# OpenSSF Scorecard Meeting Archive — 2024

## Dec 12, 2024

Attendees

* Spencer Schrock (Google)  
* Jeff Mendoza (Kusari)  
* Jeff Diecks (OpenSSF)  
* Stephen Augustus (???)  
* Avishay Balter (Microsoft)  
* Kevin Dix (Boeing)

New Attendees

* Jeff Diecks

Regrets

* 

Announcements

* Expect a minor or patch release upcoming with a collection of minor updates and fixes  
  * Scorecard \+ action  
* 

Agenda

* \[Spencer\] Using email for contributor data when organizations unavailable  
  * Trusts user-supplied git data, but the existing usage isnt much better  
  * Both GitLab and Azure DevOps suffer from this  
    * [https://github.com/ossf/scorecard/pull/4415](https://github.com/ossf/scorecard/pull/4415)  
    * [https://github.com/ossf/scorecard/pull/4437\#issuecomment-2521080469](https://github.com/ossf/scorecard/pull/4437#issuecomment-2521080469)  
  * Explore what forge alternatives look like  
    * Different behavior on different forges is reasonable  
* \[Avishay\]: question about probes implementation ([https://github.com/ossf/scorecard/issues/3736](https://github.com/ossf/scorecard/issues/3736))  
  * Proposal: Memory Safety Scorecard Checks — [https://github.com/ossf/Memory-Safety/issues/33](https://github.com/ossf/Memory-Safety/issues/33)   
  * Data isn’t purely binary, but on a continuum  
  * Probes support a `Values` map for more open ended data  
    * [https://github.com/ossf/scorecard/blob/2409124a2d48753e8030597f8ae85b6dbb275838/finding/finding.go\#L76-L80](https://github.com/ossf/scorecard/blob/2409124a2d48753e8030597f8ae85b6dbb275838/finding/finding.go#L76-L80)   
  * [https://github.com/ossf/scorecard/blob/2409124a2d48753e8030597f8ae85b6dbb275838/probes/hasRecentCommits/impl.go\#L76](https://github.com/ossf/scorecard/blob/2409124a2d48753e8030597f8ae85b6dbb275838/probes/hasRecentCommits/impl.go#L76)  
* Release cadence:  
  * Aiming to have a maximum time between releases as 2 months if there are no pressing fixes/features to release  
  * Thumbs up  
* Meeting discussion  
  * Next meeting is 26th \- will cancel \- Jeff D will send a message to Reden  
  * EMEA is on Jan 6 Spencer is available.  
  * After that is Jan 9, seems ok.  
* \[Jamie maybe?\] Azure DevOps e2e testing  
  * 2nd half. Sorry, I have a conflict the 1st half  
  * Working on implementation, almost all of client implemented, Spencer has reviewed  
  * E2e testing: should be an Azure sub in OpenSSF that we can create and Azdo org for free (5 user)  
  * Need to track down who on OpenSSF has access \- Jeff D will ask around and report back in Slack  
  * Azure Devops task \- equivalent to GitHub action, PoC working for running Scorecard  
  * Main focus is completing client and hoping for a release  
  * Would be good to update the issue([https://github.com/ossf/scorecard/issues/4177](https://github.com/ossf/scorecard/issues/4177)) with an update (this update) to also get any feedback from those following it.  
  * We may wish to get the code merged before complete to attract contributors, Jamie is close to completion.  
  * What check is being targeted with Azure Pileines?  
    * The task is for running Scorecard as a part of the build  
    * A Pipeline check (such as pinned deps in pipeline yaml) would be a subsequent effort

## Dec 9, 2024

Attendees

* Spencer Schrock (Google)  
* 

New Attendees

* M Atif Ali (Coder)

Regrets

* 

Announcements

* 

Agenda

* StepSecurity harden runner paid license?  
  * Make sure we aren’t scoring based on paid products   
* Vuln check  
  * Some vulns in dev dependencies vs production  
  * Some indirect dependencies we cant patch directly  
  * May be able to ignore it with osv-scanner config  
    * [https://google.github.io/osv-scanner/configuration/](https://google.github.io/osv-scanner/configuration/)   
* Fuzzing Check (question)  
  * What about in Go?  
    [https://go.dev/doc/tutorial/fuzz](https://go.dev/doc/tutorial/fuzz)	  
* 

## Nov 14, 2024

Attendees

* Raghav Kaul (Google)  
* Allen Shearin (Lockheed Martin)  
* Spencer Schrock (Google)  
* Hannah Sutor (GitLab)

New Attendees

* Amar Takhar (RTEMS Project)

Regrets

* 

Announcements

* Moving scorecard-action image from GCR \-\> GHCR

Agenda

* Roadmap/Status  
* Overzealous stale issue bot ran this week  
  * Closed a few open PRs, including one Spencer needs to unblock  
* Publishing Scorecard results from GitLab  
  * Contributors Check doing searching?  
    * [https://github.com/ossf/scorecard/blob/fee8bcf77eff639b1be4272f11b1bc66de8594a3/clients/gitlabrepo/contributors.go\#L78-L85](https://github.com/ossf/scorecard/blob/fee8bcf77eff639b1be4272f11b1bc66de8594a3/clients/gitlabrepo/contributors.go#L78-L85)   
  * We need to explore CI Components, but that wouldn’t help with self hosted GitLab?  
    * [https://github.com/ossf/scorecard-webapp/issues/561](https://github.com/ossf/scorecard-webapp/issues/561)  
  * API struggles with subroutes, but our library has limitations here  
    * [https://github.com/ossf/scorecard-webapp/issues/511](https://github.com/ossf/scorecard-webapp/issues/511)  
  * How to visualize a bunch of projects?  
    * There is some markdown \+ json tooling meant for GitHub, maybe can be adapted?  
      * [https://github.com/ossf/scorecard-monitor](https://github.com/ossf/scorecard-monitor)  
  * Previous subgroup fix (due to owner/repo splitting around `/`)  
    * [https://github.com/ossf/scorecard-webapp/pull/701](https://github.com/ossf/scorecard-webapp/pull/701)  
  * What is the end goal with submitting Scores?   
    * Anything to selfhost?  
      * [https://github.com/ossf/scorecard-webapp](https://github.com/ossf/scorecard-webapp)   
  * How to deal with regressions?  
    * Scorecard Action uploads some SARIF to GitHub’s security dashboard  
    * Allstar as  GitHub app supports filing issues, but again GitHub specific   
    * GitLab SARIF upload in the works?:  
      * [https://gitlab.com/gitlab-org/gitlab/-/issues/452042](https://gitlab.com/gitlab-org/gitlab/-/issues/452042)   
  * Conformance reports  
    * What’s the output format like?  
    * Here’s a blog on custom policy, but light on concrete details [https://openssf.org/blog/2024/04/17/beyond-scores-with-openssf-scorecard-granular-structured-results-for-custom-policy-enforcement/](https://openssf.org/blog/2024/04/17/beyond-scores-with-openssf-scorecard-granular-structured-results-for-custom-policy-enforcement/)  
    * Video form  
    * [Structured Scorecard Results: Tailor Your Own Supply-Chain... - Adam Korczynski & David Korczynski](https://www.youtube.com/watch?v=ZT3XdMF6U5A)  
  * 

## Nov 11, 2024

Attendees

* Spencer Schrock (Google)  
* Michael Winser (Eclipse Foundation)

New Attendees

* 

Regrets

* 

Announcements

* 

Agenda

* What is Scorecard’s roadmap and status today?  
* What is Allstar story, and alignment with Otterdog and Minder  
* Lots of data sets out there, between osv.dev deps.dev, scorecard, etc.  
  * Produce some csv dump to location to enable analysis at scale.  
    * Has happened for research partners before, could happen again  
    * Would need to talk to OpenSSF  
  * Relatively easy to join them together  
  * Attestations of these data  
* 

## Oct 31, 2024

Attendees

* Jeff Mendoza (Kusari)  
* Allen Shearin (Lockheed Martin)  
* Evan Anderson (Stacklok)  
* Eddie Knight (Sonatype)  
* Raghav Kaul (Google)  
* Kevin Dix (Boeing)

New Attendees

* 

Regrets

* 

Announcements

* 

Agenda

* [https://github.com/ossf/scorecard/pull/4391](https://github.com/ossf/scorecard/pull/4391)  
  * LFX insights needs to consume output of probes  
  * Related: [https://github.com/ossf/scorecard/pull/4020](https://github.com/ossf/scorecard/pull/4020)  
  * Related issue: do we always know if the result of a probe is true or false equals bad or good? Not currently? Depends on name of probe?  
  * Usually having a “remediation” is bad  
  *   
* [https://github.com/ossf/scorecard/pull/4398](https://github.com/ossf/scorecard/pull/4398)  
  * Will rebase after the above is merged, as this includes those changes  
  * 

## Oct 17, 2024

Attendees

* Allen Shearin (Lockheed Martin)  
* Spencer Schrock (Google)  
* Jeff Mendoza (Kusari)  
* Jamie Magee (Microsoft)  
* Stephen Augustus (Cisco)  
* Kevin Dix (Boeing)

