Hey guys welcome back schizone episode 15 topic today is a quick one And that is generating reports automatically in assembly Before we get into that topic though, let me share with you my quarterly financial statement My three main physical assets, I have a 2018 Ford Focus SE hatchback in hot pepper red I have 28 quinoa strawberry plants Highly recommend that variety and I have a wife. I believe she's Caucasian Value of those assets is probably around 15 grand. That's mostly the car to be honest balances for the accounts 2.9 K for me 1.7 K for my wife our crack house equity in the bubble is 18 K It's gonna crash Retirement obviously. Yeah funny I'm losing we already knew this no big deal with that out of the way reports. Why are reports important? Well in this series, we're gonna do a lot of analysis scientific computing and sometimes I feel that It's better to represent the data in a concise Report like the one I just showed you instead of just a matrix output to the console, you know We're visual entities we we interpret visual data. I think better than numerical data sometimes So yeah, that's the main reason and in my opinion Although it may be cringe. I think HTML is probably the best format for a report like that. Why do I think that? Well? One it's plain text. So it's easy to write easy to open easy to read any text editor can open this kind of a file and it's portable so Pretty much everything is a browser nowadays like it says in the third point everything can Open this your toaster can open this kind of a file basically And it can be sent around email on a flash drive on a you know, whatever you want You can make this a highly portable Report file customizable. You can have custom elements. You could have text tables lists pictures videos Everything inside there custom JavaScript. That's all possible. It's super simple to generate If you if you take a look at the code in this video It's literally like just printing to a file. I mean it we've done this in the one of the first few videos in this series And lastly if down the road you have to change something and you have the report file Well, you can open the report file and make a change there really quick without having to rerun all of the The code now the beauty of an automatic report is that you can rerun the code You can tweak a parameter here and there I can go back. I can tweak You know my checking account I can tweak the values in this scatter plot and rerun the report and it will automatically regenerate this file but you know if you have a simple thing you have to change on your computer without the The binary that was used to create this particular report or the source code or whatever You can make that change in the text file. So for these reasons among others. I think that HTML is an awesome format for Reports like this for example, you can't edit a PDF file very easily, but you can edit an HTML file Okay As you can tell by now in this series I'm very partial towards linked lists and that's how I think I want to encode This kind of report structure. So basically in HTML file there's a bunch of elements And this is basically just an encoding of a linked list of those elements And so you may have a paragraph element or a header element or a raw text element Hey, for example, you can do custom CSS JavaScript in this element So for example, if I go back you see where it says Accessed on this day at this time if I refresh the page you can see that updates Because that's JavaScript, but it's embedded as a raw text element in this report So yeah, that's that it also is formatting type elements like our Horizontal lines as well as page breaks. Let's say you want to print the report out Well, let's say you want to have these elements on one page these on another page You can do that with a page break element. I have list elements. I have table elements. I have Images and videos as well as from the previous video in this series scatter plot elements so all of those are Possible elements and so in this linked list the first quad word is just For each each structure the first quad word is a pointer to the next element in the linked list and the last element would just have a Quad word of zero a null pointer in this slot then the next byte is a Number which corresponds to the type of item one through or gets zero through sixteen and Then lastly you you may have other things in the structure depending on what type of item that it is so For text structures, that is elements zero through seven All you have to do is encode that next element pointer the type the number zero through seven As well as the address of the null terminated string of the text to print in this slot If you have a format structure, that would be a Line or a page break. There is nothing else to put in besides the address of the next element and the number For list elements, you're gonna have to encode the number of elements as well as the address of each No terminated string in the list. So if you have five elements you have to encode five Quad words down here I each of them goes and points toward the string that you want to print and then table is similar But you have to have also the rows and the columns So if you had two rows three columns, you would need