# OpenSSF Scorecard Meeting Archive — 2023

## 2023-12-14

Attendees:

* Adrianne Marcum (OpenSSF)  
* Jeff Mendoza (Kusari)  
* Stephen Augustus (Cisco)  
* Pedro Nacht (Google)  
* David A. Wheeler (OperSSF)  
* Raghav Kaul (Google)  
* Sarah Elder (NCSU)


  
Regrets

* 

New Attendees

* Lauri Apple

Agenda 

* There’s been some repo sprawl (multiple Scorecard-related repos). Some blocked because we don’t have a project charter so we “don’t exist” \- being fixed  
* Scootrs \- tries to do “all you should do when creating a project”  
  * URL: [https://github.com/kusaridev/skootrs](https://github.com/kusaridev/skootrs)  
* Stephen: There is interest in getting people involved in Scorecard dev/ tackling backlog  
* Backlog refinement, prioritization, and roadmapping  
  * Work done so far (review of 100 issues, starting with oldest): [https://docs.google.com/spreadsheets/d/1UuKvZLlWyIMVkXIz1CqGWPYV\_\_f0xssldbayUOqIs04/edit](https://docs.google.com/spreadsheets/d/1UuKvZLlWyIMVkXIz1CqGWPYV__f0xssldbayUOqIs04/edit)   
  * Needed: a few volunteers to help review items together (will probably take 2-3 hour-long sessions) to generate more “why”/what problem are we solving-related context. Then we can shape a roadmap.  
  * Would be helpful to have existing architecture diagrams and overview of what is intended to be accomplished with Scorecard  
  * Would be helpful to have improved Issue templates to better pull out the why/problem being solved from the request  
  * Adrianne will post Doodle poll in Slack channel for initial review session in the new year  
* CRob & David A. Wheeler suggested measuring knowledge on how to develop secure software  
  * [https://github.com/ossf/scorecard/issues/3534](https://github.com/ossf/scorecard/issues/3534)  
  * We intend to research to see how to automatically determine educational knowledge \- there’s at least one REST interface  
    * Looking for ways to checking for certification without compromising developer privacy  
  * There was 1 person originally resisting this, but that person seems to have been satisfied & we don’t need unanimous agreement anyway.  
  * David intends to start investigating this (probably Jan 2024\)  
  * Stephen: Supportive in principle but the devil is in the details  
  * Key issue: We want equity, let’s find multiple test/courses so we’re agnostic / not requiring just one system. Also; many developers are self-taught, don’t want to exclude them.  
  * 

## 2023-12-11

Attendees:

* Adrianne Marcum (OpenSSF)  
* Ian Dunbar-Hall (Lockheed Martin)  
* Allen Shearin (Lockheed Martin)  
* Joe Coyle (Lockheed Martin)  
* Juanita Gomez (UCSC)  
* Sarah Elder (NCSU)  
* David A. Wheeler (OpenSSF)


  
Regrets

* 

Announcements

* Thursday 1-2pm PST meeting has been restored to Biweekly

Agenda & Meeting Notes

* Ian Dunbar-Hall: Between Security-Insights doc & SBOM Naming convention document, this is a good time to have a uniform approach \- e.g., how do we make these projects work together  
  * E.g., should we measure SBOM quality? E.g., sbom-scorecard? Not sure  
  * We now have 2 different ways to record SBOMs \- we should be consistent.  
  * IT’d be nice to have a way to measure impact.  
  * Need to get a group together to identify & hash out any issues  
  * [https://github.com/ossf/scorecard/issues/3574](https://github.com/ossf/scorecard/issues/3574)  
  * Ian will work with SBOM Everywhere SIG to determine recommendations on what to implement  
  * Adrianne can coordinate a cross-group meeting once recommendations are determined  
* CRob & David A. Wheeler suggested measuring knowledge on how to develop secure software  
  * [https://github.com/ossf/scorecard/issues/3534](https://github.com/ossf/scorecard/issues/3534)  
  * We intend to research to see how to automatically determine educational knowledge

## 2023-11-30

Attendees:

* Spencer Schrock (Google)  
* Bennett Pursell (OpenSSF)  
* Gabriela Gutierrez (Google)  
* Pedro Nacht (Google)  
* Joyce Brum (Google)  
* Georg Kunz (Ericsson)  
* Ryan Ware (Intel)  
* Allen Shearin (Lockheed Martin)  
* Jeremy Katz (Tidelift)  
* Brian Crooks (Datalytica)

Regrets

* Adrianne Marcum (OpenSSF) \- will be late if I can attend

Announcements

* Thursday 1-2pm PST meeting has been restored to Biweekly; will continue to monitor attendance for monthly EMEA Monday 7-8am PST meetings  
* In an effort to trademark the project as “OpenSSF Scorecard,” the domain will be updated to scorecard.dev and other uses of the name will be changed to the singular form (ex: slack channel). Timeline is still being determined and more details will be shared.  
  * Goal is to give ample time for migration, e.g. redirects 

Agenda

* \[Gabriella\] Maintainer Annotations  
  * [Maintainers annotation](https://docs.google.com/document/d/1-5NKRciF3qU-vLS4xPk48EDfC8isz0Z9vnvL4OVjwpQ/edit)   
    * Similar to CNCF CLOMonitor exemptions [link](https://github.com/cilium/cilium/pull/22371/files)  
    * Comments to the [tracking issue](https://github.com/ossf/scorecard/issues/1907)  
* 

## 2023-11-13

Attendees:

* Adrianne Marcum (OpenSSF)  
* Georg Kunz (Ericsson)  
* Allen Shearin (Lockheed Martin)  
* 

Regrets

* 

Announcements

* Adrianne proposes including the EMEA Monday instance as a once/monthly meeting and moving the Thursday afternoon instance back to biweekly

Agenda

* ~~\[Gabriella\] Maintainer Annotations~~ Moved to Nov 30?  
* Request for available tooling to ease widespread adoption in large organizations [https://openssf.slack.com/archives/C0235AR8N2C/p1698669830558059](https://openssf.slack.com/archives/C0235AR8N2C/p1698669830558059)  
  * Planning to look into Scorecard Monitor and Scorecard API Visualizer

## 2023-11-02

Attendees:

* Spencer Schrock (Google)  
* Jeff Mendoza (Kusari)  
* Ian Dunbar-Hall (Lockheed Martin)  
* Allen Shearin (Lockheed Martin)  
* Sarah Elder (NCSU)  
* Keith Ganger (Lockheed Martin)  
* Michael Goddard (Google)  
* Adrianne Marcum (OpenSSF)


Regrets:

* David A. Wheeler (burial)

Agenda:

* \[Spencer\] scdiff demo of draft PR [https://github.com/ossf/scorecard/pull/3640](https://github.com/ossf/scorecard/pull/3640)  
* \[Spencer\] Contributor.md and ladder changes  
  * Looking at all of our issues labels  
  * Trying to make it easier for new contributors to be added, if ready

## 2023-10-16

Attendees:

* David A. Wheeler  
* Daniel Appelquist (Snyk)  
* Dana Wang (OpenSSF)  
* Joseph Coyle (Lockheed Martin)  
* Caroline Lee (IBM)  
* Ian Dunbar-Hall (Lockheed Martin)

Agenda:

* Welcome new friends  
  * Joe \- arrived last time, developing Hopper (under Ian). Trying to re-engage  
  *   
* Education (SOSS follow-on)  
  * In SOSS meeting \- Meeting in DC \- US Govt [https://openssf.org/press-release/2023/09/13/openssf-gathers-us-government-and-industry-leaders-at-secure-open-source-software-summit-2023/](https://openssf.org/press-release/2023/09/13/openssf-gathers-us-government-and-industry-leaders-at-secure-open-source-software-summit-2023/)   
  * [https://github.com/ossf/scorecard/issues/3534](https://github.com/ossf/scorecard/issues/3534)   
  * Education a key topic \- lots of developers don’t know how to write secure software .. how can we measure how many developers know how to write secure software … look for credentials, etc… How can we get that into ScoreCard?  
  * DW: Look for “did developer complete something”... look at “who are the maintainers” then call API to find if developers have certifications… Could be an intermediate step \- if it’s on github or gitlab \- you can get the email address and query for credentials…  
  * Dana: do we plan to have certificates like AWS \-   
  * DW: yes they already exist \- i’m thinking of cert of completion of the “fundamentals” course.. Other certifications exist…  
  * Dan: worried about false negatives…  
  * DW: yes false \+ and \- are a concern… a way to solve this in many cases … We have another database \- the LF’s database \- if you’ve logged into the LF platform (events, etc…) you can identify personal and work email addresses… Can answer “do they have a cert” in the LF database…  
  * Dan: *concerns about data protection \- primary uses, etc…*  
  * DW: totally agree we need to keep in mind \- however much of this data is public by design…  
  * DW: course I’m thinking about \- fundamentals course \- has zero cost…  not “pay to play”...  
  * Dan: what’s the process? Is there a scorecard sandbox?  
  * Ian: we’ve always worked locally and then one of the maintainers validates the work… Not a separate processing queue for items we want to track but not to be incorporated into scoring yet…  
  * Ian: i like this idea \- we brought up a similar experimental feature… ties into training, etc… we need to come to an understanding with maintainers… there’s a good amount of stuff that scorecard could track \- recommendations \- how do we track these?  There’s some resistance to adopting things …   
  * Dan: i can understand reluctance to adopt things \- e.g. SBOm \- into scorecard if they are not sufficiently mature…  
  * Dana: could we still track it and collect that data but make it an optional reporting…  
  * DW: if it’s not included in the measure than it doesn’t exist…  if it’s measured but ignored, why? I think we’re measuring things that are overly narrow. Only process things.   
  * \[Dan: maybe score it but not include it in the aggregate score until “out of beta”?\]  
  * New check process \- [https://github.com/ossf/scorecard/blob/main/checks/write.md](https://github.com/ossf/scorecard/blob/main/checks/write.md)  
  * Dana: measuring people vs. measuring projects.. Scorecard is measuring the project.   
  * DW: trying to determine an answer to a risk question… “is this safe?” which is a broader question…  
  * Ian: really interested in seeing SBOM included in Scorecard… Now solving that issue with the naming conventions thing… Reading the process \- talks about high level requirements \- but doesn’t talk about it’s voted in or rejected…   
  * DW: usually you have to convince the maintainers… often in a github issue.  
  * Dan: sounds like it’s based on project \- an aggregate score of the maintainers of a project rather than a score about individual developers/maintainers.  
  * DW: could even be “at least one maintainer has xyz certification” Opening it up : what do people think of education…? Appreciate SBOM is a little more complicated…   
  * Dan: i do think it’s worth tracking…  
  * Ian: i think it’s a good idea \- in line with other activities in OpenSSF \- also concerned about data protection.  
  * DW: I can talk to data protection officer and legal.  
  * Dana: if we look at build process or release process we look at project itself \- project achieving the maturity level \- all around the project itself \- and the people are behind it.  
* Hoppr \- (Joseph Coyle) \- Allen Shearin  
  * Maybe an SBOM-Scorecard effort as well  
  * We’d done work on GitLab. Working on O\&M. They’re known issues that are being tracked already.  
  * Ian: with sbom everywhere coming out with naming conventions … specific place to check for SBOMs… becomes more machine-readable. Very interested in seeing that happen and will dedicate resources to see it happen. Would be great to show coordination across workstreams.  We can bring the issue and start the discussion going.  
  * DW: I think some pushback will happen because this is so new… developers not seeing value yet… we’re trying to get basic agreement…  Should we have SBOMs included in the source code at all? Challenge to come up with something people can agree on. But it might be the right time. I suggest writing a doc “this is what we intend to look for”... probably need to figure out the requirements.  
  * Ian: SBOM everywhere SIG has written it \- and may take it to the TAC for informal approval \- it outlines the \- and security insights spec. We’ll have specific guidance on where to look to find SBOMs…Would love to see this be a common thread across OpenSSF… To help encourage best practices across the industry…  We should check even if take up is low at this time… But could be experimental…  
  * Dan: there’s a runway… also build processes / CICD pipeline needs updated  
  * Dana: we have to start from somewhere… Using SLSA maturity level \- level 1 is “it exists” and where does it exist \- lower hanging fruit \- then mature to the more advanced level… then advance to next stages of maturity.  
  * Ian: project to help OSS projects to adopt SBOMs \-   
* Question on event-based mechanism for changes for API (pub/sub)? \- Dan  
  * Is there a way to be notified about a change to a Scorecard result?  
  * E.g., “well-known package X has a lower score now” (hijacked?)  
  * We could create a query, but looking more for a callback.  
  * David: I don’t know of one  
  * Dan: will bring this up in the github issues for the project. ✨  
* Any other business (AOB)

## Oct 5, 2023

Attendees:

* Ian Dunbar-Hall (Lockheed Martin)  
* Sarah Elder (NC State University)  
* Allen Shearin (Lockheed Martin)  
* Joe Coyle (Lockheed Martin)  
* Jeff Mendoza (Kusari)  
* Keith Ganger (Lockheed Martin)  
* Spencer Schrock (Google)   
* Evan Anderson (Stacklok)  
* Victor Lu (?)  
* Caroline Lee (IBM)  
* Laurent (?)

Agenda:

* Welcome new friends  
  * Allen Shearin  
  * Joe Coyle  
* Discuss adding a new check that detects if a project has an SBOM. (see previous discussion in this document from April, May and June)  
  * [SBOM Everywhere SIG \- SBOM Naming Conventions Document](https://docs.google.com/document/d/1-jFoh_R7FV4NhHuUkt4Atz3h4K9b4bnmolntSbytspE/edit)  
  * If Scorecard can confidently say something is not a library, people are more amenable to having it as a check for release artifacts  
    * For libraries, there is a discussion needed. Laurent to discuss with WG  
* On a similar point to unity across the OpenSSF, Security Insights  
  * See, related issues in scorecard [https://github.com/ossf/scorecard-webapp/issues/478](https://github.com/ossf/scorecard-webapp/issues/478)   
  * FYI: Security Insights \+ CLOMonitor ([https://clomonitor.io/docs/topics/checks/\#security-insights](https://clomonitor.io/docs/topics/checks/#security-insights))  
* For future discussion (with David \+ CRob) [https://github.com/ossf/scorecard/issues/3534](https://github.com/ossf/scorecard/issues/3534)  
*   
* GitTuf ([https://github.com/gittuf/gittuf](https://github.com/gittuf/gittuf)) is moving to OpenSSF (SCI wg?). Makes sense to have as an Allstar policy ([https://github.com/ossf/allstar/issues/459](https://github.com/ossf/allstar/issues/459))  
  * Branch Protection audit at the git level (as opposed to GitHub/ GitLab preventing something)  
* 

## Sep 18, 2023

Attendees:

* Adrianne Marcum (Linux Foundation)  
* Sarah Elder (NC State University)

Agenda:

* Welcome new friends  
  * Sarah Elder \- interested in validation of metrics  
* No other attendees due to OSS-EU \- convened after 10 min 

## Sep 7, 2023

Attendees:

* Jeff Mendoza (Kusari)  
* David A. Wheeler (Linux Foundation)  
* Spencer Schrock (Google)  
* Andres Orbe (graduate / Alpha-Omega project)  
* Adrianne Marcum (Linux Foundation)  
* Raghav Kaul (Google)  
* Evan Anderson (Stacklok)  
* Caroline Lee

Agenda:

* Welcome new friends  
  * Welcome Andres\! Has worked on Alpha Omega, and learning about the rest of the OpenSSF  
* Announcements / Updates  
  * Allstar: looking into a couple of issues:  
    * [https://github.com/ossf/allstar/issues/442\#issuecomment-1702520347](https://github.com/ossf/allstar/issues/442#issuecomment-1702520347)  
    * [https://github.com/ossf/allstar/issues/445](https://github.com/ossf/allstar/issues/445)  
  * Scorecard:  
    * Blog: [OpenSSF Scorecard Launches v4.12 with Support for GitLab](https://openssf.org/blog/2023/08/28/openssf-scorecard-launches-v4-12-with-support-for-gitlab/)  
      * More GitLab contributions welcome\! Especially with Dangerous-Workflows and Pinned-Dependencies checks, or adding repos to scan in the cron to gitlab-projects.csv.  
    *   
* David A .Wheeler: Best Practices badge:  
  * Badge website has now moved to [https://www.bestpractices.dev](https://www.bestpractices.dev), Scorecard probably ought to change the URL where we get best practices info from (the old URL is being redirected so there’s no rush, but it’d be a tiny performance boost).  
    * Someone has opened a [PR](https://github.com/ossf/scorecard/pull/3448), waiting on DCO  
  * Also, the badge project intends to bring data from Scorecard to automate some of our questions, per this mapping: [https://github.com/coreinfrastructure/best-practices-badge/blob/main/docs/scorecard-map.md](https://github.com/coreinfrastructure/best-practices-badge/blob/main/docs/scorecard-map.md)  
  * CRob & I will talk about Scorecard & Best Practices badge at conference in Spain in 2 weeks  
    * Link?  
  * Question: What is the difference between the badges?  
    * BP is a “badge”, Scorecard is a “scorecard” \- but you can have a badge that shows the scorecard  
    * Will continue to have both “badges”, Scorecard for automated, BP includes non-automated  
    * Q: Could scorecard read some kind of human-generated yaml-file to address non-automated attestations?  
    * Q: Would like to point devs to a single place to get better at security, and different BP and scorecard are different  
    * Starting point is Secure software guide: [https://best.openssf.org/Concise-Guide-for-Developing-More-Secure-Software](https://best.openssf.org/Concise-Guide-for-Developing-More-Secure-Software) Recommend this as a single “Staring point” for devs.  
    * Scorecard is an easy single point to direct devs to get better at security as it is fully automated.  
    * BP should be just as easy, even if there are many questions, can just do some  
    * Scorecard does give a score on having BP badge  
    * Q: Which order, is it right to start with scorecard?  
    * Either order is good.  
    * Q: We should have a good place to start, elevator pitch, easy then continue with more advanced things  
    * **How about: “start with scorecards”? BP is included in scorecards, so that will lead folks there**  
    * Scorecards is adding a “remediation effort” estimate so people can sort by amount of effort to achieve an improved score.  
    * Can we make it easy to get scorecard information without needing to install / run / modify CI, since we have a lot of the scores already?  
      * Aka point to [https://securityscorecards.dev/viewer/?uri=github.com/ossf/scorecard](https://securityscorecards.dev/viewer/?uri=github.com/ossf/scorecard)   
      * ~~Put this at top of README.md, e.g.~~ viewer instead, form not allowed  
        * \<form action=”[https://securityscorecards.dev/viewer](https://securityscorecards.dev/viewer)” method=”get”\>URL: \<input type=”text” name=”url”\>\<input type=”submit”\>\</form\>  
      * [https://github.com/ossf/scorecard-webapp/tree/main/scorecards-site/static/viewer](https://github.com/ossf/scorecard-webapp/tree/main/scorecards-site/static/viewer)    
    *   
* Vendor news  
  * Officially started last week, roadmap defined and approved.  
    * [Scorecard Community Roadmap](https://docs.google.com/document/d/1ttLH1U4BRZkgVukBltLxKyP7UmFSLIyPtUUe1G86Sv0/edit#heading=h.ou02ukhsja30)  
  * Working on moving checks structured results?  
  * Also, false positives and negatives  
* 

