August 14th, 2023 Community Meeting

[qu1queee]

• Please add a topic in this thread and add a link to the GitHub issue associated with the topic.
• Please make sure you give folks enough time to review/discuss the topic offline on GitHub before coming into the meeting
• (optional) Paste the image of an animal 😸

[coreydaley]

This was completed.

[SaschaSchwarze0]

Let's discuss on which path we go in [BETA API] Provide a solution to automatically create TLS secret and inject caBundle #1344.

[qu1queee]

• Hacktoberfest participation is confirmed, we need to work on the issues.
• Chuang Wang from Tekton should join us today, we will discuss on the security features we are working at the moment.

[coreydaley]

I would like to propose that we bulk add all existing issues and pull requests to https://github.com/orgs/shipwright-io/projects/6 now that automation is setup on all repositories to add newly created issues and pull requests.

We should also link the project to all of the repositories Projects tab so that it can be found easily.

[qu1queee]

Meeting minutes:

1. On August 14th, 2023 Community Meeting  #156 (comment) , we conclude the following:
   a) default will be with cert-manager annotations, will generate the CABundle and update the CRD for the four CR's
   b) second option is to extend the one-line kubectl apply, and add one more step, where the CABundle is autogenerated with a script and the CR's(4) are patched on the fly.
   c) To consider how the above two options will look for the operator.

2. On August 14th, 2023 Community Meeting  #156 (comment) :

   • On Tekton Chains, currently generating attestations for SLSA v1.0 spec
   • On Tekton Chains, non forgeable provenance, e.g. how to ensure the Tekton CRD's are not temper.
   • Currently Tekton is compliant with SLSA level 2.
   • One of the conclusions is about reusability of libraries in Tekton Chains for SHP, we might need an spike issue for this
   • How do we continue the collaboration? from @adambkaplan to continue a discussion on SHP having its own attestation controller.