Re: [SCITT] SCITT Community Meeting

[Kiran Karunakaran <[e-mail]>]

Notes from SCITT community general meeting (08/29/2022)

Charter Proposal:  Charter is on track to be published by 09/05. We had discussions around adding Registry Operator as an actor, and the team reached consensus on not including Registry Operator as an actor since it is not required in the context of the charter. We are not standardizing registry operators like the rest of the actors, and this can be part of the working group content. We also discussed the addition of standardizing payload serialization in the information and interaction model section, and providing more clarity around the term, but agreed that it would also be done as part of the working group content, and the term as is fits in the context of the charter. Monty will be rewriting the introduction (with inputs from the community), and this is on track to be completed by Friday, so Henk can finish compiling the document by Saturday. We are all aligned on the rest of the charter.

Difference between information models and data models:  RFC 3444: On the Difference between Information Models and Data Models (rfc-editor.org)<https://www.rfc-editor.org/rfc/rfc3444>
Discussions around various elements of SCITT such as claims, ledger, endorsements, eNotary, evidence,: https://github.com/ietf-scitt/scitt-web/issues
Monty introduction re-write: Update ietf-scitt-charter.md by mwiseman-byid * Pull Request #20 * ietf-scitt/charter (github.com)<https://github.com/ietf-scitt/charter/pull/20/files>
Github link for Charter: https://github.com/ietf-scitt/charter/pull/18/files.



SBOM Use case discussion: We were unable to review SBOM use case due to charter discussion using up the entire hour. Since next Monday is a holiday in the US, we will repurpose our Thursday technical meeting on 09/01 to review the SBOM use case linked below. Dick will walk us through the use case and provide more details on requirements and customer impact. Please plan on attending the Technical meeting on Thursday if you'd like to be part of the SBOM use case discussion. We haven't received any other SBOM use case drafts.

Use case draft: SBOM Use Case strawman - based on CISA ICT_SCRM Task Force DRAFT - HackMD<https://hackmd.io/QuqKhy_bQ1qG9yyyBuEABg?view>
References: https://www.nist.gov/itl/executive-order-14028-improving-nations-cybersecurity/software-security-supply-chains-software-1<https://nam06.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.nist.gov%2Fitl%2Fexecutive-order-14028-improving-nations-cybersecurity%2Fsoftware-security-supply-chains-software-1&data=05%7C01%7Ckkarunakaran%40microsoft.com%7C1698e61137de4277b6ef08da89c3ca81%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C637973771288632344%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000%7C%7C%7C&sdata=Zw9LtG3bXu0tjltbwBfihJiq95nPz19qzn%2BY51b3N98%3D&reserved=0>
                      https://www.nist.gov/document/software-supply-chain-security-guidance-under-executive-order-eo-14028-section-4e
                       Cybersecurity Supply Chain Risk Management Practices for Systems and Organizations (nist.gov)<https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-161r1.pdf>

We were unable to record the meeting since we did not have admin rights to the Zoom call. Moving forward, we will make sure to have this sorted out before the meeting. Please refer to SCITT General Meeting Agenda and Notes - Google Docs<https://docs.google.com/document/d/1vf-EliXByhg5HZfgVbTqZhfaJFCmvMdQuZ4tC-Eq6wg/edit> for minutes.


Thanks,
Kiran


From: Kiran Karunakaran
Sent: Monday, August 22, 2022 9:14 PM
To: [e-mail]
Subject: RE: SCITT Community Meeting

Notes from SCITT community general meeting (08/22/2022)


  1.  Charter Proposal
     *   Github link: https://github.com/ietf-scitt/charter/pull/18/files
     *   Please input all comments/changes/suggestions (Session Transcript for SCITT Charter Iteration - HackMD<https://hackmd.io/T7GsPcJmRtC9IhVbXjUbCg>) before 08/30/2022
     *   Target Charter Proposal publish date: 09/05/2022
     *   Please reach out to Henk if you have any question



  1.  Intersection of SCITT and SLSA- Attestation Distribution and Discovery Design Doc - Google Docs<https://docs.google.com/document/d/163H4cCeT7JaeZGYzkM2yxhavGigIirQjNxfbH3daVwo/edit>
     *   Please review notes and provide feedback
     *   Our next step is to build documentation around defining where SCITT service sits and it's interaction with different blocks within the end to end supply chain security framework



[cid:image001.png@01D8BC56.302D3CB0]



  1.  RATS presentation
     *   Yogesh to talk to David Thaler
     *   Goal is to align on terminology and standards



  1.  Terminology Documentation
     *   Yogesh to review first draft with the team

                                                               i.      Review with Cedric, Dick and Henk before community review



  1.  Use Case Documentation
     *   Monty- Use case for intersection of hardware and software
     *   Bob- System of Trust
     *   Dick- SBOM use cases

