + * Bring us back to “scorecard is a linter” [viewpoint](#2024-05-30-\(pacific\)) + * Question about effort to both write the checks and maintain them + * Need to have some guidelines from Scorecard team on what we want + * + * Probe vs Check: + * Check results in a score + * Probe are distinct characteristics that get compiled into a check + * Probes can be added and then be available in structured results + * Lower bar for accepting new Probes, they don’t affect score + * Higher bar for checks, possibly not all on by default + * Will just a probe be enough for LFX to ingest results? + * LFX insights likely running Scorecard itself + * Probes: [https://github.com/ossf/scorecard/blob/main/docs/probes.md](https://github.com/ossf/scorecard/blob/main/docs/probes.md) + * What sort of checks are missing? + * (some spreadsheet) + * Are they all automated? + * Yes and no, but for the self-attesting parts are declared in security insights. + * Concerns over which data is self-attested or not? + * We don’t have many self-attested data now. Just the OpenSSF Best Practices badge. + * How do we get this merged by November? + * Steering committee can discuss the addition of CLOmonitor \-esque probes + * Confirmation that LFX Insights will run the analysis and can see the probes + * Steering Committee will meet on this topic and raise any new concerns to Eddie if needed + +## Sep 16, 2024 (EMEA) + +Attendees + +* Raghav Kaul (Google) + +New Attendees + +* Cristian Urlea \- University of Glasgow + +Regrets + +* + +Announcements + +* + +Agenda + +* Multiparty session types discussion + * Links + * [https://dsbd-morello-hat.github.io/](https://dsbd-morello-hat.github.io/) + * [https://dsbd-appcontrol.github.io/](https://dsbd-appcontrol.github.io/) + * [https://www.cl.cam.ac.uk/research/security/ctsrd/cheri/](https://www.cl.cam.ac.uk/research/security/ctsrd/cheri/) + * [http://mrg.doc.ic.ac.uk/publications/a-very-gentle-introduction-to-multiparty-session-types/main.pdf](http://mrg.doc.ic.ac.uk/publications/a-very-gentle-introduction-to-multiparty-session-types/main.pdf) + * [https://kar.kent.ac.uk/43737/1/BCDHY13.pdf](https://kar.kent.ac.uk/43737/1/BCDHY13.pdf) + +## Sep 5, 2024 (Pacific) + +Attendees + +* Lelia Bray-Musso (Cisco) +* Jeff Mendoza (Kusari) +* Allen Shearin (LMCO) +* Stephen Augustus (Cisco) +* Hannah Sutor (GitLab) + +New Attendees + +* + +Regrets + +* + +Announcements + +* + +Agenda + +* \[lelia\] Discuss [https://github.com/ossf/scorecard/issues/4333](https://github.com/ossf/scorecard/issues/4333) + * Working on this with Allstar, want to have something more formal by \~SOSS Fusion + * Can run Scorecard with a PAT or app token (some limitations) + * Experimental wrapper code around Scorecard \- could turn into real feature? + * Re: Allstar + * Good for configuring on per-repo, per-org basis, but no good way to report + * There’s also Scorecard Monitor to help with org-level reporting + * What are the right paved paths? + * End state: What does a GitHub App installation look like for Scorecard? + * Allstar can do that today, but not a paved path yet + * If we have entrypoint into Scorecard using GH App credential, if we could do that for GitLab too, that would be great. + * Group Access Token \= GitLab equivalent + * Would be ideal to provide support for GitHub App \+ GitLab’s equivalent if we’re going to roll this out + * Could be possible to get access to Gitlab sandbox for support developing this +* For GitHub, what are different containers you can organize in? + * Multiple repos \-\> organization, app installed to entire org in single click w/ permissions to run on all those repos + * From Enterprise POV: top level container \= Enterprise, which can contain many orgs, which can contain many repos \+ teams +* Do we have a higher level issue, do we want to start a new one? + * Let’s start with this, if it doesn’t exist already + * Lelia to make issue for top-level ask to improve Scorecard experience for multi-org/many repo use case, link to above issues and any related + * **Done: [https://github.com/ossf/scorecard/issues/4339](https://github.com/ossf/scorecard/issues/4339)** +* \[hannah\] How is the backlog going? + * Lelia \- We got through the spreadsheet. I’ve been doing it where I can. + * Stephen \- Spreadsheet was things that were old, incorrectly scoped, etc + * We have been chatting amongst ourselves on the steering side for defined path forward for the triager. We need to define that. Part of the journey on the way to contributing to Scorecard. + * Infrastructure contributor role to be defined + * Now that contributor ladders from various Scorecard/OSSF projects have been merged, need to review language for accuracy and come up with more defined roles for triagers + * Lelia \- The other thing about the contributor ladder is that the end state is that you’re a technical maintainer or infra person or whatever. You could be coming into it from being more on the Product side of things. All of those things I don’t believe you’d need maintainer access for. We could have a different type of graduation ladder. + * Triager has the triage permission in GitHub but could be more + * Always a challenge in OS to give visibility to the “glue work” /non-code contribution + * Lelia \- I can file an issue where we say that the triager does not have a clear ladder and I can tag you, Hannah, so you can add context + * **Done: [https://github.com/ossf/scorecard/issues/4338](https://github.com/ossf/scorecard/issues/4338)** +* Hannah: Are there any Scorecard specific activities at SOSS Fusion? + * Stephen: Details to come, pretty sure the answer is “yes” + +## Aug 22, 2024 (Pacific) + +Attendees + +* Spencer Schrock (Google) +* Jeff Mendoza (Kusari) +* Lelia Bray-Musso (Cisco) +* Avishay Balter (Microsoft) + +New Attendees + +* Tobias Heldt (tobias@cyberfame.io) + +Regrets + +* + +Announcements + +* + +Agenda + +* (Spencer) Looking at scalability for the weekly scan infrastructure + * Currently at 95% capacity + * Not much changes week to week though\! + * 3.3% changed in the last week (current weekly scan cadence) + * 6.9% changed in the last month + * 18.2% changed in the last year + * 50% changed in the last 3.4 years + * Any benefit for reducing current list of projects? + * Scorecard action installed? + * Renamed projects? + * Deleted projects? + * Archived