Interested in Dev/Contributing to GUAC?

[Brandon Lum]

Welcome! This thread is on expressing interest in contributing to GUAC! We are glad to welcome our fellow open source contributors! As the project is starting up, we will be creating issues that folks can pick up and work on. In the meantime, as the code base is forming up, we'd like to engage directly with our contributors!

BTW we now have a slack channel: https://openssf.slack.com/archives/C03U677QD46

If you are interested in contributing, it would be very helpful to provide the following details (copy and paste into your comment):

1. I am interested in contributing to:
- [ ] Development
- [ ] Documentation
- [ ] Issue triage and community
- [ ] Technical advisory (review [governance document](https://github.com/artifact-ff/artifact-ff/blob/main/GOVERNANCE.md#technical-advisory-members))

2. I am here because:
- [ ] Personal interest
- [ ] My company/orgs i work with are interested in this

3. What is your associated company/org if you're contributing in their capacity? _________

4. Depending on how things go, I may be interested in becoming a maintainer of the project
- [ ] Yes

5. (optional) I have expertise in:
- [ ] Neo4j
- [ ] Cypher
- [ ] GraphQL
- [ ] Intoto
- [ ] SPDX
- [ ] CycloneDX
- [ ] Others (fill in):

[Chapman Pendery]

1. I am interested in contributing to:

• Development
• Documentation
• Issue triage and community
• Technical advisory (review governance document)

2. I am here because:

• Personal interest
• My company/orgs i work with are interested in this

3. What is your associated company/org if you're contributing in their capacity?

4. Depending on how things go, I may be interested in becoming a maintainer of the project

• Yes

5. (optional) I have expertise in:

• Neo4j
• Cypher
• GraphQL
• Intoto
• SPDX
• CycloneDX
• Others (fill in): Grype, Syft, Trivy, OSV data formats, Golang

Note: my company may be interested in the project and me contributing in their capacity, so I'll update this note if they approve that work

[shafee]

1. I am interested in contributing to:

• Development
• Documentation
• Issue triage and community
• Technical advisory (review governance document)

2. I am here because:

• Personal interest
• My company/orgs I work with are interested in this

3. What is your associated company/org if you're contributing in their capacity? _________

4. Depending on how things go, I may be interested in becoming a maintainer of the project

• Yes
• Maybe. Would be interested to stick with it so I can learn more about supply chain security 😃

5. (optional) I have expertise in:

• Neo4j
• Cypher
• GraphQL (somewhat)
• Intoto
• SPDX
• CycloneDX
• Others (fill in): HTML, CSS, JavaScript, Node.js, React, SQL. Open to expand my contribution/learning if more work is needed in any area of this project

[Jhon Baron]

1. I am interested in contributing to:

• Development
• Documentation
• Issue triage and community
• Technical advisory (review governance document)

2. I am here because:

• Personal interest
• My company/orgs i work with are interested in this

3. What is your associated company/org if you're contributing in their capacity? _________

4. Depending on how things go, I may be interested in becoming a maintainer of the project

• Yes

5. (optional) I have expertise in:

• Neo4j
• Cypher
• GraphQL
• Intoto
• SPDX
• CycloneDX
• Others (java, spring boot, mySql, mongodb, redis, golang, xml, json, rabbitmq, activemq, gcp):

[Shripad Nadgowda]

1. I am interested in contributing to:

• Development
• Documentation
• Issue triage and community
• Technical advisory (review governance document)

2. I am here because:

• Personal interest
• My company/orgs i work with are interested in this

3. What is your associated company/org if you're contributing in their capacity? _Intel

4. Depending on how things go, I may be interested in becoming a maintainer of the project

• Yes

5. (optional) I have expertise in:

• Neo4j
• Cypher
• GraphQL
• Intoto
• SPDX
• CycloneDX
• Others (fill in):

[Brandon Lum]

btw we have a slack channel now! https://openssf.slack.com/archives/C03U677QD46 come join

[Matt Young]

1. I am interested in contributing to:

• Development
• Documentation
• Issue triage and community
• Technical advisory (review governance document)

2. I am here because:

• Personal interest
• My company/orgs i work with are interested in this

3. What is your associated company/org if you're contributing in their capacity? ...stay tuned.

4. Depending on how things go, I may be interested in becoming a maintainer of the project

• Yes

5. (optional) I have expertise in:

• Neo4j
• Cypher
• GraphQL
• Intoto
• SPDX
• CycloneDX
• Others (fill in):
  • cncf/landscape-graph
  • cncf/tag-observability
  • k8s, linkerd, operators, streaming, ci, gitops, dataThings, STRIDE, pride, compliance, ...
  • Cirrus, Nimbostratus, Cumulonimbus, Stratocumulus, Mammatus, Orographic, Lenticular, and Contrails.

[Michael de Senna]

1. I am interested in contributing to:

• Development
• Documentation
• Issue triage and community
• Technical advisory (review governance document)

2. I am here because:

• Personal interest
• My company/orgs i work with are interested in this

3. What is your associated company/org if you're contributing in their capacity? _________

4. Depending on how things go, I may be interested in becoming a maintainer of the project

• Yes

5. (optional) I have expertise in:

• Neo4j
• Cypher
• GraphQL
• Intoto
• SPDX
• CycloneDX
• Others (fill in): Grype, Syft, Trivy, testing, CI

Note: my company may be interested in the project and me contributing in their capacity, so I'll update this note if they approve that work.

