going on everyone, Sam here with late in sports cars. We're ripping 22 Bowman Chrome baseball hobby, 12 box full case break, number 29, pick your team style. Gonna read off our list of names and teams. Adrian W. Astros, Allen K. Pirates, Ammo D. Brewers, Austin L. Braves, thank you for selling us out Austin. Barry P. with the Cubs, Bo B. Guardians Padres, Ben L. Orioles, Brad R. Reyes, Charlie C. Athletics, Christopher J. with the Diamondbacks, CJ L. Rockies, David L. Bluejays, Eric R. Mariners, Irvin S. Twins, Harper B. Nationals, H.C. with the White Sox, Jeff P. Royals, Jerry F. Reds, Mark M. Dodgers, Mark L. Cardinals, Matthew R. Phillies, Michael S. Rangers, Nick C. with the Red Sox, Scott M. Yankees, Scott W. Tigers, Scott A. with the Marlins, Thomas J. Angels, and Will M. Metz and Giants. Good luck everybody, let's do it. Again guys, only five group race of spots left tonight, that's insane to me. Thank you guys so much, I just, best customer base in the entire world right here. Speechless. Speechless, exactly. Speechless. Home dust wiped down. All right, here we go, box one. Base, base. God, Teal Pink Vapor, Lonnie White Jr. to 125 Pirates. Prospect card. Got Gold Shimmer of Wilford and Varys, three of 50, going to the White Sox. Congrats, White Sox. That's HG, nice one there, three of 50. Turning off for the Gold, oh I like that, promising. That's Gold, that was for Gold. Done, done, done. Magenta Shimmer, Harry Ford to 199, not for the Mariners. For Gold I first, show first. Just kidding, Cubs is to 75, Picro Armstrong, nice one there still though. Trolled myself there. So is the canary yellow, can you do like a tweet-tweet? Yes, theoretically, yes. Base, auto, Liam Spence on the first, going to the Cubs. Nice one there.  Yeah, yes or no? The guy Sean was talking about. Nick Magigal to 499, what's up? Sean was saying there was a troll. I don't know if you, you might have been watching, but it was during the full case of Prism World Cup, first off the line. All the autos are backwards. And nothing else is backwards. So I'm going through a pack, we had not pulled our auto yet. Backwards killing in Bob Bay. And I'm like, dude, there it is, flip it over, baseball. And I'm like, dude, you gotta be kidding me. Sucks. I'm so pissed.  Everyone's like, that's so brutal. Yeah man, they got me. I was like, yes, some, some intern that's like, flip that around manually on the line, laughing right now. Watching the story, like, ah, I got him. Oh, Ronzie Contreras, rookie for the Pirates to 250. Bass and bass. I wonder what you'd have to do to get fired like first day. Oh yeah, ooh, red. Ooh. Red to five. True red. Is Daniel McElvaney, five of five, going to the Red Sox. What a color match on that. Nick C, congrats, man. True red. That is awesome. Look at that mag for you, my man. Nice, McElvaney. It's one of Blake's boys right there. Blake played with him. The guilty? Yeah. I think there's two guys in here that. No, I think like Blake's played with most of them. But I think there's Nathan Hickey and McElvaney that Blake's like, boys with. Oh. And I think he's played with Raphaela, who's like the big, Sidani Raphael is like the big Red Sox chase in this. That's cool. Yeah. Always good to have an MLB here working for us. Cause I always make, I always mess it up. I'm like, yeah, I'll take, I literally will take you for fifty guys in there. We'll literally hit a bomb off of you. We have a late baseball day. Right, honestly. Nice, another spot taken. We might be sold out on our first absolute half case, unless that was in the second one. No, that was in the second one. We're down to two in our second one now. Eric Hernandez. Samuel Munoz, nice one there on the first refractor, non-auto for the Dodgers to 499. Base auto Ian Lewis for the Marlins. Not numbered. Again, on the first. Like he, and then it's, you know, it's even weirder about Bowman from now. Like Ian Lewis in 2022 Bowman, like the first one that came out, his base first is in that. O'Neal Cruz rookie does not have base first in this, but has first autos, did not have autos in 22. And then like Brian Atunia had first autos in 22 and no base first. And now he has base first in this, but no first autos. It's strange. Zeke Otovar, shimmer for the Rockies. There's a couple other guys that have that situation too, like Trionto's. There's gotta be a weird system that they have in place. Oh yeah, for sure. Like. Absolutely. Like it's gotta make sense somehow. Doesn't make sense to us. In surface level, it's like very strange, but back there kind of pumper choice. I haven't read the case of choice in like a week. Ready for that. Base. We're gonna make it a fun little thing next year. Atomic Jose Tena for the Cardinals. No, Guardians, the 150. Arizona Fall is glad. Just show the fun of it. I know it's like not great, like a great financial game plan, but I wanna get one hobby box a month next year. I like it.  I like it a lot. There's Heavenly Evan Lee going to the Nationals base first. Be getting Chronicles every month. Yeah. Because it's not cheap it. Luminance, the other ones too. No, we'll probably be out of Luminance. Like I'm gonna try to get one more for the years over. Yeah. You think we have like two more? Yeah, we don't have a lot. I got Lane, like kept one aside for a week. Yeah, I'm sure. That'll be the last Luminance that I see in the next August. Yeah, I was gonna say like next. How depressing. Nine months base. I know what you're gonna do with yourself. I don't know. Absolutely not a bad, bad riff. No, it's not. How expensive is it? What's the price on it? I think it's four. Yeah. So that's looking pricey. Yeah. There's gonna be some other like cheaper options that come out too. Like some H2s of stuff. Absolutely five. Wow. Wow, that's going up. There we go. Teal Raywave Francisco Lindorca won 99. Yes, won 99 for the Mets. Five you wanna get. So I wanna get a Luminance box payday. Yeah. The next month I wanna get. Pena. Base Auto is gonna be Tyler Collins going to the Braves. Nice one there. Last team taken. Dude, please remove yourself from my vision, dude. Remove yourself from my vision right now. As of right now. He said here that he thinks he's gonna slap me. I still don't get it. I still don't get how you just don't have a box of sleeves in there. Well, how have you not done that? No, thank you. Why haven't you gotten just a full box of sleeves? I don't get it. I'm just about to use it. Clearly, I mean, obviously, yeah. There's no other reason. I just go grab them from a different spot. But when you're here, I have to. I cannot stand you. I can't stand you. This guy. I'm gonna go in and just start taking stuff from him. There's one been show for the Cardinals. Like stuff we don't even need, we can take it. The, I will say, Cardinals hobby still at three next month. I do wanna get up. You might pull a trigger on that. That's not bad, honestly. Well, I bought a couple H2s, but I've never opened a hobby. Hobby's probably the way to go. Yeah, it definitely is. Oh, look, oh, Caleb knocked. He knocked something over, too?  I'm gonna do it here. Next hurricane, we take Caleb. Yeah, honestly. Hey, thanks, Greg, taking the Panthers in number 17. We were sold out on absolute number 17. We got four group breaks with spots now to go. That is it. Two, 12, two and 12. That's very... What's the chances of Matt Crow competing for a starting spot next year? Low, but possible, because Darnell's not gonna be there. They just got rid of Baker. Just got rid of Baker. White speckle, Nelson Velazquez to 299 for the Cubs. And then they're gonna be bad enough where they're gonna be in the running for one of the big guys in the draft. Like a Shroud or a Yon or a Leviss. Got a green of Ryan Reckley, 6 out of 99. There you go, Giants, I think that's Will again. Will had the Giants in most of the breaks today. There you go, Will. Down to now one to go on our Prism and Select Mixers. Well, that's almost gone. And then we've just got 12 spots on Origins tiered, 12 spots on Wallace tiered, and that is it. Wallace is pretty cheap, too. For what it has been in the past, for what it is now, there's actually a pretty good discount on Wallace tiered. Shimmer or Wilman DS for the Dodgers. Oh, Joey Bart for the Giants to 75. Nice one for the Higantees. That guy ran like 50 yards to get one. There's Randon Cone for the Dodgers. Nice one there on the base auto. Congrats, Dodgers. Doyers. Doyers? Doyers, what's Doyers? Refractor, Kyle, talk her to 499 for the Astros. And base.  Thank you, Greg. Taking the last spot there, man. We got three group breaks with spots now. This is absurd. Like you hit Control, like Control C, or like, Like it's good to sold out, but it's not purple. Why is it not purple? I don't know. I don't know either. Garbit. Like you're just messing with me. Garbit, I suppose. Jeremy Pena Rookie. Dustin Harris on the Aqua Pink to 125. Rangers. Base auto, Greg Cullen, that's going to the Orioles. Not numbered. Again, that is a first. Shimmer, Joan Kenzie Noel for the Guardians. And base. Oh, Donnie, drop you guys a link to Origins Tier. What's up, Chad? Got Bowman Ascensions, Khalil Watson for the Marlins on the Super Short Print. Nice one there, Miami. That's got 12 spots to go. Orange of Daniel Vasquez. Nice one there for the Royals. Five of 25. Thank you, Don. Again, check that out, guys. That is a full 16 box case.  