projects? + * +* (Jeff) Self-hosted GitHub Enterprise support PR in Allstar + * [https://github.com/ossf/allstar/pull/559](https://github.com/ossf/allstar/pull/559) + * Any comments appreciated + * Testing can be a problem for GHES and maintaining Scorecard + * Cisco has a GHES instance and may be able to test some things? +* (avishay) increase support in nuget ecosystem over the next month or so + * Better powershell support [https://github.com/ossf/scorecard/issues/4253](https://github.com/ossf/scorecard/issues/4253) + * Any good Go library for powershell parsing? + * Csprojec restore locked mode [https://github.com/ossf/scorecard/issues/4251](https://github.com/ossf/scorecard/issues/4251) + * Can we do post-processing if we detect a relevant file and marked unpinned to pin? + * Consider nuget projects as pinned [https://github.com/ossf/scorecard/issues/4252](https://github.com/ossf/scorecard/issues/4252) + * [https://devblogs.microsoft.com/nuget/building-a-safer-future-how-nuget-is-tackling-software-supply-chain-threats/](https://devblogs.microsoft.com/nuget/building-a-safer-future-how-nuget-is-tackling-software-supply-chain-threats/) + * Similar to Go, using a package version has immutability even if not pinned +* + +## Aug 8, 2024 (Pacific) + +Attendees + +* Allen Shearin (Lockheed Martin) +* Stephen Augustus (Cisco) +* Spencer Schrock (Google) +* Jeff Mendoza (Kusari) +* Joe Coyle (Lockheed Martin) +* Sarah Elder (NCSU) +* + +New Attendees + +* Kevin Dix (Boeing) + * Product security lead architect + +Regrets + +* Lelia Bray-Musso (Cisco) + +Announcements + +* + +Agenda + +* Allstar re-deploy + * No updates, work continues +* Spencer working on making Scorecard Action use the new Scorecard library entrypoint + * Reduce API consumed, as noted in [https://github.com/ossf/scorecard-action/issues/1071](https://github.com/ossf/scorecard-action/issues/1071) +* Check ID PR + * [https://github.com/ossf/scorecard/pull/4021](https://github.com/ossf/scorecard/pull/4021) + * Spener to make an issue about current breaking cron output changes + * Allen can back out the cron specific output so we can merge partially and coordinate the rest in the issue + +## Jul 25, 2024 (Pacific) + +Attendees + +* Lelia Bray-Musso (Cisco) +* Dana Wang (OpenSSF) +* Spencer Schrock (Google) +* Caroline Lee (IBM) +* Anjlica Malla (Goldman Sachs) +* Jeff Mendoza (Kusari) +* Sarah Elder (NCSU) +* Stephen Augustus (Cisco) + +New Attendees + +* Nell Shamrell-Harrington (Microsoft) + +Regrets + +* Ulises Gascón (One Beyond) +* Teba Gomez (Whalar) + +Announcements + +* \[Spencer\] Scorecard [V5 launched](https://github.com/ossf/scorecard/releases/tag/v5.0.0). Scorecard Action release today/tomorrow +* \[Jeff\] Allstar is updating to scorecard.Run() before releasing with V5 + * \[Stephen\] Also trying to improve operations for both Scorecard and Allstar + * Feedback for how these products are/aren’t working for you: [https://github.com/ossf/allstar/issues/528](https://github.com/ossf/allstar/issues/528) + +Agenda + +* \[Nell\] Proposal to add checks for Scorecard for different language ecosystems with re: to memory safety best practices + * Some prior discussion on this [GitHub issue](https://github.com/ossf/scorecard/issues/3736), but the conversation went stale some time ago + * Want to know whether this is something we would like the Memory Safety SIG to continue to pursue or something the SIG should bring to Scorecard later + * Have been compiling a list of best practices for memory safe / non memory safe by default languages. + * Active work on increasing configurability of Scorecard, getting away from requiring every repo to run every check, moving towards probes + * Doing analysis on memory safety makes sense, probes may be a good way to play around with that, Spencer can point in the right direction on how to get started + * Independent Probes + * [https://github.com/ossf/scorecard/pull/4052](https://github.com/ossf/scorecard/pull/4052) + * Non-goal to suggest rewriting a project in a memory-safe language + * To make this a maintainable reality, would require language / ecosystem SMEs in order to achieve parity + * Additional resources: + * [https://github.com/ossf/Memory-Safety/blob/main/docs/best-practice-memory-safe-by-default-languages.md](https://github.com/ossf/Memory-Safety/blob/main/docs/best-practice-memory-safe-by-default-languages.md) + * [https://github.com/ossf/Memory-Safety/blob/main/docs/best-practice-non-memory-safe-by-default-languages.md](https://github.com/ossf/Memory-Safety/blob/main/docs/best-practice-non-memory-safe-by-default-languages.md) +* \[Lelia\] Do we need to fix the instructions [at the top of this doc](#meeting-info) re: google group to join? + * I joined [ossf-scorecard-announce@googlegroups.com](mailto:ossf-scorecard-announce@googlegroups.com) for edit access, but the correct group appears to be [ossf-scorecard-dev@googlegroups.com](mailto:ossf-scorecard-dev@googlegroups.com) + * Already fixed at the top of the doc + * Request to OpenSSF Staff: Can we make another group owner for the doc? + * Reach out in operations Slack channel + * Should we audit this? + * Not sure if multiple Google doc owners is possible +* \[Jeff\] + * Scorecard as a library example documentation: + * Do we have any? + * Where would be a good place? + * (I wrote up this example: [https://github.com/ossf/scorecard/issues/4254\#issuecomment-2250953095](https://github.com/ossf/scorecard/issues/4254#issuecomment-2250953095)) + * Currently Run() is buried under the Result type here: [https://pkg.go.dev/github.com/ossf/scorecard/v5@v5.0.0/pkg/scorecard\#Run](https://pkg.go.dev/github.com/ossf/scorecard/v5@v5.0.0/pkg/scorecard#Run) + * We want to bring our docs together as closely as possible + * A library consumer how-to doc would be worthwhile + * Can take some of it from [https://github.com/ossf/scorecard/issues/3717](https://github.com/ossf/scorecard/issues/3717) + * “Existing callers don’t need to change their signature, but those that want to customize the behavior can:” + * Putting it in the go package documentation at the top seems reasonable, as long as we include a call-out to it in the README + * Start with putting it as close to the code as possible, then make a more consumer-friendly markdown document \- Jeff to create a 2-step issue for this + * New issue to capture this