## Aug 24, 2023

Attendees:

* David A. Wheeler (LF)  
* Ian Dunbar-Hall (Lockheed Martin)  
* Raghav Kaul (Google)  
* Evan Anderson (Stacklok)

Agenda:

* GitLab Namespace Squatting  
  * [https://gitlab.com/ossf](https://gitlab.com/ossf)  
  * [https://gitlab.com/openssf](https://gitlab.com/openssf)  
* GitHub Namespace squatting recently resolved (it’s why we’ve been using “ossf” organization)  
  * Slack conversation \- [https://openssf.slack.com/archives/C05BETTLHEE/p1690586545571689](https://openssf.slack.com/archives/C05BETTLHEE/p1690586545571689)   
  * Sam White is GitLab product manager for “security product line”. We asked about GitLab squatting.  
    * [https://openssf.slack.com/archives/C052Z3A3FQA](https://openssf.slack.com/archives/C052Z3A3FQA)  
* The blog post announcing Scorecard 4.12, including GitLab support, is basically done. Need a bio from Keith Ganger & Jim Robison. Ian is trying to reach Keith & Jim now.  
* 

Actions:

- Ian Dunbar-Hall \- provide Sam White contact info to David Wheeler. David’s email: dwheeler @ linuxfoundation . org  
- Ian Dunbar-Hall \- track down keith and jim’s bios for blog post.

## Aug 21, 2023

Attendees:

* Dan Appelquist (Snyk)  
* David A. Wheeler (LF)  
* Adrianne Marcum (LF)  
* Cheuk Ho (LF)

Agenda:

*  Announcements  
  * Vendor contract process underway for [work outlined in the roadmap](https://docs.google.com/document/d/1ttLH1U4BRZkgVukBltLxKyP7UmFSLIyPtUUe1G86Sv0/edit#heading=h.ou02ukhsja30), we’ve interviewed potential contractors  
*  [https://github.com/ossf/scorecard/pull/3107](https://github.com/ossf/scorecard/pull/3107)  
  * All resolved, we just need to make sure the checks all pass  
  * David W. to merge once the checks run

## Aug 10, 2023

Attendees:

* Jeff Mendoza (Kusari)  
* Spencer Schrock (Google)  
* Pedro Nacht (Google)  
* Diogo Teles (Google)  
* David A. Wheeler (LF)  
* Adrianne Marcum (LF)  
* Cheuk Ho (LF)  
* Evan Anderson (Stacklok)

Agenda:

*  Announcements  
  * New meeting link\! Should be updated on the calendar. More details in slack [\[link\]](https://openssf.slack.com/archives/C019M98JSHK/p1691174555715859)  
    * \[Evan\] calendar seems to still have old link  
    * \[Evan\] Need LFX account to join
  * \[Spencer\] First contributor ladder nomination: Invited Gabriela as Triager [\[link\]](https://github.com/ossf/scorecard/issues/3375)  
  * \[Spencer\] WIP: GitHub support for Repository Rules [\[link\]](https://github.com/ossf/scorecard/pull/3354)  
    * Still working with author, but should help with Branch-Protection permissions in cron/action  
  * Allstar: [https://github.com/ossf/allstar/releases/tag/v4.0](https://github.com/ossf/allstar/releases/tag/v4.0) was released, includes an alternative container that includes busybox image for easy use as a GitHub Action. ([https://github.com/ossf/allstar/pull/441](https://github.com/ossf/allstar/pull/441))  
  * Roadmap approved by Best Practices WG, reviewing issues in backlog, vendor selection in process  
* \[Spencer\] Re DNS problem from last meeting:  
  * Two new health checks for the API and website added in GCP.   
  * Notification channel currently \#security\_scorecards\_cron in Slack  
  * Any other emails? Maybe a new Scorecard monitoring google group people can sign up to?  
* Alternating meeting times decided:  
  * Pacific time stays the same as current  
  * Europe time Monday at 2pm GMT (Aug 21\)

## Jul 27, 2023

Attendees:

* Jeremy Katz (Tidelift)  
* Ian Dunbar-Hall (Lockheed Martin)  
* Keith Ganger (Lockheed Martin)  
* Adrianne Marcum (LF)  
* Spencer Schrock (Google)  
* Brian Russell (Google)  
* Caroline Lee (IBM)   
* Jeff Mendoza (Kusari)  
* Eddie Knight (Sonatype)  
* David A. Wheeler (Linux Foundation)  
* Sammy Gonzalez (Lockheed Martin)  
* Raghav Kaul (Google)

Agenda

* DNS Problem  
  * For \~13 hours there was a disconnect. If you had any Scorecard Action runs fail, that’s why, everything should be good now. I imagine there will be a postmortem.  
* Scorecard Mentioned in [https://resources.snyk.io/state-of-open-source-2023](https://resources.snyk.io/state-of-open-source-2023).  
* Should we have a “Scorecard in the news” page? Yes, but not that name. “Notable references to Scorecard”?  
* Eddie Knight: Through education SIG etc., will be making a “Scorecard course” \- need someone to review it. It’s not complex, it mostly translates docs to another format. Want someone to review before sending it back to LF Training.  
  * Spencer: I’ll volunteer  
  * David A. Wheeler: I’d like to also look, especially to make sure it connects to other materials.  
* What about personal access tokens? I’ve always done the GitHub action before. But now that I’m describing how to use the CLI, I get a lot of errors. See issue \#1097, [https://github.com/ossf/scorecard/issues/1097](https://github.com/ossf/scorecard/issues/1097)  
  * Branch Protection in particular  
  * With transition to fine-grained permissions of tokens, we think this works well if you have admin access to the repo, it’s trickier if you don’t have that level access. If you do a classic token it’ll work, the problem with these tokens is that they give write access which many people won’t be comfortable with. See the README on tokens. See the scorecard-action info.  
* Take the doodle poll on meeting times, we are looking at alternating time slots for more globally friendly timezones  
  * Pacific \+ US west [poll](https://doodle.com/meeting/participate/id/dN0nO5za)  
  * Europe \+ US East [poll](https://doodle.com/meeting/participate/id/bD87qJnb)  
* GitLab release incoming  
  * Any documentation for GitLab auth token  
  * Doc to hook up to GitLab cicd system? It’d be good to document the basics (how to hook into CI/CD & how to show that from the README) \- it’s probably just a few lines of config in each, but people are more likely to do it if we explain it directly.