This tier, one from the top tier, one from the bottom tier. Purple is going to be Colin Burns for the Orioles, 114 out of 250. True purple, that is. Very nice. Ryan Acuna, Eric Hernandez. Ronald Acuna Jr. on the Refractor to 499, Braves. Chad, thank God you're here. There's been like no one in Chad. I want to talk to some people, man. What's going on, everybody? Well, I would tell you my day, but I'm right here. I was going to say, I pretty much know most of that. I'm top-loading, Sam. Dave, go crazy. Going up fanatastically. We might be slotting absolute now, too. Bold absolutes are sold out. Three group breaks with spots left on. That's it, man. Oh yeah, two, two group breaks, or two, yeah, two breaks with spots left, guys. Just origins and flawless. That is it. That is it for the night, guys. That is it. Customer in a two-digit. Unbelievable, dude. Like I said, best customer base in the entire world. Right here. The world. Could be Galaxy if we've been to the Galaxy. It's what we have here. I would, I'd put our customer base against any other customer base in the Galaxy. In the Milky Way, in the universe, even. True blue, Hendry Mendez to 150. Brew crew. True blue for the brew crew. Good job. Thank you. Don't be proud of yourself. I'm kind of telling me twice. Got a gold auto coming up now. Gold speckle. Is gonna be Michael Burroughs, 17 out of 50. Nice one there on the color match. Congrats, Pittsburgh. Michael Burrough? Please stop. It's what it says. No Burroughs. Oh, yeah. It's what it says with the cousins with Joey. My guess would be no.  What's up, Scooter? Joined Bob McRome for breakfast on Sunday down under. That's what I like to hear, man. Welcome, welcome. That's so weird thinking it's Sunday there. It's Saturday here. That's wild. Jason Shorio. And uh, look at that. Change out to a cruise out of 50, Alan. I wish, man. I wish, dude. That would be nice. That would be nice. Or a De Los Santos. De Los Santos would be pretty lit as well. Wander, shades of greatness, rookie. Yeason Morabelle to $2.99. No, $1.99 for the Rangers. I'm going to jump in. Bass Auto, Cabe Marlowe going to the Mariners. Nice one, C-Out. J-Rod, rookie. Purple Shimmer, Blaise Jordan to $2.50 for the Red Sox. Nice one there, Red Sox doing very well. Bass, there's Louise Meza first. On that one. Same game, and getting a ton of orders. We'd love to see that. Caleb Stihler stuff. Atomic, Trishon Kossus to $1.50 for the Red Sox on the Arizona Folly. No, it should do. If he goes to the trash house, he'd go take what's rightfully ours. Are the slaves back? I agree. There's your Donny De Los Santos. There you go, Alan with the Pirates. Nice one there, buddy. Take that for sure. Then he's like, do you guys take my slaves? I'd be like, how many times do we have to take them? We didn't take your slaves, we took our slaves. Yeah, there you go. Close, gotta get some color on a De Los Santos now. That would be cool. I'd be in on that. Cruz and Davis, honestly. Yeah, Henry Davis insert ought to be pretty cool. Be down for that. Cruz, rookie, speaking of, is that a sign? Is it a sign? There's gonna be a big O'Neill Cruz in here? Or a big Henry Davis? White speckle, West cap, to $2.99 for the white socks. A refractor auto, Herard Gonzales to $4.99, a 104 out of $4.99. Signed vertically, as Gonzales always does. Why did you do that? Who knows? There's a lot of questions you can ask about autographs. I just don't know if it's been stated why. No, I'm sure it hasn't. Magenta Shimmer to $1.99, Willie Vasquez for the race. I mean, this is our chance to email him. Be like, hey, we'd like to do an interview. Yes, why? Do you do that? That's the only question we have. That'll be all. Could do a two minute Zoom meeting. Honestly, what are you getting on there? So they don't give them a spot to sign? They give them a very nice spot to sign, too, Alan. That's the crazy part, man. You just guess it's against it. I don't know. It's got beef with this beef. That's a designated signing spot. I just wonder where he says the tops of the t-slit. They're like, he shows the sign in this blank part. He's just like, I'm the athlete, I'm the pro. Yeah. It's comical. That's what I'm saying, dude. I'm telling you, man. Unbelievable, to be honest. Sickening, honestly sick, like, vomit inducing. The hobby was just like, oh, because he signs differently, his cards are more valuable. Wouldn't put it past the hobby for that. There's your Donnie DeLos Santos, the 125, on the aqua pink, nice one there. Again, Alan. Alan, ever since he came in, he started manifesting all the Pirate's cards. The purple coming up, up, Norhei Vera, 112 out of 250, going to the White Sox, nice one there. White Sox are such a good team in this, dude. If you sign with an X, vertical or horizontal, is this still an X? Asking the real questions out here. It's a hard hitter right there, Scooter. Hard hitter. Shimmer, George Valera, for the Guardians, not numbered. No, that becomes a cross. Oh, to the next one. Nice. Yeah, I guess, technically. Theoretically, yes it is. That's warming Bernabelle, colding freeze and alarm to 199 on the ceiling for the Rockies. It becomes a math, a math equation. Yeah, true. Jeremy Pena. It's gonna be a base auto of Tanner McDougal going to the White Sox. Why am I digging into this? Asking the hard hit questions, that's what it is, Alan. It gives us something to talk about. Gives us something to talk about, yeah. Absolutely. There's Mookie Betts on a magenta to 199. Face. Breaker group chat. That's like, well, I'll finish it. What? I don't know, it's Breaker. A couple of groups. I was just figuring out something to say that I could figure out how to go. Dude's mouth just started moving forward. Exactly, exactly where I was going to do it. See what we got, good luck, everybody. Next, bucks. Feeling a good auto in this box? I could be talked into that. Well, to go on, Origins tiered. Like I said, guys, only two group breaks with spots left. There's a Hunter Green, Teal Raywave to 199. Rookie for the Reds. This should be our auto pack right here. We've got Samuel Munoz, very nice for the Dodgers on the base auto, we'll take that. Pack to that crew sign for, I know, honestly. Maybe they lied to me. Maybe the sign lied to me. Scootery gets it. This guy gets it. Shimmer, Danny D'Andrade on the first for the twins. Base. There's Leo Verbuero on the Aqua to 199. For the Pirates. There you go again, Alan. Base auto, Diego Velazquez going to the Giants. Nice one there. San Fran, SF. Nail Crews, Rookie. There's a Pink Torquilson to 199 for the Tigers. Not saying another word. Wander Rookie. Onto the next one here. Nail Crew, Shades of Greatness. Sup Ken, just barely made it out alive. Green, Ryan Belade for the Rockies to 99 on the True Green Rookie card. Should have our auto coming up here. Yes, it's gonna be Canary Yellow. Of Denzel Clark, 28 out of 75 on the color match for the A's, secondary color match. Congrats, Oakland. You know Tati's Refractor, it's a 499. Who's left, Serena? Who just left, Serena? Shot press. Yup, Paul and Jake. Oh, Paul and Jake. Second mini box. Who's here, just Serena and Alex now? No, Taylor. Oh, Taylor. Oh, so Paul and Jake. I was Alex during the day today. Gotcha. That's Jason Dominguez to 299. Nail Crew's written. Got Bass Auto, Willie Fannis, that's going to the Nets. Gotta tell you, do you know where the, we keep saying you gotta change your diaper, do you know where that originates from? Purple Shimmer, Jason Shorio to 250. Nice one there. Not completely. The Guardian, I gotta tell you. You might be able to tell you that story. It's actually pretty fun. You'll get why we always bring it up now, because it's pretty funny. Bass, two boxes to go, guys. Good luck, everybody.  It's up to you, if you feel like it. It's like $10 for like anything. Giancarlo Stanton to 250 for the Yankees. Anything to look at. True. White Speckle, Greg Cullen to 299. That's 32 out of 299 for the Orioles. On the first order. Card's got a lot of hands. Yeah, feel that, dude. Feel that. Like normally I don't spend more than like $10 on the card, but I got the Genesis, which is like 20 something. Then like, I want an auction for a Premier tie-dye at Kenny G. Ooh, nice. Select, and then. Refractor, Adrian Valencia to 499. That's going to the Angels on the first. And then I want another auction for out of five freshman fabric of Kenny G with the. Refractor, Otto John and the Megia going to the Cardinals. 11 out of 499, sir. With the back of the Eagles logo. Ooh, nice, nice. So, it's like $60 for like Kenny G, so. These kind of gain well guy over here. I feel like the price is like pretty good. Yeah, I know that's solid, especially if it's seen in collects. Yeah, that too. And then if we do end up fingers cross-winging Shimmer, yes, from Mercedes. One of these ones, yeah. There's potential, especially if he does something in the Super Bowl too. Right. He has some solid games. Yeah, he's not bad. Paying your rookie base. And that'll do it for box number 11. Now we're out of box 12, 12 and final. Good luck, everybody. What's up, Shane? How you doing, buddy? Got a Nelson, Alaska's orange, yellow to 75. Refractor, Austin Schultz. 130 out of 499, yeah, Almanac was nuts, dude. For the Tigers. I can't say I watched any, but I saw what was in there, so I know it is nuts. Base, gold, shimmery entry Rojas. To 50, that's going to the Padres, nice one there. Congrats, slam Diego. My kids have to carry their stuff. Wander rookie. Wander rookie again. For the focastro, that is the variation. Nice one there for you, Alan. Nathan Hickey, 208 out of 250, going to the Red Sox. Congrats, Boston. Take that for sure. Magento rookie, Wander Franco, it's a 299, congrats, Raze. Nice one there. And last pack of the break. Base, that'll do it for the break, guys. Let's do a quick recaparoni here. Base orders not numbered, Willie Fannis Mets, Diego Velasquez, Giants, Samuel Munez, Dodgers. Tanner McDougal, White Sox. Jordani De Los Santos, Pirates. Cade Marlowe, Mariners. Greg Cullen, Orioles. Randon Cohn, Dodgers. Tyler Collins, Braves. Evan Lee, Nationals. Ian Lewis, Marlins. Liam Spence, Cubs. Refractors to 499. Austin Schultz, Tigers. Jonathan Mejia, Cardinals. Gerard Gonzalez for the Royals. That is White. Now, White's back up to 299, Greg Cullen, Orioles. Purple's to 250, Nathan Hickey, Red Sox. Noor Havera, White Sox. Collin Burns, Orioles. Greens to 99, Ryan Reckley, Giants. Camarillo to 75, there's gonna be A's, Denville Clark. Got Gold, Michael Burroughs to 50 on the Gold Speckle World for Veras to 50. And we had a Red. 505, Daniel Lake-Eldney. Going to the Red Sox. Nice one there. That'll do it for the break. Thank you, guys. Again, for the fill. Next up, we got our dual case.