six quad words of Pointers for embedding videos and images. I have an embed structure you have to pass in the pixel width and height as well as the Address of the file that you want to attach and then from the previous video, we have scatter plots. So for those You have to encode the address of the scatter plot structure So besides that it's pretty simple, right? It's a link list of these elements and we may add more elements in the future and The function to generate these report is is very simple. It's called print HTML and we can see it in a second where it is and Basically, it's a void function and it returns nothing It just takes in a file descriptor of the file that you want to print this report to as Well as the linked list first element address So very simple very straightforward Now into the actual code, I've already showed you one of the examples Let me show you the second one before I show you the actual code So here is a more of an engineering related report. It says deflection of cantilever beam So if you're a mechanical engineer, you probably have seen this many times a Beam that's kind of attached at the one wall and being bent with a point load at the tip of the beam has a deflection along its axis I guess transverse to the axis of This equation basically where X is the coordinate along the beam P is the applied load L is the length of the beam and EI is bending stiffness, you know and D is the deflection in the direction of the applied load P And you can see here I've just put a list of what those things are put a table of the values and you can see I've I've done some math I've I basically evaluated this function at a bunch of points and I say well, this is the shape of the beam with these with this load applied at the tip so This is an example of a more engineering related report that you might want to generate So it's not just a matter of of jokes like this one, but you can actually generate valuable reports Which we will in this series. So Getting to the actual code The two examples are an example 15s directory, let's show you the first one really quick If I open up the code I Have to put this in light mode eventually The only includes that we have for this fancy report example are just that print HTML Function that I just described as well as the functions to open and close files And again as before the closing file function is optional, but we're going to use it just to you know Follow the rules for once So first we'll open that file With a given file name Then we will call the function print HTML with the first element in the linked list of the Report linked list in RSI So how does that look well basically you can see here all of this kind of stuff all these No, come to the string as you can see the last bite is zero and each of these elements These are things that you saw in the report, right? You can see my my car. You can see my strawberry plants. You can see The elements in the table you can see Things for the scatter plot all these things are Constituent elements of the linked list structures and then you can see down here. I have the actual Linked list so here's the first structure in the link list. It's the title structure and you can see it in codes The title so if you look db1 that corresponds with an h1 element, that's the title of the report I've selected and Sorry, you can see that it's referring to The address of an alternative string at address title and which one is that? This is q3 2023 fancy report So yeah, basically you just have a linked list down there of all of the elements and the title to the author to the date access to all the the lines all of the Lists all of the tables in the scatter plot Everything is encoded there as you would expect and If I run it it generates as you can see a dot HTML file and That we can open up and we can Refresh and you can see here that the time again is updated and this file is generated automatically The other example is a bit more involved Why is that? Well, it's because it involves evaluating that function it involves evaluating this function at 100 some odd points and so for that we have to use what we did in the previous video if you Look at example. I think it was 14c or we evaluated the polynomial It's a similar process in here except it's not a polynomial. It's it's this which I guess is a polynomial if you think about it But it's not nice and simple one. It's it's kind of a weird-looking polynomial So look in this code This one has a few more includes a lot of them are just to support our ability to Evaluate that expression So we have a heap We have our Parametric functions here to evaluate parameters to create a linear space of a design variable We have our heap initialization function allocation functions as well as that Print HTML function that this video is about Then you can see here. We have a function that basically implements that equation and that function gets evaluated in our Evaluate parameters function, which we covered Very briefly in the previous video, but I'll cover it in more detail in the future So ignore that for now if it's confusing But besides that it's all pretty much the same stuff again, you have a Bunch of an alternator strings here and actually one cool thing here is I