[NaveenKumar Namachivayam ⚡]

1. I am interested in contributing to:

• Development
• Documentation
• Issue triage and community
• Technical advisory (review governance document)

2. I am here because:

• Personal interest
• My company/orgs i work with are interested in this

3. What is your associated company/org if you're contributing in their capacity? _________

4. Depending on how things go, I may be interested in becoming a maintainer of the project

• Yes

5. (optional) I have expertise in:

• Neo4j
• Cypher
• GraphQL
• Intoto
• SPDX
• CycloneDX
• Others (fill in):

[Jude]

1. I am interested in contributing to:

• Development
• Documentation
• Issue triage and community
• Technical advisory (review governance document)

2. I am here because:

• Personal interest
• My company/orgs i work with are interested in this

3. What is your associated company/org if you're contributing in their capacity? https://haiphen.io__

4. Depending on how things go, I may be interested in becoming a maintainer of the project

• Yes

5. (optional) I have expertise in:

• Neo4j
• Cypher
• GraphQL
• Intoto
• SPDX
• CycloneDX
• Others (fill in): ml, nlp, BERT, inductive GNN

[Daniel Haim]

1. I am interested in contributing to:

• Development
• Documentation
• Issue triage and community
• Technical advisory (review governance document)

2. I am here because:

• Personal interest
• My company/orgs i work with are interested in this

4. Depending on how things go, I may be interested in becoming a maintainer of the project

• Yes

5. (optional) I have expertise in:

• Neo4j
• Cypher
• GraphQL
• Intoto
• SPDX
• CycloneDX
• Others (fill in):

[Satish Chintapalli]

1. I am interested in contributing to:

• Development
• Documentation
• Issue triage and community
• Technical advisory (review governance document)

2. I am here because:

• Personal interest
• My company/orgs i work with are interested in this

3. What is your associated company/org if you're contributing in their capacity? _________

4. Depending on how things go, I may be interested in becoming a maintainer of the project

• Yes

5. (optional) I have expertise in:

• Neo4j
• Cypher
• GraphQL
• Intoto
• SPDX
• CycloneDX
• Others (fill in):

[Asankhaya Sharma]

1. I am interested in contributing to:

• Development
• Documentation
• Issue triage and community
• Technical advisory (review governance document)

2. I am here because:

• Personal interest
• My company/orgs i work with are interested in this

3. What is your associated company/org if you're contributing in their capacity? N/A

4. Depending on how things go, I may be interested in becoming a maintainer of the project

• Yes

5. (optional) I have expertise in:

• Neo4j
• Cypher
• GraphQL
• Intoto
• SPDX
• CycloneDX
• Others (fill in):
  We designed and implemented a similar Security Graph Language (SGL) @sourceclear.
  The work was presented at IEEE SecDev 2018:
  SGL Slides
  SGL Paper

[anthonyharrison]

1. I am interested in contributing to:

• Development
• Documentation
• Issue triage and community
• Technical advisory (review governance document)

2. I am here because:

• Personal interest
• My company/orgs i work with are interested in this

3. What is your associated company/org if you're contributing in their capacity? _________

4. Depending on how things go, I may be interested in becoming a maintainer of the project

• Yes

5. (optional) I have expertise in:

• Neo4j
• Cypher
• GraphQL
• Intoto
• SPDX
• CycloneDX
• Others (fill in): Python

[salnewton]

1. I am interested in contributing to:

• Development
• [x ] Documentation
• [x ] Issue triage and community
• [x ] Technical advisory (review governance document)

2. I am here because:

• [x ] Personal interest
• [x ] My company/orgs I work with are interested in this

3. What is your associated company/org if you're contributing in their capacity? Intel_______

4. Depending on how things go, I may be interested in becoming a maintainer of the project

• [x ] Yes
• [x ] Co-Maintainer

5. (optional) I have expertise in:

• Neo4j
• Cypher
• GraphQL
• Intoto
• SPDX
• CycloneDX
• [x ] Others (fill in):
• [x ] Policy
• [x ] Policy Shifted Left
• [x ] SDLC Requirements
• [x ] Risk Management
• [x ] Compliance through SDLC
• [x ] NIST 800-218
• [x ] Smart aggregation turning data into meaning

[GreyXor]

1. I am interested in contributing to:

• Development
• Documentation
• Issue triage and community
• Technical advisory (review governance document)

2. I am here because:

• Personal interest
• My company/orgs i work with are interested in this

3. What is your associated company/org if you're contributing in their capacity?
   Morphysm

4. Depending on how things go, I may be interested in becoming a maintainer of the project

• Yes

6. (optional) I have expertise in:

• Neo4j
• Cypher
• GraphQL
• Intoto
• SPDX
• CycloneDX
• Go
• CodeQL

[blaz Ocepek]

1. I am interested in contributing to:

• Development
• Documentation
• Issue triage and community
• Technical advisory (review governance document)

2. I am here because:

• Personal interest
• My company/orgs i work with are interested in this

3. What is your associated company/org if you're contributing in their capacity? _________

4. Depending on how things go, I may be interested in becoming a maintainer of the project

• Yes

5. (optional) I have expertise in:

• Neo4j
• Cypher
• GraphQL
• Intoto
• SPDX
• CycloneDX
• Others (fill in): Python, C#, C++, HTML, PHP, MSSQL, Oracle, TypeScript, NodeJs, Bash, Batch, PowerShell

[Ragha Vema]