Hello everyone, welcome to another OpenShift Commons briefing. Today, we're going to talk more security. You've been seeing a lot of security briefings lately. That's because, well, I mean, we all really care about security. You've heard about the recent acquisition and hopefully you watched the Stack Rocks briefing. We've had briefings on DevPsychOps and this one's great because there's this new project called Project SigStore that our guest Bob Callaway and Ivan Font have been working on. They'll tell you more about it. And they're both here from the CTO office at Red Hat in the Emerging Technologies Division. And this project was just recently donated to the Linux Foundation. So, giving that intro, Bob, would you like to introduce yourself as well and kick it off? I think you're still muted. Hope so if you unmute, right? All right. So, hey everybody, Bob Callaway, good morning, good afternoon, good evening, wherever you are. So, as Karina said, I'm part of the CTO office here at Red Hat and I'm one of the maintainers on the collection of projects that we're calling SigStore. Today, what we're hoping to do is just give you an overview of the problem space that we're working in, some of the challenges that exist today, what we've actually done to try to rectify some of those challenges. We'll do a live demo of a couple of different things, not only the system, just generating keys and signing software, but also tech on pipelines, as well as open policy agent. Then happy to take questions at the end. So, with that, we'll jump right in. So, as you guys have heard from the last few briefings, there's a lot of challenges in securing the overall supply chain for software. There was a report that came out that said in the last two years, there's been a 400-some percent increase. And part of the reason why is that the supply chains are fundamentally complicated, right? You've got developers' workstations to various CI systems, you've got public code repos, you've got masterories behind the firewall, container registries, I mean, there's a lot of moving parts that it ultimately takes to develop and deploy and iterate on cloud native software. So, there's no shortage of issues that have come up of late. Certainly, the SolarWinds attack is one that I think is on a lot of people's minds right now. But at the end of the day, right, maintaining keys, making sure that you've got account security set up. These are all complicated tasks. And the more that we put a shift left and put more of the responsibility on developers to solve these problems, that our jobs are getting more and more complex. Now, oftentimes, you think about artifacts and even if you go to the SolarWinds kind of post-mortem and look at what happened, code signing is often kind of looked to as one way that you can hopefully verify the integrity of what is being distributed. But when we look in the open source community today, across many of the popular projects, some of them are being signed. You can see here in the table, the little, we have some of the most popular ones out of the, okay. But, you know, there are different ways in terms of how we publish key material, how, what are the trust models that are applied, whether you need to start and verify from default or whether you need to trust on first use. You know, these, there's a collection of some of the other package managers that exist today. Long story short, you know, we have a very disparate set of practices out in the industry today, as well as in open source around how software is signed and fundamentally our consumers of software looking to verify those signatures at the end of the day. You know, part of the reason why signing is so important is not only does it provide integrity, but it also provides some other features, non-repudiation to make sure that, hey, somebody can't claim that they didn't create something, that, you know, the presence of a signature implies the possession of the public or private key, rather, you know, if we have a linkage between identity and the possession of the keys, we could actually use this for authentication as well. But I don't know if anybody on the line has ever tried to use some of the more widely known public key cryptography tools, namely PGP. You know, the user experience leaves a lot to be desired. Not to mention, once you figure out how to use that, you've then got to figure out, what do you do with this key pair, right? I've got to clearly keep it secure to make sure that nobody gets, you know, hold of the private key and can masquer, masquerade as me. But, you know, do I buy an HSM? Do I use a UB key? What if I want to do this in the cloud? How do I mask all this? There's different cloud APIs. There's key management systems. You know, quickly, if you're not a security expert, this becomes very, very difficult to implement correctly. There's no shortage of folks that have tried to do this and failed or tried to do this and are very cautious about exactly how far they want to go down the rabbit hole, just due to the complexity here.  Who's actually able to speak on behalf of the project itself? Who's able to publish an artifact? And how do consumers of that software ultimately go through the steps to verify? Not only is it signed, but is it signed by somebody that we should trust? And maintainers come, maintainers go, how do I maintain that list of the project? Maintainers is also another challenge as well. And so here you get an example on the right side of the Node.js project. Now, they publish this on GitHub and not meaning to throw any shade at the Node team because this is, as I mentioned before, this is a hard thing to fundamentally manage. But if a maintainer leaves, how do you actually ensure that that key pair is not used after the fact to go sign a malicious release of that project? Again, assuming no will, and then maybe that's not an issue, but at the end of the day, we need to be able to prove the provenance of what we use in IT environments today. So even if you go to all this extent to try to sign software, again, this is a pretty complicated thing to get right. So that's the setup for what we hope to solve with SIGSTORE, we wanna make, imagine a world where signing is just done by default and it's ubiquitous across everything. And part of the way that we have to deliver that vision is to just make it so much simpler. The other thing that we're missing is a notion of transparency, and we'll get into this a little bit later around how we actually add this in. So we created this collection of projects that we're calling SIGSTORE, and as Karina mentioned as well, we've, a little earlier in this month of March, we donated the project set to the Linux Foundation as well. So we've actually also launched what we're calling a public goods service, basically as a hosted instance of the set of projects that developers can use. But if you wanna take it and use it yourself, you can certainly do that firewall as well. So let's jump in and figure out a little bit more about what's in SIGSTORE itself. So as I just mentioned, SIGSTORE is this collection of modular projects that can be used independently or together as a whole to address some of these problems. We have implemented this by default on top of CUBE with certainly everything done in containers. And I guess the best mental model that I can give you if you're familiar with the Let's Encrypt project, that's a public goods service that's trying to make it easier for folks to secure their websites. And so through the advent of the ACME protocol, as well as hosting up infrastructure that's paid for by an open consortium of entities that are all incentivized to see a more secure internet and that's certainly good for all of us. We see ourselves in that same light as well. We want to make sure that software is signed and we want to make sure that it's transparent. So the more that we can do to offer that to folks. So SIGSTORE, you may hear it used in a couple of different standards throughout this presentation or if you are reading more. That's kind of our umbrella brand, if you may. So giving you a quick little decoder ring is to some of the key projects that we have right now. There are really three that we'll go through in some detail today. FullCO is the first one. This is a certificate authority that actually issues code signing certificates and that there's a linkage there between your open ID connect identity and that's embedded inside of the code signing certificate. The second project is Recor and this is what we're calling a signature transparency law and we'll go into what that ultimately means. But think of this as an append only, a mutable ledger that serves as that transparent source of truth as to what artifacts have been signed with what key pairs and by whom. And then finally, obviously we're talking on the OpenShift briefing today and containers are certainly a hot topic. So we've created a tool called Cosign which actually uses the Red Hat simple signing approach to actually go and sign containers and publish that information into OCI compliant registries. So if you go to our GitHub organization, you'll see a ton of other projects that are coming in, many more are under development and we're starting to reach out and get new ideas coming into the community other ways that we can integrate capability. So I'm gonna walk you through how from a developer's point of view how you would take advantage of sick store and then we'll jump into a demo because obviously sitting and staring at charts isn't as fun as seeing it work in the field.  