have a math Element in HTML there are math elements and you can kind of encode formulas in it not perfect way, but Not terrible looking away. You can put exponents. You can put kind of like a Curse of looking letters. So it doesn't look terrible, but it's not great But yeah, you can encode a formula in HTML pretty nicely, which I think is pretty cool and useful for our purposes in this series And and yeah, so a bunch of crap like that. I'm not going to dive too deep into it. It's all there on the Suppository if you're curious you can take a look, but yes, if you run that code you will get a Can lever beam that HTML file and if you open that file you will get this and The beauty of this is well, what if you want to change this value? So right now under a thousand pound applied load you can see it deflects right around negative point five What if we double this applied load? Let's get let's go in that function and Let's change the number So first things first, let's change the the table element to two thousand and let's change the Actual deflection function the value of the applied load to two thousand so now if I run that code and then open run the binary and open up that Report you'll see that the applied load has doubled in the table and the deflection has doubled as you would expect for the equation in The diagram and so that's why I think reports are cool is because I can change inputs rerun the report get a new set of results and I Could print them out on my printer. I could email into somebody. It's just a much nicer way to present data than a Stupid matrix output to the console window, which is kind of a kind of a cringe thing So with that out of the way, that's what I wanted to cover in this video It was a very short video today, but we will leverage this kind of stuff Not in every video, but in some videos in future. So hope you enjoyed if you did Check the last link in the description and hang out on discord. So thanks for watching guys. See you


All right. We're at time. So first, welcome and thank you for coming to this session. It's a I don't know, a very kind of exciting time for me because we're going to show Vex working, actually making use of Vex from end to end, which is exciting. The title of this session is Enabling Vex and Full Exxon Courage. I had to trim it a little bit because the proper title would also have included all of that because we're going to demo how you can do it the easy way and also another way which requires a little bit more of work but still works. So just before I start a little bit about me, my name is Adolfo Garcia or also Puerco everywhere on the internet. I am an open source engineer at Cengar, a software supply chain security company. I also do some open source work. I one of the technical leads with Kubernetes Secret Release. This year, I'm sitting on the Knative Cine committee. I also consider myself to be an SPDX contributor and I am a maintainer of probably too many S1 tools at this point. I also like to ride my bike around the world. You can see that picture of me in Mexico City forcing my kid to like what I like. So before we start, oh, I left the subtitles, sorry. So I want to start with a short story about cars and I'm sorry because I'm going to probably say all the wrong things about cars.  So around the year 2000, complaints like report started surfacing that tires were mysteriously blowing up. I'm probably some of you are familiar with the story. I know most young people perhaps not so much so. But after some investigation, it turned out that the reason for those tires blowing up were tracked. The tires were, the faults were severe enough that vehicles started flipping and actually killing people in those accidents. And after some investigations, they found out that the reason was a fault in the tires that were shipping in the 1990s model of the Ford Explorer. These tires were manufactured by Firestone and apparently they were the only ones having that flaw. And some more research was done and they started locating that those tires also shipped with some Bronco models and some whatever that Mazda thing is. And so this was severe enough that they issued massive recall of the tires, millions of tires started to be recalled. And in the middle of that, more news started surfacing that vulnerable tires may have been shipped in other models. So that gave way to somehow some panic because people started wondering if their cars could somehow have a tire blow up and flip. I had a Ford SUV at the time with Firestone tires so I know I was pretty worried. I also had that phone picture there. But then since news started surfacing that those tires may be in other models, people who had other 90s SUVs started wondering, like, oh, am I affected? So what about my Durango, I think that is? Or what about my beautiful Aztec? Or what about cars derived from other Ford vehicles like, for example, is my Ford NASCAR racer a little bit affected? Or my Ford monster truck limo, I don't know, cars. So jokes aside, the problem was severe enough that action needed to be taken, information needed to be sorted out to locate all of the affected tires. So in the end, around 270 people were killed in accidents related to the tires. And my sense, putting on my historian hat and going back into the archives, is that there was not such a good sense of which tire lots were affected. So during this talk, I'm going to be using the car as your software application and the tire as one of the components in your software application. For S-Bomb nuts and fans like me, which I see many here, this analogy should already be familiar. It's the software and its components. But yeah, let's start going into that. So the first thing we want to talk about is S-Bomb completeness. For people unfamiliar with S-Bomb, an S-Bomb is a manifest list of components of all of the dependencies that conform a piece of software. And more information can be added to it.  