1. I am interested in contributing to:

• Development
• Documentation
• Issue triage and community
• Technical advisory (review governance document)

2. I am here because:

• Personal interest
• My company/orgs i work with are interested in this

3. What is your associated company/org if you're contributing in their capacity? FannieMae

4. Depending on how things go, I may be interested in becoming a maintainer of the project

• Yes

5. (optional) I have expertise in:

• Neo4j
• Cypher
• GraphQL
• Intoto
• SPDX
• CycloneDX
• Others (fill in): Java, TypeScript, Python, Bash

[Randall]

1. I am interested in contributing to:

• Development
• Documentation
• Issue triage and community
• Technical advisory (review governance document)

2. I am here because:

• Personal interest
• My company/orgs i work with are interested in this

3. What is your associated company/org if you're contributing in their capacity? _________

4. Depending on how things go, I may be interested in becoming a maintainer of the project

• Yes

5. (optional) I have expertise in:

• Neo4j
• Cypher
• GraphQL
• Intoto
• SPDX
• CycloneDX
• Others (fill in): Go, Rust, C/C++, JS, TS, Ruby, Bash, Python, WASM, HTML/CSS, SQL

[Theofilos Petsios]

1. I am interested in contributing to:

• Development
• Documentation
• Issue triage and community
• Technical advisory (review governance document)

2. I am here because:

• Personal interest
• My company/orgs i work with are interested in this

3. What is your associated company/org if you're contributing in their capacity? Crash Override

4. Depending on how things go, I may be interested in becoming a maintainer of the project

• Yes

5. (optional) I have expertise in:

• Neo4j (familiarity)
• Cypher (familiarity)
• GraphQL (familiarity)
• Intoto
• SPDX
• CycloneDX (familiarity)
• Others (fill in): Python, Golang, C, LLVM, GCC, JS, TS, Bash, Python, HTML/CSS, SQL

[MALLA RAVINDRA ADITYA]

1. I am interested in contributing to:

• Development
• Documentation
• Issue triage and community
• Technical advisory (review governance document)

2. I am here because:

• Personal interest
• My company/orgs i work with are interested in this

3. What is your associated company/org if you're contributing in their capacity? _NA

4. Depending on how things go, I may be interested in becoming a maintainer of the project

• Yes

5. (optional) I have expertise in:

• Neo4j
• Cypher
• GraphQL
• Intoto
• SPDX
• CycloneDX
• Developer Advocacy
• Platform Enabler
• Programming Distributed Systems & Design Internals
• Best practices, recommendations for cloud native applications for good.

[Justin Abrahms]

1. I am interested in contributing to:

• Development
• Documentation
• Issue triage and community
• Technical advisory (review governance document)

2. I am here because:

• Personal interest
• My company/orgs i work with are interested in this

3. What is your associated company/org if you're contributing in their capacity? eBay

4. Depending on how things go, I may be interested in becoming a maintainer of the project

• Yes

5. (optional) I have expertise in:

• Neo4j
• Cypher
• GraphQL
• Intoto
• SPDX
• CycloneDX
• Others (fill in):

[JonZeolla]

1. I am interested in contributing to:

• Development
• Documentation
• Issue triage and community
• Technical advisory (review governance document)

2. I am here because:

• Personal interest
• My company/orgs I work with are interested in this

3. What is your associated company/org if you're contributing in their capacity? Seiso - cloud native security consulting. https:/sei.so

4. Depending on how things go, I may be interested in becoming a maintainer of the project

• Yes

5. (optional) I have expertise in:

• Neo4j
• Cypher
• GraphQL
• Intoto (user)
• SPDX
• CycloneDX
• Others (fill in): Policy [as code], compliance automation, TAG-Security Controls, being pedantic

[xavier zebier]

1. I am interested in contributing to:

• [ x ] Development
• [ x ] Documentation
• [ ] Issue triage and community
• Technical advisory (review governance document)

2. I am here because:

• [ X ] Personal interest
• My company/orgs i work with are interested in this

3. What is your associated company/org if you're contributing in their capacity? _________

4. Depending on how things go, I may be interested in becoming a maintainer of the project

• Yes

5. (optional) I have expertise in:

• [ X ] Neo4j
• Cypher
• GraphQL
• Intoto
• SPDX
• [ X ] CycloneDX
• Others (fill in):

[Andy Raj]

1. I am interested in contributing to:

• Development
• [X ] Documentation
• [ X] Issue triage and community
• [ X] Technical advisory (review governance document)

2. I am here because:

• [ X] Personal interest
• My company/orgs i work with are interested in this

3. What is your associated company/org if you're contributing in their capacity? _________

4. Depending on how things go, I may be interested in becoming a maintainer of the project

• [X ] Yes

5. (optional) I have expertise in:

• Neo4j
• Cypher
• GraphQL
• Intoto
• SPDX
• CycloneDX
• [X ] Others (fill in): Python, Compliance, FedRAMP,

[Zach Probst]

1. I am interested in contributing to:

• Development
• Documentation
• Issue triage and community
• Technical advisory (review governance document)

2. I am here because:

• Personal interest
• My company/orgs i work with are interested in this

3. What is your associated company/org if you're contributing in their capacity? Intuit

4. Depending on how things go, I may be interested in becoming a maintainer of the project

• Yes

5. (optional) I have expertise in:

• Neo4j
• Cypher
• GraphQL
• Intoto
• SPDX
• CycloneDX
• Others (fill in): Snyk, Artifactory

As one final note, my team is building an application that is much in the same vein as yours. We have a fairly mature project for modeling the infrastructure side. We are beginning to build new features around ingesting SBOM data and artifacts.

