Supply Chain Integrity, Transparency, and Trust (SCITT): Meeting Minutes

• Meeting: Working Group
• Date and Time: 12 December 2022, 16:00 - 17:00 UTC
• Chairs: Hannes Tschofenig
• Note Takers: Kay Williams, Kiran Karunakaran, Brian
  Knight

Resources

• Meeting Video (link forthcoming)
• Agenda
• Bluesheets (link forthcoming)
• Presentation: None
• Chat Log

Introduction

• Welcome from Hannes to the group
• We are using IETF tooling including Meetecho for remote
  participation and HedgeDoc for notes
• Resources for Meetecho
  • https://www.ietf.org/media/documents/IETF-Meetecho-Documentation.pdf
  • https://www.ietf.org/how/meetings/technology/meetecho-guide-participant/

Use Cases Discussion

• Hannes shared the pull request for use cases
  https://github.com/ietf-scitt/draft-birkholz-scitt-software-supply-chain-use-cases/pull/8/files

• Henk described three use cases

  • Trust Bond between Package Supplier and Signing Authority
  • Updated Statements over Time
  • Authenticity of Promoted Software Products

• Dick confirmed the description of the Trust Bond use case

• Firmware Use Case

  • Hannes asked if Firmware use case is from Monty
  • Henk said he thinks Monty has not yet reviewed

• We need an audit use case and an infrastructure (system integration)
  use case

• Editor's Copy of Software Supply Chain Use Case: Please review
  and submit feedback via GitHub PR

Next Meeting Agenda

• Next meeting is on 19 December 2022,16:00 - 17:00 UTC

  • Agenda
  • Join Meetecho

• Target to have audit use case and infrastructure use case in the PR
  for review by next meeting: Discuss for next meeting

• Next step is to derive user requirements (scope for working group)
  from use case document and align on terminology (at least for
  critical terms)