So why is an S-Bomb and especially a complete S-Bomb important? When you consider a complex system like a car, you need to make sure that you keep track of all of its pieces. So whenever there's a flow in one of the parts, you need to take that S-Bomb, which is the same in applications, locate the component, and that can tell you if that component is contained in your application. Obviously, if the S-Bomb is missing parts, is missing information, or some of the components are not listed there, you are in a somewhat of a problem. Especially for example, if you don't have an S-Bomb, what can you do? Well, what do you do when you don't have questions about the safety of your car? You take it to the mechanic. And with the mechanic, it's kind of the same, and it needs information to do their job. You need to think about the mechanic as an entity, which may not be part of the production of the car that gives you some certainty about the safety of that vehicle. As I said, the mechanic needs information to do their job. One is the S-Bomb. The mechanic is going to have a much better time if they have the complete car S-Bomb to go look at the parts and make sure it's working. But what do you do when the information is missing there? Where if information is missing, the mechanic has to pull apart the car, look at every piece, and make sure that the car is working. And sometimes the methods of breaking things apart are not the best. So the mechanic has to figure out how to put it apart. So in software, I think that assessment is performed today by security vulnerability scanners. But the vulnerability scanners also need complete information. And when they bring the car apart, which is what we call software composition analysis, some software may be easier to compose or may give you more information than others. So they can also benefit from a complete S-Bomb. But not only that, there's another problem with a vulnerability scanner. And so to give you a quick dive into how vulnerability scanner works, it's just fancy database lookups. So here's how a vulnerability scanner works. When you have a piece of software and you run your security scanner through it, what it does is that it looks inside of the application, or in this case, if you have an S-Bomb, it can use the S-Bomb to locate the components living inside of that application. Here's Graip looking with its big eye. So it locates the list of components, and then it performs a database lookup in one or more security databases. And if it finds a match, it gives you back a report of the vulnerabilities that apply to your software project. Now, the problem with that is that sometimes that matching is not perfect. If you have the incomplete list, that's a problem. But there's also more challenges like actually matching the software identifiers, clashes between components that are named the same. Sometimes the information contained in the databases is not of very high quality or it's missing bits to actually do a correct matching and other problems. And this leads to lots of false positives in the information. And to show you one, I hope it's still true. I ran it a while ago. I'm going to scan. And this is scanning the latest Alpine image on... This is the Alpine image for Linux AMD 64. And when I scan it with Graip, it will find CVE-2023-4807 classified as high. Now, if it's a high vulnerability, it must be serious. But the thing here is, if we look at that vulnerability in the NVIDIA, that information only applies to Windows 64 platforms. Here you can see Red Hat knacking it in their own advisory because it doesn't apply to their products. So this leads to lots of noise. It leads to a miserable life for people who have to react to these vulnerabilities. And when we left the tire story, panic wasn't suing, but also a call for patience because during the tire chaos, people started asking, like, calling whatever had to do with tires, like car dealerships, tire vendors, and all of them just trying to find information about their vehicles. So here's where VEX can enter the picture and help. So how can VEX help in this situation? Whenever you're having that anxiety of not knowing if things are safe and especially being drawn in information that seems redundant that may not apply to you, VEX is like in our tire analogy, is like having VEX opens a new channel for more expertise to flow and give you more assessments on your vulnerabilities. So we already saw the analogy with the mechanic, but you can also get like a thumbs up from the car dealership. You can get it from an