[Raj Joshi]

1. I am interested in contributing to:

• Development
• Documentation
• Issue triage and community
• Technical advisory (review governance document)

2. I am here because:

• Personal interest
• My company/orgs i work with are interested in this

3. What is your associated company/org if you're contributing in their capacity? _________

4. Depending on how things go, I may be interested in becoming a maintainer of the project

• Yes

5. (optional) I have expertise in:

• Neo4j
• Cypher
• GraphQL
• Intoto
• SPDX
• CycloneDX
• Others (fill in): NIST 800-218, 800-161, SAMM, Secure SDLC, Third party risk, Product Security

[Alex Floyd Marshall]

1. I am interested in contributing to:

• Development
• Documentation
• Issue triage and community
• Technical advisory (review governance document)

2. I am here because:

• Personal interest
• My company/orgs i work with are interested in this

3. What is your associated company/org if you're contributing in their capacity? Raft

4. Depending on how things go, I may be interested in becoming a maintainer of the project

• Yes

5. (optional) I have expertise in:

• Neo4j
• Cypher
• GraphQL
• Intoto
• SPDX
• CycloneDX
• Others (fill in):

[Rajesh Jain]

1. I am interested in contributing to:

• Development
• Documentation
• Issue triage and community
• Technical advisory (review governance document)

2. I am here because:

• Personal interest
• My company/orgs i work with are interested in this

3. What is your associated company/org if you're contributing in their capacity? _________

4. Depending on how things go, I may be interested in becoming a maintainer of the project

• Yes

5. (optional) I have expertise in:

• Neo4j
• Cypher
• GraphQL
• Intoto
• SPDX
• CycloneDX
• Others (fill in): Iac, Policy, Compliance, Python, Ascii Doc

[Brandon Lum]

Hi all! Thanks for expressing interest, we will probably be starting a series of community meetings soon! Information will be put here when they start - stay tuned! In the meantime, thanks for joining us!

[Stephan]

1. I am interested in contributing to:

• Development
• Documentation
• Issue triage and community
• Technical advisory (review governance document)

2. I am here because:

• Personal interest
• My company/orgs i work with are interested in this

3. What is your associated company/org if you're contributing in their capacity? _________

4. Depending on how things go, I may be interested in becoming a maintainer of the project

• Yes

5. (optional) I have expertise in:

• Neo4j
• Cypher
• GraphQL
• Intoto
• SPDX
• CycloneDX
• Others (fill in): development in general (Java, Go, Python), secure development, supply chain security

[peter-thomas-db]

1. I am interested in contributing to:

• Development
• Documentation
• Issue triage and community
• Technical advisory (review governance document)

2. I am here because:

• Personal interest
• My company/orgs i work with are interested in this

3. What is your associated company/org if you're contributing in their capacity? Deutsche Bank

4. Depending on how things go, I may be interested in becoming a maintainer of the project

• Yes

5. (optional) I have expertise in:

• Neo4j
• Cypher
• GraphQL
• Intoto
• SPDX
• CycloneDX
• Others (fill in):

[siranen]

1. I am interested in contributing to:

• Development
• Documentation
• Issue triage and community
• Technical advisory (review governance document)

2. I am here because:

• Personal interest
• My company/orgs i work with are interested in this

3. What is your associated company/org if you're contributing in their capacity? _________

4. Depending on how things go, I may be interested in becoming a maintainer of the project

• Yes

5. (optional) I have expertise in:

• Neo4j
• Cypher
• GraphQL
• Intoto
• SPDX
• CycloneDX
• Others (fill in):

[Alex Vanderpot]

1. I am interested in contributing to:

• Development
• Documentation
• Issue triage and community
• Technical advisory (review governance document)

2. I am here because:

• Personal interest
• My company/orgs i work with are interested in this

3. What is your associated company/org if you're contributing in their capacity? LunaSec

4. Depending on how things go, I may be interested in becoming a maintainer of the project

• Yes

5. (optional) I have expertise in:

• Neo4j
• Cypher
• GraphQL
• Intoto
• SPDX
• CycloneDX
• Others (fill in): graph based vulnerability management databases, golang

LunaSec's LunaTrace project produces SBOM and VEX documents that could be consumed by the graph. LunaTrace is similar to GUAC in that it uses a graph data structure to reason about dependencies.

[Siddhant Khare]

1. I am interested in contributing to:

• Development
• Documentation
• Issue triage and community
• Technical advisory (review governance document)

2. I am here because:

• Personal interest
• My company/orgs i work with are interested in this

3. What is your associated company/org if you're contributing in their capacity? _________

4. Depending on how things go, I may be interested in becoming a maintainer of the project

• Yes

5. (optional) I have expertise in:

• Neo4j
• Cypher
• GraphQL
• Intoto
• SPDX
• CycloneDX
• Others (fill in):

[Ryan Craig]

1. I am interested in contributing to:

• Development
• Documentation
• Issue triage and community
• Technical advisory (review governance document)

2. I am here because:

• Personal interest
• My company/orgs i work with are interested in this

3. What is your associated company/org if you're contributing in their capacity? _________

4. Depending on how things go, I may be interested in becoming a maintainer of the project

• Yes

5. (optional) I have expertise in:

• Neo4j
• Cypher
• GraphQL
• Intoto
• SPDX
• CycloneDX
• Others (fill in): SLSA Framework, CUElang

[Jhon Baron]

btw we have a slack channel now! https://openssf.slack.com/archives/C03U677QD46 come join

could you please share another link ? I´m not able to join to this channel :(

[robh-snyk]

1. I am interested in contributing to:

• Development
• Documentation
• Issue triage and community
• Technical advisory (review governance document)

2. I am here because:

• Personal interest
• My company/orgs i work with are interested in this

3. What is your associated company/org if you're contributing in their capacity?

4. Depending on how things go, I may be interested in becoming a maintainer of the project

• Yes

5. (optional) I have expertise in:

• Neo4j
• Cypher
• GraphQL
• Intoto
• SPDX
• CycloneDX
• Others (fill in):

[Kumar Abhishek Shahi]

1. I am interested in contributing to:

• Development
• Documentation
• Issue triage and community
• Technical advisory (review governance document)

2. I am here because:

• Personal interest
• My company/orgs i work with are interested in this

3. What is your associated company/org if you're contributing in their capacity? Not Applicable_____

4. Depending on how things go, I may be interested in becoming a maintainer of the project

• Yes

5. (optional) I have expertise in:

• Neo4j
• Cypher
• GraphQL
• Intoto
• SPDX
• CycloneDX
• Others (fill in):

[gth999]

1. I am interested in contributing to:

• Development
• Documentation
• Issue triage and community
• Technical advisory (review governance document)

2. I am here because:

• Personal interest
• My company/orgs i work with are interested in this

3. What is your associated company/org if you're contributing in their capacity? Not Applicable

4. Depending on how things go, I may be interested in becoming a maintainer of the project

• Yes

5. (optional) I have expertise in:

• Neo4j
• Cypher
• GraphQL
• Intoto
• SPDX
• CycloneDX
• Others (fill in):

[Brandon Lum]

Hi All! We are having our first community meeting next week! Looking forward to meeting everyone!!

https://calendar.google.com/calendar/event?action=TEMPLATE&tmeid=MWc4aDR2cG80dXIyMmRkM[…]7576484474ebefce57c47d1eaeb02d6%40group.calendar.google.com

Google Meet link: meet.google.com/zpf-pfkj-ywd

@cpendery @shafeeshafee @Jhooomn @nadgowdas @halcyondude @desenna @QAInsights @JudeSafo @danielhaim1 @scpli3 @codelion @anthonyharrison @sallienewton @GreyXor @cepix1234 @rvema @ran-dall @nettrino @ralav @justinabrahms @JonZeolla @tixu @raj-andy1 @zprobst @raj-riskone @apmarshall @rjain15 @s-spindler @peter-thomas-db @AndrzejRPiotrowski @ajvpot @Siddhant-K-code @ryancraig @robh-snyk @KumarAbhishekShahi @gth999

[Jude]

What date and time? FYI: Unable to join the slack channel thus far.

…

On Tue, Dec 6, 2022, 7:27 PM Brandon Lum ***@***.***> wrote: Hi All! We are having our first community meeting next week! Looking forward to meeting everyone!! @cpendery <https://github.com/cpendery> @shafeeshafee <https://github.com/shafeeshafee> @Jhooomn <https://github.com/Jhooomn> @nadgowdas <https://github.com/nadgowdas> @halcyondude <https://github.com/halcyondude> @desenna <https://github.com/desenna> @QAInsights <https://github.com/QAInsights> @JudeSafo <https://github.com/JudeSafo> @danielhaim1 <https://github.com/danielhaim1> @scpli3 <https://github.com/scpli3> @codelion <https://github.com/codelion> @anthonyharrison <https://github.com/anthonyharrison> @sallienewton <https://github.com/sallienewton> @GreyXor <https://github.com/GreyXor> @cepix1234 <https://github.com/cepix1234> @rvema <https://github.com/rvema> @ran-dall <https://github.com/ran-dall> @nettrino <https://github.com/nettrino> @ralav <https://github.com/ralav> @justinabrahms <https://github.com/justinabrahms> @JonZeolla <https://github.com/JonZeolla> @tixu <https://github.com/tixu> @raj-andy1 <https://github.com/raj-andy1> @zprobst <https://github.com/zprobst> @raj-riskone <https://github.com/raj-riskone> @apmarshall <https://github.com/apmarshall> @rjain15 <https://github.com/rjain15> @s-spindler <https://github.com/s-spindler> @peter-thomas-db <https://github.com/peter-thomas-db> @AndrzejRPiotrowski <https://github.com/AndrzejRPiotrowski> @ajvpot <https://github.com/ajvpot> @Siddhant-K-code <https://github.com/Siddhant-K-code> @ryancraig <https://github.com/ryancraig> @robh-snyk <https://github.com/robh-snyk> @KumarAbhishekShahi <https://github.com/KumarAbhishekShahi> @gth999 <https://github.com/gth999> https://calendar.google.com/calendar/event?action=TEMPLATE&tmeid=MWc4aDR2cG80dXIyMmRkM[…]7576484474ebefce57c47d1eaeb02d6%40group.calendar.google.com <https://calendar.google.com/calendar/event?action=TEMPLATE&tmeid=MWc4aDR2cG80dXIyMmRkMWRvamc2cTJjdWcgY184NGYxZmNhYWRlYTJjNDU2ZWEwZDVkNjk5YzMyMGVlOWQ3NTc2NDg0NDc0ZWJlZmNlNTdjNDdkMWVhZWIwMmQ2QGc&tmsrc=c_84f1fcaadea2c456ea0d5d699c320ee9d7576484474ebefce57c47d1eaeb02d6%40group.calendar.google.com> — Reply to this email directly, view it on GitHub <#1 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/ACHAMGNFF6RJB6T5PG6Y2Q3WL7KWNANCNFSM55P5JXUQ> . You are receiving this because you were mentioned.Message ID: ***@***.***>