So first thing I've gotta do is I've gotta generate a key pair. If you can't sign without using a public key cryptography so I need a key pair. And we jokingly call sick store keyless signing in the same vein that serverless is doesn't use a server. Obviously it does behind the scenes. It's just obfuscated. We call this keyless signing in the same sense. Yes, we use a key, but the lifespan of the key really can be a matter of milliseconds in this system. So we're not worried about protecting that this key pair in perpetuity. We're relying on the immutable nature of some of the transparency logs to ensure that we've got a trust route that can be independently verified. It's a, hey, at this point in time, the developer owned this set of keys. We'll note as well that again, back to the modular point, if you have your own key pair and you're gone down that process to store it securely in an HSM and a vault with arm guards, that's totally fine too. Nothing here precludes you from bringing here. So anyways, developing software. I've got a key pair. The first thing that I'll do is I will go and authenticate using the open ID connect protocol. For those of you who aren't familiar with this, if you've gone to any website of late and you see the login with Google or login with Apple or login with Facebook buttons on a website, they're actually using a protocol called open ID connect behind the scenes. This is built on top of OAuth and essentially just uses an external identity provider to authenticate and make an attestation around who you fundamentally are at the end of the day. So in our system, you would reach out to the full CO service. You authenticate using open ID connect. And then we would get an ID token that's what's passed underneath the covers. We verify that that came from a provider and that's cryptographically verified through it being signed itself. And then we generate a code signing certificate and think of this as a record that has the public key from your key pair. And we put that into an immutable transparency log. And you can use that code signing certificate and publish that in, it's kind of a basically your new public key. So folks can use that certificate to verify a signature just as they could if they only had the artifact. So once that certificate is published into the log and returned back to the developer, now I've got this key pair. I've got a code signing certificate. What should I do now? Well, the next thing to do is actually just sign the software itself. You can use open SSL. You can use our client tooling that we provide. But at the end of the day, we want that artifact to be signed. Now, the next thing, once we have a signed artifact and we've got the signature, we need to put that into a transparency log and that's where the RECOR project comes in. So we'll show an example of what goes in the log, but at the end of the day, it's the public key, it's the signature itself. And then we extract the hash value from the signature. So in the immutable log, we have a record of what artifact was signed, it was signed with what public key pair and we store all that information on the log. So if people wanna go back and verify that themselves, they can do that. And then finally, we'll get into this when we talk about the integration with OPA that we'll demo. You have to have some way of kind of rounding out this trust loop to say, hey, these are the actual software releases that exist and are trusted. And these are the maintainers in the software project that I trust. There's a couple of different ways that we've seen folks address this problem. Some people are comfortable putting a maintainers list on GitHub. Some people put a maintainers list on a website. Obviously those have some pros and cons, but we also see transparency logs potentially playing a role here as well. So at the end of the day, you wanna be able to publish what are the known good releases and who are the signers that I fundamentally trust? Put that into a system as well. So now I've signed it, I've published it to all the transparency logs. I can throw away the keys. I don't need them anymore because they're again stored in this immutable ledger. And I as a developer, I can now monitor these transparency logs and look for, hey, has anybody else published anything with that private key? Maybe I thought I threw it away. Maybe somebody, I use a system and the memory was compromised. We wanna make sure that you monitor your identity and say who else might have had my password and logged in and generated an identity token. So the concept of monitoring is also really critical in this model to make sure that, hey, if you see a certificate or a signature being generated with your identity, then obviously that's a notion of, hey, wait a minute, it might be my keys weren't as secure as perhaps I thought. And then once I've monitored it, I can give that signed piece of software out to end users that can download it, verify the signature, they can actually query the log themselves and make sure that you as a developer were the person that signed this and that you actually published it into the log and you can tie all of this together into a trust route that is bootstrapped off of, again, full CO, providing the certificate transparency, record providing the signature transparency and the open ID provider attesting to your identity. So with all that, we will jump to a demo. So we'll do this live here. Hopefully you guys can see my screen. So we'll walk through basically the exact same thing that I just showed you in slides through the command line. So the first thing we'll do is we'll create a software artifact that we want to distribute. In this case, I'm just gonna generate some random, a small little random file and put that into a file name artifact. Next thing again, we call it keyless but we need a key pair. So we'll generate a set of keys. This case we're using the elliptic curve algorithm but we can use RSA as well. We'll generate two files, the private key and the public key and we'll write those into the directory. Next thing we'll do is we'll just sign that small little artifact file using the private key. In here, we'll just use open SSL to accomplish that and we'll store the signature in a detached file called artifact.sig. Now, just to prove that the signing worked fine, we'll go back and verify it using the public key. All of these commands will publish as well on our website on our blog post sort of a library. I actually wanted to try this out. We'll verify that signature, everything comes back and says it verified okay. So the next thing we'll do is we'll reach out to an open ID connect identity provider and get that ID token that I mentioned. So we're using here a CLI command that will help to launch a browser to drive this authentication workflow. And so hopefully you can see screen switch away from my terminal now into the browser and I'm presented with, again, one of those login screens that you may have seen where it says login with GitHub, login with Google, login with some other identity. So in this case, SigStore is not managing a list of username and passwords. We never get your username and passwords. We're relying on a delegated token to be generated from one of these two providers today. We're gonna probably add Microsoft and many more to come. But for just the sake of this demo, we'll login with Google. I choose my email address here and then I come back and say, hey, great, a token was granted. Inside of that token, there's a couple of different things, but mainly the one that we're looking for is just an email address. So what I'm gonna do is just quickly execute a little bash trickery to get out the email address and we'll print that there and you can see my username at redhead.com is what's printed out. I'm gonna sign that email address using the same private key and the reason that I do this is it proves that I actually have possession of the private key at the same time that I'm going to submit this to FullCO. I'm gonna quickly sign that email address and then I'm gonna send a little bit of information over to FullCO. Now this is a rather long bash command here, but I'm doing this deliberately just so you can see at the end of the day we're sending JSON over an HTTP post. We're extracting the public key and we're including that sign signature. So assuming that that worked, we're gonna now throw away the keys because we don't need them anymore. We're now gonna look at the signed certificate that came back from FullCO. Couple things to call out again, if you're not familiar, I'm looking at X509 certificates. This may seem like Greek to you, but at the end of the day, again, we want to linkage between identity and the possession of the key pair. And you can see inside the certificate, we've got the identifiers that were specified as well as the public key that we generated is all stored in this co-signing certificate. And we've got the appropriate flag set up to say, hey, not only is this a cert with a public key, but it's meant to be used to verify signatures. You've got a root CA in the list as well, just in case you're interested and want to port that all into your trust store. So now I've got a signed artifact. I no longer have any key pairs. I've got the co-signing cert that I can use to prove this. The next step is to actually go and submit this to the RECOR transparency. So what I'm gonna do is I'm gonna use one of our CLI tools called RECOR CLI. We're going to upload the artifact itself, the detached signature, the public key. And we're just telling the command line utility here that we're using an X509 for PKI collateral. Again, you could do this with Curl, but that submit is pretty nasty. So we'll just see a line instead. So what we've done is we've submitted all that information up to RECOR. You'll note here, we did actually send the entire file up to the system. That file is not stored in the transparency log itself. Only the SHA-256 digest value is actually stored in the log. So again, if you were to sign a piece of software, you don't necessarily want that to be a distribution vehicle for it. We only require that that be sent just to be able to go back and verify the hash. We now see, hey, there's a new artifact that has been added to the transparency log. We could fetch it by putting that into the browser and we would get back some JSON content. But more meaningfully, what we'll do is we'll use another sub-command of this called Verify. Where again, we pass at the same exact credentials and we're gonna be able to see not only is that entry in the log, but we're going to see a ton of SHA hash values. And I'll go into a little bit around how this is all built together a little bit later in the talk. But long story short, this is the mathematical backing behind this concept of a transparency log that allows it to be pen-only and immutable. And this actually displays all of the math that you would need to do to verify that this, that particular artifact, that particular signature are actually in the log.  