independent researcher or maybe the company is involved in the car or the tires themselves can also give you information that makes you feel better about the status and safety of your car. So VEX stands for the vulnerability, explorability exchange. There are many implementations of VEX and Open VEX is one of them and we're going to be focusing on Open VEX for this talk. VEX is a community project led by the CISA, well not led but facilitated by CISA, the Cyber Security Infrastructure Security Agency. We have a recurring VEX meeting every morning, which if you're interested in shaping the future of VEX you can join. And here's how VEX works. VEX is a system of documents that convey statements that inform about the impact that a vulnerability has on a piece of software. A VEX statement contains groups together, three main things. The first one a vulnerability. The second one is a product and that product can specify also one or more subcomponents. In this case the product would be the car, subcomponent, the tire. And finally a VEX status. And the VEX status can be one of three outcomes. You're affected and VEX can tell you if mitigations are available or how to apply them. You're not affected, in that case it can give you machine readable justifications of why it doesn't apply to your software and finally it can inform you if the software authors or whoever is looking at the vulnerabilities researching it. So it's under investigation. VEX statements also contain a timestamp because they form sequences as knowledge of the impact evolves. So here's how you use VEX documents in our car analogy. So supposing that you have a tire researcher, this is more of a value or something, but supposing someone is researching the impact on tires and finds that one of the tires has a flaw. So that person can issue a VEX document containing a statement about the tire as a product. And it lets it down the supply chain and then where the executives that car companies, for example, can pick up that statement and what we call in VEX transition it to become the subcomponent of the product. So the first person researches the tire, issues VEX about the tire, and the second one issues a new VEX statement with the tire transition as the subcomponent of the new document. And that new document can be picked up by interested parties like the mechanic or the car dealership and leading to happy drivers. Business clip art, I love it. So now, how do you generate VEX data? So to generate VEX data, you need to have the information that you want to encode in whatever VEX flavor you want to do. So the first option I'm going to show you is using Wulfi. So my company, Cengar, produces maintenance, open source Linux on distribution. It's on distribution because it's a Linux distribution optimized for containers, so it doesn't include a kernel. But we package all sorts of software. And the focus of Wulfi is high security, especially for supply chain applications. All of the Wulfi packages contain S-bombs describing them, which are generated at build time. So you have full coverage of each of the operating system packages. And the tooling to create images from Wulfi reads those S-bombs, composes them into a new S-bomb describing the image. So you have full coverage of all of the layers of the image, plus all of the information down to the file level with all of their hashes and all the information that you need. And the other important part about Wulfi is that Wulfi has its own advisory feed. So whenever there's any vulnerability, one of the Cengar engineers will go get paged, looked at it, and do an assessment, and patch the operating system package, often far quicker than any of the other distributions, or knack it if it doesn't apply to us. And based on that information, my team, I work at the Research and Development Area of Cengar, produced this tool called Vexi. And Vexi, which is a super clever composed name of Vex an image, what it does is that it takes the Wulfi S-bombs, it takes the feed from the Wulfi advisories and produces Vex out of it. So I can give you a quick, I can show you a quick demo of Vexi. It's not, I mean, it's not very impressive because when I hit the button, it's going to do things really quick. But what it does is it clones all of the advisory data from Wulfi, and then generates the Vex. So clones the advisory data from Wulfi, fetches the S-bombs from the image, which in this case I generated an S-bombs, I generated Vex for the Node.js image, and then composes Vex information for that image. So as you can see here, here are the components of the statement, the CVE, the timestamp when it was generated, the product, which in this case is the Node.js image, and the components for which the Vex statement applies. In this case, it's a Wulfi JLVC package. And the status here is not affected. In this statement, the engineer, whoever wrote this, didn't include a human readable justification. Sometimes the packages have them and you would see them here in the Wulfi case. So this is, I mean, I think it's pretty cool, because you are taking advantage of the S-bombs to generate Vex, of the advisory data to generate Vex. In effect, for your daily applications, it means that you have your Wulfi car is serviced by the