discussion: [https://github.com/ossf/scorecard/issues/4258](https://github.com/ossf/scorecard/issues/4258) +* \[Dana\] security baseline update if time permits + * [OpenSSF Security Baseline](https://github.com/ossf/tac/blob/main/process/security_baseline.md) was officially established as an OpenSSF security standard as of July 23\. The baselines for sandbox are part of the TAC project lifecycle operating model. Baselines for incubating and graduated are in the process of being incorporated into the operating model. + * Document needs optimization \- want to take Scorecard approach of making everything referenceable + * Adoption tracking has been challenging \- 4 projects piloting, some are sandboxed + * Flexibility in enabling vs enforcing \- On the enterprise level, enforcing means any org within enterprise will kick out members without 2FA enabled + * Start with enablement to give opportunity for compliance, *then* enforce it + * Larger conversation around what integration looks like for various Scorecard/OSSF projects, identifying overlap in checks that CLOMonitor vs Scorecard are running + * [Adoption tracking](https://docs.google.com/spreadsheets/d/1LCLpN1Hgx7C9M9KNuvH5aN5vukYPmxrq_1dUQrDhnco/edit?gid=818010490#gid=818010490) has started, would like to hear the feedback from Scorecard for how to automate the tracking. + * Put Scorecard on the list of pilot projects, working towards incubating status + * Difficult to establish a clear baseline for whether projects are meeting requirements + * Wondering if Scorecard structured results can help with this + * Open question on Security Insights adoption \- not sure it’s recognized on GitHub API level. How to come into compliance with something you’re not informed of? + * CNCF projects using security insights significantly more than OSSF (only GUAC) + * Provide people with clear instructions, if they want to do it themselves, that’s great, or else we can do it on your behalf \- prioritize self-service and discoverability + * [Security baseline SIG](https://github.com/ossf/security-baseline) was established + * OK to add Scorecard to the list of [pilot projects](https://github.com/ossf/security-baseline) +* \[Dana\]if time permits, update on [architecture document draft](https://github.com/Danajoyluck/security-baseline/blob/Danajoyluck-patch-1/architecture/architecture/consumption-architecture-dependency-management.md) that includes the work of Allstar and Scorecard + * Take a look and give feedback if anything about Scorecard is misrepresented + * Best way to provide feedback? Dana to create draft PR for comments +* \[Anjlica\] Has there been talk about enhancing one of the probes with activity committed? + * Name of probe is “has-recent-commits” + * Currently has binary response, any plan to enhance beyond a binary check? + * To some extent it is slightly more than binary already + * [https://github.com/ossf/scorecard/blob/ea7e27ed41b76ab879c862fa0ca4cc9c61764ee4/probes/hasRecentCommits/impl.go\#L40-L41](https://github.com/ossf/scorecard/blob/ea7e27ed41b76ab879c862fa0ca4cc9c61764ee4/probes/hasRecentCommits/impl.go#L40-L41) + * Willing to contribute to this + * There might be an issue already for this, it’s slightly more than binary already + * Please feel free to open an issue for clarification, can discuss async, we can re-discuss at the next meeting as an agenda item if not resolved by then + * + +## Jul 11, 2024 (Pacific) + +Attendees + +* Jeff Mendoza (Kusari) +* Lelia Bray-Musso (Cisco) +* Spencer Schrock (Google) +* Caroline Lee (IBM) +* Allen Shearin (LM) +* Sarah Elder (NCSU) +* Raghav Kaul (Google) +* Dana Wang (OpenSSF) + +New Attendees + +* + +Regrets + +* Stephen Augustus +* Ulises Gascón (One Beyond) +* Teba Gomez (Whalar) + +Announcements + +* Scorecard v5 release imminent ( O(days) ) + * Should be feature complete + * Drafting release notes now + +Agenda + +* \[Dana\] OpenSSF [Security Baseline](https://github.com/ossf/tac/blob/a87572b75025e136bd951c3048c699003bb1a91b/process/security_baseline.md) has been [submitted](https://github.com/ossf/tac/pull/353) to the [TAC](https://github.com/ossf/tac) + * Dana to attend today’s session — share motivation for the security baseline, discuss Scorecard’s involvement, get support promoting within the Scorecard universe + * Scorecard is sometimes a measurement tool, and sometimes the requirement + * Scorecard does some of this analysis already and allows the OpenSSF to monitor for regressions + * Allstar would work well for regression, if you trust the public instance + * After review, get some existing OpenSSF projects to try out the baseline + * Later try to get some other LF foundations to try it out + * The security baselines are two part + * If projects have the resources to do the checks (in terms of maintainers) + * What the impact would be if the project were compromised (more adopted projects can impact more software) + * Security insights + * Currently only GUAC has it in their repo? + * (Related scorecard issues) [https://github.com/ossf/scorecard/issues/2305](https://github.com/ossf/scorecard/issues/2305) + * Vulnerability check may be a partial measure, but not complete measure + * How to measure the impact of Scorecard over time in terms of scorecard severity (Critical, High, Medium, etc) + * Related dashboard work, Scorecard TSC needs to discuss + * Have you considered Scorecard Monitor? + * [https://github.com/ossf/scorecard-monitor](https://github.com/ossf/scorecard-monitor) + +## Jun 27, 2024 (Pacific) + +Attendees + +* Ulises Gascón (One Beyond) +* Allen Shearin (Lockheed Martin) +* Spencer Schrock (Google) +* Raghav Kaul (Google) +* Adrianne Marcum (OpenSSF) +* Sarah Elder (NCSU) + +New Attendees + +* + +Regrets + +* Jeff Mendoza \- at CloudNativeSecurityCon +* Teba Gomez (Whalar) + +Announcements + +* New version of the Scorecard Monitor [https://github.com/ossf/scorecard-monitor/releases/tag/v2.0.0-beta8](https://github.com/ossf/scorecard-monitor/releases/tag/v2.0.0-beta8) 🎉 +* V5 “soon”, some open PRs + +Agenda + +* Aggregating Scorecard scores across a dependency tree (NCSU Research Project) + * Survey request? Or results? + * Data still being processed +* + +## Jun 24, 2024 (EMEA) + +Attendees + +* Adrianne Marcum (OpenSSF) +* Sarah Elder (NCSU) + +New Attendees + +* Gergely Csatari (Nokia) +* Shivam Agarwal (Nokia) + + + +Regrets + +* Ulises Gascón (One Beyond) +* Teba Gomez (Whalar) + +Announcements + +* + +Agenda + +* CI Check \- how to ensure that CI checks were actually ran and passed? [https://github.com/ossf/scorecard/issues/4191](https://github.com/ossf/scorecard/issues/4191) + * ([https://openssf.slack.com/archives/C0235AR8N2C/p1714376086115049](https://openssf.slack.com/archives/C0235AR8N2C/p1714376086115049)) + * From Zoom chat: how can we get the logs for each commit for ci-tests? + * CI check doesn’t run in the cron job +* Security policy check \- would it be possible to check for security policies somewhere else than in the SECURITY.md? + * [https://github.com/ossf/scorecard/issues/4192](https://github.com/ossf/scorecard/issues/4192) + +## Jun 13, 2024 (Pacific) + +Attendees + +* Jeff Mendoza (Kusari) +* Spencer Schrock (google) +* Sarah Elder (NCSU) +* Alex Klevans (NCSU) +* Raghav Kaul (Google) + +New Attendees + +* Teba Gomez (Whalar) +* Ulises Gascón (One Beyond) +* Annie Mao (Google) +* Chris de Almeida (IBM) + +Regrets + +* Stephen Augustus (Cisco) +* Lelia Bray-Musso (Cisco) +* Hannah Sutor (GitLab) + +Announcements + +* The OSSF Scorecard Visualizer ([https://github.com/ossf/scorecard-visualizer](https://github.com/ossf/scorecard-visualizer)) donation has finished +* The OSSF Scorecard Monitor ([https://github.com/ossf/scorecard-monitor/issues/79](https://github.com/ossf/scorecard-monitor/issues/79)) donation has finished + +Agenda + +* Scorecard Visualizer redirection issue +* Scorecard Monitor GH Marketplace publication agreement +* Lelia as triager: [https://github.com/ossf/scorecard/issues/4136](https://github.com/ossf/scorecard/issues/4136) + * Any maintainer objections? + * Note: Adrianne noticed that the triager role still does not allow label editing/creation, so this will be a continued limitation w/r/t issue triaging. + * I (Lelia) won’t be able to attend this week’s sync due to an ongoing outage with my ISP, but let me know if I need to take any action to move the nomination forward, thanks\! +* Tsunami ([https://github.com/google/tsunami-security-scanner](https://github.com/google/tsunami-security-scanner)) + * Intersection with Scorecard, add probes/checks for these AI/ML related checks? + * Ideally automated analysis of the repo, as well as analysis of the software runtime behaviour and/or their security feature/control + * POC + +| Software | Category | Auth Supported | Can be Internet Exposed | Actively Exploited | Testing Range | Scanning Solution | +| :---- | :---- | :---- | :---- | :---- | :---- | :---- | +| [PyTorch Serve](https://github.com/pytorch/serve) | Model Serving | Yes | Yes\* (only the latest version with token based auth) | Yes | | [Tsunami PytorchServe Exposed API Detector](https://github.com/google/tsunami-security-scanner-plugins/blob/27727598d9fe0fcf2e20c96bdfd0050e91a3c97a/google/detectors/exposedui/pytorch_serve/src/main/java/com/google/tsunami/plugins/detectors/exposedui/pytorchserve/PytorchServeExposedApiDetector.java#L64) | +| [Ray](https://github.com/ray-project/ray) | Model Serving | No | No, RCE by design | Yes | | [Tsunami Ray Exposed UI Detector for CVE-2023-48022](https://github.com/google/tsunami-security-scanner-plugins/blob/27727598d9fe0fcf2e20c96bdfd0050e91a3c97a/google/detectors/rce/ai/cve202348022/README.md) [Tsunami Ray Detector for CVE-2023-6019](https://github.com/google/tsunami-security-scanner-plugins/blob/27727598d9fe0fcf2e20c96bdfd0050e91a3c97a/google/detectors/rce/ai/cve20236019/README.md) | +| [MLflow](https://github.com/mlflow/mlflow) | Model Serving | Yes | Yes\* (only newer versions) | ??? | | [Tsunami MLflow Detector for CVE-2023-1777](https://github.com/google/tsunami-security-scanner-plugins/blob/master/community/detectors/mlflow_cve_2023_1177/README.md?plain=1) [Tsunami MLflow Detector for CVE-2023-6014](https://github.com/google/tsunami-security-scanner-plugins/blob/master/community/detectors/mlflow_cve_2023_6014/README.md) | +| [Tensorflow Serving](https://github.com/tensorflow/serving) | Model Serving | No | Maybe (if inference should be publicly accessible) | ??? | | | +| [H2O](https://github.com/h2oai/h2o-3) | Model Serving | Yes | Yes\* | ??? | | [Tsunami H2O Exposed UI Detector](https://github.com/google/tsunami-security-scanner-plugins/blob/master/google/detectors/rce/ai/cve20236018/src/main/java/com/google/tsunami/plugins/cve20236018/Cve20236018Detector.java) | +| [Argo Workflow](http://github.com/argoproj/argo-workflows) | Workflow Management | Yes | Yes\* | ??? | | [Tsunami Argo Workflow Exposed UI Detector](https://github.com/google/tsunami-security-scanner-plugins/blob/master/google/detectors/exposedui/argoworkflow/src/main/java/com/google/tsunami/plugins/detectors/exposedui/argoworkflow/ExposedArgoworkflowDetector.java) | +| [Argo CD](https://github.com/argoproj/argo-cd) | CI/CD | Yes | Yes\* | ??? | | Tsunami plugin in development | + + * Open an issue to discuss possibilities + * May know more after Codename Internet CTF launches in July? Currently we are setting up securely and vulnerable configurations of OSS at [https://github.com/google/security-testbeds](https://github.com/google/security-testbeds) + * Potentially collaborate with Best Practice group to provide best practice guidelines for configuring the AI related software +* Having both Scorecard Visualizer and the webapp “viewer” + * Upcoming UX work + * Known issues in scorecard-webapp + +## 2024-05-30 (Pacific) {#2024-05-30-(pacific)} + +Attendees + +* Lelia Bray-Musso (Cisco) +* Allen Shearin (LM) +* Spencer Schrock (Google) +* Stephen Augustus (Cisco) +* Jeff Mendoza (Kusari) +* Sarah Elder (NCSU) +* Alex Klevans (NCSU) + +New Attendees + +* + +Regrets + +* Adrianne Marcum (OpenSSF) +* Hannah Sutor (GitLab) +* Lauri Apple + +Announcements + +* Allstar is developed as a part of the [OpenSSF Scorecard](https://github.com/ossf/scorecard) project. + * [https://github.com/ossf/allstar?tab=readme-ov-file\#what-is-allstar](https://github.com/ossf/allstar?tab=readme-ov-file#what-is-allstar) + * There’ll be more doc updates eventually, but we wanted to update obvious places now +* PR merged for letting people know who steering committee members are + +Agenda + +* \[Spencer\] Continue discussion of [OpenSSF Scorecard as a Supply Chain Linter](https://docs.google.com/document/d/1I5vtZWa0_64ruFP_MrSaTgzQrAHfh_NknA2feVOHdD4/edit?usp=sharing) + * Idea: Have a baseline/default set of checks that are universally consistent, allow further customization from there + * No specific feedback on the doc so far, but we may want to hold off until we have personas + * \[jeff\] Some previous thoughts: [Scorecard UX for Annotations and Configuration](https://docs.google.com/document/d/1CcJeIr3Uskj84uwFQQHu12wEKRoO55rkCo7FzBA6jsc/edit#heading=h.n318i9hjmace) + * This is an older doc, but is an example of prior art to show we’ve thought about this + * Has some persona categories there we can use for inspiration +* \[Lelia\] Scorecard personas update +* \[Lelia\] [“Needs discussion” issue](https://docs.google.com/spreadsheets/d/1UuKvZLlWyIMVkXIz1CqGWPYV__f0xssldbayUOqIs04/edit#gid=452836399) progress + * We have completed the “red” category (2021 or older) + * We should probably run this same exercise on Allstar in the future + * Scorecard also has two other repos: scorecard-action \+ scorecard-webapp + * If donation goes through, then we’ll need to go through it again\! + * We should look into label syncing between repos now that everything’s consolidating under ossf org + * Description of the labels should also be documented in the repo + * A lot of these labels are unique to scorecard, so not all of them need to be duplicated/synced across the org. Maybe just a set of generic ones? + * Dependencydiff code removal + * Consensus among present maintainers to remove deadcode + * actions/dependency-review-action has the functionality + * Spencer to comment and close / remove + * [Scorecard-dependency analysis](https://github.com/ossf/scorecard-dependencyanalysis) \<- candidate to be archived +* \[Lauri\] [Label descriptions](https://docs.google.com/spreadsheets/d/1UuKvZLlWyIMVkXIz1CqGWPYV__f0xssldbayUOqIs04/edit#gid=293611645) progress + * Lauri is unable to attend today, so we can continue this at a future session +* + +## 2024-05-16 (Pacific) + +Attendees + +* Spencer Schrock (Google) +* Jeff Mendoza (Kusari) +* Hannah Sutor (GitLab) +* Lelia Bray-Musso (Cisco) +* Stephen Augustus (Cisco) + +New Attendees + +* + +Regrets + +* + +Announcements + +* + +Agenda + +* \[Lauri\] [Label descriptions](https://docs.google.com/spreadsheets/d/1UuKvZLlWyIMVkXIz1CqGWPYV__f0xssldbayUOqIs04/edit#gid=293611645) progress + * Priority & urgency? +* \[Lelia\] [“Needs discussion” issue](https://docs.google.com/spreadsheets/d/1UuKvZLlWyIMVkXIz1CqGWPYV__f0xssldbayUOqIs04/edit#gid=452836399) progress +* \[Spencer\] [OpenSSF Scorecard as a Supply Chain Linter](https://docs.google.com/document/d/1I5vtZWa0_64ruFP_MrSaTgzQrAHfh_NknA2feVOHdD4/edit?usp=sharing) + * \[jeff\]Some previous thoughts: [Scorecard UX for Annotations and Configuration](https://docs.google.com/document/d/1CcJeIr3Uskj84uwFQQHu12wEKRoO55rkCo7FzBA6jsc/edit#heading=h.n318i9hjmace) +* \[Stephen\] Updates on survey things? + +## 2024-05-02 (Pacific) + +Attendees + +* Jeff Mendoza (Kusari) +* Adrianne Marcum (OpenSSF) +* Stephen Augustus (Cisco) +* Lelia Bray-Musso (Cisco) +* Lauri Apple +* Caroline Lee (IBM) +* Spencer Schrock (Google) +* Sarah Elder (NCSU) + +New Attendees + +* + +Regrets + +* + +Announcements + +* \[Jeff\] Allstar + * New release tomorrow (with v5 scorecard) + * Public instance is having reliability issues +* + +Agenda + +* \[Stephen\] Creating the Scorecard Universe: [https://github.com/ossf/scorecard/issues/4073](https://github.com/ossf/scorecard/issues/4073) + * Will anyone be joining from Scorecard Monitor and Scorecard API Visualizer? Yes, once the tasks outlined in the issue are underway, those maintainers will be pulled in more. + * Approval and permissions will be separated by area of expertise +* \[Lauri\] survey results \+ spreadsheet + * **AI:** bucket roles into top personas (soft-yes Adrianne and Lauri) + * **AI:** priority re: org size means prioritizing deployment as many orgs/repos as quickly as possible + * **AI:** tool should be useful for lay person, \# of sec supply chain startup folks should go down over time + * **AI:** badge factoring into decisions based on pressuring maintainers or not? + * Followup survey: Didn’t know about it, or know about it and you don’t want to advertise your score? One use case is private repos – don’t need a badge. + * **AI:** ask people what’s preventing them from using Scorecard–is the “unclear” stuff to blame? + * **AI:** Find out more about what does the badge mean to different audiences? + * **AI:** I wonder if any of the three "hasn't helped us" respondents offered to do user interviews? Find out if so, and follow up with them in those interviews; same for “hasn’t helped us”; for the 16.2% “not sure” can follow up later + * If you're using \[the X\], were you able to install Scorecard in less than 10 minutes? + * 77.3% said yes for CLI + * 68% said yes for GitHub Action; should focus on this to help highest number of checks run (66.7%) + * **Acceptable Rate of false negatives:** 73.5% said rate of 5% or less. But getting false negatives: + * SAST 37.9% + * Pinned Dependencies 17.9% + * Security Policy 17.2% + * Signed Releases 16% + * Vulnerabilities 14.3% + * Fuzzing 13.8% + * CI Tests 13.8% + * Token Permissions 12.5% + * Packaging 12% + * Dependency-Update-Tool 10.7% + * Code Review 10.3% + * Binary Artifacts 6.9% + * **Acceptable Rate of false positives:** 64.7% said rate of 5% or less. But getting false positives: + * Pinned Dependencies 26.9% + * SAST 25% + * Maintained 17.4% + * Signed-Releases 17.4% + * Dangerous Workflow 16.7% + * Dependency-Update-Tool 15.4% + * Vulnerabilities 15.4% + * CI Tests 14.3% + * Contributors 13% + * Packaging 13% + * Pinned Dependencies 11.5% + * Binary Artifacts 10.7% + * Fuzzing 10.7% + * Token Permissions 8.3% + * Branch Protection 7.1% + * **Unclear purpose** + * Dangerous workflow 75% + * This is interesting. Could be tracking issue about projects not interested in adopting Scorecard because “these checks have no value in my ecosystem.” Is this related? Could require docs embellishment. + * Confusion around “CRITICAL” rank/weighting + * [https://github.com/ossf/scorecard/issues/3990](https://github.com/ossf/scorecard/issues/3990) + * Binary Artifacts 58.8% + * Fuzzing 58.8% + * Webhooks 58.3% + * **Most important, Source** + * Code Review (9) + * Branch Protection (9) + * **Most important, Build** + * Token Permissions (18) + * Dangerous