Thanks,
Kiran

-----Original Appointment-----
From: Yogesh Deshpande <[e-mail]<mailto:[e-mail]>>
Sent: Monday, July 18, 2022 2:13 PM
To: Yogesh Deshpande; Kay Williams; Roy Williams (COSINE); Steve Lasker; Birkholz, Henk; Hannes Tschofenig; [e-mail]<mailto:[e-mail]>; Eliot Lear
Cc: Aeva Black; [e-mail]<mailto:[e-mail]>; [e-mail]<mailto:[e-mail]>; Bhuvaneshwari Krishnamurthi; [e-mail]<mailto:[e-mail]>; Sylvan Clebsch; EDGS Platform LT; [e-mail]<mailto:[e-mail]>; Brian Knight; [e-mail]<mailto:[e-mail]>; Entezari, Mehdi; Robert A Martin; [e-mail]<mailto:[e-mail]>; Nabanita Sen; Stephen Provine; Orie Steele; Travis Jones; Kellie Eickmeyer; Bhuvaneshwari Krishnamurthi; Shilpa Shastri; Kiran Karunakaran
Subject: SCITT Community Meeting
When: Monday, August 22, 2022 4:00 PM-5:00 PM (UTC+00:00) Dublin, Edinburgh, Lisbon, London.
Where: https://armltd.zoom.us/j/99133885299?pwd=b0w4aGorRkpjL3ZHa2NPSmRiNHpXUT09


Place Holder SCITT Meeting on behalf of Kay Williams, till we finally land ourselves in IETF Meeting tools.
Here's the link to the notes: SCITT General Meeting Agenda and Notes - Google Docs<https://nam06.safelinks.protection.outlook.com/?url=https%3A%2F%2Fdocs.google.com%2Fdocument%2Fd%2F1vf-EliXByhg5HZfgVbTqZhfaJFCmvMdQuZ4tC-Eq6wg%2Fedit&data=05%7C01%7Ckkarunakaran%40microsoft.com%7C7f24bfc16c4b4ac132a608da795ad9ba%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C637955728414190607%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000%7C%7C%7C&sdata=ZUJdwWNDp7MesjiBlA3X7fY5oiuegYxlmOyADPlQeU4%3D&reserved=0>

@Kay Williams<mailto:[e-mail]>: Request please forward the Invite to those I missed in the thread.

Join Zoom Meeting
https://armltd.zoom.us/j/99133885299?pwd=b0w4aGorRkpjL3ZHa2NPSmRiNHpXUT09<https://nam06.safelinks.protection.outlook.com/?url=https%3A%2F%2Farmltd.zoom.us%2Fj%2F99133885299%3Fpwd%3Db0w4aGorRkpjL3ZHa2NPSmRiNHpXUT09&data=05%7C01%7Ckkarunakaran%40microsoft.com%7C7f24bfc16c4b4ac132a608da795ad9ba%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C637955728414190607%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000%7C%7C%7C&sdata=sOkJqNZA%2FzBRBHryjSrtY5d7Sfvir5%2BKX4iEYvg8TLU%3D&reserved=0>

Meeting ID: 991 3388 5299
Passcode: 531470
One tap mobile
[phone],,99133885299#,,,,*531470# United Kingdom

Dial by your location
        [phone] United Kingdom
        [phone] US (Houston)
        [phone] US (San Jose)
        [phone] US (New York)
        [phone] India
        [phone] India
        [phone] India
        [phone] India
        [phone] Hong Kong SAR
        [phone] Sweden
        [phone] Norway
        [phone] Israel
        [phone] Ireland
        [phone] Hungary
        [phone] Germany
        [phone] France
        [phone] Finland
        [phone] Denmark
        [phone] Canada
        [phone] Korea, Republic of
        [phone] Singapore
        [phone] South Africa
        [phone] Belgium
        [phone] Poland
        [phone] Slovenia
        [phone] Malaysia
        [phone] Taiwan
        [phone] Japan
Meeting ID: 991 3388 5299
Passcode: 531470
Find your local number: https://armltd.zoom.us/u/auABE2oPq<https://nam06.safelinks.protection.outlook.com/?url=https%3A%2F%2Farmltd.zoom.us%2Fu%2FauABE2oPq&data=05%7C01%7Ckkarunakaran%40microsoft.com%7C7f24bfc16c4b4ac132a608da795ad9ba%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C637955728414190607%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000%7C%7C%7C&sdata=SjEuVbChZ2I9XVXcAzGztMRnRrQFqT%2FD3zaZvJ0YTQQ%3D&reserved=0>

Join by SIP
[e-mail]<mailto:[e-mail]>

Join by H.323
162.255.37.11 (US West)
162.255.36.11 (US East)
115.114.131.7 (India Mumbai)
115.114.115.7 (India Hyderabad)
213.19.144.110 (Amsterdam Netherlands)
213.244.140.110 (Germany)
103.122.166.55 (Australia Sydney)
103.122.167.55 (Australia Melbourne)
209.9.211.110 (Hong Kong SAR)
149.137.40.110 (Singapore)
64.211.144.160 (Brazil)
69.174.57.160 (Canada Toronto)
65.39.152.160 (Canada Vancouver)
207.226.132.110 (Japan Tokyo)
149.137.24.110 (Japan Osaka)
Meeting ID: 991 3388 5299
Passcode: 531470

IMPORTANT NOTICE: The contents of this email and any attachments are confidential and may also be privileged. If you are not the intended recipient, please notify the sender immediately and do not disclose the contents to any other person, use it for any purpose, or store or copy the information in any medium. Thank you.