New Attendees

* Tom Hennen (Google)

Regrets

* 

Announcements

* 

Agenda

* \[Tom Hennen\] [SLSA and Scorecards](https://github.com/ossf/scorecard/issues/3352#issuecomment-2417737004)??  
  * SLSA source track attestations  
    * Attestations are forge/VCS agnostic  
    * Refer to specific revisions (for git is a ref either commit or branch)  
      * Scorecard is very git and GitHub/GitLab specific. Is that a problem?  
        * No, there can be multiple attestors  
  * Differences/similarities to OpenSSF security baseline?  
  * Would a derivative VSA work, if Scorecard has their own predicate type?  
    * Not really, we need some sort of authority to be producing these VSAs  
    * SLSA also wants the VSA to be a standard predicate type so that downstream users don’t need to understand every possible predicate type that might attest to these things ([some background here](https://docs.google.com/presentation/d/1_1ikfSaja87-Qx2ev26DYdiNgS6AEvVFO92oSwNGvJ8/edit)).  
    * CLI could produce a VSA, signed with Sigstore (OIDC?)   
      * Better than what exists today (nothing)  
    * Trusted workflow, which calls scorecard, and does the mapping to L2, and produces a VSA?  
* Need review: [https://github.com/ossf/allstar/pull/582](https://github.com/ossf/allstar/pull/582) (thanks)  
* \[Jamie Magee\] Azure DevOps  
  * [https://github.com/ossf/scorecard/issues/4177](https://github.com/ossf/scorecard/issues/4177)   
  * [https://github.com/ossf/scorecard/pull/4377](https://github.com/ossf/scorecard/pull/4377)  
  * How do we handle these self hosted and non-standard configurations?  
  * AZDO Tasks / GitHub Actions analogue  
    * Running Scorecard in a pipeline, to produce SARIF output  
      * Container specific logic, unique to GitHub Actions  
      * But SARIF is supported  
    * But AZDO specific analysis is an angle too  
      * [https://github.com/ossf/scorecard/issues/4380](https://github.com/ossf/scorecard/issues/4380)  
      * And similar for DangerousWorkflows  
    * Can the task be in the marketplace?  
      * Discoverability is one thing, from the OpenSSF  
      * [Extensions for Visual Studio family of products | Visual Studio Marketplace](https://marketplace.visualstudio.com/azuredevops)

## Oct 14, 2024

Attendees

* CRob (OpenSSF)  
* Zach Steindler (GitHub)  
* Edward Thomson (Stacklok)  
* Jakub Hrozek (Stacklok)  
* Raghav Kaul (Google)

New Attendees

* CRob \- new OSSF architect and BEST WG rep; seeking to get better engaged with project  
* Edward Thomson \- PM for Minder; looking to foster closer collab with Scorecard team  
* Jakub Hrozek \- project member of Minder, here to answer technical questions  
* Zach S \- new TAC chair

Regrets

* 

Announcements

* SOSS Fusion \- Scorecard workshop  
* Two talks at Fusion about Scorecard

Agenda

* Welcome / Introductions  
* How are things going? What’s going well? What help do you need?  
  * High-level \- released v5 w/ structured results and maintainer annotations ; still looking for feedback.  Structured Results may be a feature users don’t fully understand yet.  Hopefully will help it easier to write a new probe or to pick-and-choose probes to use (narrow focus for viewer)  
  * Can now accept new probes (SBOM probe, as an example).  
  * Not sure users are getting value out of this feature yet though  
  * Zach \- notices that there are lots of open issues; this is a sign that the project is generating a lot of interest.  Does the project feel they have enough folks to help with new features/work backlog?  
  * Raghav \- feels backlog is a nice indicator the project is useful and liked (RFEs, and other suggestions).  We could use more help in addressing some of those.  Can we build the community (this is the intent of the Scorecard Workshops).  A PM would be very useful to help the team.  
  * Did backlog grooming last year and did a batch of updates, but the queue continues to grow.  Not sure how to catch up with the pace of interest.  
  *  Zach \- community demand might be outstripping team’s capacity  
  * CRob \- could leverage TAC’s TI Funding process to see about getting a project manager to assist in getting the backlog wrangled.  [https://github.com/ossf/tac/blob/main/process/TI%20Funding%20Request%20Process.md](https://github.com/ossf/tac/blob/main/process/TI%20Funding%20Request%20Process.md)   
* TAC PR for Scorecard moving up to Incubating Status [https://github.com/ossf/tac/pull/390](https://github.com/ossf/tac/pull/390)  
  * 15Oct TAC call at 11am ET this will be discussed  
  *   
* 

## Oct 3, 2024

Attendees

* Evan Anderson (Stacklok)  
* Jeff Mendoza (Kusari)  
* Spencer Schrock (Google)  
* Hannah Sutor (GitLab)  
* Eddie Knight (Sonatype)  
* Jeff Diecks (OpenSSF)  
* Kevin Dix (Boeing)  
* Raghav Kaul (Google)  
* 

New Attendees

* 

Regrets

* 

Announcements

* 

Agenda

* OpenSSF GCP budget, lots of container egress costs  
  * GitHub package registry  
  * Container egress comes from pulling down the image from GCR(GCP)  
  * Idea: try using GHCR instead of GCR  
  * New action version will contain the change  
* Webapp  
  * Better imposter commit verification in the works ([PR](https://github.com/ossf/scorecard-webapp/pull/682))  
* Updates on adding probes to replace clomonitor  
  * Steering committee met and are ok with accepting these probes, see slack messages in \#scorecard  
* [Minder contribution](https://github.com/ossf/tac/pull/386) – hello, and how do we relate (vis-a-vis Scorecard and AllStar)?  
  * ([overview](https://docs.google.com/presentation/d/1em0pdt-h-ghPdkmbklXw8_LvuQzo-gAxZ8NFVPQKkpQ/edit?usp=drive_link) presented to TAC)  
  * Q: possibility for app to be “read-only”  
    * Yes, some design and possibilities here  
    * Split remediation app from scanning app  
      * Possibly even keep queue of remediations and apply async from a GitHub Action or even from desktop  
  * Evan: Scorecard is a measuring stick  
    * Spencer: scorecard is trying to be a home for analyses, and then you can choose which ones to measure yourself from  
    * Evan: Scorecards also has the “public observations” data set, which seems like it’s been useful from e.g. Tidelift  
  * Jeff: If a user approaches OpenSSF and says “how do I strengthen my security”, how do they decide between Minder and Scorecards?  
    * Need a clear rubric between the two.  
    * How does Scorecards relate to private repos?  
      * Doesn’t centrally report on private repos, but can run a lot of the checks locally.  
    * Would be nice to have a flow chart or wizard to help choose  
  * Jeff: AllStar and Minder – harder to square the message here  
    * How to choose between installing AllStar and Minder on an org I manage.  
  * What does the Venn Diagram of these three projects look like?  
    * Scorecard Universe (CLI, action, API, monitor, visualizer)  
    * Allstar  
    * Minder

## Sep 19, 2024 (Pacific)

Attendees

* Jeff Mendoza (Kusari)  
* Raghav Kaul (Google)  
* Spencer Schrock (Google)  
* Eddie Knight (Sonatype)

New Attendees

* 

Regrets

* (many are at OSS EU \- Vienna)

Announcements

* 

Agenda

* CNCF usage of Scorecard  
  * Clomonitor is being sunset  
  * Needing to work with LFX insights  
  * LF Baseline SIG  
  * Good starting point from OpenJS foundation  
  * Scorecard is already checking for many things on the baseline   
    * (and some things which aren’t in the baseline)  
  * LFX Insights question: Hard to check things that are not already in Scorecard  
    * Adding things to scorecard. Lots of checks, may not agree with everything  
    * Bring us back to “scorecard is a linter” [viewpoint](#2024-05-30-pacific)
  * Question about effort to both write the checks and maintain them  
    * Need to have some guidelines from Scorecard team on what we want  
    *   
  * Probe vs Check:  
    * Check results in a score  
    * Probe are distinct characteristics that get compiled into a check  
    * Probes can be added and then be available in structured results  
    * Lower bar for accepting new Probes, they don’t affect score  
    * Higher bar for checks, possibly not all on by default  
    * Will just a probe be enough for LFX to ingest results?  
    * LFX insights likely running Scorecard itself  
    * Probes: [https://github.com/ossf/scorecard/blob/main/docs/probes.md](https://github.com/ossf/scorecard/blob/main/docs/probes.md)   
  * What sort of checks are missing?  
    * (some spreadsheet)  
    * Are they all automated?  
      * Yes and no, but for the self-attesting parts are declared in security insights.  
      * Concerns over which data is self-attested or not?  
        * We don’t have many self-attested data now. Just the OpenSSF Best Practices badge.  
  * How do we get this merged by November?  
    * Steering committee can discuss the addition of CLOmonitor \-esque probes  
    * Confirmation that LFX Insights will run the analysis and can see the probes  
  * Steering Committee will meet on this topic and raise any new concerns to Eddie if needed

## Sep 16, 2024 (EMEA)

Attendees

* Raghav Kaul (Google)