full team of change-order engineers, which is cool, but may not be the case, who for some reason or another, you cannot use Wulfi. And it's, I mean, you should, because it's pretty cool, but perhaps it doesn't, you can't for whatever reason. So what's the alternative for people who don't have Wulfi in their systems or are using other types of software? Okay, so we, let's compare it. So we had the Wulfi car and let's try to look at another car. I tried to pick another cool car. I don't know if it's cool, but I didn't want to like pick a cool one and I don't know if we want it. So let's compare them both. With Wulfi, you get the S-bombs right away from a generation. And when you build an image for Wulfi, it's there. That means that using the advisory feed, you can also get Vex for free. Now, on the regular car, you need an S-bombs and you can generate it. If you don't have it, you can use BOM, the tool that we maintain for generation, S-bombs generation in Kubernetes. Or if you're not, don't want to be as cool, you can use something like SIFT. And that should give you a good enough S-bombs describing your image or any other piece of software. It doesn't have to be container. I use container images a lot because I'm involved with Kubernetes, but it applies to any piece of software really. So once you have the S-bombs, let's move the Wulfi car away. Presentation chops. So when you have your regular piece of software, the first thing that you need is to have open Vex data about the components. And this is where we're trying to work with all sorts of communities and projects so that they can start generating their own Vex data. And right now, the uses that we've seen are companies internally trying to Vex. And then, so one of the security teams inside of companies will generate Vex data for their own components and then using those they can do Vex today. But our hope is that in the near future, especially since our tooling has reached a good level of maturity, other projects will start publishing Vex. So if you're maintaining an open source project and you don't want to get bugged constantly about false positives and things that don't apply to you, Vex could be a good solution. So once you generate the S-bombs for your application, you're done because using the S-bombs, you can look up the components, check out the available Vex data and generate an S-bombs that the security scanners can give you the thumbs up. So how do you do that? And the answer for that is the open Vex tooling. So let me show you. So the first thing that we need, remembering the vulnerable image that we have here, we need to Vex this to CVE. Well, it's just a CVE but in found in two components. So what you need is, first we need the S-bombs for that image. So I'm going to generate the S-bombs for that image and I'm going to pipe it through the visualizer so that you can see the results. So this generates, let me show you first this. So if I generate the S-bombs, I'm going to get the raw S-bdx for that image. It has information about the packages and everything and by visualizing it we can understand better how it looks like. So at the top we have the image and then one layer and all of the operating system components. These are all Alpine packages and our vulnerability is found in these two here. So let's suppose that OpenSSL decided, oh, we need to start vexing, which if they were doing it, we could be using those files instead of generating them ourselves. So hopefully soon. So let me show you what they look like. For example, this is one of them. So here's the file, the document of vex.vcv in LiveSSL. So it's again the vulnerability, the name of the vulnerability, the timestamp, the product ID, which is a PURL that defining that package and I'm specifying here the architecture and then the status which is not affected and then I added a human readable note which vex processors may choose or not to surface to the users. They can just opt to do the operation fully automatically. And here's the machine readable justification. Vulnerable code node in execute path, which I don't know if it's the best fitting one, but it's one of them that could apply. So I have that document and now what? Well, now I need to build, if you think about this, this is the vex document for the component, for the tire of the car, but I want to build the vex document for the car itself. So how do I do that? And the way you do it is you use vexctl, which is the main tool from the OpenVex project. This doesn't blow up. This is like 21st century S1 technology, so it's not even merged yet, but this is the way it works. So the way it works, this sub-command reads an S1, analyzes all of the components it finds, and then it will give me, I can pass it more OpenVex documents, where you will look for information about them, our hope is to at some point out though discover all of this, and then it should give me a new document describing not the tire, but the car, which is my container image. So I run it and it's here. So if you see the new document, I mean, all of these fields are not, I didn't define them so they're empty, but you can pass your name and all those fields, value for those fields. So here's a vulnerability, the timestamp when I generated