Ivan, take it away. Thanks Bob. Yeah, so my name is Ivan Font. I'm also in the Emerging Technologies Group within the CTO office. And as Bob mentioned, I will be demoing the integration of six-tor within OpenShift and show you an example of how you can integrate this into your CI CD workflow. So here, there's an app running that we have on an OpenShift cluster. And let's go quickly take a look at that. We'll just open up a tab here and we can see that we have a simple, just, yeah. We can't see your screen, so you may wanna share it. Oh, let me, thanks for that. Yeah, it would help if I shared, wouldn't it? Thanks, all right, so yeah, just you should be seeing the terminal here and we'll go ahead and open up a web browser. As I mentioned, we'll open up a tab here and you can take a look that we have a demo app running here. It's just a simple Hello World app. And just show you quickly what the contents of this repository is. We have this repo that's posted on GitHub, just a simple Go web app that displays some, you know, Hello World message. We have a list of maintainers. As Bob was mentioning, you know, one of the practices you can do is list the maintainers for a particular repository, which you can then use to apply policy and government's information against your signed artifacts. So we can also see that we have a Docker file here and this is used to actually build the image that's posted in this repo. Here we just have a builder image that we use to build the Go app and then we use a rebuilt UBI minimal container image here with a stable tag that we're using to run the application. So let's say you come in on a Friday and you have some work to do, you have to make a change to your app. So we go ahead and first, we have to build the base image for the application that we're using here. This is the Hello World application. So we can do a podman build using, we have a base Docker file here, we have a Docker file for the base image and we can see we go ahead and build that. We go ahead and push this built container image to the container registry. So now we'll go ahead and make some changes to the app here. So let's just change something like, let's just say, Hello, CB World. We'll save that. We'll commit the change.  And so we have a pipeline that's in our OpenShift cluster, run in OpenShift pipeline, built with Tecton. And we can see that we have several steps here, several tasks that are run as part of this pipeline. We'll go ahead and fetch the repo. This is the Git repo with the commit that I just pushed. Then we'll build the image. There's a few steps here. We build the image and push the image using Builda to our integrated container registry that's running inside of OpenShift here. Once that image is built, we then inspect the image and extract the base image that was used to build this web app. And once we extract the base image, we can pass that to a task that will verify that base image. And so there's two steps here to verify it, which I'll go into once we get to those steps. But one of them is running a step called Cosign, which is that tool that Bob mentioned earlier. And it's a tool that allows us to sign container images. And we'll go into a little bit more of that. And then we extract the email from the actual certificate and that will refer to the identity that was used to sign that image. And then we'll pass that to an OPPA policy that will apply and verify that that image was signed by an entity that's in the maintainers list that you saw earlier. And then we'll just go through a simple, apply the manifest and update the deployment so that we can get the changes deployed into our cluster here and see them go live. So here we can see we're building this. We'll go ahead and push that. And then we'll get the base image. As I was mentioning, so now that the image is built and pushed to the integrated container registry, we'll go ahead and extract the base image from that built image. And this base image is that UBI minimal that we built and pushed to the container registry right before we launched this pipeline. So you'll be able to see here as we inspect the image, this is the image that was built. And it's in the integrated registry as part of OpenShift and it was built using the base image that you can see here. And that's that UBI 8 minimal. Then we go verify the base image, but we didn't actually sign that image. The base image wasn't signed. And so we fail here because we're actually trying to retrieve the signature for that image and it doesn't exist. So that's what that error is saying and it's basically saying that we failed to verify. So we actually failed the pipeline because the image isn't even signed. So let's transition back to the terminal and let's actually sign that image. So here, cosine is generating an ephemeral key pair and then it's calling out to full seal to get the OIDC provider to authenticate us and be able to provide that certificate. So we'll go ahead and log in with Google. And here we'll just use my iphoneredhat.com. We authenticate successfully there. And then what it'll do is it'll actually use the general, the ephemeral key pair. It'll create the signature and then it will use the certificate that it got back from full seal and be able to upload a new object to the container registry that contains the signature, the certificate and chain, along with the reference to the image, the SHA of the image that was signed. So now we can go ahead and rerun the pipeline that we just failed. And this step will take a little bit but as we wait for it to propagate through, let's just go back to the slides a little bit and I'll talk a little bit more about these particular pieces here. So Cosign is a project within the Sixth Floor envelope in the GitHub org. And that's the Cosign command that you saw there to sign the container image. And it's architecture, as I spoke a little bit to, is basically outlaid here and you can see that Cosign will generate that ephemeral key pair. You can also use a key management system or any existing key pair if you have that. So we try to accommodate all the different use cases and then it requests a Cosign certificate from Pulsio which you saw then calls out to an identity provider like GitHub or Google in this case and it will basically authenticate that you're the owner of that private key associated with that email account. So once we get that back, Cosign will then download the container manifest from the registry. This contains, this is the reference to the image that you wanna sign. It generates the signature using the key that the ephemeral key that it generated attaches the certificate and chain and uploads the signature and the public key and certificate and chain to the container registry as a new OCI object. And then after it does all that, it creates an entry in Recor using similar sort of content and uploads and it creates an entry in that transparency log for the sign container. Let's go back and take a look to see how our pipeline is doing here. It looks like the login expired here. Let's go ahead and log in. That's taking a little while, there we go. All right, how are we doing here? Okay, so we're getting the base image as we can see. Then we verify that base image and here you'll see that Cosign runs to those similar steps as I just showed. So we verify the image and then Cosign outputs here that the claims were validated so you can actually add annotations as well. If you want to the signature that gets uploaded, you can actually add any sort of additional annotations and it also verifies that the entry was existed in the transparency long along with those claims. So the signature was integrated into Recor. Any certificates were also verified with the Fusio route that we obtained and then you can see that the certificate has the common name here iPhone at redhat.com and then you can see the redhat simple signing spec that gets dumped as well that the payload for the object that gets uploaded to the container registry. So once we get that common name, we apply our OPA maintainers policy that says iPhone at redhat.com is an authorized maintainer for this image. And so we go ahead and pass the OPA maintainers policy and then we apply the manifest and update the deployment. So let's go take a look at the deployment. And if we refresh, we see the updated helloocb world change that we made a little bit earlier. Okay, great. So we can show that we can find the container image and we won't go through the CICD flow successfully until that image is signed. Well, what happens if credentials are stolen? So let's say you leave for the weekend over the weekend, somebody