New Attendees

* Cristian Urlea \- University of Glasgow

Regrets

* 

Announcements

* 

Agenda

* Multiparty session types discussion  
  * Links  
    * [https://dsbd-morello-hat.github.io/](https://dsbd-morello-hat.github.io/)  
    * [https://dsbd-appcontrol.github.io/](https://dsbd-appcontrol.github.io/)  
    * [https://www.cl.cam.ac.uk/research/security/ctsrd/cheri/](https://www.cl.cam.ac.uk/research/security/ctsrd/cheri/)  
    * [http://mrg.doc.ic.ac.uk/publications/a-very-gentle-introduction-to-multiparty-session-types/main.pdf](http://mrg.doc.ic.ac.uk/publications/a-very-gentle-introduction-to-multiparty-session-types/main.pdf)  
    * [https://kar.kent.ac.uk/43737/1/BCDHY13.pdf](https://kar.kent.ac.uk/43737/1/BCDHY13.pdf)

## Sep 5, 2024 (Pacific)

Attendees

* Lelia Bray-Musso (Cisco)  
* Jeff Mendoza (Kusari)  
* Allen Shearin (LMCO)  
* Stephen Augustus (Cisco)  
* Hannah Sutor (GitLab)

New Attendees

* 

Regrets

* 

Announcements

* 

Agenda

* \[lelia\] Discuss [https://github.com/ossf/scorecard/issues/4333](https://github.com/ossf/scorecard/issues/4333)   
  * Working on this with Allstar, want to have something more formal by \~SOSS Fusion  
  * Can run Scorecard with a PAT or app token (some limitations)  
  * Experimental wrapper code around Scorecard \- could turn into real feature?  
  * Re: Allstar  
    * Good for configuring on per-repo, per-org basis, but no good way to report  
    * There’s also Scorecard Monitor to help with org-level reporting  
  * What are the right paved paths?  
  * End state: What does a GitHub App installation look like for Scorecard?  
    * Allstar can do that today, but not a paved path yet  
  * If we have entrypoint into Scorecard using GH App credential, if we could do that for GitLab too, that would be great.   
    * Group Access Token \= GitLab equivalent  
    * Would be ideal to provide support for GitHub App \+ GitLab’s equivalent if we’re going to roll this out  
    * Could be possible to get access to Gitlab sandbox for support developing this  
* For GitHub, what are different containers you can organize in?  
  * Multiple repos \-\> organization, app installed to entire org in single click w/ permissions to run on all those repos  
  * From Enterprise POV: top level container \= Enterprise, which can contain many orgs, which can contain many repos \+ teams  
* Do we have a higher level issue, do we want to start a new one?  
  * Let’s start with this, if it doesn’t exist already  
  * Lelia to make issue for top-level ask to improve Scorecard experience for multi-org/many repo use case, link to above issues and any related  
    * **Done: [https://github.com/ossf/scorecard/issues/4339](https://github.com/ossf/scorecard/issues/4339)**   
* \[hannah\] How is the backlog going?  
  * Lelia \- We got through the spreadsheet. I’ve been doing it where I can.   
  * Stephen \- Spreadsheet was things that were old, incorrectly scoped, etc   
    * We have been chatting amongst ourselves on the steering side for defined path forward for the triager. We need to define that. Part of the journey on the way to contributing to Scorecard.   
    * Infrastructure contributor role to be defined  
  * Now that contributor ladders from various Scorecard/OSSF projects have been merged, need to review language for accuracy and come up with more defined roles for triagers  
  * Lelia \- The other thing about the contributor ladder is that the end state is that you’re a technical maintainer or infra person or whatever. You could be coming into it from being more on the Product side of things. All of those things I don’t believe you’d need maintainer access for. We could have a different type of graduation ladder.  
    * Triager has the triage permission in GitHub but could be more  
    * Always a challenge in OS to give visibility to the “glue work” /non-code contribution  
  * Lelia \- I can file an issue where we say that the triager does not have a clear ladder and I can tag you, Hannah, so you can add context  
    * **Done: [https://github.com/ossf/scorecard/issues/4338](https://github.com/ossf/scorecard/issues/4338)**   
* Hannah: Are there any Scorecard specific activities at SOSS Fusion?  
  * Stephen: Details to come, pretty sure the answer is “yes” 

## Aug 22, 2024 (Pacific)

Attendees

* Spencer Schrock (Google)  
* Jeff Mendoza (Kusari)  
* Lelia Bray-Musso (Cisco)  
* Avishay Balter (Microsoft)

New Attendees

* Tobias Heldt (tobias@cyberfame.io)

Regrets

* 

Announcements

* 

Agenda

* (Spencer) Looking at scalability for the weekly scan infrastructure  
  * Currently at 95% capacity  
  * Not much changes week to week though\!  
    * 3.3% changed in the last week (current weekly scan cadence)  
    * 6.9% changed in the last month  
    * 18.2% changed in the last year  
    *  50% changed in  the last 3.4 years  
  * Any benefit for reducing current list of projects?  
    * Scorecard action installed?  
    * Renamed projects?  
    * Deleted projects?  
    * Archived projects?  
    *   
* (Jeff) Self-hosted GitHub Enterprise support PR in Allstar  
  * [https://github.com/ossf/allstar/pull/559](https://github.com/ossf/allstar/pull/559)  
  * Any comments appreciated  
  * Testing can be a problem for GHES and maintaining Scorecard  
    * Cisco has a GHES instance and may be able to test some things?  
* (avishay) increase support in nuget ecosystem over the next month or so  
  * Better powershell support [https://github.com/ossf/scorecard/issues/4253](https://github.com/ossf/scorecard/issues/4253)  
    * Any good Go library for powershell parsing?  
  * Csprojec restore locked mode [https://github.com/ossf/scorecard/issues/4251](https://github.com/ossf/scorecard/issues/4251)  
    * Can we do post-processing if we detect a relevant file and marked unpinned to pin?  
  * Consider nuget projects as pinned [https://github.com/ossf/scorecard/issues/4252](https://github.com/ossf/scorecard/issues/4252)  
    * [https://devblogs.microsoft.com/nuget/building-a-safer-future-how-nuget-is-tackling-software-supply-chain-threats/](https://devblogs.microsoft.com/nuget/building-a-safer-future-how-nuget-is-tackling-software-supply-chain-threats/)  
    * Similar to Go, using a package version has immutability even if not pinned  
* 

## Aug 8, 2024 (Pacific)

Attendees

* Allen Shearin (Lockheed Martin)  
* Stephen Augustus (Cisco)  
* Spencer Schrock (Google)  
* Jeff Mendoza (Kusari)  
* Joe Coyle (Lockheed Martin)  
* Sarah Elder (NCSU)  
* 

New Attendees

* Kevin Dix (Boeing)  
  * Product security lead architect

Regrets

* Lelia Bray-Musso (Cisco)

Announcements

* 

Agenda

* Allstar re-deploy  
  * No updates, work continues  
* Spencer working on making Scorecard Action use the new Scorecard library entrypoint  
  * Reduce API consumed, as noted in [https://github.com/ossf/scorecard-action/issues/1071](https://github.com/ossf/scorecard-action/issues/1071)  
* Check ID PR  
  * [https://github.com/ossf/scorecard/pull/4021](https://github.com/ossf/scorecard/pull/4021)  
  * Spener to make an issue about current breaking cron output changes  
  * Allen can back out the cron specific output so we can merge partially and coordinate the rest in the issue

## Jul 25, 2024 (Pacific)

Attendees

* Lelia Bray-Musso (Cisco)  
* Dana Wang (OpenSSF)  
* Spencer Schrock (Google)  
* Caroline Lee (IBM)  
* Anjlica Malla (Goldman Sachs)  
* Jeff Mendoza (Kusari)  
* Sarah Elder (NCSU)  
* Stephen Augustus (Cisco)

New Attendees

* Nell Shamrell-Harrington (Microsoft)

Regrets

* Ulises Gascón (One Beyond)  
* Teba Gomez (Whalar)

Announcements

* \[Spencer\] Scorecard [V5 launched](https://github.com/ossf/scorecard/releases/tag/v5.0.0). Scorecard Action release today/tomorrow   
* \[Jeff\] Allstar is updating to scorecard.Run() before releasing with V5  
  * \[Stephen\] Also trying to improve operations for both Scorecard and Allstar  
  * Feedback for how these products are/aren’t working for you: [https://github.com/ossf/allstar/issues/528](https://github.com/ossf/allstar/issues/528)