Workflow (14) + * Webhooks (26 in 3rd place) + * **Most important, Dependencies** + * Vulnerabilities (21) + * Dependency Update Tool + * Pinned Dependencies (20 in 3rd place) + * **Most important, Package and Miscellaneous** + * Maintained (10) + * CII-Best-Practices (9) + * Signed Releases (5) + * **Proposed checks, ranked by interest in:** + * Secret Scanning 122 points + * Security Audit 116 points + * Validates Domains 106 points + * 14 respondents were open to direct interviews; will follow up after deeper dive + +## 2024-04-29 (EMEA) + +Attendees + +* Adrianne Marcum (OpenSSF) +* Georg Kunz (Ericsson) +* Neal McBurnett +* + +New Attendees + +* + +Regrets + +* + +Agenda + +* + +## 2024-04-04 (Pacific) + +Attendees + +* Lelia Bray-Musso (Cisco) +* Lauri Apple +* Louis Vera +* Allen Shearin (LM) +* Jeff Mendoza (Kusari) +* Spencer Schrock (Google) +* Hannah Sutor (GitLab) +* Caroline Lee (IBM) +* Stephen Augustus (Cisco) +* Jared Miller (SAP) + +New Attendees + +* + +Regrets + +* Adrianne Marcum (OpenSSF) + +Announcements + +* Ongoing Reminder: OpenSSF Scorecard New Contributor Workshop co-located at OSS NA \<[link](https://events.linuxfoundation.org/open-source-summit-north-america/features/co-located-events/#openssf-scorecard-new-contributor-workshop)\> + * Will need to update onboarding docs and prepare good first issues +* Ongoing Reminder: User survey open through April 20, 2024 \<[link](https://docs.google.com/forms/d/e/1FAIpQLSfEgrFVBhin9pClvWSv6WirZW3yKaIvhZAU_CPqR29_yIJl8g/viewform?usp=sf_link)\> – please share in your networks. We’ve got 16 responses so far + * Related: use survey data will, among other things, help us prioritize contents about checks and draft strategy doc … see Miro ([https://miro.com/app/board/uXjVN7\_ijXQ=/](https://miro.com/app/board/uXjVN7_ijXQ=/)) +* Allstar: + * Comment on: Policy for checking for arbitrary file existence: [https://github.com/ossf/allstar/issues/500](https://github.com/ossf/allstar/issues/500) + * Updating from Scorecard v4.13.1 to head ([https://deps.dev/go/github.com%2Fossf%2Fscorecard%2Fv4](https://deps.dev/go/github.com%2Fossf%2Fscorecard%2Fv4)) + * Note: v5 Scorecard release by OSS NA + +* Maintainer team has been reviewing Scorecard project charter + * Once project can be shipped under LF project umbrella, Scorecard can start to accept other projects as donations (eg. scorecard-monitor) + +Agenda + +* \[Lauri\] Some issue triage / whatever we can do +* Documenting common understanding/definition of labels \- great task for triagers to work on +* How to run Allstar + * As a service (original) + * Polls in a loop + * Webhooks never implemented + * As a cron job \- single loop + * As a GitHub Action +* Allstar runtime credentials + * GitHub App (current) + * PAT + * Needs to be scoped to many repos or an org + * CLI params list repos/orgs to run on +* AI: Take a look at the “needs discussion” items and consolidate into some bullet points to inform broader conversation about “what goes in and what stays out” of Scorecard; hold off on discussions (Lelia and Lauri to do) + * Need to process user feedback once survey closes, creates some buckets around “needs discussion” +* AI: Make new issue based off: [https://github.com/ossf/scorecard/issues/3687](https://github.com/ossf/scorecard/issues/3687) + +## 2024-04-01 (EMEA) + +Attendees + +* Adrianne Marcum (OpenSSF) +* Lelia Bray-Musso (Cisco) +* + +New Attendees + +* + +Announcements + +* OpenSSF Scorecard New Contributor Workshop co-located at OSS NA \<[link](https://events.linuxfoundation.org/open-source-summit-north-america/features/co-located-events/#openssf-scorecard-new-contributor-workshop)\> + * Will need to update onboarding docs and prepare good first issues +* User survey open through April 20, 2024 \<[link](https://docs.google.com/forms/d/e/1FAIpQLSfEgrFVBhin9pClvWSv6WirZW3yKaIvhZAU_CPqR29_yIJl8g/viewform?usp=sf_link)\> + +Agenda + +* + +## 2024-03-21 (Pacific) + +Attendees + +* Spencer Schrock (Google) +* Ian Dunbar-Hall (Lockheed Martin) +* Allen Shearin (Lockheed Martin) +* Raghav Kaul (Google) +* Caroline Lee (IBM) +* Gabriela Gutierrez (Google) +* Sarah Elder (NCSU) +* Adrianne Marcum (OpenSSF) +* Hannah Sutor (GitLab) +* + +New Attendees + +* Aaron Bacchi (Labelbox) + +Announcements + +* OpenSSF Scorecard New Contributor Workshop co-located at OSS NA \<[link](https://events.linuxfoundation.org/open-source-summit-north-america/features/co-located-events/#openssf-scorecard-new-contributor-workshop)\> + * Will need to update onboarding docs and prepare good first issues +* User survey open through April 20, 2024 \<[link](https://docs.google.com/forms/d/e/1FAIpQLSfEgrFVBhin9pClvWSv6WirZW3yKaIvhZAU_CPqR29_yIJl8g/viewform?usp=sf_link)\> + +Agenda + +* (Raghav) [Proposal: Scorecard SLSA Attestation Probe](https://docs.google.com/document/d/1dziCiVVBEgtpdGp-C9Nls6ryrXFWz1DR9T5E9THesXk/edit?usp=sharing) + * Discussion mainly in the doc through the form of comments + * The proposal talks about multiple challenges. Not all of them are being addressed, because some of the challenges are currently untenable (downloading artifacts, finding public keys, etc). + * Interfaces allows for multiple implementations + * Deps.dev may be best API currently, but no reason we cant use NPM or other package manager APIs directly + * Any other provenance/attestation formats to consider when designing/generalizing? + * Hard when not many package managers support any, and npm is just slsa only for now + * Will be tracking work against [https://github.com/ossf/scorecard/issues/3038](https://github.com/ossf/scorecard/issues/3038) +* + +## 2024-03-07 (APAC) + +Attendees: + +* Jeff Mendoza (Kusari) +* Lelia Bray-Musso (Cisco) +* Caroline Lee (IBM) +* Adrianne Marcum (OpenSSF) +* Spencer Schrock (Google) +* Allen Shearin (Lockheed Martin) +* Lauri Apple +* Reden Martinez (Linux Foundation) +* Joe Coyle (Lockheed Martin) + +New Attendees \- Welcome\!: + +* Louis Vera + +Announcements: + +* OpenSSF Scorecard New Contributor Workshop co-located at OSS NA \<[link](https://events.linuxfoundation.org/open-source-summit-north-america/features/co-located-events/#openssf-scorecard-new-contributor-workshop)\> + * Will need to update onboarding docs and prepare good first issues +* OpenSSF Scorecard talk accepted at OSS NA +* OpenSSF Scorecard Tech Talk scheduled for next