obtains the credentials and still the credentials to the container registry that you use to upload the face image as well as the signature that you also use to find that face image. Well, let's go through that example. And we can go ahead and we have another Docker file here. That's just the exploited image that the malicious black hat user that I'm now representing wants to build. And it's just a simple echo something malicious for the sake of this demo. So let's go ahead and build that malicious image. We'll go ahead and build it and push that to the registry. Again, we have the stolen credentials, so we are now authorized and able to push a new updated stable tag for this face image. Let's say this is a very sophisticated black hat hacker and this user also knows that, hey, we are using recor and the six store architecture to be able to create a transparent trusted source for anything that's fine. So this user knows that we have to create an entry in there, otherwise we might, there might be some red flags that are raised. So let's go ahead, this user knows that we need to go ahead and find the actual base image. This is a malicious image and they're signing it. So this goes to show you that you can use, you know, the transparency log is there for a good or malicious intent and the idea is that it needs to be monitored. And so here, the user would be able to log in with whatever identity provider they want to use. In this case, they'll try and use Google and they don't have access to my iPhone at redhat.com. Obviously here, I have both accounts integrated. I'm representing both, I'm putting on both hats but this person has their own email that they can only authenticate with and it's just evil person, you know, hackerloals at gmail.com. So that is authenticated there and we can see here that cosine generator is a femoral key pair for that signature, grabbed the certificate from Fusio, which then authenticated with Google again and then uploaded the signature, the payload and the certificate chain for that container image and created a transparency log entry through Recor. So all right, so we now have pushed a malicious image out there. So now it's open to be able to download and be used by others. So let's make another change. You come in on Monday and you do not know what happened over the weekend. So let's go ahead and come in here, make another change. Hello again, OCB world. You have to come in and Monday morning make this change. Let's commit another change here and let's push that. And so let me just draw your attention again to this maintainers.json file here. And these are the list of maintainers that are in this repo. And the only maintainers are Bob Callaway and Ivan Font here with their email addresses. So if we transition to the pipeline, we have another pipeline that's running here. And as this goes through, we'll go see what happens as we try to apply that policy. Let me just transition back here to the slides and we can quickly cover while we wait for that. Let's go into a little bit of the RECORE architecture. So RECORE is another project in the six-room Bella and this is the transparency log that maintains the signature log for the different artifacts that get signed. So the architecture here is that the RECORE will only insert records into the transparency log with signatures that it verifies. So the certificate that's used, the public key that's used to sign that better match the signature that's used to create that record and it will verify that. And so the developer will use whatever key pair whether it's key lists, whether it's key management system, it will sign and publish those artifacts and publish the signatures to RECORE. And let me just cover another point, a few more points here that the artifacts are not actually stored in the transparency log as was alluded to a little bit earlier. We do have some ideas around that, but right now we'll need the digest, the signature, and the code or the artifact signing certificate and public key are stored in there. And there's a REST API that you can use that you can actually keep appending to the log and you'll be able to submit request to verify like an inclusion proof to verify that a particular artifact or signature exists in the logs. And we also have a public good instance that again needs to be publicly monitored because as you just saw, we can have good uses of the signature transparency log or malicious intent as well. So it needs to be monitored to keep track of those types of things. We have a RECORE manifest schema. This is kind of the basic version here. The spec basically just contains the signature information. So we can do like GPG, X509, MiniSign, we support different signatures and you can have the URL here to the signature itself along with the public key that was used. And then the data itself, again, it's just a link to the data, it's not the actual data itself along with a hash of that data to verify the integrity of the content. So RECORE has been built with extensibility in mind. So there's a pluggable PKI interface that supports multiple different formats, X509, GPG, so on and so forth. And we have plans to add further signing systems. And then it also has a pluggable supply chain format so we can support like OCI or notary B2 signatures in the future whenever that becomes ready. And it's also designed to work with systems like the update framework and in-todo and as well as like RPM signature transparency, DBOM and S-BOM stuff as well. All right, let's go back to see how we're doing on the pipeline here. And we went ahead and verified the base image. So remember this malicious Black Hat user actually signed the image so everything was validated, everything existed in the transparency log, everything checks out okay here. So you can see the certificate was actually contain the content for the common name of the user's email address here, Hacker Lowell's. Unbeknownst to the user trying to use this image unless we have a actual OPA policy that we can enforce the list of maintainers here and we can see that it fails the OPA policy because the certificate with this email is not, it does not match the list of maintainers from the repo which was as we showed Bob Calloway and myself only. All right, I think that's it, Bob, back to you. Yeah, awesome.  Sure. Just in the interest of time because I wanna leave a few minutes for Q and A. We'll just jump to the kind of where we're looking at kind of the roadmap for some of these projects. And you can view all of this at our community repo as well. So if you have thoughts or ideas, I meant those certainly as issues in terms of how can we make the usability better or other ideas for integrations, we'd love to hear what folks think. I think the example that Ivan showed today is pretty powerful that we can actually include signing and a policy around signing into our build pipelines. There are other places within OpenShift or Kubernetes that we could potentially integrate with. There's a concept of admission controllers that can decide whether or not we want to create an object on Coob. And we could use that to enforce only running sign content. We could look at integrating with schedulers to ensure that we only run trusted content on particular nodes. Or we could look at even going down to the lower levels, integrating in with container D, Podman and whatnot to actually catch this at the runtime layer. So we would only launch the image if we were able to verify the signature. So we've started looking into all of these areas and we think we'll be able to offer a variety of different approaches going forward. I think the other thing too is, while we showed a pretty basic example with the maintainers list, OPA and other policy engines certainly have a larger functional set that we can maybe take advantage of. So we'll look at improving and formalizing those extension points. And finally, this is solving this problem more broadly. If we don't get that list of community projects that I opened the presentation with to start signing their content and getting people used to verifying this content, then all of this is just a fun technical exercise. So we are also working with many of the most popular open source community projects out there, whether it be the package managers for Ruby or PyPy, whether it be popular distributions like Fedora, to make sure that we are signing the content that they are distributing and that we are making it very easy and simple to use and integrate with their build systems. So there's a lot of work to do to kind of close the loop on both the policy side as well as getting people to adopt this, but we're seeing a ton of interest in the community. We've got hundreds of people in our Slack instance. So we're pretty excited about what the last couple of weeks have ended up being for us. And we think that there's a ton of awesome work to be done. Next slide, please. So as we kind of alluded to, we are in a point where we launched a couple of weeks ago. So we're still in a soft launch phase, if you may. So we've made kind of a public statement that while we are running these services live, they are not to be considered production grade. We have no SLA around it, but they are available for folks to go play around with. Everything that we showed today was a live demo. So none of that was hacked up behind the scenes. You can go back and recreate everything that we showed today. We use REST APIs, and so we have open API specifications published for all those APIs. You can go and play around with that as well. If you choose not to use our CLI, it's willing, that's fine. You can use the APIs directly as I showed, but we're in the soft launch phase to try to work out some of the bugs and make sure that we've got some of the use cases really hardened and we look to go into more of a production capacity this summer. Next