Agenda

* \[Nell\] Proposal to add checks for Scorecard for different language ecosystems with re: to memory safety best practices  
  * Some prior discussion on this [GitHub issue](https://github.com/ossf/scorecard/issues/3736), but the conversation went stale some time ago  
  * Want to know whether this is something we would like the Memory Safety SIG to continue to pursue or something the SIG should bring to Scorecard later  
  * Have been compiling a list of best practices for memory safe / non memory safe by default languages.  
  * Active work on increasing configurability of Scorecard, getting away from requiring every repo to run every check, moving towards probes  
  * Doing analysis on memory safety makes sense, probes may be a good way to play around with that, Spencer can point in the right direction on how to get started  
    * Independent Probes  
      * [https://github.com/ossf/scorecard/pull/4052](https://github.com/ossf/scorecard/pull/4052)   
  * Non-goal to suggest rewriting a project in a memory-safe language  
  * To make this a maintainable reality, would require language / ecosystem SMEs in order to achieve parity  
  * Additional resources:  
    * [https://github.com/ossf/Memory-Safety/blob/main/docs/best-practice-memory-safe-by-default-languages.md](https://github.com/ossf/Memory-Safety/blob/main/docs/best-practice-memory-safe-by-default-languages.md)   
    * [https://github.com/ossf/Memory-Safety/blob/main/docs/best-practice-non-memory-safe-by-default-languages.md](https://github.com/ossf/Memory-Safety/blob/main/docs/best-practice-non-memory-safe-by-default-languages.md)   
* \[Lelia\] Do we need to fix the instructions at the top of this doc re: google group to join?
  * I joined [ossf-scorecard-announce@googlegroups.com](mailto:ossf-scorecard-announce@googlegroups.com) for edit access, but the correct group appears to be [ossf-scorecard-dev@googlegroups.com](mailto:ossf-scorecard-dev@googlegroups.com)   
  * Already fixed at the top of the doc  
  * Request to OpenSSF Staff: Can we make another group owner for the doc?  
    * Reach out in operations Slack channel  
    * Should we audit this?  
    * Not sure if multiple Google doc owners is possible  
* \[Jeff\]  
  * Scorecard as a library example documentation:  
    * Do we have any?  
    * Where would be a good place?  
    * (I wrote up this example: [https://github.com/ossf/scorecard/issues/4254\#issuecomment-2250953095](https://github.com/ossf/scorecard/issues/4254#issuecomment-2250953095))  
    * Currently Run() is buried under the Result type here: [https://pkg.go.dev/github.com/ossf/scorecard/v5@v5.0.0/pkg/scorecard\#Run](https://pkg.go.dev/github.com/ossf/scorecard/v5@v5.0.0/pkg/scorecard#Run)   
  * We want to bring our docs together as closely as possible  
    * A library consumer how-to doc would be worthwhile  
      * Can take some of it from [https://github.com/ossf/scorecard/issues/3717](https://github.com/ossf/scorecard/issues/3717)   
      * “Existing callers don’t need to change their signature, but those that want to customize the behavior can:”  
    * Putting it in the go package documentation at the top seems reasonable, as long as we include a call-out to it in the README  
    * Start with putting it as close to the code as possible, then make a more consumer-friendly markdown document \- Jeff to create a 2-step issue for this  
  * New issue to capture this discussion: [https://github.com/ossf/scorecard/issues/4258](https://github.com/ossf/scorecard/issues/4258)   
* \[Dana\] security baseline update if time permits  
  * [OpenSSF Security Baseline](https://github.com/ossf/tac/blob/main/process/security_baseline.md) was officially established as an OpenSSF security standard as of July 23\. The baselines for sandbox are part of the TAC project lifecycle operating model. Baselines for incubating and graduated are in the process of being incorporated into the operating model.  
    * Document needs optimization \- want to take Scorecard approach of making everything referenceable  
    * Adoption tracking has been challenging \- 4 projects piloting, some are sandboxed  
    * Flexibility in enabling vs enforcing \- On the enterprise level, enforcing means any org within enterprise will kick out members without 2FA enabled  
    * Start with enablement to give opportunity for compliance, *then* enforce it  
    * Larger conversation around what integration looks like for various Scorecard/OSSF projects, identifying overlap in checks that CLOMonitor vs Scorecard are running  
  * [Adoption tracking](https://docs.google.com/spreadsheets/d/1LCLpN1Hgx7C9M9KNuvH5aN5vukYPmxrq_1dUQrDhnco/edit?gid=818010490#gid=818010490) has started, would like to hear the feedback from Scorecard for how to automate the tracking.  
    * Put Scorecard on the list of pilot projects, working towards incubating status  
    * Difficult to establish a clear baseline for whether projects are meeting requirements  
    * Wondering if Scorecard structured results can help with this  
    * Open question on Security Insights adoption \- not sure it’s recognized on GitHub API level. How to come into compliance with something you’re not informed of?  
    * CNCF projects using security insights significantly more than OSSF (only GUAC)  
    * Provide people with clear instructions, if they want to do it themselves, that’s great, or else we can do it on your behalf \- prioritize self-service and discoverability  
  * [Security baseline SIG](https://github.com/ossf/security-baseline) was established   
    * OK to add Scorecard to the list of [pilot projects](https://github.com/ossf/security-baseline)  
* \[Dana\]if time permits, update on [architecture document draft](https://github.com/Danajoyluck/security-baseline/blob/Danajoyluck-patch-1/architecture/architecture/consumption-architecture-dependency-management.md) that includes the work of Allstar and Scorecard  
  * Take a look and give feedback if anything about Scorecard is misrepresented  
  * Best way to provide feedback? Dana to create draft PR for comments  
* \[Anjlica\] Has there been talk about enhancing one of the probes with activity committed?  
  * Name of probe is “has-recent-commits”  
  * Currently has binary response, any plan to enhance beyond a binary check?  
    * To some extent it is slightly more than binary already  
    * [https://github.com/ossf/scorecard/blob/ea7e27ed41b76ab879c862fa0ca4cc9c61764ee4/probes/hasRecentCommits/impl.go\#L40-L41](https://github.com/ossf/scorecard/blob/ea7e27ed41b76ab879c862fa0ca4cc9c61764ee4/probes/hasRecentCommits/impl.go#L40-L41)  
  * Willing to contribute to this  
  * There might be an issue already for this, it’s slightly more than binary already  
  * Please feel free to open an issue for clarification, can discuss async, we can re-discuss at the next meeting as an agenda item if not resolved by then  
  * 

## Jul 11, 2024 (Pacific)

Attendees

* Jeff Mendoza (Kusari)  
* Lelia Bray-Musso (Cisco)  
* Spencer Schrock (Google)  
* Caroline Lee (IBM)  
* Allen Shearin (LM)  
* Sarah Elder (NCSU)  
* Raghav Kaul (Google)  
* Dana Wang (OpenSSF)

New Attendees

* 

Regrets

* Stephen Augustus  
* Ulises Gascón (One Beyond)  
* Teba Gomez (Whalar)

Announcements

* Scorecard v5 release imminent ( O(days) )  
  * Should be feature complete  
  * Drafting release notes now

Agenda

* \[Dana\] OpenSSF [Security Baseline](https://github.com/ossf/tac/blob/a87572b75025e136bd951c3048c699003bb1a91b/process/security_baseline.md) has been [submitted](https://github.com/ossf/tac/pull/353) to the [TAC](https://github.com/ossf/tac)  
  * Dana to attend today’s session — share motivation for the security baseline, discuss Scorecard’s involvement, get support promoting within the Scorecard universe  
  * Scorecard is sometimes a measurement tool, and sometimes the requirement  
    * Scorecard does some of this analysis already and allows the OpenSSF to monitor for regressions  
      * Allstar would work well for regression, if you trust the public instance  
  * After review, get some existing OpenSSF projects to try out the baseline  
    * Later try to get some other LF foundations to try it out  
  * The security baselines are two part  
    * If projects have the resources to do the checks (in terms of maintainers)  
    * What the impact would be if the project were compromised (more adopted projects can impact more software)  
  * Security insights  
    * Currently only GUAC has it in their repo?  
    * (Related scorecard issues) [https://github.com/ossf/scorecard/issues/2305](https://github.com/ossf/scorecard/issues/2305)  
  * Vulnerability check may be a partial measure, but not complete measure  
  * How to measure the impact of Scorecard over time in terms of scorecard severity (Critical, High, Medium, etc)  
    * Related dashboard work, Scorecard TSC needs to discuss  
  * Have you considered Scorecard Monitor?  
    * [https://github.com/ossf/scorecard-monitor](https://github.com/ossf/scorecard-monitor)

## Jun 27, 2024 (Pacific)

Attendees

* Ulises Gascón (One Beyond)  
* Allen Shearin (Lockheed Martin)  
* Spencer Schrock (Google)  
* Raghav Kaul (Google)  
* Adrianne Marcum (OpenSSF)  
* Sarah Elder (NCSU)

New Attendees

* 

Regrets

* Jeff Mendoza \- at CloudNativeSecurityCon  
* Teba Gomez (Whalar)

Announcements

* New version of the Scorecard Monitor [https://github.com/ossf/scorecard-monitor/releases/tag/v2.0.0-beta8](https://github.com/ossf/scorecard-monitor/releases/tag/v2.0.0-beta8) 🎉  
* V5 “soon”, some open PRs

Agenda

* Aggregating Scorecard scores across a dependency tree (NCSU Research Project)  
  * Survey request? Or results?  
  * Data still being processed  
* 

## Jun 24, 2024 (EMEA)

Attendees

* Adrianne Marcum (OpenSSF)  
* Sarah Elder (NCSU)