week (March 13\) \- register [here](https://openssf.org/blog/2024/03/04/come-to-first-openssf-tech-talk-of-the-year-on-scorecard/) +* Scorecard [Blog Post](https://openssf.org/blog/2024/03/05/openssf-scorecard-evaluating-and-improving-the-health-of-critical-oss-projects/) mentions things to come + * “Finally, the OpenSSF Scorecard website, including documentation and API is changing from securityscorecards.dev to scorecard.dev. The new site is up and running. **We’ll continue to host api.securityscorecards.dev for 12 months, afterwhich the API will redirect to api.scorecard.dev**. Migrate your applications, or ensure you follow redirects.: +* Allstar: + * Working with Dana on [OpenSSF Security MVP Draft](https://docs.google.com/document/d/1-NBXdKvEJ9Wsh2i7lDNYven4fY9Bn6uvNJM5ySlMrdg/edit?usp=sharing). Will be adding org-level policy checks. + * New deploy last week causing some stability problems this week. Working on getting that fixed. + +Agenda: + +* \[Adrianne+Lauri\] Review user survey with incorporated feedback (inclusive to folks not in orgs, time estimates, fewer required questions); hope to share by EOW \<[link](https://docs.google.com/forms/d/e/1FAIpQLSfEgrFVBhin9pClvWSv6WirZW3yKaIvhZAU_CPqR29_yIJl8g/viewform?usp=sf_link)\> + * Next step: Ping Amanda to send out to whole community + * Checked that it doesn’t collect email addresses + * Can we extend the survey open time until after OSSNA (week of Apr 15-19) + * Feedback + * Job title, recommend adding SWE as an alias for one of the options + * Post-meeting update: Feedback shared during the meeting is now incorporated +* \[Lauri\] Show off new project board [https://github.com/orgs/ossf/projects/24/views/1](https://github.com/orgs/ossf/projects/24/views/1) and + * Capacity: [https://github.com/orgs/ossf/projects/24/views/2](https://github.com/orgs/ossf/projects/24/views/2) + * Roadmap: [https://github.com/orgs/ossf/projects/24/views/4](https://github.com/orgs/ossf/projects/24/views/4) + * Priority field built into GitHub now – Lauri set three options (must, should, nice to have) + * There are a few more columns right now as we sort through items +* \[Lauri\] Finish reviewing and prioritizing bugs [https://miro.com/app/board/uXjVN7\_ijXQ=/?moveToWidget=3458764576985195132\&cot=10](https://miro.com/app/board/uXjVN7_ijXQ=/?moveToWidget=3458764576985195132&cot=10) +* Let’s timebox miro review for \~20 mins, then look over updated survey in last 5-10 + +## 2024-03-04 (EMEA) + +Attendees: + +* Laurent Simon (Google) +* Adrianne Marcum (OpenSSF) +* Lelia Bray-Musso (Cisco) +* Reden Martinez (Linux Foundation) +* Sarah Elder (NCSU) +* Jared Miller (SAP) + +New Attendees \- Welcome\!: + +* Hannah Sutor (GitLab) +* Martina Goetz (SAP SE) + +Announcements: + +* OpenSSF Scorecard New Contributor Workshop co-located at OSS NA \<[link](https://events.linuxfoundation.org/open-source-summit-north-america/features/co-located-events/#openssf-scorecard-new-contributor-workshop)\> + * Will need to update onboarding docs and prepare good first issues +* Scorecard talk accepted at OSSA NA + +Agenda: + +* Looking to map checks/probes to where they fit in standards +* Users thinking about both rooting out bad dependencies, but also meeting compliance standards + +## 2024-02-22 (APAC) + +Attendees: + +* Caroline Lee (IBM) +* Allen Shearin (Lockheed Martin) +* Spencer Schrock (google) +* Lelia Bray-Musso (Cisco) +* Joe Coyle (Lockheed Martin) +* Adrianne Marcum (OpenSSF) + +New Attendees \- Welcome\!: + +* Sarah Evans (Dell, Risk API) +* Rahul (Microsoft) + +Announcements: + +* + +Agenda: + +* Upcoming Scorecard Tech Talk (Caroline) + * Intro to scorecard. + * New OpenSSF tech talk series +* Forthcoming Sbom Check Draft MR (Allen) + * Related to issues: + * [https://github.com/ossf/scorecard/issues/3574](https://github.com/ossf/scorecard/issues/3574) + * [https://github.com/ossf/scorecard/issues/2605](https://github.com/ossf/scorecard/issues/2605) +* Suggestions by Lauri, who can’t join—gather around the Miro ([https://miro.com/app/board/uXjVN7\_ijXQ=/](https://miro.com/app/board/uXjVN7_ijXQ=/)) and: + * sign off on the labeling suggestions + * Deletions are fine + * Common prefix + * Good, but consistency needed + * Spaces vs kebab case + * Dont have to double quote when doing queries + * Prioritization good change + * figure out a plan to add labels to items so we can organize them accurately + * Workflow that runs on newly created issues + * finish prioritizing the bug items, with an eye toward closing as many of them as possible + * async + * Take a look at this draft user survey and add notes for me to act on next week: [https://docs.google.com/forms/d/e/1FAIpQLSfEgrFVBhin9pClvWSv6WirZW3yKaIvhZAU\_CPqR29\_yIJl8g/viewform?usp=sf\_link](https://docs.google.com/forms/d/e/1FAIpQLSfEgrFVBhin9pClvWSv6WirZW3yKaIvhZAU_CPqR29_yIJl8g/viewform?usp=sf_link). + * [@John Klein](https://openssf.slack.com/team/U05HYRLNCTB) has editing access to this, and I'm happy to share with anyone else who wants to actively work on it. + * Please note that for now the questions aren't in any particular order and that there might be too many questions overall—this is in "dumping ground" state :) + * Add documentation questions\! + * Weekend warrior UX? + * Follow up with Mike + * Some questions organization focused + * Not everyone is in an organization + * Time required? Optional questions? Avoiding required ones + * Be clear about time up front + * +* + +## 2024-02-08 (APAC) + +Attendees: + +* Spencer Schrock (google) +* David A. Wheeler (Linux Foundation) +* Jared Miller (SAP) +* Raghav Kaul +* Lauri A +* John Klein (Capital One) +* Allen Shearin (Lockheed Martin) +* Adrianne Marcum (LF OpenSSF) +* + +Regrets + +* + +New Attendees \- Welcome\! + +* + +Agenda + +* Implement decision from last time: “Adapt standing community meetings to be half-office hours, half-planning” + * Let’s do the reverse order. We’ll do agenda items first, then free-form. That way people can prepare & make progress on planned items. +* Review AIs from last time +* Label cleanup + * Areas that aren’t checks, group similar labels + +* Review bug issues/org on prio matrix [https://miro.com/app/board/uXjVN7\_ijXQ=/](https://miro.com/app/board/uXjVN7_ijXQ=/) +* Callout: strategy doc now drafted—next steps: [Security Scorecard charter/strategy