slide, please. And as I mentioned, if you use the analogy of Let's Encrypt, part of the reason why people can fundamentally trust Let's Encrypt is because they're not owned by one single corporate entity. This is not Google or just Google or IBM or Red Hat or Microsoft saying, hey, we're a valid certificate authority. We knew for this to be successful in the public good model that we needed an open consortium and a neutral third party that could fundamentally run this just for the good of not only open source, but the entire software industry. And that's why we've partnered with the Linux Foundation who are actually the sponsors behind the scene for Let's Encrypt as well. And so we're relying on some of their infrastructure and their outreach and guidance to help get this launched and off the ground. But while we are running these soft launch services today, ourselves, we hope that when we transfer that into a more of a production capacity, that will be officially run by the Linux Foundation. Next slide, please. So in summary, click through the animations, please. This is 100% open source. You would expect no less from Red Hat and Google and others here, but all of the tooling, everything that we're running is all publicly available. We are, the system is live. We are actively in development. Like I said, we've got a lot of great activity going on in Slack and on mailing lists. It's totally free to use. There's no cost required. We're gonna support a number of identity providers so that you're not locked in the only using GitHub or only using Google. As we showed today, we're gonna add many of the more popular ones as well. And then finally, we've got a blossoming community and we would love to see folks that are watching this to come join or come play around with some of the technology that we've made. But at the end of the day, open source is successful when folks jump in and share their ideas and help to contribute. So this is kind of a call to action. If you're passionate about something that we've talked about today and you'd love to help or give us feedback, please jump in the Slack channel, shoot us an email. We'd love to hear from. So I think with that, we'll jump to questions. Thanks Bob, thanks Ivan. Looks like we have a question. I may have missed it, but can this be used to verify third-party resources, such as code images, et cetera? Yeah, great question. So short answer is yes. There's nothing, you know, the cosine-specific tool is container-specific but there's nothing to, as I showed you, generating random content. There's nothing here that says we can't use this system to sign XML files, JSON files, pretty much anything that you could use, open SSL to sign, we could put into these transparency logs. So we're trying to go after one of the most popular vehicles for distributing software today, which is why we're working with folks like the Java community, the Node.js community, et cetera, as well as some of the Linux distributions. But the use cases here are pretty much all content agnostic. So we think that this model is pretty powerful. I mean, as I was watching both of you talk about it in demo, I mean, I'm sitting there thinking, okay, this project could really use this, or this project, it's one of those you can take over the world type projects. So I mean, how, where do you see this? You mentioned productization, well, I mean production, not productization, but like being able to use this in production environments, when do you see that happening? Like I said, I think, give us a few more weeks here. We are putting the system through its paces through many of the community members and partnering with many of the open source projects. But if you look at the transparency log component, we're actually reusing an open source project called Trillian, which came from Google. That runs the transparency log service behind certificate transparency. So this is a, IETF RFC standard that was created and that's run by Google, Let's Encrypt, Cloudflare, many of the other popular providers today that use the same immutable concept of an appennantly transparent log to attest to what certificates, what SSL certificates have been generated. So that has been battle tested up to thousands of transactions per second under full load from many of the popular web browsers that are actually calling the system on a regular basis. So we are pretty confident that we've built on top of scalable infrastructure to start, but we want to necessarily not just go in with assumptions, we want to test that out. So we think by the end of the summer, we will have a system that we can turn on into production and get folks to start using it. And the other thing about production, as I will note as well, for all our GoLang programmers out there, whenever you pull down a Go module to include in your program, we're actually, certificate transparency is used behind the scenes there. So we're looking at, again, we're building off of a system that's already been battle tested for quite a while. That's pretty impressive saying in the summer, we're going to hold you to it. I'm on record now, so we got to do it, but no, it's, we've had, like I said, with the graded community involvement and partnering with folks from the LF, we've made a ton of progress over the last couple months. No reason to see that moment of stopping, so. And Ivan, where do you see it going? Where would you like to see it go? Yeah, I mean, I think I'd like to see it go everywhere where open source security is needed, which is pretty much everywhere. I think we still have some more work to do, definitely, to get it at a point where it can be started, start to be adopted more inclusively everywhere. As Bob mentioned, I think probably a few more weeks to get the instance a little bit more battle tested. But yeah, I would like to see this definitely expanded to a bunch of different open source projects. Go modules is a good example. I think Kubernetes as well is a project that's not using any sort of signing on the artifacts that are produced. So I think that would be for the cloud native space that's probably one of the first things we need to tackle. And one other point I think we've made, but I think it's worth maybe making again. This is a modular system. So if you already have your own certificate authority behind the firewall, we can integrate with that. If you already are managing your key pairs today, we can certainly integrate and use that. So you can run just the signature transparency log if you want, if that's all that matters for your particular use case, or you can replicate the entire infrastructure that we're running for the public service, you can run that behind your own firewall as well, or you can leverage the public service. So the intent here is not to just stand up a single entity. It's really to meet customers and developers where they're at and just get them signing things. Let's get it, let's make sure that things that are generated are signed and that we get people to actually start verifying those signatures. And as soon as we do that, we're gonna get to a spot where hopefully we've made some progress in terms of addressing some of the attack vectors in supply chain. And I know Luke is on, I think still. Nope, he may have dropped. I was gonna see if he wanted to jump in. But any closing thoughts? I'm honestly right after this call, I'm gonna go jump and go check it out and try to install it. It was a fantastic presentation and demo. Thank you. No, thanks, I mean, like I said, this is a chicken and the egg type thing. If nobody signs, then what's the point? So I'd really encourage folks to go, not only play around with it and get familiar with it themselves if you're a developer, but also lobby your favorite projects, right? Send them to a link to our website. Send them a link to our blog. Get them aware of, hey, there's innovation happening in this space that they can take advantage of. And so part of your role in the community, even if you're not a coder, you can advocate for these better practices, whether it be software signing or just general best practices with security. So there's other ways that folks can get involved on just showing up or anything. Absolutely, yeah. And just to add to that as well, it's kind of a network effect sort of problem, right? Because as more projects start using it, eventually that grows and grows and then eventually it may become the default. And then now if you don't do it, it's seen as a security risk, right? So get the word out, you know, as more projects start using it, we have the infrastructure there to meet people where they're at, as Bob was saying. So let's get more projects in here. Yes. Well, thank you. And we will be posting those slides. If you are watching this on YouTube or on Twitch, you can find them there, as well as the recording, but we'll send that out. And thank you everybody for joining us and go to the six store.dev. Am I remembering that correctly? Awesome, and slack.sixstore.dev. All right, we'll meet you all there. Thanks again, Ivan and Bob. Really appreciate it. Thanks, everybody. Yeah, thanks, everyone. Thanks for having us.


Commander, Navy Region Midwest has been in operation since 2003. Captain Francis Martin was given the difficult test to disestablish the region from a two-year plan into a fast-tracked one-year plan. A Navy Region Midwest was selected to be disestablished as part of this reorganization to achieve efficiencies at lower cost in delivering services to the fleet fighter and family. Past and present employees were recognized for their job well done during the short life of the command. I'm proud to be part of Navy Region Midwest's effort and I think we can successfully claim that we have done this well with the greatest concern for our employees. For Naval Station Great Lakes, I'm Petty Officer Timmy Wakefield.


