Discussion on path to S2C2F aligning with SLSA as its dependency track

camaleon2016 commented 1 month ago

Based on discussions within the Supply Chain integrity working group and S2C2F Project we wanted to open discussions on a path for S2C2F to align with SLSA as its dependency track. This would be contingent on SLSA's Source and Build tracks being completed and a clear understanding of the strategic direction, path, and roadmap. @mlieberman85 @marcelamelara @hepwori

hepwori commented 1 month ago

Great timing! @meder has done some early sketches of goals, scope, and shape of a possible dependency track. He'd be a great person to pull in here too.

meder commented 1 month ago

Thanks, would love to collaborate. Dependency track issue is here: https://github.com/slsa-framework/slsa/issues/961 You can see the first draft there, which will be reworked based on feedback.

hepwori commented 3 weeks ago

Update on this: as planned, folks from S2C2F and from SLSA Specification met this week to discuss this idea.

Attendees: @adriandiglio @camaleon2016 @haydentherapper @hepwori @meder

Discussion points:

SLSA is pursuing a Dependencies track, along with Hardware Attestations and Source tracks
S2C2F is interested in exploring ✨synergy✨ between what S2C2F has today and what SLSA desires
On the face of it, the S2C2F project has a bunch of skills, research, and prior art relevant to SLSA Dependencies
Also, S2C2F community contains folks who are expert and passionate about the topic
SLSA's aim is to have a set of tracks which share a standard approach and philosophy to level definition
There may be some gaps between how S2C2F is formulated today, and how SLSA approaches tracks and levels

Next steps:

S2C2F (Adrian): Assess community interest (e.g., in the next S2C2F meeting) in putting focused effort behind adapting S2C2F to be contributed as SLSA's Dependencies Track
SLSA Dependencies Track (Meder): Produce and share first draft of track principles, and areas where we'd need to adapt S2C2F to conform
SLSA Specification (Spec Leads): Validate approach (e.g., in next meeting) and raise any concerns with proposed plan.

Others — please chime in if I missed or misrepresented anything!

tombedfordgit commented 1 week ago

Hey @meder Were you able to produce the first draft of track principles? As we discuss this opportunity within the S2C2F community, it'd be really useful to understand the delta we'd encounter today. Thanks!

meder commented 2 days ago

@tombedfordgit I should have something to share next week.

slsa-framework / slsa

Discussion on path to S2C2F aligning with SLSA as its dependency track #1105