[Ross McEwan]

1. I am interested in contributing to:

• Development
• Documentation
• Issue triage and community
• Technical advisory (review governance document)

2. I am here because:

• Personal interest
• My company/orgs i work with are interested in this

3. What is your associated company/org if you're contributing in their capacity? _________

4. Depending on how things go, I may be interested in becoming a maintainer of the project

• Yes

5. (optional) I have expertise in:

• Neo4j
• Cypher
• GraphQL
• Intoto
• SPDX
• CycloneDX
• Others (fill in):

[Mihai Maruseac]

What date and time? FYI: Unable to join the slack channel thus far.
…

Monday, 12th of December, 8 am Pacific Time, 11 am East Coast time

[Jude]

Hi Mihai, Thanks for providing the date and time. Do you mind also providing the Google Meet link or zoom link to the meeting tomorrow? (The link provided in the original thread just pops open an empty calendar template). Sorry for the noise everyone, once I'm on the slack channel I'm sure it will be easier to communicate. On Wed, Dec 7, 2022, 12:26 PM Mihai Maruseac ***@***.***> wrote:

…

What date and time? FYI: Unable to join the slack channel thus far. … <#m_2465046113364643861_> On Tue, Dec 6, 2022, 7:27 PM Brandon Lum *@*.*> wrote: Hi All! We are having our first community meeting next week! Looking forward to meeting everyone!! @cpendery <https://github.com/cpendery> https://github.com/cpendery <https://github.com/cpendery> @shafeeshafee <https://github.com/shafeeshafee> https://github.com/shafeeshafee <https://github.com/shafeeshafee> @Jhooomn <https://github.com/Jhooomn> https://github.com/Jhooomn <https://github.com/Jhooomn> @nadgowdas <https://github.com/nadgowdas> https://github.com/nadgowdas <https://github.com/nadgowdas> @halcyondude <https://github.com/halcyondude> https://github.com/halcyondude <https://github.com/halcyondude> @desenna <https://github.com/desenna> https://github.com/desenna <https://github.com/desenna> @QAInsights <https://github.com/QAInsights> https://github.com/QAInsights <https://github.com/QAInsights> @JudeSafo <https://github.com/JudeSafo> https://github.com/JudeSafo <https://github.com/JudeSafo> @danielhaim1 <https://github.com/danielhaim1> https://github.com/danielhaim1 <https://github.com/danielhaim1> @scpli3 <https://github.com/scpli3> https://github.com/scpli3 <https://github.com/scpli3> @codelion <https://github.com/codelion> https://github.com/codelion <https://github.com/codelion> @anthonyharrison <https://github.com/anthonyharrison> https://github.com/anthonyharrison <https://github.com/anthonyharrison> @sallienewton <https://github.com/sallienewton> https://github.com/sallienewton <https://github.com/sallienewton> @GreyXor <https://github.com/GreyXor> https://github.com/GreyXor <https://github.com/GreyXor> @cepix1234 <https://github.com/cepix1234> https://github.com/cepix1234 <https://github.com/cepix1234> @rvema <https://github.com/rvema> https://github.com/rvema <https://github.com/rvema> @ran-dall <https://github.com/ran-dall> https://github.com/ran-dall <https://github.com/ran-dall> @nettrino <https://github.com/nettrino> https://github.com/nettrino <https://github.com/nettrino> @ralav <https://github.com/ralav> https://github.com/ralav <https://github.com/ralav> @justinabrahms <https://github.com/justinabrahms> https://github.com/justinabrahms <https://github.com/justinabrahms> @JonZeolla <https://github.com/JonZeolla> https://github.com/JonZeolla <https://github.com/JonZeolla> @tixu <https://github.com/tixu> https://github.com/tixu <https://github.com/tixu> @raj-andy1 <https://github.com/raj-andy1> https://github.com/raj-andy1 <https://github.com/raj-andy1> @zprobst <https://github.com/zprobst> https://github.com/zprobst <https://github.com/zprobst> @raj-riskone <https://github.com/raj-riskone> https://github.com/raj-riskone <https://github.com/raj-riskone> @apmarshall <https://github.com/apmarshall> https://github.com/apmarshall <https://github.com/apmarshall> @rjain15 <https://github.com/rjain15> https://github.com/rjain15 <https://github.com/rjain15> @s-spindler <https://github.com/s-spindler> https://github.com/s-spindler <https://github.com/s-spindler> @peter-thomas-db <https://github.com/peter-thomas-db> https://github.com/peter-thomas-db <https://github.com/peter-thomas-db> @AndrzejRPiotrowski <https://github.com/AndrzejRPiotrowski> https://github.com/AndrzejRPiotrowski <https://github.com/AndrzejRPiotrowski> @ajvpot <https://github.com/ajvpot> https://github.com/ajvpot <https://github.com/ajvpot> @Siddhant-K-code <https://github.com/Siddhant-K-code> https://github.com/Siddhant-K-code <https://github.com/Siddhant-K-code> @ryancraig <https://github.com/ryancraig> https://github.com/ryancraig <https://github.com/ryancraig> @robh-snyk <https://github.com/robh-snyk> https://github.com/robh-snyk <https://github.com/robh-snyk> @KumarAbhishekShahi <https://github.com/KumarAbhishekShahi> https://github.com/KumarAbhishekShahi <https://github.com/KumarAbhishekShahi> @gth999 <https://github.com/gth999> https://github.com/gth999 <https://github.com/gth999> https://calendar.google.com/calendar/event?action=TEMPLATE&tmeid=MWc4aDR2cG80dXIyMmRkM[…]7576484474ebefce57c47d1eaeb02d6%40group.calendar.google.com <https://calendar.google.com/calendar/event?action=TEMPLATE&tmeid=MWc4aDR2cG80dXIyMmRkM%5B%E2%80%A6%5D7576484474ebefce57c47d1eaeb02d6%40group.calendar.google.com> https://calendar.google.com/calendar/event?action=TEMPLATE&tmeid=MWc4aDR2cG80dXIyMmRkMWRvamc2cTJjdWcgY184NGYxZmNhYWRlYTJjNDU2ZWEwZDVkNjk5YzMyMGVlOWQ3NTc2NDg0NDc0ZWJlZmNlNTdjNDdkMWVhZWIwMmQ2QGc&tmsrc=c_84f1fcaadea2c456ea0d5d699c320ee9d7576484474ebefce57c47d1eaeb02d6%40group.calendar.google.com <https://calendar.google.com/calendar/event?action=TEMPLATE&tmeid=MWc4aDR2cG80dXIyMmRkMWRvamc2cTJjdWcgY184NGYxZmNhYWRlYTJjNDU2ZWEwZDVkNjk5YzMyMGVlOWQ3NTc2NDg0NDc0ZWJlZmNlNTdjNDdkMWVhZWIwMmQ2QGc&tmsrc=c_84f1fcaadea2c456ea0d5d699c320ee9d7576484474ebefce57c47d1eaeb02d6%40group.calendar.google.com> — Reply to this email directly, view it on GitHub <#1 (comment) <#1 (comment)>>, or unsubscribe https://github.com/notifications/unsubscribe-auth/ACHAMGNFF6RJB6T5PG6Y2Q3WL7KWNANCNFSM55P5JXUQ <https://github.com/notifications/unsubscribe-auth/ACHAMGNFF6RJB6T5PG6Y2Q3WL7KWNANCNFSM55P5JXUQ> . You are receiving this because you were mentioned.Message ID: @.*> Monday, 12th of December, 8 am Pacific Time, 11 am East Coast time — Reply to this email directly, view it on GitHub <#1 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/ACHAMGJ5DJIM7476AV4HPYLWMDCELANCNFSM55P5JXUQ> . You are receiving this because you were mentioned.Message ID: ***@***.***>