Hi, my name is Thomas. I work at the Czech Technical University in Prague and I also work for the R-Cortain on R. And I would like to tell you something about encoding support in R. Encoding defines our character maps to a sequence of bytes. Different encodings support different sets of characters and they map them differently. Commonly used encodings with R are ASCII on all operating systems, UTF-8 on Unix systems, and Latin 1 and many others as well on Windows. ASCII maps one character to one byte using only seven bits from the byte. The text here, hello in this slide, is mapped to the five bytes as shown here. ASCII only supports the English language. Latin 1 is a superset of ASCII. It uses eight bits of a byte to represent a single character. The Latin text Grise from German is represented using the bytes shown here. GR and E are the same bytes as in ASCII. Latin 1 is a common encoding in R on Windows for users from the United States and Western European countries, but Latin 1 is also used in other countries in the world. SJS Win, for example, is an encoding used in Japan. It also supports Russian and English, but primarily it is for Japanese. It is a double byte character set, which means that one character is encoded using one or two bytes. In this example, we have three characters and the first two are each represented by two bytes. The third character in the example is an exclamation mark which is represented using a single byte and is the same byte as it would be in ASCII. There is a number of other double byte character sets used on Windows. These are by people from Asia. UTF-8 is an encoding that maps one character to one to four bytes. It is a so-called multi-byte character set. The text Grise is represented using the bytes shown here. GR and E are represented using the same bytes as in ASCII. And U and SHARP-S are represented each using two bytes as shown here. What is important is that UTF-8 supports all languages. It also dominates the web use today and it's the default on all current operating systems that are used with ARC except Windows. Operating systems have the concept of native encoding. It's the encoding that is currently expected by the operating system and the C library in the strings that are passed to them. On Unix, it is one native encoding at a time and today by default it is UTF-8 even though one can change it. On Windows, things are more complicated. There are two current native encodings, one for the C library and one for the operating systems with additional details that complicate things. Also applications may choose to use UTF-16 instead ignoring the encoding that is set by the OK. In AR, character objects on the heap represent strings. One character object for one element of a string vector. Each character object can be stored in a different encoding and there is a flag saying which encoding it is. The flag can be saying it's UTF-8, Latin one. It may also say it's unknown which means that it is either ASCII which is a subset of all encodings supported by AR or it means it's a native encoding that is neither UTF-8 nor Latin one. So for instance it could be this SG-SWIN encoding for Japanese on Windows. In addition to these three values one can also use bytes encoding which is not really an encoding. It means that we are not working with strings but with byte arrays and this is for expert use only mostly. This works nicely on UNIX. When the native encoding is UTF-8, when we enter the string grisa by typing or pasting we get the encoding flag for it UTF-8. A string hello gets encoding flag unknown because it's ASCII. On Windows running in Latin one locale encoding again you can enter grisa, pasting or we have the German keyboard typing and it will get the Latin one flag. And we can also enter grisa using the byte slash uscapes which then mean that it will be UTF-8 string. AR will automatically convert the string to the right encoding if it needs to and things work well. Except when they don't and I will speak out it later. The internal encoding support in AR hence it supports multiple encodings on input and output. It's very many encodings that are supported via the icon library. Character objects supports the encoding I have said and what is very important sometimes are needs to convert strings to the native encoding. This is necessary often when passing strings to external libraries or to code that is from external projects but has been incorporated into AR. Sometimes it's also necessary to pass it to some AR subsystems that have been designed to work with byte arrays. So sometimes strings are converted to the native encoding. Symbols in AR are native encoding for instance. So this brings a limitation to Windows and AR. The native encoding on Windows cannot be UTF-8. It cannot be any other unique encoding. And hence it cannot represent all characters. Printing in AR already requires conversion to the native encoding. So this Japanese string that I have shown before we can't even print in AR. We will get some weird escapes as shown here when running in Windows in Latin 1 locale. It would work fine when Windows was running in Japanese locale but not in Latin 1. So how to prevent getting into these problems? Well, only work with strings that can be represented in your native encoding. And if there is no Windows locale with such encoding, use Linux. Unfortunately that's the simplest case today and you will not have these problems. Also I would recommend to use ASCII only for file names, directory names and user names. And in addition not for encoding reasons but in addition also only letters, numbers and other score and dots. But still how to improve things on the AR side, how to become more permissive. Using UTF-16 on Windows is not a solution. UTF-16 or it was UCS-2 has been adopted by Windows a long time ago and perhaps too early. It's an encoding that is not used by most software, most open source software uses UTF-A and one needs to write platform-specific, Windows-specific code to be able to take advantage of the UTF-16 API. We could change R to do it and in parts we have changed R to do it on Windows but this could never be the main encoding in R because we have so much external software that will never work with UTF-16 and this is not really used by platform-independent code. But there is a solution now. Very recently Windows 10 came with support for UTF-8 that is already sufficient. One can set UTF-8 as the default native encoding because both of them, as I said before, there are two on Windows and it can be done for R, so selectively for applications. This is great. R has to be changed only a little bit to support UTF-8 as native encoding. I didn't change but it was simple because we already supported it on other systems. The problem is that UTF-8 on Windows requires a new C library. It requires UCRT which is the Universal C runtime in Microsoft terminology and to be able to use it we need a new toolchain unfortunately. We need a toolchain that will build everything with this new C runtime. R2-4 is not new enough and we have to rebuild our libraries for packages, all packages and R. As a proof of concept I have created an experimental toolchain for R that is good enough to build R itself. The base packages and the recommended packages and I have described the details in my blog post and even more details in a technical write-up. I also created a custom R build with an R installed that anyone can use to play with this. Also one can download my toolchain. The toolchain only supports some packages not all run and by conductor packages. With this custom build in R term after setting the code page to UTF-8 and choosing a suitable font one can print the Japanese string I've shown before. The native encoding is UTF-8 so nothing happens when printing, no conversion because it's already in UTF-8 and it can be represented in UTF-8. So that's all from me. I hope I have explained the basics of the R encoding support. More is available in my blog and of course in the R manuals and I hope I have also explained to you that R actually supports Unicode. The problem on Windows is setting UTF-8 as the native encoding and what we need for that is a new toolchain to rebuild R and packages.


What's going on everyone? Sam here with latent sports cards. We are ripping one box of 2021-22 Panini select a basketball For Michael S. So good luck here Michael. See what we got in here three autos or memorabilia cards Generally, it's one at one of one and then two of the other That's generally what you will see on these. Let's check it out here Miles Bridges Ingram, Jaren Jackson Jr. filler card Silver Bradley Beale on the concourse and a James Booknite premier level Like it 150 points Franz Wagner rookie Niamh Esquieta, Anthony Simons. There's a JT Thor red. That's gonna be 165 out of 199 on the concourse Ornates and Brandon Boston, Jr. Rookie Moses Moody Got James Harden on the silver concourse for the Nets and a Blake Griffin Williams, Lou Dort There's a Miles Bridges tri-color not numbered and a Jared Allen premier level. It's hate them There's a Dirk Nowitzki Game worn nice one there Michael on the Dirk Not numbered there game worn material. I love the the bets in this this year's select. They're so nice We've got Donovan Mitchell on the orange 63 out of 65 for the jazz And then Wanzo ball premier level base. There's a Josh Giddy base rookie Tobias Harris there is Alfred Shengun rookie tri-color And the tri-colors are not numbered and a Kyle Lowry premier level Something coming up here Okay, love Seth Curry. We've got nice Evan Mobley on the rookie Jersey guard. There you go Grats on that one there Michael Yep Yep, silver mark is smart and Corey Kisper that that'll happen right there Rory I've done the same thing in the past with like when I've opened my own hobby boxes my guy I'm gonna put these to the side and we're gonna open these later and then it's just they're all fillers Jericho Sims silver Anthony Davis premier level Lakers and Jonathan coming up on the rookie Chris towards that Shaq there is a blue Joe Harris.  Come on be Christian Wood Alvin Shen doing we've got nice rookie auto for the Sixers. That is Jaden Springer Nice Jaden Springer lime green rookie auto. That's gonna be 73 out of 99 There you go Michael The future Jaden Springer and Malik Beasley's last pack here. Good luck Garuba George Sexton there's gonna be a Tatum scope on the insert and a Jalen Green from your level rookie at base That'll do it for your break there Michael. Congrats again on the hits man. We'll get them right out to you. Appreciate it buddy


Outside Africa, the first secretary at the Swiss Embassy in Tehran was found dead after fallen from a high rise building where she lived in the north of the city. The Swiss foreign ministry said an employee at its embassy in Iran had died of an accident without identifying the victim. It called the incident a tragic death and expressed deepest condolences to the family. Iranian emergency services spokesman Mujtaba Khalid E said the diplomat's body was found by a gardener of that employee who arrived at her apartment early on Tuesday, noticed she was missing.


Well anytime Bemidji and Brainerd come together in any sport, you know it's going to be a good one and on the tennis courts, both the Jackson Warriors, high expectations, so an early season showdown is a great measuring stick. We're also back outside of Bemidji High School. Strap in for a good one, starting with four singles. The Warriors keen and hodge with the winner down the line. He would take it in straight set, 7-5-5-0. Three singles, the other hodge, Jacob. Nice placement with the forehand volley. He also wins in straight set, 6-2-7-5s. The two singles, Jack Spencer-Kanishni in control throughout. The forehand return gets him the point. 6-2 in straight sets. Upset of the day though, one singles. Nick Bufo takes down Tanner Lundberg in straight sets. This forehand winner gives him the first 7-6. Then you go on to win 6-4 and set number two. But all Brainerd after that, two doubles. Ian Adlin and Patrick Morgan. Strong at the net here, 6-3 and 6-2. And finally the top doubles, Nathan Rudd and Garrett Godin. And look at this serve. They crew 6-4, 6-3. Brainerd would go on to win this one in the end. Final score there, 5-2. If you enjoyed this segment of Lakeland News, please consider making a tax deductible contribution to Lakeland PBS.