{"thread":{"id":"57922","subject":"Fwd: Syncing up team members for the comprehensive security review of Git","startedAt":"2022-05-25T19:06:08Z","lastAt":"2022-05-25T19:06:08Z","messageCount":1,"participants":["Amir Montazery"],"isPatch":false,"patchVersion":null,"patchTotal":null},"messages":[{"id":"456112","messageId":"CADKuG0ukPErr75yd-bdosuxgkyALFqGqkWFJTLaM+npBzwEWFg@mail.gmail.com","threadId":"57922","inReplyTo":"CADKuG0vBcXp4GYECUUfYqc14LXjReudp1+UnJ+k=81pe9XuHUw@mail.gmail.com","subject":"Fwd: Syncing up team members for the comprehensive security review of Git","fromName":"Amir Montazery","fromEmail":"amir@ostif.org","sentAt":"2022-05-25T19:05:49Z","receivedAt":"2022-05-25T19:06:08Z","isPatch":false,"sender":{"key":"amir@ostif.org","avatar":null},"body":"Hello git mailing list! The purpose of this email is to inform you of\nthe coordinated security effort for git, and hopefully source some\ncontacts for questions and follow up. An overview of the effort is as\nfollows. It is broken up into three work packages. It would be great\nto have at least one contact/maintainer for each work package.\n\nWork Package 1: git source code review and threat modeling: This will\nbe done by the team at x41-dsec with a Gitlab team.\n\nWork Package 2: Supply chain security / CI infrastructure review with\nChainguard and Gitlab team.\n\nWork Package 3: A new setup of CodeQL for git with Xavier and his team\nfrom Github.\n\nPlease let me know if you have any questions. Thank you in advance! We\nare aiming to start the week of June 13th 2022.\n\n- Amir\n\nAmir Montazery\nManaging Director\nOpen Source Technology Improvement Fund\nhttps://ostif.org/\nhttps://calendly.com/ostif\n\n\n---------- Forwarded message ---------\nFrom: Amir Montazery \nDate: Wed, May 25, 2022 at 1:38 PM\nSubject: Re: Syncing up team members for the comprehensive security\nreview of Git\nTo: Xavier René-Corail , Markus Vervier\n, Eric Sesterhenn\n\nCc: Dennis Appelt , Derek Zimmer\n, Joern Schneeweisz , Eddie\nZaneski , Adolfo Veytia\n, Tracy Miranda , Ethan\nStrike \n\n\nAdding +Markus Vervier and +Eric Sesterhenn to the thread. Sorry, I\ngot my threads mixed up.\n\nOn Wed, May 25, 2022 at 12:38 PM Xavier René-Corail wrote:\n>\n> Hey Amir,\n>\n> Sorry for the late reply, busy times here. I am trying to find the best persons on our side an will let you know ASAP.\n>\n> --\n> Cheers\n> Xavier\n>\n>\n> On Tue, May 24, 2022 at 1:18 PM Amir Montazery wrote:\n>>\n>> Hello all,\n>>\n>> Please see the following doc. The next steps are as follows:\n>>\n>> Confirm information is accurate.\n>> Confirm who else, in anyone, should be engaged as part of this effort.\n>> Schedule intro meetings.\n>>\n>> Please let us know your thoughts and feedback! Thank you in advance!\n>>\n>> Link to doc: https://docs.google.com/document/d/1kRLVuvOFkXS1Jt_voDLBVZVQMpgfXUOCJQpnNXDZhQo\n>>\n>>\n>> On Tue, May 24, 2022 at 3:00 PM Amir Montazery wrote:\n>>>\n>>> Wonderful. Thank you everyone! We are finalizing a doc that will help guide the work and keep everyone informed. Once that is shared, we can confirm the info is accurate and move forward with scheduling a sync.\n>>>\n>>> Thank you,\n>>> Amir\n>>>\n>>> On Mon, May 16, 2022 at 6:56 AM Dennis Appelt wrote:\n>>>>\n>>>> Hi Derek - sounds good. Looking forward to learning more about the effort.\n>>>>\n>>>> On Fri, May 13, 2022 at 6:13 PM Derek Zimmer wrote:\n>>>>>\n>>>>> Nice to meet you Dennis!\n>>>>>\n>>>>> The supply chain side is Eddie, Tracy, and Adolfo. I believe they are all going to Kubecon so it will be sometime after that.\n>>>>>\n>>>>> Derek Zimmer\n>>>>> Executive Director\n>>>>> Open Source Technology Improvement Fund\n>>>>>\n>>>>>\n>>>>> On Thu, May 12, 2022 at 8:16 AM Joern Schneeweisz wrote:\n>>>>>>\n>>>>>> Hi all,\n>>>>>>\n>>>>>> sorry for just replying to a subset here, but I didn't want to spam everyone with scheduling questions.