profile
viewpoint
If you are wondering where the data of this site comes from, please visit https://api.github.com/users/MarkLodato/events. GitMemory does not store any data, but only uses NGINX to cache data for a period of time. The idea behind GitMemory is simply to give users a better reading experience.

MarkLodato/git-reparent 46

Git command to recommit HEAD with a new set of parents

MarkLodato/js-boxdrawing 34

JavaScript Box Drawing Library

MarkLodato/git-ssh-server 28

A restricted shell for managing GitHub-like sites through SSH.

MarkLodato/gh-contest 9

My github contest entry

MarkLodato/patch-converter 9

A script to convert the output of git patches to Hg format.

MarkLodato/scripts 9

Random scripts that I find useful

in-toto/attestation 8

ITE-6 Attestation Definitions

MarkLodato/cgit 5

a fast web interface for git

MarkLodato/dotfiles 5

My dotfiles

startedMarkLodato/visual-git-guide

started time in 2 hours

issue openedslsa-framework/slsa

Typo in source definition

"Artifact that was directly authored or directly by persons..."

Is it intend to say directly or indirectly authored?

created time in a day

issue commentslsa-framework/slsa

Add threat model, in/out-of-scope attacks, and real-world examples

Looks like the threat model diagram and example of mitigated attacks was done for the blog post here https://security.googleblog.com/2021/06/introducing-slsa-end-to-end-framework.html

It would be good to get these added to the repo here.

MarkLodato

comment created time in a day

issue commentslsa-framework/slsa

README file describes an Alpine build process incompletely

Thanks @kaniini, I'll join there.

vielmetti

comment created time in 2 days

issue commentslsa-framework/slsa

README file describes an Alpine build process incompletely

There is a reproducible builds interest group forming in #alpine-reproducible on OFTC. We haven't had a meeting yet, because getting 3.14 release caught up and out the door took priority.

vielmetti

comment created time in 2 days

issue commentslsa-framework/slsa

README file describes an Alpine build process incompletely

I think leaving the alpine example is fine! There are certainly a desire to answer these kinds of questions about Alpine, and our efforts to implement reproducible builds etc will hopefully help in some ways. I think we can get alpine to SLSA 3, which is pretty good.

It's a bit off-topic for this thread, but I am very excited to read that the Alpine project is looking to answer more of these kinds of questions and plans to implement reproducible builds. Is there somewhere we can track, and possibly contribute, to these two efforts? I took a look around Gitlab and the wiki and didn't manage to find anything.

vielmetti

comment created time in 2 days

PR merged slsa-framework/slsa

Reviewers
SLSA 3->4

SLSA 4 section should say that once these controls are enabled the artifact will be SLSA 4, not 3.

+1 -1

0 comment

1 changed file

TomHennen

pr closed time in 2 days

push eventslsa-framework/slsa

Tom Hennen

commit sha 739475127ccfb486f557204c0d5a203ebbca3cee

Update README.md SLSA 4 section should say that once these controls are enabled the artifact will be SLSA 4, not 3.

view details

Abhishek Arya

commit sha 8063315707b90b128f1311de9ad93cc79373f248

Merge pull request #63 from slsa-framework/TomHennen-patch-1 SLSA 3->4

view details

push time in 2 days

push eventslsa-framework/slsa

Kara Olive

commit sha 160f3901e4e4ff1fef76cec282f4986c1dc2902d

Update landing page to use language from blogpost

view details

push time in 2 days

issue commentslsa-framework/slsa

README file describes an Alpine build process incompletely

I think leaving the alpine example is fine! There are certainly a desire to answer these kinds of questions about Alpine, and our efforts to implement reproducible builds etc will hopefully help in some ways. I think we can get alpine to SLSA 3, which is pretty good.

vielmetti

comment created time in 2 days

push eventslsa-framework/slsa

Dan Lorenc

commit sha dd9a4dbfecd371fef97d385ca4e29592fd697dc2

Clarify where the sha256 comes from in the Alpine build process.

view details

Abhishek Arya

commit sha 97943d9afad3fd08213dc75eec9e02043be658ba

Merge pull request #64 from dlorenc/sha Clarify where the sha256 comes from in the Alpine build process.

view details

push time in 2 days

issue commentslsa-framework/slsa

README file describes an Alpine build process incompletely

Hi @vielmetti and @kaniini!

I'm very sorry about the errors made here. I know the Alpine puts a huge amount of effort into securing their build and packaging system, and you as a community do an excellent job at this. I can either get the corrections you outlined made in the documentation or remove the Alpine example entirely - whichever you would prefer.