draft](https://docs.google.com/document/d/1MHVTaAynPoCKYRHB0EQIi4LxHtYHuWpR4SEBFfBIqTc) + * Leave comments + * Sign off + * Post to repo +* Survey Questions for next time? +* Free-form discussion / office hours (standing agenda item) + +## 2024-02-05 (EMEA) + +Attendees: + +* Adrianne Marcum (OpenSSF) +* Raghav Kaul (Google) +* Lelia Bray-Musso (Cisco) +* Sarah Elder (NCSU) +* Lauri Apple +* Maximilian Huber (TNG Technology Consulting) + +Regrets + +* + +New Attendees \- Welcome\! + +* Antonio (Toni) Pereira (Google) + +Agenda + +* Going over backlog: [https://miro.com/app/board/uXjVN7\_ijXQ=/](https://miro.com/app/board/uXjVN7_ijXQ=/) + +## 2024-01-25 (APAC) + +Attendees: + +* Allen Shearin (Lockheed) +* Caroline Lee (IBM) +* Spencer Schrock (Google) +* Lelia Bray-Musso (Cisco) +* Stephen Augustus (Cisco) +* Patricia Tarro (Dell Technologies) +* John Klein (Capital One) +* Lauri Apple + +New Attendees \- Welcome\! + +* Jared Arave (Tanium) +* Lelia Bray-Musso (Cisco) +* Patrick Kwiatkowski (Lockheed Martin) +* Jared Miller (SAP) + +Agenda: + +* \[Lauri\] Update on strategy doc and Action Items; finishing up checks prioritization + * ([Miro link](https://miro.com/app/board/uXjVN7_ijXQ=/) from last time) + +## 2024-01-11 (APAC) + +Attendees: + +* Spencer Schrock (Google) +* David A. Wheeler (Linux Foundation) +* Allen Shearin (Lockheed) +* Jeff Mendoza (Kusari) +* John Klein (Capital One) +* Patricia Tarro (Dell Technologies) +* Pedro Nacht (Google) +* Lauri Apple +* Raghav Kaul (Google) + +Regrets + +* Adrianne Marcum (OpenSSF) can only attend first half on mobile + +New Attendees \- Welcome\! + +* John Klein (Capital One) +* Patricia Tarro (Dell Technologies) +* Lelia Bray-Musso (Cisco) + +Agenda + +* Spencer Schrock leading today’s meeting +* Do we have any priority items before doing backlog review? + * None noted. +* Review (long\!) backlog items that propose A) new checks or B) substantial(-ish) adjustments to existing checks. To prepare, I've created this Miro: [https://miro.com/app/board/uXjVN7\_ijXQ=/?share\_link\_id=559268244976](https://miro.com/app/board/uXjVN7_ijXQ=/?share_link_id=559268244976) + * Sourced from [https://github.com/ossf/scorecard](https://github.com/ossf/scorecard) + * Async in Between now and next meeting, async work on step 3 of Miro agenda + +## 2024-01-08 (EMEA) + +Attendees: + +* Adrianne Marcum (OpenSSF) +* Lauri Apple +* Maximilian Huber (TNG Technology Consulting) +* David A. Wheeler +* Raghav Kaul +* Lucas Gonze + + + +Regrets + +* + +New Attendees + +* Lucas Gonze + +Agenda + +* Quick housekeeping question \- would the group like staff to create a new 2024 notes template and upload previous notes to GitHub? + * Prefer to continue with this document +* Discuss [https://github.com/ossf/tac/issues/169\#issuecomment-1871056697](https://github.com/ossf/tac/issues/169#issuecomment-1871056697) and [https://github.com/ossf/wg-best-practices-os-developers/issues/344](https://github.com/ossf/wg-best-practices-os-developers/issues/344) if there is interest, otherwise, will cover in next Best Practices WG meeting +* Backlog review + * [Link to sheet](https://docs.google.com/spreadsheets/d/1UuKvZLlWyIMVkXIz1CqGWPYV__f0xssldbayUOqIs04/edit#gid=293611645) with some notes about 100 issues I/Lauri scanned + * Ideally 2-4 dedicated volunteers can work with me to focus on reviewing and prioritize, pull together a roadmap draft + +Meeting Notes + +* Quick housekeeping question \- would the group like staff to create a new 2024 notes template and upload previous notes to GitHub? + * Prefer to continue with this document +* Discuss [https://github.com/ossf/tac/issues/169\#issuecomment-1871056697](https://github.com/ossf/tac/issues/169#issuecomment-1871056697) and [https://github.com/ossf/wg-best-practices-os-developers/issues/344](https://github.com/ossf/wg-best-practices-os-developers/issues/344) if there is interest, otherwise, will cover in next Best Practices WG meeting + * Issue opened with recommendations to level up OpenSSF + * Specific recommendations similar to workflows used by OSPOs + * What is the benefit or what is missing compared with the BP Badge json output? + * Converting the json is an extra step + * There is also UI in BP Badges, though it is not obvious (to some) and has not been noticed + * There is a button at the top that hides met criteria + * Why are some people not seeing this? Maybe the buttons don’t have enough contrast; if we switch them to have more contrast, maybe that’d be more obvious \- [https://github.com/coreinfrastructure/best-practices-badge/issues/2093](https://github.com/coreinfrastructure/best-practices-badge/issues/2093) + * Which remediation should be used? Direct to documentation about specific checks or criteria or to a full checklist with all items? Where does this tool fit within Scorecard? + * Ideally Scorecard would output a kanban board + * There is interest in this feature though no concrete design concept. Currently creating GH issue to dump json and individuals create separate issues with specific fixes + * Creating output that fits into project’s existing workflows will solve the problem. Can create a script to use GH CLI to create issue including To Do list from Scorecard feedback. + * Scorecard Monitor + * Allstar can create issues based on findings from checks and automate closing issues when problem is resolved. Includes some checks from Scorecard and others. + * Markdown to copy/paste into a GitHub issue (or GitLab issue) is probably best “bang for buck” \- it’s widely supported, there may social pressure to do more. Maybe csv also. + * Best Practices badge: New issue here: [https://github.com/coreinfrastructure/best-practices-badge/issues/2094](https://github.com/coreinfrastructure/best-practices-badge/issues/2094) + * +* Backlog review + * [Link to sheet](https://docs.google.com/spreadsheets/d/1UuKvZLlWyIMVkXIz1CqGWPYV__f0xssldbayUOqIs04/edit#gid=293611645) with some notes about 100 issues I/Lauri scanned + * Ideally 2-4 dedicated volunteers can work with me to focus on reviewing and prioritize, pull together a roadmap draft + * 2FA check? [https://github.com/ossf/scorecard/issues/7](https://github.com/ossf/scorecard/issues/7) . GitHub automatic. GitLab, requires admin to do it [https://forum.gitlab.com/t/retrieving-mfa-status-via-api/89759/4](https://forum.gitlab.com/t/retrieving-mfa-status-via-api/89759/4)