the document, and here is the new product. I'm using the PURL, the packet URL for the Alpine image that I was just showing you. And OpenVex has more fields to do the matching on the software that you're doing, so it's, here's a packet URL, which I'm using as an ID because it can fit as an RI, and then it can also match on the hashes and other identifiers. And here's the sub-component, here's the tire, so the image is the car, and the tire is here. Not affected, and here's the transitioned human readable message and the justification. Now, if you have that document, your question is, well, what good does it, what purpose does it have? How do I use it? And the way you use it is when you scan the image, you get this false positive here. And what you do with the Vex document is that you feed it into one scanner that is Vex-enabled, and as of last week, we merged OpenVex support into GRIP, so you just pass it the documents. Here it is. So this is a new flag in the latest release of GRIP. You pass it the Vex, the Vex flag with the document that I just generated, and when I run it, it says no vulnerability is found. But if you look closely, you'll see that the vulnerabilities are still there, but they just have been ignored because I'm choosing to trust those Vex documents and they in GRIP is still finding them but not showing them to me. So if I run GRIP with the show suppressed flag, it will show me what Vex did. So you see here that those vulnerabilities are still there, but Vex chose to suppress them. So this is Vex end-to-end from generation all the way to the scanner. And so our hope is that the new channel of information that Vex is going to open is going to enable this sort of thing fully automatic. There's still some work that we need to do, especially around the areas of auto discovery and trust, but things are moving really, really fast. There are many interested parties, so we hope to see some progress really, really soon. So thank you. And I wanted to just open the invitation, open invite for anybody that wants to participate in this open source project. Open Vex is a project that's incubating in the OpenSSF. We have bi-weekly meetings. That's a repo or join us on the OpenSSF, see OpenVex channel on the OpenSSF Slack. That's the Wolfie main repository and the tooling, which you can use to generate the images, and that's Mac and the Tata. So yeah, that's it. And I think we have time for questions if anybody has some. So my question is pretty basic. So let's say internally in my org, someone found a vulnerability and it's a proprietary tool, so we don't want to expose it. So we generated a CV kind of internally and then we also created a Vex for it. So how can I notify my entire org? So let's say we have an SBOM in, you know, a process is there, every product has an SBOM. How can I notify all of them about this vulnerability along with the Vex to check whether their product is vulnerable or not? Well, so if you're producing SBOMs, the best way is add the Vex file as an external reference on the SBOM. That's the key. And then you solve all, I mean, we want to make sure that Vex is sort of discoverable, but nothing beats the component itself pointing to the Vex file. And so that's the one. And what was the other part of the question? The part is like, is there a way I can publish this Vex information? So every product can, you know, from their SBOM just go through it and make sure it's not vulnerable. Yeah, so that's the discoverability part. So right now, our tooling supports automatically fetching the Vex data from images that are attached to the image, like six-store style in signing them as well. Another feature being built is finding open Vex at a well-known location in GitHub repositories. That's another one. But I think so far, that's the only ones I think are fine, unless you feed them manually like that. But using the SBOM, that's the best way because if you distribute the SBOM and you have already a way of distributing it, the SBOM can point to the open Vex document. Good. Thank you. So in one of your slides, you were using the Vex CTL that was reading an SBOM. What was the output of that? Was it another SBOM or...? So it was in the demo, right? Yeah, in the demo. This one? Yeah, that one. This? Yeah. So is that the enriched SBOM or...? So yeah, the flow is you call Vex CTL. And what Vex CTL does is it reads the SBOM. So the SBOM in this case is the standard SPDX SBOM. And then it uses the list of components from the SBOM and the information contained in the Vex from the components does the crossing and gives you back this document, which is an open Vex document. So this is pure Vex information and nothing else.


