[SCITT] Intel Corporation pursuing SCITT interoperability via Open Architecture / Alice

[John Andersen <[e-mail]>]

Hi all,

I am on vacation but can’t help myself as SCITT is very exciting. I was
watching the BoF presentation recently linked on the mailing list mentioned
folks will be doing implementations in one of the first slides.

We are not so much doing an implementation as seeking to be interoperable
with other implementations so as to feed and consume data. Maybe that makes
it an implementation, just wanted to put it out there that this is what
were working on. I believe I mentioned in the last meeting of July that we
were working on this and aligning with the OpenSSF as well (Identifying
Security Threats, Metics, and Alpha-Omega)

The code is very early stages but we are going to be analyzing software
supply chains and serializing them to a format known as the Open
Architecture, or Alice, then we stumbled across SCITT and found it seems to
be most of the same stuff (we have some additions for risk management which
I’m not clear if they are covered by SCITT yet or if they will be layered
on top). We’ll probably do SCITT plus some extra stuff as linked DIDs.

Just posting as an FYI as I see others must have mentioned their intent to
implement.

References:
- Rolling Alice
  - https://github.com/intel/dffml/blob/alice/docs/tutorials/rolling_alice/
- 2022-07-25 Supply Chain Integrity, Transparency and Trust (SCITT)
  -
https://github.com/intel/dffml/discussions/1406#discussioncomment-3223361
- 2022-07-20 Identifying Security Threats WG
  -
https://github.com/intel/dffml/discussions/1406#discussioncomment-3191292

Thanks,
John