New Attendees

* Gergely Csatari (Nokia)  
* Shivam Agarwal (Nokia)


  
Regrets

* Ulises Gascón (One Beyond)  
* Teba Gomez (Whalar)

Announcements

* 

Agenda

* CI Check \- how to ensure that CI checks were actually ran and passed? [https://github.com/ossf/scorecard/issues/4191](https://github.com/ossf/scorecard/issues/4191)   
  * ([https://openssf.slack.com/archives/C0235AR8N2C/p1714376086115049](https://openssf.slack.com/archives/C0235AR8N2C/p1714376086115049))  
  * From Zoom chat: how can we get the logs for each commit for ci-tests?  
  * CI check doesn’t run in the cron job  
* Security policy check \- would it be possible to check for security policies somewhere else than in the SECURITY.md?  
  * [https://github.com/ossf/scorecard/issues/4192](https://github.com/ossf/scorecard/issues/4192) 

## Jun 13, 2024 (Pacific)

Attendees

* Jeff Mendoza (Kusari)  
* Spencer Schrock (google)  
* Sarah Elder (NCSU)  
* Alex Klevans (NCSU)  
* Raghav Kaul (Google)

New Attendees

* Teba Gomez (Whalar)  
* Ulises Gascón (One Beyond)  
* Annie Mao (Google)  
* Chris de Almeida (IBM)

Regrets

* Stephen Augustus (Cisco)  
* Lelia Bray-Musso (Cisco)  
* Hannah Sutor (GitLab)

Announcements

* The OSSF Scorecard Visualizer ([https://github.com/ossf/scorecard-visualizer](https://github.com/ossf/scorecard-visualizer)) donation has finished  
* The OSSF Scorecard Monitor ([https://github.com/ossf/scorecard-monitor/issues/79](https://github.com/ossf/scorecard-monitor/issues/79)) donation has finished

Agenda

* Scorecard Visualizer redirection issue  
* Scorecard Monitor GH Marketplace publication agreement   
* Lelia as triager: [https://github.com/ossf/scorecard/issues/4136](https://github.com/ossf/scorecard/issues/4136)  
  * Any maintainer objections?  
  * Note: Adrianne noticed that the triager role still does not allow label editing/creation, so this will be a continued limitation w/r/t issue triaging.   
  * I (Lelia) won’t be able to attend this week’s sync due to an ongoing outage with my ISP, but let me know if I need to take any action to move the nomination forward, thanks\!  
* Tsunami ([https://github.com/google/tsunami-security-scanner](https://github.com/google/tsunami-security-scanner))   
  * Intersection with Scorecard, add probes/checks for these AI/ML related checks?  
    * Ideally automated analysis of the repo, as well as analysis of the software runtime behaviour and/or their security feature/control  
    * POC

| Software | Category | Auth Supported | Can be Internet Exposed | Actively Exploited | Testing Range | Scanning Solution |
| :---- | :---- | :---- | :---- | :---- | :---- | :---- |
| [PyTorch Serve](https://github.com/pytorch/serve) | Model Serving | Yes | Yes\* (only the latest version with token based auth) | Yes |  | [Tsunami PytorchServe Exposed API Detector](https://github.com/google/tsunami-security-scanner-plugins/blob/27727598d9fe0fcf2e20c96bdfd0050e91a3c97a/google/detectors/exposedui/pytorch_serve/src/main/java/com/google/tsunami/plugins/detectors/exposedui/pytorchserve/PytorchServeExposedApiDetector.java#L64) |
| [Ray](https://github.com/ray-project/ray) | Model Serving | No | No, RCE by design | Yes |  | [Tsunami Ray Exposed UI Detector for CVE-2023-48022](https://github.com/google/tsunami-security-scanner-plugins/blob/27727598d9fe0fcf2e20c96bdfd0050e91a3c97a/google/detectors/rce/ai/cve202348022/README.md) [Tsunami Ray Detector for CVE-2023-6019](https://github.com/google/tsunami-security-scanner-plugins/blob/27727598d9fe0fcf2e20c96bdfd0050e91a3c97a/google/detectors/rce/ai/cve20236019/README.md) |
| [MLflow](https://github.com/mlflow/mlflow) | Model Serving | Yes | Yes\* (only newer versions) | ??? |  | [Tsunami MLflow Detector for CVE-2023-1777](https://github.com/google/tsunami-security-scanner-plugins/blob/master/community/detectors/mlflow_cve_2023_1177/README.md?plain=1) [Tsunami MLflow Detector for CVE-2023-6014](https://github.com/google/tsunami-security-scanner-plugins/blob/master/community/detectors/mlflow_cve_2023_6014/README.md) |
| [Tensorflow Serving](https://github.com/tensorflow/serving) | Model Serving | No | Maybe (if inference should be publicly accessible) | ??? |  |  |
| [H2O](https://github.com/h2oai/h2o-3) | Model Serving | Yes | Yes\* | ??? |  | [Tsunami H2O Exposed UI Detector](https://github.com/google/tsunami-security-scanner-plugins/blob/master/google/detectors/rce/ai/cve20236018/src/main/java/com/google/tsunami/plugins/cve20236018/Cve20236018Detector.java) |
| [Argo Workflow](http://github.com/argoproj/argo-workflows) | Workflow Management | Yes | Yes\* | ??? |  | [Tsunami Argo Workflow Exposed UI Detector](https://github.com/google/tsunami-security-scanner-plugins/blob/master/google/detectors/exposedui/argoworkflow/src/main/java/com/google/tsunami/plugins/detectors/exposedui/argoworkflow/ExposedArgoworkflowDetector.java) |
| [Argo CD](https://github.com/argoproj/argo-cd) | CI/CD | Yes | Yes\* | ??? |  | Tsunami plugin in development |

  * Open an issue to discuss possibilities   
  * May know more after Codename Internet CTF launches in July? Currently we are setting up securely and vulnerable configurations of OSS at [https://github.com/google/security-testbeds](https://github.com/google/security-testbeds)   
  * Potentially collaborate with Best Practice group to provide best practice guidelines for configuring the AI related software  
* Having both Scorecard Visualizer and the webapp “viewer”  
  * Upcoming UX work  
    * Known issues in scorecard-webapp

## 2024-05-30 (Pacific)
Attendees

* Lelia Bray-Musso (Cisco)  
* Allen Shearin (LM)  
* Spencer Schrock (Google)  
* Stephen Augustus (Cisco)  
* Jeff Mendoza (Kusari)  
* Sarah Elder (NCSU)  
* Alex Klevans (NCSU)

New Attendees

* 

Regrets

* Adrianne Marcum (OpenSSF)  
* Hannah Sutor (GitLab)  
* Lauri Apple

Announcements

* Allstar is developed as a part of the [OpenSSF Scorecard](https://github.com/ossf/scorecard) project.  
  * [https://github.com/ossf/allstar?tab=readme-ov-file\#what-is-allstar](https://github.com/ossf/allstar?tab=readme-ov-file#what-is-allstar)   
  * There’ll be more doc updates eventually, but we wanted to update obvious places now  
* PR merged for letting people know who steering committee members are

Agenda

* \[Spencer\] Continue discussion of [OpenSSF Scorecard as a Supply Chain Linter](https://docs.google.com/document/d/1I5vtZWa0_64ruFP_MrSaTgzQrAHfh_NknA2feVOHdD4/edit?usp=sharing)  
  * Idea: Have a baseline/default set of checks that are universally consistent, allow further customization from there  
  * No specific feedback on the doc so far, but we may want to hold off until we have personas  
  * \[jeff\] Some previous thoughts: [Scorecard UX for Annotations and Configuration](https://docs.google.com/document/d/1CcJeIr3Uskj84uwFQQHu12wEKRoO55rkCo7FzBA6jsc/edit#heading=h.n318i9hjmace)  
    * This is an older doc, but is an example of prior art to show we’ve thought about this  
    * Has some persona categories there we can use for inspiration  
* \[Lelia\] Scorecard personas update  
* \[Lelia\] [“Needs discussion” issue](https://docs.google.com/spreadsheets/d/1UuKvZLlWyIMVkXIz1CqGWPYV__f0xssldbayUOqIs04/edit#gid=452836399) progress  
  * We have completed the “red” category (2021 or older)  
  * We should probably run this same exercise on Allstar in the future  
  * Scorecard also has two other repos: scorecard-action \+ scorecard-webapp  
  * If donation goes through, then we’ll need to go through it again\!  
    * We should look into label syncing between repos now that everything’s consolidating under ossf org  
    * Description of the labels should also be documented in the repo  
    * A lot of these labels are unique to scorecard, so not all of them need to be duplicated/synced across the org. Maybe just a set of generic ones?  
    * Dependencydiff code removal  
      * Consensus among present maintainers to remove deadcode  
      * actions/dependency-review-action has the functionality  
      * Spencer to comment and close / remove  
    * [Scorecard-dependency analysis](https://github.com/ossf/scorecard-dependencyanalysis) \<- candidate to be archived  
* \[Lauri\] [Label descriptions](https://docs.google.com/spreadsheets/d/1UuKvZLlWyIMVkXIz1CqGWPYV__f0xssldbayUOqIs04/edit#gid=293611645) progress  
  * Lauri is unable to attend today, so we can continue this at a future session  
* 