[Rewanth Tammana]

1. I am interested in contributing to:

• Development
• Documentation
• Issue triage and community
• Technical advisory (review governance document)

2. I am here because:

• Personal interest
• My company/orgs i work with are interested in this

3. What is your associated company/org if you're contributing in their capacity? Freelancer

4. Depending on how things go, I may be interested in becoming a maintainer of the project

• Yes

5. (optional) I have expertise in:

• Neo4j
• Cypher
• GraphQL
• Intoto
• SPDX
• CycloneDX
• Others (fill in): Nmap GSoC, Trivy Operator, Kubectl krew plugins, Damn Vulnerable Bank, containers-from-scratch, sigstore-the-easy-way, Golang, & many more. I'm willing to learn more whenever required.

Blog - https://blog.rewanthtammana.com/
Portfolio - https://rewanthtammana.com/

[Brandon Lum]

@JudeSafo here's the meet link: meet.google.com/zpf-pfkj-ywd

[Batuhan Apaydın]

1. I am interested in contributing to:

• Development
• Documentation
• Issue triage and community
• Technical advisory (review governance document)

2. I am here because:

• Personal interest
• My company/orgs i work with are interested in this

3. What is your associated company/org if you're contributing in their capacity? Trendyol

4. Depending on how things go, I may be interested in becoming a maintainer of the project

• Yes

5. (optional) I have expertise in:

• Neo4j
• Cypher
• GraphQL
• Intoto
• SPDX
• CycloneDX
• Others (fill in): Golang, Sigstore, SBOM, Tekton, Tekton Chains, SPIFFE, cosign, ko, Docker Buildx, Buildpacks, Kyverno, Flux, Helm, regclient, zot, OCI, Vault

[Furkan Türkal]

1. I am interested in contributing to:

• Development
• Documentation
• Issue triage and community
• Technical advisory (review governance document)

2. I am here because:

• Personal interest
• My company/orgs i work with are interested in this

3. What is your associated company/org if you're contributing in their capacity? Trendyol

4. Depending on how things go, I may be interested in becoming a maintainer of the project

• Yes

5. (optional) I have expertise in:

• Neo4j
• Cypher
• GraphQL
• Intoto
• SPDX
• CycloneDX
• Others (fill in): golang, sigstore, oci, sbom, slsa, and many more

[Brandon Lum]

Recording from the inaugural GUAC community meeting on 12 Dec (https://drive.google.com/file/d/1u1O6RSYeZT2w6u9jxeSj9X9Z1uqtD1Vn/view)

[Hemil K]