## Jul 13, 2023

Attendees:

* Spencer Schrock (Google)  
* Pedro Nacht (Google)  
* Diogo Teles (Google)  
* Laurent Simon (Google)  
* Caroline Lee (IBM)  
* Ian Dunbar-Hall (Lockheed Martin)  
* Jonathan Howard (Lockheed Martin)  
* Evan Anderson (Stacklok)  
* Jeff Mendoza (Kusari)  
* Adrianne Marcum (LF)  
* Keith Ganger (Lockheed Martin)  
* David A. Wheeler (LF)  
* Joyce Brum  
* Brian Russell (Google)  
* Raghav Kaul 

Regrets:

*  

Agenda:

* Welcome new friends  
  * Adrianne Marcum \- OpenSSF Tech PM  
  * Jonathan Howard (Lockheed Martin)  
* Announcements  
* \[Spencer\] Change in Dangerous-Workflow and Token-Permissions scores for repos with no workflows ([issue link](https://github.com/ossf/scorecard/issues/3205))  
  * David \- at least score somewhere on the 0 \- 10 scale  
  * Dangerous CI/CD on other platforms is something that could happen in the future  
    * Possibly through structured results  
* \[Pedro\] Should Dependency-Update-Tool require a dependabot.yml file to detect Dependabot? Or should having Dependabot security updates be sufficient? ([issue link](https://github.com/ossf/scorecard/issues/2845))  
  * Dependabot.yml is currently optional, used as a detection signal in addition to commit activity  
    * Problem is repos that have enabled dependabot once X years ago and havent since  
    * Score decay?  
  * If required, does it change what the D-U-T check is checking?  
    * Dependency tool to mitigate security vulns  
    * Dependency tool to keep all dependencies up-to-date where reasonably possible  
  * What happens with an empty dependabot.yml?  
    * Need to test  
* \[From Stephen Augustus via Slack\] In-person meeting w/ Adrianne Marcum & Brian Russell tomorrow to strawman the community roadmap  
* \[Laurent\] Status on alternating times for different timezones? Doodle shared?

## Jun 29, 2023

**Attendees:**

Please add an “X” for those present.

| Present? | Name | Organization |
| ----- | :---- | :---- |
| X | Brian Russell | Google |
| X | David A. Wheeler | Linux Foundation |
| X | Raghav Kaul | Google |
| X | Evan Anderson | Stacklok |
| X | Laurent Simon | Google |
| X | Dan Appelquist (Snyk) | Snyk |
| X | Christine Abernathy | F5 |
| X | Victor Lu |  |
| X | Sanket Naik | Palosade |
| X | Stephen Augustus | Cisco |

Attendees:

* Evan Anderson  
* David Wheeler  
* Christine Abernathy  
* Laurent  
* Victor Lu  
* Christine Abernathy (F5)  
* Sanket Naik (Palosade)

Regrets:

* Jeff Mendoza (Kusari) \- Under the weather  
* Jeremy Katz (Tidelift) \- Vacation  
* Spencer Schrock (Google) \- Vacation

Agenda:

* Welcome new friends  
  * Dan Appelquist  
  * Evan Anderson  
* Announcements  
  * Introductions  
    *   
  * Project updates  
    * Announcement: Donation of visualizer [https://github.com/ossf/scorecard/issues/3204](https://github.com/ossf/scorecard/issues/3204) by nodejs team.   
* ✅ Possible to alternate call times to accommodate European time zones? \- Dan Appelquist (resident troublemaker)  
  * Dan: We’re heavily EU-centered. I chatted with Laurent re: remediation links. This is currently 9pm London time.  
  * Stephen Augustus:  
    * Thursdays are triply booked for me\!  
    * Kubernetes release team ended up switching to Eastern / EMEA for one and Pacific / APAC for the other  
  * The hardest is that we need to overlay times with maintainer facilitation availability.  
  * [https://www.timeanddate.com/worldclock/meeting.html](https://www.timeanddate.com/worldclock/meeting.html)  
  * Two Doodle polls:  
    * For the Pacific / US-West audience (incl. Sydney) we have now  
    * For the Europe / US-East (incl Israel)  
* ✅ Remediation of [links to external commercial sites](https://github.com/search?q=repo%3Aossf%2Fscorecard%20stepsecurity&type=code)… \- Dan Appelquist  
  * Someone saw a trace of Scorecard run, raised alarm for [https://stepsecurity.io/](https://stepsecurity.io/) (product) URL.  
  * In the SCM best practices WG, we’re working with Legitify who developed many remediation steps for SCM which were contributed & those are sitting in GitHub.  
  * It would be good for Scorecard to NOT send people to commercial sites. Instead, refer to the OSS site.  
  * It’s happening within the \*remediation\* text. Legity can process & do a “hardened” repo.  
  * Let’s create an issue to id & resolve this. Dan will create the issue.  
  * SCM Best practices can be found here: [wg-best-practices-os-developers/docs/SCM-BestPractices at main · ossf/wg-best-practices-os-developers · GitHub](https://github.com/ossf/wg-best-practices-os-developers/tree/main/docs/SCM-BestPractices) and at its new home .. somewhere.  
* ✅ Announcement: Donation of visualizer [https://github.com/ossf/scorecard/issues/3204](https://github.com/ossf/scorecard/issues/3204) by nodejs team.  
  * Stephen Augustus will follow up on this with the TAC  
  * May not have a well-defined / easy process  
* ✅ Licensing of API Data \- [https://github.com/ossf/scorecard/pull/3107](https://github.com/ossf/scorecard/pull/3107) \- Dan Appelquist  
  * Just noting I’m happy to clarify this issue or help in any way if needed…  
  * In the Legal Jira world  
  * David has re-contacted LF legal to get more info  
* ✅ (Brian Russell) [project roadmap](https://drive.google.com/file/d/1DJJh-9XyLPtSIdcBZZrMg0G4tNlOzxqc/view?usp=sharing) (first pass / discussion kickoff)  
  * TL;DR: Known contributions \+ Google (GOSST) team commitments \+ OpenSSF contracted vendors  
  * Addition: OpenSSF Raising test coverage to 80%+ statement coverage  
  * Additions: Integrating BigQuery & project-run results  
  * How can we show “gradual improvements” \- handle/detect more CI/CD (CircleCI, Jenkins, etc), more test frameworks, more SAST tools \- maybe show the “by this point” milestone  
* ✅ \[Christine Abernathy\] Thoughts on publishing Scorecard results in  places other than BigQuery?  
  * What formats / locations?  
  * Have a transfer job that weekly transfers data from 1.XM repos from GCS to a BigQuery table which is publicly queryable  
    * Could probably support other transfer mechanisms  
    * They can run up a bill somewhere in GCP when copying / querying\!\!  
  * `Api.securityscorecards.dev` \- where does it pull data?  We believe it reads from GCS blobs, not from BigQuery.  
    * Or maybe somewhere else  
  * Where do we pass costs off to the consumer?  
  * May need to create an issue to work out use cases \- Christine will file  
  * ​​Dan created this demonstrator: [https://github.com/torgo/Scorecard4Purl](https://github.com/torgo/Scorecard4Purl)  
  * [https://github.com/ossf/wg-best-practices-os-developers/tree/main/docs/SCM-BestPractices](https://github.com/ossf/wg-best-practices-os-developers/tree/main/docs/SCM-BestPractices)  
*  Evan Anderson Where does the infrastructure (particularly `allstar`) run?  
  * Want to be able to verify that community-run public benefit instances are being managed consistently  
  * `allstar`: Google runs an instance, not clear who runs the public instance  
    *  Evan Anderson to file an issue

## Jun 15, 2023

Attendees:

* Spencer Schrock (Google) \- a Scorecard maintainer\!  
* Pedro Nacht (Google)  
* Diogo Sant Anna (Google)  
* Brian Russell (Google)  
* Jeremy Katz (Tidelift)  
* Ashish Kurmi (StepSecurity)  
* Jim Robison (Lockheed Martin)  
* Lucas Gonze (eBay)  
* Jeff Mendoza (Kusari)  
* David A. Wheeler (Linux Foundation)  
* Ian Dunbar-Hall (Lockheed Martin)  
* Michael Goddard (Google)  
* Raghav Kaul (Google)  
* Caroline Lee (IBM)

Agenda:

* \[Spencer\] Golden test tool proposal  
  * GitHub issue: [CI: Report scoring differences for PRs that modify scorecard checks](https://github.com/ossf/scorecard/issues/2462)  
  * [Scorecard Golden Testing Design Document](https://docs.google.com/document/d/1xbk036RCVr5yUCU2NfjDzNAkT8oSRcDFmucUAXjQgaQ/edit?usp=sharing)  
* \[Diogo\] [Allow unpinned dependencies in the selection of unprivileged workflows](https://github.com/ossf/scorecard/issues/2018) – workflows with read-only permissions and no secrets  
  * Current blocker is that actions/upload-artifacts can still be called with read-only permissions and the artifacts can be used for critical processes, e.g. builds. Example: [This](https://github.com/pyca/cryptography/blob/main/.github/workflows/wheel-builder.yml#L43) piece of code uploads a python build artifact that is used by [this other workflow](https://github.com/pyca/cryptography/blob/main/.github/workflows/pypi-publish.yml#LL28C56-L28C56) to publish it.  
  * “Don't punish but throw a warning.”  
  * Who is this for? Developers? Auditors?  
    * Should there be a confidence level for analysis to switch between permissive/restrictive?  
  * We should DOCUMENT what we do when we’re not sure, in particular, the general rule. Should we err on caution or permissive?  
    * False positives negatively affect people’s view on Scorecard  
    * Proposed documented statement: “When we aren’t sure if there’s a problem or not, by default we presume it’s okay, and we’ll output a warning that we can’t determine something”  
    * Maybe have a flag for “only give credit when there’s confidence in it”  
    * Raghav Kaul: “Structured results feel like they'd go a long way here, we'd create findings and a maintainer can choose what to ignore. I wish there were a threat mapping/threat model of GitHub API permission levels and what a given permission allows you to do. If someone knows of something like this, it would really help to encode it into scorecard.”  
    * Not very elegant, but this shows what endpoints are accessible:  
      * for a classic token: [https://docs.github.com/en/rest/overview/permissions-required-for-github-apps?apiVersion=2022-11-28](https://docs.github.com/en/rest/overview/permissions-required-for-github-apps?apiVersion=2022-11-28)  
      * for fine-grained tokens: [https://docs.github.com/en/rest/overview/permissions-required-for-fine-grained-personal-access-tokens?apiVersion=2022-11-28](https://docs.github.com/en/rest/overview/permissions-required-for-fine-grained-personal-access-tokens?apiVersion=2022-11-28#actions)  
    * The decision doesn't need to be binary, as either restrictive or permissive. We could decrease at least a low amount of score (e.g. 0.2 or 0.5) for unpinned read-only actions. That would keep scorecard impartial on possible security risks, and maintainers that'd rather not hash-pin safe dependencies could still be cool with a 9/10 score.  
* \[Ashish\] Potential updates in StepSecurity remediation page  
  * We have noticed that open-source maintainers get confused when they visit the current StepSecurity remediation page from scorecard findings. We have an alternate workflow that we can enable on the current page to simplify the user experience.  
    * Proposing sending people towards the PR generating tool  
    * Maybe switch up which remediations are enabled by default  
      * I.e. if coming from a token permission issue, only have the token permissions on by default. But other remediations are available to enable.  
    * Is there functionality remaining for people not logged in? Even if it’s the same landing page  
* \[Jeff\] [https://github.com/ossf/allstar/issues/422](https://github.com/ossf/allstar/issues/422)  
  * [https://github.com/ossf/allstar/pull/424](https://github.com/ossf/allstar/pull/424)   
* \[MichaelG\] Contributor ladder (see draft in [\#1529 (comment)](https://github.com/ossf/scorecard/issues/1529#issuecomment-1572664893))  
  * Feedback / next steps?  
  * TAC feedback  
    * Contributor ladder is nice to have for all ossf projects, and how people can become maintainers  
    * But the proposal is too detailed to apply to all projects, especially smaller ones. So the proposal in question should be viewed as scorecard specific.  
* \[DavidW\] I’d like to change our Scorecard meeting note permissions; currently they are “edit by all”. I want to switch to “comment by all” to prevent problems from trolls. Can everyone share your email address so we can set everyone here can edit?  
  * Do you want to limit edit permissions to the [https://groups.google.com/g/ossf-scorecard-dev](https://groups.google.com/g/ossf-scorecard-dev)?  
    * I’m not sure I can do that now that it’s moved to OpenSSF’s drive. Pointers?  
    * I shared it as “editor” to: [ossf-scorecard-dev@googlegroups.com](mailto:ossf-scorecard-dev@googlegroups.com) \- if that’s enough then we’re done, not sure that’s enough.  
      * \[Brian Russell\] I think that should work  
    * Looks like it works\! Now everyone can “suggest” but we’re more careful about who can edit.  
    * David: I’m not worried about the people present.  
* David: The OpenSSF critical projects WG has developed a draft updated list of “critical OSS projects” for 2023\. Can we make sure that all projects in their list (where specific GitHub repos are referenced) is included in the weekly run? Below is the list of repos. I expect many are already there, but possibly not all.  
  * MichaelG: looks like they are all there  
  * Thanks for checking\!\!

Here is the list that was checked:  
https://github.com/angular/angular  
https://github.com/ansible/ansible  
https://github.com/ant-design/ant-design  
https://github.com/caolan/async  
https://github.com/babel/babel  
https://github.com/twbs/bootstrap  
https://github.com/Homebrew/brew  
https://github.com/ceph/ceph  
https://github.com/chromium/chromium  
https://github.com/Kitware/CMake  
https://github.com/veged/coa  
https://github.com/apache/commons-codec  
https://github.com/apache/commons-io  
https://github.com/apache/commons-lang  
https://github.com/home-assistant/core  
https://github.com/python/cpython  
https://github.com/curl/curl  
https://github.com/DefinitelyTyped/DefinitelyTyped  
https://github.com/drupal/drupal  
https://github.com/electron/electron  
https://github.com/flutter/flutter  
https://github.com/laravel/framework  
https://github.com/gatsbyjs/gatsby  
https://github.com/gradle/gradle  
https://github.com/grafana/grafana  
https://github.com/google/guava  
https://github.com/Homebrew/homebrew-cask  
https://github.com/Homebrew/homebrew-core  
https://github.com/apache/httpcomponents-client  
https://github.com/apache/httpcomponents-core  
https://github.com/isaacs/inherits  
https://github.com/juliangruber/isarray  
https://github.com/FasterXML/jackson-core  
https://github.com/FasterXML/jackson-databind  
https://github.com/joomla/joomla-cms  
https://github.com/JuliaLang/julia  
https://github.com/jonschlinkert/kind-of  
https://github.com/knative/community  
https://github.com/kubernetes/kubernetes  
https://github.com/laravel/framework  
https://github.com/lodash/lodash  
https://github.com/apache/logging-log4j2  
https://github.com/qos-ch/logback  
https://github.com/magento/magento2  
https://github.com/mui-org/material-ui  
https://github.com/apache/maven  
https://github.com/mesonbuild/meson  
https://github.com/substack/minimist  
https://github.com/addaleax/natives  
https://github.com/nginx/nginx  
https://github.com/NixOS/nixpkgs  
https://github.com/nodejs/node  
https://github.com/numpy/numpy  
https://github.com/openssl/openssl  
https://github.com/OpenVPN/openvpn  
https://github.com/pandas-dev/pandas  
https://github.com/symfony/symfony  
https://github.com/php/php-src  
https://github.com/postgres/postgres  
https://github.com/PowerShell/PowerShell  
https://github.com/PrestaShop/PrestaShop  
https://github.com/puppetlabs/puppet  
https://github.com/pytorch/pytorch  
https://github.com/ljharb/qs  
https://github.com/rails/rails  
https://github.com/dominictarr/rc  
https://github.com/facebook/react-native  
https://github.com/nodejs/readable-stream  
https://github.com/ruby/ruby  
https://github.com/rubygems/rubygems  
https://github.com/rust-lang/rust  
https://github.com/saltstack/salt  
https://github.com/qos-ch/slf4j  
https://github.com/apache/spark  
https://github.com/storybookjs/storybook  
https://github.com/nodejs/string\_decoder  
https://github.com/systemd/systemd  
https://github.com/tensorflow/tensorflow  
https://github.com/mrdoob/three.js  
https://github.com/torproject/tor  
https://github.com/microsoft/TypeScript  
https://github.com/faisalman/ua-parser-js  
https://github.com/microsoft/vscode  
https://github.com/webpack/webpack  
https://github.com/WordPress/WordPress  
https://github.com/zephyrproject-rtos/zephyr

## Jun 1, 2023

Attendees:

* Diogo Sant'Anna (Google, GOSST Upstream team)  
* Gabriela Gutierrez (Google, GOSST Upstream team)  
* Joyce Brum (Google, GOSST Upstream team)  
* Pedro Nacht (Google, GOSST Upstream team)  
* Spencer Schrock (Google)  
* Jeremy Katz (Tidelift)  
* Jeff Mendoza (Kusari)  
* Brian Russell (Google)  
* Raghav Kaul (Google)  
* Caroline Lee (IBM)  
* Brian Behlendorf (OpenSSF/LF)  
* Josh Clements (ADI)  
* Ian Dunbar-Hall (Lockheed Martin)  
* Justin Abrahms (hire me?)

Regrets:

* Michael Goddard (Google) \- SYD this time. NYC next time\!