## 2024-05-16 (Pacific)

Attendees

* Spencer Schrock (Google)  
* Jeff Mendoza (Kusari)  
* Hannah Sutor (GitLab)  
* Lelia Bray-Musso (Cisco)  
* Stephen Augustus (Cisco)

New Attendees

* 

Regrets

* 

Announcements

* 

Agenda

* \[Lauri\] [Label descriptions](https://docs.google.com/spreadsheets/d/1UuKvZLlWyIMVkXIz1CqGWPYV__f0xssldbayUOqIs04/edit#gid=293611645) progress  
  * Priority & urgency?  
* \[Lelia\] [“Needs discussion” issue](https://docs.google.com/spreadsheets/d/1UuKvZLlWyIMVkXIz1CqGWPYV__f0xssldbayUOqIs04/edit#gid=452836399) progress  
* \[Spencer\] [OpenSSF Scorecard as a Supply Chain Linter](https://docs.google.com/document/d/1I5vtZWa0_64ruFP_MrSaTgzQrAHfh_NknA2feVOHdD4/edit?usp=sharing)  
  * \[jeff\]Some previous thoughts: [Scorecard UX for Annotations and Configuration](https://docs.google.com/document/d/1CcJeIr3Uskj84uwFQQHu12wEKRoO55rkCo7FzBA6jsc/edit#heading=h.n318i9hjmace)  
* \[Stephen\] Updates on survey things?

## 2024-05-02 (Pacific)

Attendees

* Jeff Mendoza (Kusari)  
* Adrianne Marcum (OpenSSF)  
* Stephen Augustus (Cisco)  
* Lelia Bray-Musso (Cisco)  
* Lauri Apple  
* Caroline Lee (IBM)  
* Spencer Schrock (Google)  
* Sarah Elder (NCSU)

New Attendees

* 

Regrets

* 

Announcements

* \[Jeff\] Allstar  
  * New release tomorrow (with v5 scorecard)  
  * Public instance is having reliability issues  
* 

Agenda

* \[Stephen\] Creating the Scorecard Universe: [https://github.com/ossf/scorecard/issues/4073](https://github.com/ossf/scorecard/issues/4073)   
  * Will anyone be joining from Scorecard Monitor and Scorecard API Visualizer? Yes, once the tasks outlined in the issue are underway, those maintainers will be pulled in more.  
  * Approval and permissions will be separated by area of expertise  
* \[Lauri\] survey results \+ spreadsheet  
  * **AI:** bucket roles into top personas (soft-yes Adrianne and Lauri)  
  * **AI:** priority re: org size means prioritizing deployment as many orgs/repos as quickly as possible  
  * **AI:** tool should be useful for lay person, \# of sec supply chain startup folks should go down over time  
  * **AI:** badge factoring into decisions based on pressuring maintainers or not?  
    * Followup survey: Didn’t know about it, or know about it and you don’t want to advertise your score? One use case is private repos – don’t need a badge.  
  * **AI:** ask people what’s preventing them from using Scorecard–is the “unclear” stuff to blame?  
  * **AI:** Find out more about what does the badge mean to different audiences?  
  * **AI:** I wonder if any of the three "hasn't helped us" respondents offered to do user interviews? Find out if so, and follow up with them in those interviews; same for “hasn’t helped us”; for the 16.2% “not sure” can follow up later  
  * If you're using \[the X\], were you able to install Scorecard in less than 10 minutes?  
    * 77.3% said yes for CLI  
    * 68% said yes for GitHub Action; should focus on this to help highest number of checks run (66.7%)  
  * **Acceptable Rate of false negatives:** 73.5% said rate of 5% or less. But getting false negatives:  
    * SAST 37.9%  
    * Pinned Dependencies 17.9%  
    * Security Policy 17.2%  
    * Signed Releases 16%  
    * Vulnerabilities 14.3%  
    * Fuzzing 13.8%  
    * CI Tests 13.8%  
    * Token Permissions 12.5%  
    * Packaging 12%  
    * Dependency-Update-Tool 10.7%  
    * Code Review 10.3%  
    * Binary Artifacts 6.9%  
  * **Acceptable Rate of false positives:** 64.7% said rate of 5% or less. But getting false positives:  
    * Pinned Dependencies 26.9%  
    * SAST 25%  
    * Maintained 17.4%  
    * Signed-Releases 17.4%  
    * Dangerous Workflow 16.7%  
    * Dependency-Update-Tool 15.4%  
    * Vulnerabilities 15.4%  
    * CI Tests 14.3%  
    * Contributors 13%  
    * Packaging 13%  
    * Pinned Dependencies 11.5%  
    * Binary Artifacts 10.7%  
    * Fuzzing 10.7%  
    * Token Permissions 8.3%  
    * Branch Protection 7.1%  
  * **Unclear purpose**  
    * Dangerous workflow 75%  
      * This is interesting. Could be tracking issue about projects not interested in adopting Scorecard because “these checks have no value in my ecosystem.” Is this related? Could require docs embellishment.   
      * Confusion around “CRITICAL” rank/weighting  
        * [https://github.com/ossf/scorecard/issues/3990](https://github.com/ossf/scorecard/issues/3990)   
    * Binary Artifacts 58.8%  
    * Fuzzing 58.8%  
    * Webhooks 58.3%  
  * **Most important, Source**  
    * Code Review (9)  
    * Branch Protection (9)  
  * **Most important, Build**  
    * Token Permissions (18)  
    * Dangerous Workflow (14)  
    * Webhooks (26 in 3rd place)  
  * **Most important, Dependencies**  
    * Vulnerabilities (21)  
    * Dependency Update Tool  
    * Pinned Dependencies (20 in 3rd place)  
  * **Most important, Package and Miscellaneous**  
    * Maintained (10)  
    * CII-Best-Practices (9)  
    * Signed Releases (5)  
  * **Proposed checks, ranked by interest in:**  
    * Secret Scanning 122 points  
    * Security Audit 116 points  
    * Validates Domains 106 points  
  * 14 respondents were open to direct interviews; will follow up after deeper dive 

## 2024-04-29 (EMEA)

Attendees

* Adrianne Marcum (OpenSSF)  
* Georg Kunz (Ericsson)  
* Neal McBurnett  
* 

New Attendees

* 

Regrets

* 

Agenda

* 

## 2024-04-04 (Pacific)

Attendees

* Lelia Bray-Musso (Cisco)  
* Lauri Apple  
* Louis Vera  
* Allen Shearin (LM)  
* Jeff Mendoza (Kusari)  
* Spencer Schrock (Google)  
* Hannah Sutor (GitLab)  
* Caroline Lee (IBM)  
* Stephen Augustus (Cisco)  
* Jared Miller (SAP)

New Attendees

* 

Regrets

* Adrianne Marcum (OpenSSF)

Announcements

* Ongoing Reminder: OpenSSF Scorecard New Contributor Workshop co-located at OSS NA \<[link](https://events.linuxfoundation.org/open-source-summit-north-america/features/co-located-events/#openssf-scorecard-new-contributor-workshop)\>  
  * Will need to update onboarding docs and prepare good first issues  
* Ongoing Reminder: User survey open through April 20, 2024 \<[link](https://docs.google.com/forms/d/e/1FAIpQLSfEgrFVBhin9pClvWSv6WirZW3yKaIvhZAU_CPqR29_yIJl8g/viewform?usp=sf_link)\> – please share in your networks. We’ve got 16 responses so far  
  * Related: use survey data will, among other things, help us prioritize contents about checks and draft strategy doc … see Miro ([https://miro.com/app/board/uXjVN7\_ijXQ=/](https://miro.com/app/board/uXjVN7_ijXQ=/))  
* Allstar:  
  * Comment on: Policy for checking for arbitrary file existence: [https://github.com/ossf/allstar/issues/500](https://github.com/ossf/allstar/issues/500)   
  * Updating from Scorecard v4.13.1 to head ([https://deps.dev/go/github.com%2Fossf%2Fscorecard%2Fv4](https://deps.dev/go/github.com%2Fossf%2Fscorecard%2Fv4))  
    * Note: v5 Scorecard release by OSS NA

* Maintainer team has been reviewing Scorecard project charter  
  * Once project can be shipped under LF project umbrella, Scorecard can start to accept other projects as donations (eg. scorecard-monitor)

Agenda

* \[Lauri\] Some issue triage / whatever we can do  
* Documenting common understanding/definition of labels \- great task for triagers to work on  
* How to run Allstar  
  * As a service (original)  
    * Polls in a loop  
    * Webhooks never implemented  
  * As a cron job \- single loop  
  * As a GitHub Action  
* Allstar runtime credentials  
  * GitHub App (current)  
  * PAT  
    * Needs to be scoped to many repos or an org  
    * CLI params list repos/orgs to run on  
* AI: Take a look at the “needs discussion” items and consolidate into some bullet points to inform broader conversation about “what goes in and what stays out” of Scorecard; hold off on discussions (Lelia and Lauri to do)  
  * Need to process user feedback once survey closes, creates some buckets around “needs discussion”   
* AI: Make new issue based off: [https://github.com/ossf/scorecard/issues/3687](https://github.com/ossf/scorecard/issues/3687) 