I've sent https://github.com/slsa-framework/slsa/pull/64 as a start for fixing up this content. If you're up for it, I'd love any other feedback on how to either correct this or switch to a different example.

vielmetti

comment created time in 2 days

PR opened slsa-framework/slsa

Clarify where the sha256 comes from in the Alpine build process.

Ref #62

+2 -2

0 comment

1 changed file

pr created time in 2 days

issue commentslsa-framework/slsa

You are only as secure as your weakest dependency; SLSA 4 artifacts can have SLSA 0 dependencies?

@TomHennen

Upon reflection this seems to make sense for prioritizing the workload, if nothing else. As long as people understand the SLSA is a metric of build system quality, not code quality, I think that will be helpful overall.

However - I look at the results from Google's deps.dev project where big projects routinely include 100s of individual dependencies, and wonder how this process will adequately identify weak spots in big systems like kubernetes.

vielmetti

comment created time in 2 days

PR opened slsa-framework/slsa

Reviewers
SLSA 3->4

SLSA 4 section should say that once these controls are enabled the artifact will be SLSA 4, not 3.

+1 -1

0 comment

1 changed file

pr created time in 2 days

create barnchslsa-framework/slsa

branch : TomHennen-patch-1

created branch time in 2 days

issue commentslsa-framework/slsa

You are only as secure as your weakest dependency; SLSA 4 artifacts can have SLSA 0 dependencies?

Hi Edward, thanks for your comment.

This issue is discussed in the scope section.

The reason for non-transitivity is to make the problem tractable. If SLSA 4 required dependencies to be SLSA 4, then reaching SLSA 4 would require starting at the very beginning of the supply chain and working forward. This is backwards, forcing us to work on the least risky component first and blocking any progress further downstream. By making each artifact's SLSA rating independent from one another, it allows parallel progress and prioritization based on risk. (This is a lesson we learned when deploying other security controls at scale throughout Google.)

Does that help? Is further clarification needed?

vielmetti

comment created time in 2 days

Pull request review commentsecure-systems-lab/signing-spec

Rename to DSSE, update PAE, mark as v1

 KEYID           | string | No       | No  Functions: -*   PAE() is the-    [PASETO Pre-Authentication Encoding](https://github.com/paragonie/paseto/blob/master/docs/01-Protocol-Versions/Common.md#authentication-padding),-    where parameters `type` and `body` are byte sequences:+*   PAE() is the "Pre-Authentication Encoding", where parameters `type` and+    `body` are byte sequences: -    ```none-    PAE(type, body) := le64(2) || le64(len(type)) || type || le64(len(body)) || body-    le64(n) := 64-bit little-endian encoding of `n`, where 0 <= n < 2^63+    ```python+    PAE(type, body) := "DSSEv1 <len(type)> <type> <len(body)> <body>"+    len(s) := ASCII decimal encoding of the byte length of s, with no leading zeros

Can you add that <type> and <body> have no leading or trailing space (just like the lengths have no leading zeros)

MarkLodato

comment created time in 3 days

issue commentsecure-systems-lab/signing-spec

Use a simpler PAE

Just a minor nit: when you write "concatenate the following elements, separated by spaces" you probably mean "separated by a single space character".

Otherwise, there can be ambiguity, for example when a length is followed by multiple spaces.

MarkLodato

comment created time in 3 days

issue commentin-toto/attestation

Question: Why is the protocol included on _type and predicateType?

If we're actually expecting content to be served from the URI (docs, etc.) this makes more sense. Thanks!

I'm not quite sure I agree on the classification between mediaType and URI though. For example, OCI uses mediaTypes to represent structured data with an encoding, like this:

mediaType": "application/vnd.oci.image.manifest.v1+json"