Agenda:

* Announcements  
  * Introductions  
    * Pedro, from GOSST Upstream team. Work full time on external contributions  
    * Josh, OSPO at Analog Devices. Interested in implementing Scorecard at ADI  
  * Project updates  
    * GitHub access changed to teams, check that access is correct.  
* \[Raghav\] Code Review proportional scoring changes: [https://github.com/ossf/scorecard/pull/2882](https://github.com/ossf/scorecard/pull/2882)   
  * How to avoid this scoring whiplash in the future?  
    * Score change visualizer being designed, will be presented here when ready  
* \[Brian Russell\] FYI putting together launch plan for GitLab support  
* \[GOSST Upstream team\] Suggest adoption of a contributor ladder (see draft in [\#1529 (comment)](https://github.com/ossf/scorecard/issues/1529#issuecomment-1572664893))  
  * Current draft is focused on overall openssf contributor ladder, to do so should propose to the TAC with an issue in the TAC repository and then discussion there  
* \[GOSST Upstream team\] CLO-Monitor viewer of Scorecard scores ([\#2979](https://github.com/ossf/scorecard/issues/2979))  
  * General acceptance of the idea of hosting in the scorecard site, awaiting PR from the CLO monitor team  
* \[GOSST Upstream team\] [List of priority issues](https://docs.google.com/spreadsheets/d/1QrpD85bUbnKIWp7UMjrl8nwUcLeCytirMV_UXPR1sEE/edit#gid=0) we believe are important for maintainer satisfaction and Scorecard adoption, that we are willing to contribute with. Example:  
  * ~~Code-Review: Review change made on version 4.10.5 that caused large reduction of scores ([issue](https://github.com/ossf/scorecard/issues/2812))~~ (covered on Raghav first point)  
  * Token-Permissions: Only low-risk permissions are punished at the job-level ([issue](https://github.com/ossf/scorecard/issues/3045))  
  * Pinned-Deps: allow unpinned deps in unprivileged workflows ([issue](https://github.com/ossf/scorecard/issues/2018))  
* \[Justin Abrahms\] [sboms](https://github.com/ossf/scorecard/issues/3043)  
  * [There's a way](https://gist.github.com/lucasgonze/b84a2c52c697bf8f686a005080c369dd) to find if they're generated based on looking through github actions  
  * Github itself [has a way to generate SBOMs](https://docs.github.com/en/rest/dependency-graph/sboms?apiVersion=2022-11-28)

## May 18, 2023

Attendees:

* Justin Abrahms (Hire me?)  
* Ian Dunbar-Hall (Lockheed Martin)  
* Jeff Mendoza (Kusari)  
* Ashish Kurmi (StepSecurity)  
* David A. Wheeler (Linux Foundation)  
* Lucas Gonze (eBay OSPO) \- works on OSPOs, uses Scorecard  
* Jim Robison (Lockheed Martin)  
* Keith Ganger (Lockheed Martin)  
* Andrew Brinker (MITRE)  
* Jeremy Katz (Tidelift)  
* Raghav Kaul (Contributor, Google)  
* Caroline Lee (IBM)  
* Sanket Naik (Palosade)  
* Brian Russell (Google)

Regrets:

* Naveen Srinivasan  
* \[Spencer Schrock (Google)\]  
* Michael Goddard (Google) \- sorry, in SYD, timezones :(

Agenda:

* Announcements  
  * Introductions  
  * Project updates  
    *   
* Open Issues & One-off discussion topics (e.g. pull request to be merged, feature request, etc.)  
  * [Add support for SBOM analyzing](https://github.com/ossf/scorecard/issues/2605)  
    * Bigger issue: Where do the SBOMs go? SBOMs are often \*generated\* from source code (e.g., during build) \- how do we find them?  
    * Also: [Issue \#1476](https://github.com/ossf/scorecard/issues/1476)  
    * Question of implementation  
      * Where does the score go \- release, binary artifacts, new check, etc?   
        * How would we score this?  
      * Where does sbom live?  
    * Write proposal and invite feedback   
      * Q: How/where does one write a proposal?  
      * A: Create a GitHub issue  
        * So.. we have one. :) What next?  
          * More details on code implementation, and how score is calculated  
        * Needs to propose an implementation, not ask  
    * Lot of end users and organizations want this  
    * If scorecard can find sbom, maybe use rest api to show location of sbom?   
    * Utilize related ossf groups for their expertise: sbom everywhere (under tooling, \#stream-09-sbom-everywhere) and repos working group (\#wg\_securing\_software\_repos)  
    * David: This is important, but it is challenging. OSS NA presentation showed that different JavaScript package managers produced very different sets of packages to be installed given the same inputs.  
  * \[Jeff\]Who are the scorecard core maintainers? Is there a contributor ladder?  
    * [https://github.com/ossf/scorecard/blob/main/.github/CODEOWNERS](https://github.com/ossf/scorecard/blob/main/.github/CODEOWNERS)   
    * [https://github.com/ossf/scorecard/pull/3039](https://github.com/ossf/scorecard/pull/3039)   
    * Contributor ladder: ?   
  * New mitre tool similar to scorecard called “hipcheck”: [https://github.com/mitre/hipcheck](https://github.com/mitre/hipcheck) (written in Rust)  
    * What’s the diff?   
    * Originally focused on software supply chain risks.  
      * Focuses on typosquatting \- looks for dependencies that are probably typosquatting. Repos are also countering this, maybe that’s less important.  
      * Concerning contributions: Packed malware, etc.  
        * What about false+?  
        * We’d love to validate this.  
        * We found it hard to find malicious code sample. Looked for patches to fix CVEs, then went backwards to see what contributions were especially likely to be problematic.  
        * David: There’s a group that has a collection.  
      * There are also some UI differences, trying to make it easier to use. It’d be possible for scorecard’s JSON output to be sent into something that could build on the UI ideas.  
      * Probably would just re-implement (Rust vs. Go)  
      * They’ll come back & identify the specific criteria that (1) are especially useful and (2) not already in scorecard.  
    * Guide to analyses, slightly out of date, but still useful: [https://github.com/mitre/hipcheck/blob/main/docs/book/src/using/analyses.md](https://github.com/mitre/hipcheck/blob/main/docs/book/src/using/analyses.md)   
* Summary (last 3-5 minutes)  
  * Facilitator transfer for next meeting  
  * 

Note: A lot of the Scorecard work now is being done by Raghav Kaul, Spencer Schrock, and Naveen Srinivasan.

## May 4, 2023

Attendees:

* David A. Wheeler (Linux Foundation)  
* Jeff Mendoza (Kusari)  
* Brian Russell (Google)  
* Ashish Kurmi (StepSecurity)  
* Ian Dunbar-Hall (Lockheed Martin)  
* Jim Robison (Lockheed Martin)  
* Caroline Lee (IBM)  
* Jeremy Katz (Tidelift)  
* Amber Webb (Shell)  
* 

Agenda:

* Announcements  
  * Introductions  
  * Project updates  
    *   
* Open Issues & One-off discussion topics (e.g. pull request to be merged, feature request, etc.)  
  * Code Review Check: Use of AI to review code to help projects with single maintainers  
    * David: AI shouldn’t count as a human review. It’s a static analysis, sure, and it could count that way. But we’d need strong evidence that AI is as good as human reviews in general before they’d count.  
    * Jeff: Single-maintainers have a risk, if the maintainer disappears the project stops. AI doesn’t solve that either, so no, AI shouldn’t counter.  
    * So overall, no, AI doesn’t count for this.  
    * David: I can draft a tweak to Scorecard to clarify this  
    * If we ever evaluate the quality of (static analysis) tools, the quality of the AI would matter & we’d need to evaluate.  
* Summary (last 3-5 minutes)  
  * Facilitator transfer for next meeting  
  * Caroline Lee: I can take it\!

## Apr 20, 2023

Attendees:

* David A. Wheeler (Linux Foundation)  
* Jeff Mendoza (Kusari)  
* Brian Russell (Google)  
* Justin Abrahms (hire me?)  
* Spencer Schrock (Google)  
* Ashish Kurmi (StepSecurity)  
* Ian Dunbar-Hall (Lockheed Martin)  
* Jim Robison (Lockheed Martin)

Agenda:

* Announcements  
  * Introductions  
  * Project updates  
    * Allstar  
      * Could use some help here: [https://github.com/ossf/allstar/issues/381\#issuecomment-1509513138](https://github.com/ossf/allstar/issues/381#issuecomment-1509513138)  
      * Using cached-transport but tarball download is too big  
* Open Issues & One-off discussion topics (e.g. pull request to be merged, feature request, etc.)  
  * \[Abrahms\] [sbom-scorecard](https://github.com/justinabrahms/sbom-scorecard) inclusion. ([Issue](https://github.com/ossf/scorecard/issues/2605))  
    * Seems promising. What’s the vision on how to integrate overall?  
    * How would you include this with Scorecard, since SBOM might not be in version control of source code? Scorecard is currently very based on repo  
    * Can look at GitHub releases, see if there are artifacts in its release, so could infer it from that.  
    * It seems to fit better with the Signed Releases or Packaging check, but that’s okay.  
    * Publishing workflow (vs. packaging)  
    * Sounds reasonable.  
    * How do we find the SBOM? Probably first check filename extension, look in certain places, verify if they’re SBOMs.  
    * Google’s osv-scanner uses some naming conventions to find SBOMs, we can use similar ones.  
      * [https://github.com/google/osv-scanner/pull/258](https://github.com/google/osv-scanner/pull/258) which references  
        * Cyclonedx [https://cyclonedx.org/specification/overview/\#recognized-file-patterns](https://cyclonedx.org/specification/overview/#recognized-file-patterns)  
        * SPDX [https://spdx.github.io/spdx-spec/v2.3/conformance/](https://spdx.github.io/spdx-spec/v2.3/conformance/)  
    * Issue updated: [https://github.com/ossf/scorecard/issues/2605\#issuecomment-1516899502](https://github.com/ossf/scorecard/issues/2605#issuecomment-1516899502)   
  * OpenSSF Scorecard and Best Practices badges  
    * David Wheeler will co-present these with crob @ OpenSSF Day  
  * Is there any guidance between the three ways to pull scorecard data?  
    * BQ directly / REST API / Deps.dev  
      * Deps.dev does temporarily filter some data out (currently \-1s, SAST, Dependency-Update-Tool and Code-Review) while Scorecard is re-enabling some checks  
    * And how is the data licensed [https://github.com/ossf/scorecard/issues/2713](https://github.com/ossf/scorecard/issues/2713)  
    * ?  
* Quick heads-up \- will present on Scorecard @ OpenSSF Day  
  * Naveen \+ Spencer also presenting a Scorecard \+ Sigstore talk, not ready for feedback, maybe next week  
* Summary (last 3-5 minutes)  
  * Facilitator transfer for next meeting

## Apr 6, 2023

Attendees

* Jeremy Katz (Tidelift)  
* Ian Dunbar-Hall (Lockheed Martin)  
* Ashish Kurmi (StepSecurity)  
* Spencer Schrock (Google)  
* Brian Russell (Google)  
* Jim Robison (Lockheed Martin)  
* Jeff Mendoza (Kusari)  
* Keith Ganger (Lockheed Martin)  
* David A. Wheeler (Linux Foundation)  
* Azeem Shaikh (Google)  
* Raghav Kaul (Google)

Project Updates

* Allstar (Jeff)  
  * Two new policies contributed:   
    * Administrator \- are individuals allowed or only teams, with exceptions  
    * Codeowners \- settings for if required, or optional and if it is there does it have errors  
  * Looking to fix a memory leak (previously rolled-back)  
  * Next will cut a release.  
* Scorecard Action new release   
  * [https://github.com/ossf/scorecard-action/releases/tag/v2.1.3](https://github.com/ossf/scorecard-action/releases/tag/v2.1.3)

Agenda

* FYI: OpenSSF \- we’re working on funding more maintenance (Naveem, 25 hours/week, reporting to David A. Wheeler), scorecard improvements  
* FYI: MITRE has “hipcheck” which has some similarities to Scorecard, it might be useful to review it & see if has ideas to reuse. See: [https://github.com/ossf/scorecard/issues/2816](https://github.com/ossf/scorecard/issues/2816)  
  * Hipcheck: [https://github.com/mitre/hipcheck](https://github.com/mitre/hipcheck)  
  * *AI: David to reach out to Andrew who led the work and see if he’s up to join and share*  
* Gitlab discussion  
  * Plan to use cron to loadtest. Have a list of 25K-30K GitLab repos that we’ll add to the cron list soon. We plan to start by adding just a few GitLab repos to make sure it works before “fulling turning it on”.  
  * When we talked with Sam & ? from GitLab, they suggested the best thing is to use GitLab service accounts, for now we have a stub account & we’ll switch over once the service account is available. That’s a construct that doesn’t QUITE exist yet in GitLab, but is about to: [https://gitlab.com/groups/gitlab-org/-/epics/9573](https://gitlab.com/groups/gitlab-org/-/epics/9573) . So the idea is to use a normal account, then switch.  
* Process for proposing scoring changes  
  * Bug(?): Large changes to Code-Review scores between 4.10.2 and 4.10.5  
    * [https://github.com/ossf/scorecard/issues/2812](https://github.com/ossf/scorecard/issues/2812)  
    * Changes proposed during Nov 17, 2022 meeting drastically changed scoring. Having 2 unreviewed PRs (out of \~30) gives a 0  
    * Number of repos scoring  0 went from 905,973 \-\> 1,058,062  
  * David W: Might want to borrow the approach from the best practices badge  
    * When we add new criteria, we mark them as “future” \- we measure them, but report them as “future” & don’t include their values in the final value  
    * That way, we can add new criteria but give people time to implement them.  
    * Later the “future” criteria have the “future” marking removed, and thus are included in the final score.  
  * Maybe for tweaking checks, can create a variant of the check  
    * Could do the same thing, mark the new variant as “future”  
  * Planning on Golden tests, details not solidified yet  
    * Basically, before creating changes, run it against a subset with expected results to see if it does what we expect.  
    * Is something anyone can do to move that along? Spencer:We can bring things once further along.  
  * Wheeler: Can add “future: true” property to each criterion, final scoring ignores the criteria with future:true.  
* Brian will moderate in 2 weeks

## Mar 23, 2023

Attendees

* Jeremy Katz (Tidelift)  
* Spencer Schrock (Google)  
* Ashish Kurmi (StepSecurity)  
* Azeem Shaikh (Google)  
* Naveen Srinivasan  
* Theresa Mammarella (Sonatype)  
* Sanket Naik (Palosade)  
* Namita Madhira (Comcast)  
* Brian Russell (Google)  
* Caroline Lee (IBM)  
* Raghav Kaul (Google)

Project Updates

* Scorecard v4.10.4 released [https://github.com/ossf/scorecard/releases/tag/v4.10.4](https://github.com/ossf/scorecard/releases/tag/v4.10.4)  
  * Scorecard action release needed  
* Scorecard talk at [SCALE](https://www.socallinuxexpo.org/scale/20x)

Agenda

* Ashish discuss StepSecurity using Scorecard, provide remediation steps, add to automation to sbom  
* Gitlab support timeline question  
  * There is a Software supply chain security WG [https://gitlab.com/gitlab-com/www-gitlab-com/-/merge\_requests/120855](https://gitlab.com/gitlab-com/www-gitlab-com/-/merge_requests/120855)  
  * Gitlab repos slowly integrating into cron results, check by check  
    * Security Policy: [https://github.com/ossf/scorecard/pull/2754](https://github.com/ossf/scorecard/pull/2754)  
  * Issue tracker: [https://github.com/ossf/scorecard/issues/2775](https://github.com/ossf/scorecard/issues/2775)  
  * 

## Mar 9, 2023

Attendees

* Naveen Srinivasan  
* Spencer Schrock (Google)  
* Jim Robison (Lockheed Martin)  
* Caroline Lee (IBM)  
* Keith Ganger (Lockheed Martin)  
* Sammy Gonzalez (Lockheed Martin)  
* Ian Dunbar-Hall (Lockheed Martin)  
* Raghav Kaul (Google)  
* Michael Goddard (Google)

Agenda

- [https://github.com/ossf/scorecard-action/pull/1095](https://github.com/ossf/scorecard-action/pull/1095) Naveen Srinivasan  
  - Discuss about the blocking issue  
  - Naveen is blocked on the PR  
    - This issue was opened and presente  
  - Bus factor  
  - Try to resolve next steps by next meeting  
- Code Review scoring changes Raghav Kaul   
  - Some big (negative) changes in prominent projects (e.g. numpy)  
  - Change between previous cron results, to recent restarted run  
  - Change/release policy for score changes needed?  
    - Better communication about changes (e.g. versioned releases with release notes?)  
    - Add emoji on PR \[like sapling etc\]  
  - E2E tests?  
    - On canary cohort? (to minimize token usage)  
  - Cron job  
    - Has a canary, but only that the binary itself works, does not check score variance  
- Blog on Scorecard published [https://developer.ibm.com/blogs/ibm-works-with-openssf-scorecard-to-improve-supply-chain-security/](https://developer.ibm.com/blogs/ibm-works-with-openssf-scorecard-to-improve-supply-chain-security/) Caroline Lee  
- 

## Feb 23, 2023

Attendees

* Naveen Srinivasan  
* Jeff Mendoza  
* Spencer Schrock (Google)  
* Ian Dunbar-Hall (Lockheed Martin)  
* Keith Ganger (Lockheed Martin)  
* Ashish Kurmi (StepSecurity)  
* Michael Goddard (Google)  
* Raghav Kaul (Google)  
* Matt Rutkowski (IBM)  
* Caroline Lee (IBM)  
* Jerod Heck (Lockheed Martin)  
* Brian Russell (Google)

Welcome new faces

* Ashish Kurmi \- Welcome Ashish\!  
* Keith Ganger \- Welcome Keith\!