## 2024-04-01 (EMEA)

Attendees

* Adrianne Marcum (OpenSSF)  
* Lelia Bray-Musso (Cisco)  
* 

New Attendees

* 

Announcements

* OpenSSF Scorecard New Contributor Workshop co-located at OSS NA \<[link](https://events.linuxfoundation.org/open-source-summit-north-america/features/co-located-events/#openssf-scorecard-new-contributor-workshop)\>  
  * Will need to update onboarding docs and prepare good first issues  
* User survey open through April 20, 2024 \<[link](https://docs.google.com/forms/d/e/1FAIpQLSfEgrFVBhin9pClvWSv6WirZW3yKaIvhZAU_CPqR29_yIJl8g/viewform?usp=sf_link)\>

Agenda

* 

## 2024-03-21 (Pacific)

Attendees

* Spencer Schrock (Google)  
* Ian Dunbar-Hall (Lockheed Martin)  
* Allen Shearin (Lockheed Martin)  
* Raghav Kaul (Google)  
* Caroline Lee (IBM)  
* Gabriela Gutierrez (Google)  
* Sarah Elder (NCSU)  
* Adrianne Marcum (OpenSSF)  
* Hannah Sutor (GitLab)  
* 

New Attendees

* Aaron Bacchi (Labelbox)

Announcements

* OpenSSF Scorecard New Contributor Workshop co-located at OSS NA \<[link](https://events.linuxfoundation.org/open-source-summit-north-america/features/co-located-events/#openssf-scorecard-new-contributor-workshop)\>  
  * Will need to update onboarding docs and prepare good first issues  
* User survey open through April 20, 2024 \<[link](https://docs.google.com/forms/d/e/1FAIpQLSfEgrFVBhin9pClvWSv6WirZW3yKaIvhZAU_CPqR29_yIJl8g/viewform?usp=sf_link)\>

Agenda

* (Raghav) [Proposal: Scorecard SLSA Attestation Probe](https://docs.google.com/document/d/1dziCiVVBEgtpdGp-C9Nls6ryrXFWz1DR9T5E9THesXk/edit?usp=sharing)  
  * Discussion mainly in the doc through the form of comments  
  * The proposal talks about multiple challenges. Not all of them are being addressed, because some of the challenges are currently untenable (downloading artifacts, finding public keys, etc).  
  * Interfaces allows for multiple implementations  
    * Deps.dev may be best API currently, but no reason we cant use NPM or other package manager APIs directly  
  * Any other provenance/attestation formats to consider when designing/generalizing?  
    * Hard when not many package managers support any, and npm is just slsa only for now  
  * Will be tracking work against [https://github.com/ossf/scorecard/issues/3038](https://github.com/ossf/scorecard/issues/3038)   
* 

## 2024-03-07 (APAC)

Attendees:

* Jeff Mendoza (Kusari)  
* Lelia Bray-Musso (Cisco)  
* Caroline Lee (IBM)  
* Adrianne Marcum (OpenSSF)  
* Spencer Schrock (Google)  
* Allen Shearin (Lockheed Martin)  
* Lauri Apple  
* Reden Martinez (Linux Foundation)  
* Joe Coyle (Lockheed Martin)

New Attendees \- Welcome\!:

* Louis Vera

Announcements: 

* OpenSSF Scorecard New Contributor Workshop co-located at OSS NA \<[link](https://events.linuxfoundation.org/open-source-summit-north-america/features/co-located-events/#openssf-scorecard-new-contributor-workshop)\>  
  * Will need to update onboarding docs and prepare good first issues  
* OpenSSF Scorecard talk accepted at OSS NA  
* OpenSSF Scorecard Tech Talk scheduled for next week (March 13\) \- register [here](https://openssf.org/blog/2024/03/04/come-to-first-openssf-tech-talk-of-the-year-on-scorecard/)  
* Scorecard [Blog Post](https://openssf.org/blog/2024/03/05/openssf-scorecard-evaluating-and-improving-the-health-of-critical-oss-projects/) mentions things to come  
  * “Finally, the OpenSSF Scorecard website, including documentation and API is changing from securityscorecards.dev to scorecard.dev. The new site is up and running. **We’ll continue to host api.securityscorecards.dev for 12 months, afterwhich the API will redirect to api.scorecard.dev**. Migrate your applications, or ensure you follow redirects.:  
* Allstar:  
  * Working with Dana on [OpenSSF Security MVP Draft](https://docs.google.com/document/d/1-NBXdKvEJ9Wsh2i7lDNYven4fY9Bn6uvNJM5ySlMrdg/edit?usp=sharing). Will be adding org-level policy checks.  
  * New deploy last week causing some stability problems this week. Working on getting that fixed.

Agenda:

* \[Adrianne+Lauri\] Review user survey with incorporated feedback (inclusive to folks not in orgs, time estimates, fewer required questions); hope to share by EOW \<[link](https://docs.google.com/forms/d/e/1FAIpQLSfEgrFVBhin9pClvWSv6WirZW3yKaIvhZAU_CPqR29_yIJl8g/viewform?usp=sf_link)\>  
  * Next step: Ping Amanda to send out to whole community  
  * Checked that it doesn’t collect email addresses  
  * Can we extend the survey open time until after OSSNA (week of Apr 15-19)  
  * Feedback  
    * Job title, recommend adding SWE as an alias for one of the options  
    * Post-meeting update: Feedback shared during the meeting is now incorporated  
* \[Lauri\] Show off new project board [https://github.com/orgs/ossf/projects/24/views/1](https://github.com/orgs/ossf/projects/24/views/1) and  
  * Capacity: [https://github.com/orgs/ossf/projects/24/views/2](https://github.com/orgs/ossf/projects/24/views/2)   
  * Roadmap: [https://github.com/orgs/ossf/projects/24/views/4](https://github.com/orgs/ossf/projects/24/views/4)   
  * Priority field built into GitHub now – Lauri set three options (must, should, nice to have)  
  * There are a few more columns right now as we sort through items  
* \[Lauri\] Finish reviewing and prioritizing bugs [https://miro.com/app/board/uXjVN7\_ijXQ=/?moveToWidget=3458764576985195132\&cot=10](https://miro.com/app/board/uXjVN7_ijXQ=/?moveToWidget=3458764576985195132&cot=10)  
* Let’s timebox miro review for \~20 mins, then look over updated survey in last 5-10 

## 2024-03-04 (EMEA)

Attendees:

* Laurent Simon (Google)  
* Adrianne Marcum (OpenSSF)  
* Lelia Bray-Musso (Cisco)  
* Reden Martinez (Linux Foundation)  
* Sarah Elder (NCSU)  
* Jared Miller (SAP)

New Attendees \- Welcome\!:

* Hannah Sutor (GitLab)  
* Martina Goetz (SAP SE)

Announcements: 

* OpenSSF Scorecard New Contributor Workshop co-located at OSS NA \<[link](https://events.linuxfoundation.org/open-source-summit-north-america/features/co-located-events/#openssf-scorecard-new-contributor-workshop)\>  
  * Will need to update onboarding docs and prepare good first issues  
* Scorecard talk accepted at OSSA NA

Agenda:

* Looking to map checks/probes to where they fit in standards  
* Users thinking about both rooting out bad dependencies, but also meeting compliance standards

## 2024-02-22 (APAC)

Attendees:

* Caroline Lee (IBM)  
* Allen Shearin (Lockheed Martin)  
* Spencer Schrock (google)  
* Lelia Bray-Musso (Cisco)  
* Joe Coyle (Lockheed Martin)  
* Adrianne Marcum (OpenSSF)

New Attendees \- Welcome\!:

* Sarah Evans (Dell, Risk API)  
* Rahul (Microsoft)

Announcements: 

* 

Agenda:

* Upcoming Scorecard Tech Talk (Caroline)  
  * Intro to scorecard.  
  * New OpenSSF tech talk series  
* Forthcoming Sbom Check Draft MR (Allen)  
  * Related to issues:  
    * [https://github.com/ossf/scorecard/issues/3574](https://github.com/ossf/scorecard/issues/3574)  
    * [https://github.com/ossf/scorecard/issues/2605](https://github.com/ossf/scorecard/issues/2605)   
* Suggestions by Lauri, who can’t join—gather around the Miro ([https://miro.com/app/board/uXjVN7\_ijXQ=/](https://miro.com/app/board/uXjVN7_ijXQ=/)) and:  
  * sign off on the labeling suggestions  
    * Deletions are fine  
  * Common prefix  
    * Good, but consistency needed  
  * Spaces vs kebab case  
    * Dont have to double quote when doing queries  
  * Prioritization good change  
  * figure out a plan to add labels to items so we can organize them accurately  
    * Workflow that runs on newly created issues  
  * finish prioritizing the bug items, with an eye toward closing as many of them as possible  
    * async  
  * Take a look at this draft user survey and add notes for me to act on next week: [https://docs.google.com/forms/d/e/1FAIpQLSfEgrFVBhin9pClvWSv6WirZW3yKaIvhZAU\_CPqR29\_yIJl8g/viewform?usp=sf\_link](https://docs.google.com/forms/d/e/1FAIpQLSfEgrFVBhin9pClvWSv6WirZW3yKaIvhZAU_CPqR29_yIJl8g/viewform?usp=sf_link).   
    * [@John Klein](https://openssf.slack.com/team/U05HYRLNCTB) has editing access to this, and I'm happy to share with anyone else who wants to actively work on it.   
    * Please note that for now the questions aren't in any particular order and that there might be too many questions overall—this is in "dumping ground" state :)  
    * Add documentation questions\!  
    * Weekend warrior UX?  
      * Follow up with Mike  
    * Some questions organization focused  
      * Not everyone is in an organization  
    * Time required? Optional questions? Avoiding required ones  
      * Be clear about time up front  
    *   
* 

