Okay, hi, everyone. Welcome. My name is Jeff Mendoza. I work for Kusari, and I'm here
to talk to you about S-bombs and using them with clearly defined. I also want to give
a shout out to Chiang and Lynette, who both wanted to come, but we're able to make it
and they're, um, yeah, they're sad they can't be here, but me, Chiang, and Lynette,
make up the technical steering committee for clearly defined. Other stuff that I work
on is open SSF projects like guac, and scorecard, and all star.
Okay, you're at the limit. Thank you. All right, so this shouldn't be a surprise. S-bombs are
great for legal compliance. That was literally one of the primary reasons that S-bombs
were created. They have all the right fields to put in your license information, the
expressions, discovered licenses, attributions, copyright statements, et cetera.
And then for those of you that are really only focused on security, legal compliance is
of course, complying with the licenses of all the open source software that you use, that
you ship, that you distribute. Licenses, what makes open source open source, and they
have obligations, even permissive licenses, have obligations.
All right, so getting back to S-bombs, so we have an S-bombs, we want to carry out legal
compliance. They have all the right fields, but what goes into those fields. Most of the
time, when you're generating an S-bombs, you're running some kind of S-bombs creation tool,
generator. And these tools actually have to be jack of all trades. They have to find all
of your dependencies, depending on what language you use, whether you have files, whether you
have a container. They do a lot of great work there, but sometimes they can't be the
best at everything. So your creation tool might on the legal side just look at the top
level reported license, like if you have an NPM package, it might look at what is the license
name inside your package JSON. I'm going to stick that into the S-bombs. Or some other
top level matching on the license file, or they might just skip actually doing license
detection and just put no assertion in all the license fields, because maybe you're using
S-bombs for something else. So kind of what I want to get to is this is not, this is
not suitable for really serious legal compliance. There's a lot more that you can look at
and get to. And the creation tool, we shouldn't really expect it to be perfect at everything.
So there's a project called scan code that will scan the not just the package top level,
but all the different files inside of the package, inside of distribution, gets all the legal
text out of every file, gets a detailed scan data. And there's other good scanners as well,
like scan code that we do this for you. And anybody that works in legal compliance, it works
with scan code or another tool like this all the time. So that brings us to clearly defined.
So clearly defined is a project, a code project that scans lots of projects, and then it's also
an open data set project that contains all of the results of all of the scans. So it's
while it runs scan code and other scanners, it also compiles all of that information into a
top level definition, where it's kind of summarizes and groups everything together. It has both
the declared license, what we think that the package author was trying to say, and then the
discovered, which is kind of the comprising of all the results of all the different scan tools.
You can get the definition, which is that summary, or also the actual raw data from the scanners
themselves. Clearly defined uses the SPDX license list for license identifiers and the expressions,
which both major S-bomb formats use as well. And it gives you not just the license and the
expression, but the copyright attribution information, which you would need to generate a notice file
and the source location, which is if you're distributing a copy left, you don't be able to download
that and distribute that as well. And so the whole idea of clearly defined is that if you were to run
something like scan code on jQuery 1, 2, 3, if somebody else runs that scan code on that same
package, they're going to get the same results and why does everybody have to run it separately?
And it does take a little bit of time to run. So let's just put all that information in a central
area. Another thing that clearly defined does is, in addition to all of the
programmatically generated information, the community and of legal experts can say, oh, I think that
this scan information is incorrect. We looked at all of the files and the author really intended
this license. So they can actually add a curation on top of the data that's peer reviewed by
the community. And then you can get actually higher fidelity information from clearly defined
than you would if you just ran the scanner yourselves. So it's available on a website which you
could browse or rest API, which you can use to download all the definitions. So we run the service,
we run scans, and then we hold all the data. But does it work with S-bombs?
Until now, no, but now it does. So this was actually very, very straightforward to write things
to some other tools. But I wrote a very quick tool called CDS-bom, which will, you can pass it
a nest bomb that has whatever legal information in there, but we can throw that away and then
query the legal information from clearly defined, replace it in the S-bom and then output a new
augmented S-bom. It can also generate a notice file. It's available as a CLI or a Google library.
But the things that really made this very easy to do is that protobom is a great
library that allows you to read modify right S-bombs with very little code in go.
And then the other thing is clearly defined doesn't use pearls exactly. It uses this
what it was called. The coordinate is the idea of the software package identifier. And so to translate
between pearl and coordinate, the Glock project released a library that you can pass one and get the
other and have that translation there. I do want to give a quick demo. So I've got here a directory that's
got some S-bombs. I'm just going to run CDS-bom on S-bom S-bDX and it's going to read the S-bom.
Find out all the pearls translate all those coordinates. It's very clearly defined. Get all the data.
I output the difference here and then if we look here, we have a new file called S-bDX new and it
has a bunch of we could down a little bit. Some of these discovered licenses get really long.
When there's a lot of like test data or other stuff found and that's the declared side. It's
still pretty easy. And then I want to run the the other tool which is S-bom. Notice.
Let's run it on the cyclone DX one. And then if I refresh here, I'll have a notice file.
So it'll just use the S-bom parset and go up to clearly find to grab a notice file that you
could use to distribute that code. The other thing I wanted to show real quick,
this is where the code is located. So I'm trying to figure out if we want to move it into the
clearly defined project itself or if I'll host it or wherever just the install instructions.
And then the the part that does the enhancement is again a library that you could easily.
If you have a go code and you parse a S-bom with protobom, you can just call this library to enhance
your protobom S-bom document with the legal information from clearly defined.
And oops, I started from the beginning. Yeah, that's it. So you know, the user S-bom is clearly defined.
If you have any any have any other ideas on how you want to use S-bom and get the legal
information clearly defined that isn't here, I'd be really interested to know.
Because I think putting these things together was very simple and I want to get workflows
that work and get the right legal information to all of you all. Other things you can do to join the
community is if you have a dependency and the the scan results from clearly defined or incorrect,
open up a curation. The community will look at it and see like is this, is this the right
change and merge it if so. The running the scans takes a lot of compute power. We allow people
to donate their compute and run the scans on their their saw their hardware and then upload the results.
And of course it's a it's a code project so you can join us and and start hacking.
Yeah, question ringer.
Yeah. So on the tools I wrote yeah the question is does cycling dx s pdx all have the right
feature parity so the tools I wrote use protocol and protocol supports all the formats.
Cycling dx doesn't have right now the license discovered or concluded field so that wouldn't be put in there.
Question Anthony. Yeah. How do we offer it in all the languages?
Well the question is like how do we offer this another languages? Well the CLI tool can be used by anybody.
So this is another idea I'm having is like again getting away from the s bomb generator doing everything.
I've seen tools like yours that are a little bit more about modifying s bombs after they're generated.
So you know I can see people generating s bombs using a a number of tools to enhance them.
And then ending up with a bit with a better s bomb. So the CLI tool should be great for everybody.
But for libraries I'll maintain go and you know I'm sure there's a python one that will work.
Great. Is there a plan to local pearls and the question is is there a plan to move to pearls and clearly find not right now?
The question is how do we deal with information with a lower reliability score?
So you know when we get a lot of curation we can think about like is there something that we can do there?
But for the most part we're really relying on the underlying scan tool.
Okay so the question is should we use the reliability score and clearly to find and maybe only selectively pull license information into the s bomb?
That's a great feature I'd like to have that.
Questions in the back?
Yeah the question is how are pearls and coordinates different and
there's just some minor differences like if there's an empty string in the coordinate use a dash.
Sorry. Okay, I don't let that offline. Thank you.