1. I am interested in contributing to:

• Development
• Documentation
• Issue triage and community
• Technical advisory (review governance document)

2. I am here because:

• Personal interest
• My company/orgs i work with are interested in this

3. What is your associated company/org if you're contributing in their capacity? Yahoo

4. Depending on how things go, I may be interested in becoming a maintainer of the project

• Yes

5. (optional) I have expertise in:

• Neo4j
• Cypher
• GraphQL
• Intoto
• SPDX
• CycloneDX
• Others (fill in): golang, sbom, syft

[Hossein Siadati]

1. I am interested in contributing to:

• Development
• Documentation
• Issue triage and community
• Technical advisory (review governance document)

2. I am here because:

• Personal interest
• My company/orgs i work with are interested in this

3. What is your associated company/org if you're contributing in their capacity? _________

4. Depending on how things go, I may be interested in becoming a maintainer of the project

• Yes

5. (optional) I have expertise in:

• Neo4j
• Cypher
• GraphQL
• Intoto
• SPDX
• CycloneDX
• Others (fill in): SBOM

[Alfred Tom]

The distributed energy grid might be able to use this so I'd like to get involved. Two questions:

• do I need to be a member of OpenSSF to join the Slack channel?
• what/who is going to host the database that stores all this data?

1. I am interested in contributing to:

• Development
• Documentation
• Issue triage and community
• Technical advisory (review governance document)

2. I am here because:

• Personal interest
• My company/orgs i work with are interested in this

3. What is your associated company/org if you're contributing in their capacity? Lumian.org and SunSpec.org

4. Depending on how things go, I may be interested in becoming a maintainer of the project

• Yes

5. (optional) I have expertise in:

• Neo4j
• Cypher
• GraphQL
• Intoto
• SPDX
• CycloneDX
• [x ] Others (fill in): distributed energy, Web3, smart contracts, solidity,

[Brandon Lum]

Hi fellow GUAC community members!

We have some exciting updates and announcements for the GUAC project!

Community Updates!

• We are having our next community meeting on 16 February! This will be a monthly recurring meeting! Calendar Invite here (located under Communication in README)
• We created a community mailing list! (located under Communication in README)

GUAC Beta v0.1

• We have a GUAC Beta v0.1 planned coming up. Besides a deployable services, this also marks a milestone in the development of a GraphQL which will eventually mature to the v1.0 API. The GUAC Beta is planned for end of March.
• We had the first maintainer summit since the initial formation of the project. The focus of the workshop was to discuss and get consensus on the open issues/design docs, as well as get some clarity around the proposed GUAC Beta v0.1. The summit notes are made available here (located under Additional References in README).

Lots of changes coming! Including some breaking ones!

• During this transition to the new API, there will be a LOT of code refactors and breaking changes within the next 3 months of project development.
• To ensure that folks can still try out the initial POC, we have created a tag for v0.0.1 to pin to the demo.
• We understand that this will impact contributors that want to contribute code to the project, since there are many moving pieces during this time, there is a chance that certain files within will be refactored or deprecated. For those wanting to contribute, we encourage discussing with a maintainer through issues or slack about the topic first before picking up an issue or opening a PR!

Cheers
GUAC Maintainers

[Brandon Lum]

@alftom

do I need to be a member of OpenSSF to join the Slack channel?

no, anyone can join it.

what/who is going to host the database that stores all this data?

for the attestations and the blob themselves this would be from the repo/storage that they reside in. For the graph DB, currently, we store the linkage and metadata in neo4j. However, this backend is extensible.

In terms of document storage, we have chatted about potentially have a collector that handles this for you (e.g. if you point it to a http endpoint, it will keep a copy of the documents it collects), and these are exposed through the SourceInformation field within the nodes/edges.

Would you mind creating a separate issue if you'd like further expansion so it will be better searchable! Thanks!

[Dejan Bosanac]

1. I am interested in contributing to:

• Development
• Documentation
• Issue triage and community
• Technical advisory (review governance document)

2. I am here because:

• Personal interest
• My company/orgs i work with are interested in this

3. What is your associated company/org if you're contributing in their capacity? Red Hat

4. Depending on how things go, I may be interested in becoming a maintainer of the project

• Yes

5. (optional) I have expertise in:

• Neo4j
• Cypher
• GraphQL
• Intoto
• SPDX
• CycloneDX
• Others (fill in): Rust, Kubernetes, Containers, Java, Community building

[Kanchan Dhamane]

1. I am interested in contributing to:

• Development
• Documentation
• Issue triage and community
• Technical advisory (review governance document)

2. I am here because:

• Personal interest
• My company/orgs i work with are interested in this

3. What is your associated company/org if you're contributing in their capacity? _________

4. Depending on how things go, I may be interested in becoming a maintainer of the project

• Yes

5. (optional) I have expertise in:

• Neo4j
• Cypher
• GraphQL
• Intoto
• SPDX
• CycloneDX
• Others (golang):

[Parth Patel]

Hello everyone! Please join our slack channel: https://openssf.slack.com/archives/C03U677QD46. If you are interested or looking to contribute and can't find an issue to work on, please reach out to us and we will be happy to point you to issues that need tackling!

[Brandon Lum]

Hi all! Now that we are close to our GUAC v0.1 beta launch (in a few weeks). Part of that is closing this issue! And pointing everyone over to the new contributing page that we've updated and fleshed out! So please do take a look there!

We have additional information on how to contribute and also a contributor ladder as well!