dlorenc

comment created time in 4 days

startedMarkLodato/visual-git-guide

started time in 4 days

PR opened MarkLodato/enigma

Bump postcss from 7.0.17 to 7.0.36

Bumps postcss from 7.0.17 to 7.0.36. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/postcss/postcss/releases">postcss's releases</a>.</em></p> <blockquote> <h2>7.0.36</h2> <ul> <li>Backport ReDoS vulnerabilities from PostCSS 8.</li> </ul> <h2>7.0.35</h2> <ul> <li>Add <a href="https://github.com/postcss/postcss/wiki/PostCSS-8-for-end-users">migration guide link</a> to PostCSS 8 error text.</li> </ul> <h2>7.0.34</h2> <ul> <li>Fix compatibility with <code>postcss-scss</code> 2.</li> </ul> <h2>7.0.33</h2> <ul> <li>Add error message for PostCSS 8 plugins.</li> </ul> <h2>7.0.32</h2> <ul> <li>Fix error message (by <a href="https://github.com/admosity"><code>@​admosity</code></a>).</li> </ul> <h2>7.0.31</h2> <ul> <li>Use only the latest source map annotation (by <a href="https://github.com/emzoumpo"><code>@​emzoumpo</code></a>).</li> </ul> <h2>7.0.30</h2> <ul> <li>Fix TypeScript definition (by <a href="https://github.com/nex3"><code>@​nex3</code></a>)</li> </ul> <h2>7.0.29</h2> <ul> <li>Update <code>Processor#version</code>.</li> </ul> <h2>7.0.28</h2> <ul> <li>Fix TypeScript definition (by <a href="https://github.com/nex3"><code>@​nex3</code></a>).</li> </ul> <h2>7.0.27</h2> <ul> <li>Fix TypeScript definition (by <a href="https://github.com/nex3"><code>@​nex3</code></a>).</li> </ul> <h2>7.0.26</h2> <ul> <li>Fix TypeScript definition (by <a href="https://github.com/nex3"><code>@​nex3</code></a>)</li> </ul> <h2>7.0.25</h2> <ul> <li>Fix absolute path support for Windows (by <a href="https://github.com/tomrav"><code>@​tomrav</code></a>)</li> </ul> <h2>7.0.24</h2> <ul> <li>Fix TypeScript definition (by <a href="https://github.com/keithamus"><code>@​keithamus</code></a>).</li> </ul> <h2>7.0.23</h2> <ul> <li>Update <code>Processor#version</code>.</li> </ul> <h2>7.0.22</h2> <ul> <li>Add funding link for <code>npm fund</code>.</li> </ul> <h2>7.0.21</h2> <ul> <li>Revert passing <code>nodes</code> property to node constructor.</li> </ul> <h2>7.0.20</h2> <ul> <li>Allow to pass PostCSS’s nodes in <code>nodes</code> property to node constructor.</li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/postcss/postcss/blob/main/CHANGELOG.md">postcss's changelog</a>.</em></p> <blockquote> <h2>7.0.36</h2> <ul> <li>Backport ReDoS vulnerabilities from PostCSS 8.</li> </ul> <h2>7.0.35</h2> <ul> <li>Add migration guide link to PostCSS 8 error text.</li> </ul> <h2>7.0.34</h2> <ul> <li>Fix compatibility with <code>postcss-scss</code> 2.</li> </ul> <h2>7.0.33</h2> <ul> <li>Add error message for PostCSS 8 plugins.</li> </ul> <h2>7.0.36</h2> <ul> <li>Backport ReDoS vulnerabilities from PostCSS 8.</li> </ul> <h2>7.0.35</h2> <ul> <li>Add migration guide link to PostCSS 8 error text.</li> </ul> <h2>7.0.34</h2> <ul> <li>Fix compatibility with <code>postcss-scss</code> 2.</li> </ul> <h2>7.0.33</h2> <ul> <li>Add error message for PostCSS 8 plugins.</li> </ul> <h2>7.0.32</h2> <ul> <li>Fix error message (by <a href="https://github.com/admosity"><code>@​admosity</code></a>).</li> </ul> <h2>7.0.31</h2> <ul> <li>Use only the latest source map annotation (by Emmanouil Zoumpoulakis).</li> </ul> <h2>7.0.30</h2> <ul> <li>Fix TypeScript definition (by Natalie Weizenbaum).</li> </ul> <h2>7.0.29</h2> <ul> <li>Update <code>Processor#version</code>.</li> </ul> <h2>7.0.28</h2> <ul> <li>Fix TypeScript definition (by Natalie Weizenbaum).</li> </ul> <h2>7.0.27</h2> <ul> <li>Fix TypeScript definition (by Natalie Weizenbaum).</li> </ul> <h2>7.0.26</h2> <ul> <li>Fix TypeScript definition (by Natalie Weizenbaum).</li> </ul> <h2>7.0.25</h2> <ul> <li>Fix absolute path support for Windows (by Tom Raviv).</li> </ul> <h2>7.0.24</h2> <ul> <li>Fix TypeScript definition (by Keith Cirkel).</li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/postcss/postcss/commit/67e3d7b3402c5d3d036ab7c1e781f86910d6ca72"><code>67e3d7b</code></a> Release 7.0.36 version</li> <li><a href="https://github.com/postcss/postcss/commit/54cbf3c4847eb0fb1501b9d2337465439e849734"><code>54cbf3c</code></a> Backport ReDoS vulnerabilities from PostCSS 8</li> <li><a href="https://github.com/postcss/postcss/commit/12832f3d203474bd273bd06bd3b2407567bfe09e"><code>12832f3</code></a> Release 7.0.35 version</li> <li><a href="https://github.com/postcss/postcss/commit/4455ef6baf84ceea87cb662131f95d798063896c"><code>4455ef6</code></a> Use OpenCollective in funding</li> <li><a href="https://github.com/postcss/postcss/commit/e867c794b5d646839350dd4b76f3cc81423413e6"><code>e867c79</code></a> Add migration guide to PostCSS 8 error</li> <li><a href="https://github.com/postcss/postcss/commit/32a22a98bc4de9c7a2489041ceae24eedc62144f"><code>32a22a9</code></a> Release 7.0.34 version</li> <li><a href="https://github.com/postcss/postcss/commit/22939829688574b9acdbd29106ca2ec9470b2b17"><code>2293982</code></a> Lock build targets</li> <li><a href="https://github.com/postcss/postcss/commit/2c3a111a940b373a60fae196e63931b3b6e9d8ca"><code>2c3a111</code></a> Release 7.0.33 version</li> <li><a href="https://github.com/postcss/postcss/commit/4105f21b48d75847e822e89746633792c478922b"><code>4105f21</code></a> Use yaspeller instead of yaspeller-ci</li> <li><a href="https://github.com/postcss/postcss/commit/c8d02a0da503f9fa5d96a854a2c9244710c18c72"><code>c8d02a0</code></a> Revert yaspeller-ci removal</li> <li>Additional commits viewable in <a href="https://github.com/postcss/postcss/compare/7.0.17...7.0.36">compare view</a></li> </ul> </details> <br />

Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


<details> <summary>Dependabot commands and options</summary> <br />

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot merge will merge this PR after your CI passes on it
  • @dependabot squash and merge will squash and merge this PR after your CI passes on it
  • @dependabot cancel merge will cancel a previously requested merge and block automerging
  • @dependabot reopen will reopen this PR if it is closed
  • @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  • @dependabot use these labels will set the current labels as the default for future PRs for this repo and language
  • @dependabot use these reviewers will set the current reviewers as the default for future PRs for this repo and language
  • @dependabot use these assignees will set the current assignees as the default for future PRs for this repo and language
  • @dependabot use this milestone will set the current milestone as the default for future PRs for this repo and language

You can disable automated security fix PRs for this repo from the Security Alerts page.

</details>

+3 -3

0 comment

1 changed file

pr created time in 4 days

create barnchMarkLodato/enigma

branch : dependabot/npm_and_yarn/postcss-7.0.36

created branch time in 4 days

issue commentin-toto/attestation

Question: Why is the protocol included on _type and predicateType?

I would keep https://, taking inspiration from the Linked Data universe where everything is a URI. I also agree with the self-documenting nature of it.

dlorenc

comment created time in 4 days

issue commentin-toto/attestation

Question: Why is the protocol included on _type and predicateType?

FWIW, Kubernetes uses the "URL minus the https://" convention.

Yeah they also limit the path to one "/" annoyingly IIRC

dlorenc

comment created time in 4 days

issue commentin-toto/attestation

Question: Why is the protocol included on _type and predicateType?

Media types are typically used for file formats, while URIs are used for schemas. In this case they are JSON-compatible schemas. If you use media types, then you would have to restrict it to JSON media types to still make sense (since the predicate is put into the statement object), and even then, the general assumption is that the "media" is preserved as-is and not JSON-parsed and inserted into an existing object. Using URIs makes sense to me. It also allows to re-use schemas with different payload media types (e.g. application/vnd.in-toto+cbor) since the schema is not strictly tied to a specific file format.

Another argument is that formats like CycloneDX already have built-in integrity support. If the media type of such formats would be used directly, then it would pull in the whole format, not just the claims schema, and this is not the intention here.

dlorenc

comment created time in 4 days

pull request commentsecure-systems-lab/signing-spec

Allow signature-less envelopes.

On the other, we have an actual use case for unauthenticated in-toto attestations (SLSA 1); publishing the raw payload also doesn't seem super desirable.

Would you elaborate on this?

Also, what about the suggestion from here?

Even for an initially unsigned payload that needs to be signed in turn by multiple people, someone can start by signing it first, turning it into a signed payload, then pass it around to attach more signatures.

MarkLodato

comment created time in 4 days

Pull request review commentsecure-systems-lab/signing-spec

Rename to DSSE, update PAE, mark as v1

 envelopes with individual signatures. } ``` +### No signatures++An envelope MAY have zero signatures to indicate unsigned data. For example,

Yes, what Dan says makes sense. Even for an initially unsigned payload that needs to be signed in turn by multiple people, someone can start by signing it first, turning it into a signed payload, then pass it around to attach more signatures.

MarkLodato

comment created time in 4 days