Project Updates

* Allstar  
  * Did a release [https://github.com/ossf/allstar/releases/tag/v3.0](https://github.com/ossf/allstar/releases/tag/v3.0)   
  * Operations funding secured  
  * Working on a memory leak  
  * Will merge contributor ladder PR. [https://github.com/ossf/allstar/pull/339](https://github.com/ossf/allstar/pull/339)    
* Scorecard  
  * Upcoming talks:  
    * [SCaLE March](https://www.socallinuxexpo.org/scale/20x/presentations/how-do-you-trust-your-open-source-software)  
    * [RSA](https://www.rsaconference.com/usa/agenda/session/How%20Do%20You%20Trust%20Open%20Source%20Software) 

Agenda

* Matt Rutkowski would like to describe CycloneDX efforts on Formulation (v1.5, RFC pending)  (i.e., CI/CD Workflow) and its artifact capture from tasks/tools and how to reference them in future SBOMs (and delta from v1.4) with interactive Q\&A  
* Fuzzing check \- read OSS Fuzz logs instead of GitHub project YAMLs?  
  * Add RepoURL to schema: [https://github.com/google/oss-fuzz/issues/9782](https://github.com/google/oss-fuzz/issues/9782)  
  * [https://github.com/ossf/scorecard/issues/2670](https://github.com/ossf/scorecard/issues/2670)  
    * Naveen provided information for Raghav to check with Oliver in GOOST  
* Demo \- Implement Scorecard action for dependencies \- [https://github.com/ossf/scorecard-action/issues/1070](https://github.com/ossf/scorecard-action/issues/1070) \- Naveen Srinivasan  
  * Naveen will open a PR   
  * It was recommended that we include policy as to what makes the action fail.  
    * Naveen \-The Policy checks will be added later when scorecard comes up with a policy framework.  
  * [Scorecard action for dependencies](https://docs.google.com/presentation/d/1QOBO4AGsXT7hddLY0HOyO6evfLvVvQ0fIdnzXiMsN_c/edit?usp=sharing)  
* 

## Feb 9, 2023

Attendees

* Jeremy Katz (Tidelift)  
* Spencer Schrock (Google)  
* Ian Dunbar-Hall (Lockheed Martin)  
* Jerod Heck (Lockheed Martin)  
* Keith Ganger (Lockheed Martin)  
* David A. Wheeler (Linux Foundation)  
* Jeff Mendoza  
* Kara Olive (Google)  
* Bob Callaway (Google)  
* Brian Russell (Google)  
* Raghav Kaul (Google)

Welcome new faces

* Ian Dunbar-Hall, Jerod Heck, Keith Ganger (Lockheed Martin)  
  * Working on GitLab support on Scorecard  
* Justin Abrahms (eBay)  
  * Working on SBOM Scorecard

Laurant is on travel, can’t lead meeting. Spencer will lead today.

Project/Individual updates

* Allstar  
  * Contributor ladder: [https://github.com/ossf/allstar/pull/339](https://github.com/ossf/allstar/pull/339)   
  * Planning on release soon.  
* Scorecard  
  * Probably also need a release for bug fixes

Agenda

* Allstar request for neutral infrastructure (funding).  
  * Any donations?  
  * SCP WG will petition TAC for funding otherwise: [https://github.com/ossf/tac/blob/main/working-group-abilities.md\#technical-infrastructure](https://github.com/ossf/tac/blob/main/working-group-abilities.md#technical-infrastructure)   
  * Access to repositories through privileged GitHub app is under the image of the OpenSSF  
    * Administration of the project should be under LF IT  
  * Jeff to open ticket with TAC  
* Lockheed-Martin is interested in adding support for GitLab (welcome\!)  
  * Ian Dunbar-Hall, Jerod Heck, Keith Ganger (Keith not on today) (Lockheed Martin)  
  * Ragav has been working to get this PR across the finish line.  
    * Should have a discussion in the relevant issues  
  * We’re using Scorecard topic & bringing it in, happy to help support  
  * Local git analysis improvements are also benefit other ecosystems  
  * David: We’d love improvements to the criteria so they’re more general, if they aren’t, per [https://github.com/ossf/scorecard\#scorecard-checks](https://github.com/ossf/scorecard#scorecard-checks)  
  * In general, please discuss in the issues.  
* SBOM Scorecard project (Justin Abrams)  
  * It scores SBOMs. An “SBOM” can be useless, e.g,. Doesn’t list dependencies or doesn’t list their versions. My project attempts to evaluate them.  
  * [https://github.com/eBay/sbom-scorecard](https://github.com/eBay/sbom-scorecard)  
  * David: Have you looked at the US  list of “minimum viable” fields?  
    * The document is here: [https://www.ntia.gov/sites/default/files/publications/sbom\_minimum\_elements\_report\_0.pdf](https://www.ntia.gov/sites/default/files/publications/sbom_minimum_elements_report_0.pdf)  
      * Supplier Name The name of an entity that creates, defines, and identifies components.  
      * Component Name Designation assigned to a unit of software defined by the original supplier.  
      * Version of the Component Identifier used by the supplier to specify a change in software from a previously identified version.  
      * Other Unique Identifiers Other identifiers that are used to identify a component, or serve as a look-up key for relevant databases.  
      * Dependency Relationship Characterizing the relationship that an X is included in software Y.  
      * Author of SBOM Data upstream component The name of the entity that creates the SBOM data for this component.  
      * Time stamp Record of the date and time of the SBOM data assembly .  
  * David: have you considered identifying missing sub-dependencies?  
    * Doesn’t verify if correct, it just makes sure that the data there is useful & certain kinds of data are present: licenses, version\#s, etc.  
  * Let’s get the other scorecards maintainers to review the proposed issue: [https://github.com/ossf/scorecard/issues/2605](https://github.com/ossf/scorecard/issues/2605)  
  * [https://sbom-scorecard.dev/](https://sbom-scorecard.dev/) if y’all wanna try it out.  
* Docs mini-fixit plans  
  * Proposed plan of scheduling a doc session every 6 months to speed read docs and identify problems  
  * Support from previous meeting around this frequency  
* 

## Jan 26, 2023

Attendees

* Jeff Mendoza  
* Spencer Schrock (Google)  
* Jeremy Katz (Tidelift)  
* Stephen Augustus (he/him) (Cisco)  
* Raghav Kaul (Google)

Welcome new faces

* Jeremy Katz (Tidelift)

Project/Individual updates

* Allstar  
  * Update contribution guidelines [https://github.com/ossf/allstar/pull/339](https://github.com/ossf/allstar/pull/339)   
  * Contributing.md and ladder  
  * Working on quickstart and other docs updates  
* Scorecard  
  * Doc freshness also planned [https://github.com/ossf/scorecard/issues/2579](https://github.com/ossf/scorecard/issues/2579)  
    * Overarching Issue TBD

Agenda

* CI/CD rate limit improvements. Comments welcome  
  * [https://github.com/ossf/scorecard/issues/2603](https://github.com/ossf/scorecard/issues/2603)  
* Comments still welcome on Laurent’s structured results  
  *  [https://github.com/ossf/scorecard/pull/2584](https://github.com/ossf/scorecard/pull/2584)   
  * Make sure SARIF output we’re producing for GitHub is good with these changes  
* What is doc freshness?   
  * Doing these discussions as a community meeting  
  * 6 month sync good for re-evaluating  
* SemVer: [https://github.com/ossf/scorecard/issues/1683](https://github.com/ossf/scorecard/issues/1683)  
  * Discussion over what is a major/minor change. E.g. [https://github.com/ossf/scorecard/pull/2195](https://github.com/ossf/scorecard/pull/2195)  
    * Score calculation changed, result format stays the same  
  * Also needs a discussion on the API / public data

## Jan 12, 2023

Attendees

* Naveen Srinivasan  
* Spencer Schrock (Google)  
* Caroline Lee (IBM)  
* Jeff Mendoza (Google)  
* Michael Goddard (Google)  
* Stephen Augustus (Cisco)  
* Varun Sharma (StepSecurity)

Welcome new faces

* 

Project/Individual updates

* Jeff / Allstar: Planning some docs overhaul  
  * Ex: [https://github.com/ossf/allstar/issues/336](https://github.com/ossf/allstar/issues/336)  
  * More updates are coming as well.  
* 

Agenda

* Laurent: structured results first PR [https://github.com/ossf/scorecard/pull/2584](https://github.com/ossf/scorecard/pull/2584)   
  * Reference (on convo re: API guarantees): [https://github.com/ossf/scorecard/issues/1683](https://github.com/ossf/scorecard/issues/1683)  
  * Question from Varun on use an existing standard of SARIF instead of a new format  
    * [https://docs.github.com/en/code-security/code-scanning/integrating-with-code-scanning/sarif-support-for-code-scanning](https://docs.github.com/en/code-security/code-scanning/integrating-with-code-scanning/sarif-support-for-code-scanning)  
  *   
* Naveen : Action to the use API to get comments on updates on the dependencies changes.