\n>>>>>>\n>>>>>> Regarding:\n>>>>>>\n>>>>>> > -Supply chain security / CI infrastructure review with Chainguard and Joern from Gitlab (if he so chooses to assist).\n>>>>>>\n>>>>>> My colleague Dennis (in cc:) is interested in joining this effort as he did quite some research in the supply chain field.\n>>>>>> For our scheduling and to decide how we can join the review we'd need to know the timeline for the supply chain and CI infra review.\n>>>>>>\n>>>>>> Thanks and looking forward to collaborate\n>>>>>>\n>>>>>> joern\n>>>>>>\n>>>>>>\n>>>>>>\n>>>>>> On Wed, May 11, 2022 at 6:54 PM Derek Zimmer wrote:\n>>>>>>>\n>>>>>>> Hello everyone,\n>>>>>>>\n>>>>>>> We've had all of our initial meetings with the stakeholders on this project and I'm here to fill us all in on communication channels and responsibilities. If I've missed anyone that is participating from any of the orgs involved, please add them to this email so that we can all get on the same page and have all of the required contacts.\n>>>>>>>\n>>>>>>> Because of the wide scope of this project there will be some overlap between the work of the teams, and it is crucial that we ensure that everyone has access to the information that they need to make this work as fruitful as possible.\n>>>>>>>\n>>>>>>> We have three main work packages that we are executing:\n>>>>>>> -Git source code review and threat modeling: This will be done by the team at x41-dsec with Joern from Gitlab.\n>>>>>>> -Supply chain security / CI infrastructure review with Chainguard and Joern from Gitlab (if he so chooses to assist).\n>>>>>>> -A new setup of CodeQL for git with Xavier and his team from Github.\n>>>>>>>\n>>>>>>> Because Git is an enormous project with hundreds of contributors, we've been directed by the maintainers to refer questions to the mailing list. If we get no response or need some specific responses or access, OSTIF can reach out to the maintainers directly to find the people required (if the mailing list fails to produce results). The mailing list is at git@vger.kernel.org (PLAIN TEXT EMAIL ONLY, ANYTHING ELSE IS AUTOMATICALLY REJECTED).\n>>>>>>>\n>>>>>>> Our next step is to find everyone's availability so that we can generally set expectations about who is doing work and when. These projects do not have to happen simultaneously as each work package has different end-goals, but we should share relevant information between teams to prevent redundant work and wasted resources.\n>>>>>>>\n>>>>>>> So the questions to answer:\n>>>>>>>\n>>>>>>> Do we have everyone here?\n>>>>>>> Is everyone's role understood?\n>>>>>>> When can your respective teams begin?\n>>>>>>>\n>>>>>>>\n>>>>>>> Thank you all for participating in this! I'm confident that this effort is going to help secure all of open source!\n>>>>>>>\n>>>>>>> All the best,\n>>>>>>>\n>>>>>>> Derek Zimmer\n>>>>>>> Executive Director\n>>>>>>> Open Source Technology Improvement Fund\n>>>>>>\n>>>>>>\n>>>>>>\n>>>>>> --\n>>>>>> Joern SchneeweiszStaff Security Engineer, Security Research | GitLab\n>>>>>>\n>>>>>> GitLab GmbH\n>>>>>>\n>>>>>> Elsenheimerstraße 7\n>>>>>> c/o RPI Roehm + Partner 80687 München\n>>>>>> Registergericht: Amtsgericht München, HRB 237630\n>>>>>> Geschäftsführer: Sytse Rients Sijbrandij\n>>>>\n>>>>\n>>>>\n>>>> --\n>>>>\n>>>> Dennis Appelt Security Engineer | GitLab\n>>>\n>>>\n>>>\n>>> --\n>>> Amir Montazery\n>>> Managing Director\n>>> Open Source Technology Improvement Fund\n>>> https://ostif.org/\n>>> https://calendly.com/ostif\n>>>\n>>\n>>\n>> --\n>> Amir Montazery\n>> Managing Director\n>> Open Source Technology Improvement Fund\n>> https://ostif.org/\n>> https://calendly.com/ostif\n>>\n\n\n-- \nAmir Montazery\nManaging Director\nOpen Source Technology Improvement Fund\nhttps://ostif.org/\nhttps://calendly.com/ostif\n\n\n\n-- \nAmir Montazery\nManaging Director\nOpen Source Technology Improvement Fund\nhttps://ostif.org/\nhttps://calendly.com/ostif\n"}]}