## 2024-02-08 (APAC)

Attendees:

* Spencer Schrock (google)  
* David A. Wheeler (Linux Foundation)  
* Jared Miller (SAP)  
* Raghav Kaul  
* Lauri A  
* John Klein (Capital One)  
* Allen Shearin (Lockheed Martin)  
* Adrianne Marcum (LF OpenSSF)  
* 

Regrets

* 

New Attendees \- Welcome\!

* 

Agenda 

* Implement decision from last time: “Adapt standing community meetings to be half-office hours, half-planning”  
  * Let’s do the reverse order. We’ll do agenda items first, then free-form. That way people can prepare & make progress on planned items.  
* Review AIs from last time  
* Label cleanup  
  * Areas that aren’t checks, group similar labels

* Review bug issues/org on prio matrix [https://miro.com/app/board/uXjVN7\_ijXQ=/](https://miro.com/app/board/uXjVN7_ijXQ=/)   
* Callout: strategy doc now drafted—next steps: [Security Scorecard charter/strategy draft](https://docs.google.com/document/d/1MHVTaAynPoCKYRHB0EQIi4LxHtYHuWpR4SEBFfBIqTc)  
  * Leave comments  
  * Sign off  
  * Post to repo  
* Survey Questions for next time?  
* Free-form discussion / office hours (standing agenda item)

## 2024-02-05 (EMEA)

Attendees:

* Adrianne Marcum (OpenSSF)  
* Raghav Kaul (Google)  
* Lelia Bray-Musso (Cisco)  
* Sarah Elder (NCSU)  
* Lauri Apple  
* Maximilian Huber (TNG Technology Consulting)

Regrets

* 

New Attendees \- Welcome\!

* Antonio (Toni) Pereira (Google)

Agenda 

* Going over backlog: [https://miro.com/app/board/uXjVN7\_ijXQ=/](https://miro.com/app/board/uXjVN7_ijXQ=/) 

## 2024-01-25 (APAC)

Attendees:

* Allen Shearin (Lockheed)  
* Caroline Lee (IBM)  
* Spencer Schrock (Google)  
* Lelia Bray-Musso (Cisco)  
* Stephen Augustus (Cisco)  
* Patricia Tarro (Dell Technologies)  
* John Klein (Capital One)  
* Lauri Apple

New Attendees \- Welcome\!

* Jared Arave (Tanium)  
* Lelia Bray-Musso (Cisco)  
* Patrick Kwiatkowski (Lockheed Martin)  
* Jared Miller (SAP)

Agenda:

* \[Lauri\] Update on strategy doc and Action Items; finishing up checks prioritization  
  * ([Miro link](https://miro.com/app/board/uXjVN7_ijXQ=/) from last time)

## 2024-01-11 (APAC)

Attendees:

* Spencer Schrock (Google)  
* David A. Wheeler (Linux Foundation)  
* Allen Shearin (Lockheed)  
* Jeff Mendoza (Kusari)  
* John Klein (Capital One)  
* Patricia Tarro (Dell Technologies)  
* Pedro Nacht (Google)  
* Lauri Apple  
* Raghav Kaul (Google)

Regrets

* Adrianne Marcum (OpenSSF) can only attend first half on mobile

New Attendees \- Welcome\!

* John Klein (Capital One)  
* Patricia Tarro (Dell Technologies)  
* Lelia Bray-Musso (Cisco)

Agenda 

* Spencer Schrock leading today’s meeting  
* Do we have any priority items before doing backlog review?  
  * None noted.  
* Review (long\!) backlog items that propose A) new checks or B) substantial(-ish) adjustments to existing checks. To prepare, I've created this Miro: [https://miro.com/app/board/uXjVN7\_ijXQ=/?share\_link\_id=559268244976](https://miro.com/app/board/uXjVN7_ijXQ=/?share_link_id=559268244976)  
  * Sourced from [https://github.com/ossf/scorecard](https://github.com/ossf/scorecard)  
  * Async in Between now and next meeting, async work on step 3 of Miro agenda

## 2024-01-08 (EMEA)

Attendees:

* Adrianne Marcum (OpenSSF)  
* Lauri Apple  
* Maximilian Huber (TNG Technology Consulting)  
* David A. Wheeler  
* Raghav Kaul  
* Lucas Gonze


  
Regrets

* 

New Attendees

* Lucas Gonze

Agenda 

* Quick housekeeping question \- would the group like staff to create a new 2024 notes template and upload previous notes to GitHub?  
  * Prefer to continue with this document  
* Discuss [https://github.com/ossf/tac/issues/169\#issuecomment-1871056697](https://github.com/ossf/tac/issues/169#issuecomment-1871056697) and [https://github.com/ossf/wg-best-practices-os-developers/issues/344](https://github.com/ossf/wg-best-practices-os-developers/issues/344) if there is interest, otherwise, will cover in next Best Practices WG meeting  
* Backlog review  
  * [Link to sheet](https://docs.google.com/spreadsheets/d/1UuKvZLlWyIMVkXIz1CqGWPYV__f0xssldbayUOqIs04/edit#gid=293611645) with some notes about 100 issues I/Lauri scanned  
  * Ideally 2-4 dedicated volunteers can work with me to focus on reviewing and prioritize, pull together a roadmap draft

Meeting Notes

* Quick housekeeping question \- would the group like staff to create a new 2024 notes template and upload previous notes to GitHub?  
  * Prefer to continue with this document  
* Discuss [https://github.com/ossf/tac/issues/169\#issuecomment-1871056697](https://github.com/ossf/tac/issues/169#issuecomment-1871056697) and [https://github.com/ossf/wg-best-practices-os-developers/issues/344](https://github.com/ossf/wg-best-practices-os-developers/issues/344) if there is interest, otherwise, will cover in next Best Practices WG meeting  
  * Issue opened with recommendations to level up OpenSSF  
  * Specific recommendations similar to workflows used by OSPOs  
  * What is the benefit or what is missing compared with the BP Badge json output?  
    * Converting the json is an extra step  
  * There is also UI in BP Badges, though it is not obvious (to some) and has not been noticed  
    * There is a button at the top that hides met criteria  
    * Why are some people not seeing this? Maybe the buttons don’t have enough contrast; if we switch them to have more contrast, maybe that’d be more obvious \- [https://github.com/coreinfrastructure/best-practices-badge/issues/2093](https://github.com/coreinfrastructure/best-practices-badge/issues/2093)  
  * Which remediation should be used? Direct to documentation about specific checks or criteria or to a full checklist with all items? Where does this tool fit within Scorecard?  
    * Ideally Scorecard would output a kanban board  
  * There is interest in this feature though no concrete design concept. Currently creating GH issue to dump json and individuals create separate issues with specific fixes  
  * Creating output that fits into project’s existing workflows will solve the problem. Can create a script to use GH CLI to create issue including To Do list from Scorecard feedback.  
  * Scorecard Monitor  
  * Allstar can create issues based on findings from checks and automate closing issues when problem is resolved. Includes some checks from Scorecard and others.  
  * Markdown to copy/paste into a GitHub issue (or GitLab issue) is probably best “bang for buck” \- it’s widely supported, there may social pressure to do more. Maybe csv also.  
    * Best Practices badge: New issue here: [https://github.com/coreinfrastructure/best-practices-badge/issues/2094](https://github.com/coreinfrastructure/best-practices-badge/issues/2094)  
  *   
* Backlog review  
  * [Link to sheet](https://docs.google.com/spreadsheets/d/1UuKvZLlWyIMVkXIz1CqGWPYV__f0xssldbayUOqIs04/edit#gid=293611645) with some notes about 100 issues I/Lauri scanned  
  * Ideally 2-4 dedicated volunteers can work with me to focus on reviewing and prioritize, pull together a roadmap draft  
  * 2FA check? [https://github.com/ossf/scorecard/issues/7](https://github.com/ossf/scorecard/issues/7) . GitHub automatic. GitLab, requires admin to do it [https://forum.gitlab.com/t/retrieving-mfa-status-via-api/89759/4](https://forum.gitlab.com/t/retrieving-mfa-status-via-api/89759/4)  