Hello there, I'm Sandy Olnok. Welcome to my YouTube channel. I will be watercoloring this lovely Akiya plant from Hawaii It's a small ground cover low to the ground and I thought it'd be great for my paper testing series and In this one, I'm going to be testing some Stonehenge Aqua. I bought a sheet of this at my local art store and It has two sides to it and you can definitely feel the difference This is the back side. You can see there is a texture that some people would consider watercolour texture and that's fine But it has a different feel it feels smoother than the front side. The front side is More like this and it's got just a softer touch to it But while we're talking about Hawaii I wanted to real quick take a left turn and let you know there's a color wheel fundraiser you can buy this color wheel image color it up any way you like and It is a fundraiser for disaster victims currently. It's going to victims of the fires on Maui Particularly in Lahaina. So please do see the link in the doobly-doo if you're interested in that and otherwise Let's get busy painting the plant that we'll be using is good for glazing because this one has Yellow in the little flowerettes and each of those leaves the paddle-shaped leaves are Either a green Green-green or a blue-green kind of color. There's more blue in some of them than others And I thought that would be a great chance to practice glazing And we'll talk about that as we go in a whole bunch of different layers There's five passes that I'll take on this painting, but it's gonna be a looser style Then is normally done in these tests This is the sketch and the sketch is available if you'd like to download it and trace it over in art Dash classes calm in the green thumb watercolor sketches class if you've already signed up for that then That lesson is right there for you and you can just go ahead and get started And if not you can go pick that class up for just a few bucks and join in the fun of painting green plants so this first pass that I'm going to do is Basically just yellow and you can use a hands a yellow and Oriolan Cobalt yellow just you know something very very light and use a lot of water with it You want it to be really really thin Because when you're glazing it's so nice to be able to shift colors just slightly And not do a lot of shifting and if you put down too much yellow When you go to add a blue leaf then you're gonna end up really fighting that yellow underneath So I wanted just a little bit for all the lightest places on the plant because there is no white there And then I decided to get crazy and do some dripping since I had this very very wet and liquidy type of paint and Then also added some specific yellow in the areas where those flowers are So those will be more yellow than everything else, but notice. There's some white places There's some just sploogey places all over because I wasn't really worried about being perfect in this I want to keep it looser and the second past then I've taken a little bit of The cascade green which is in that top well and put a little bit of it in the center And I wanted the paint a little bit thicker To add to that yellow so that the green that I'm adding is the green that I'm going to use when I get to the Blue-green, but if I use it here in my mix when I make of yellow green Then it's going to relate to the darker blue green color because it's got a little bit of that in it But notice it's not making a blue green color. It's making a very green green and the goal in this pass is to Work around each of those highlight areas each of the leaves Well, mostly shall I say has a bright edge to it So I'm painting everything except that edge and everything except those flowers So that I end up having that little yellow highlight sticking out And then we're going to work into the shadows into the darker areas through each pass during the painting Then I'm going to Just keep working around each one of these now in the class I will put a real-time version of this video With no narration in it So if you just want to sit and listen to music and watch the video go by while you're painting then you could certainly do that This is sped up about a hundred and seventy-five percent of normal speed So about three quarters of the the time faster than I would normally paint But if you'd like to see it real-time then you can see that just with some music behind it And if you don't like the music you can turn it off and go put on your own music and just mute it So now you can see that there is just some highlights left of that light yellow and The rest of it started going into this Greenish color So next up we're going to mix a darker color for pass three And in watercolor generally you work from light to dark Not always I'm not going to say always because there's not always a rule sometimes I do a glaze of a light color over everything else Which means it's a light color going on last but in general so I'm using the cascade green which is more of a blue green and I'm going to paint just the leaves that have that bluish tint to them and There's going to be some areas in here where I can't quite tell what the tint is especially down below Because those leaves they're just out of focus and you can't really see very much down there Especially since we're eliminating the background in the photo But at least that's going to give me a start in getting to be something on the bluish side and then mixing up a little bit thicker of the green mixture and I'm going to start switching back and forth between brushes because as I get to areas where I want a Big brush stroke to start off with I want to refine some of those edges in my large brush That's a number eight brush. It's a sable is not small enough to get into some of those small areas So a number four is going to do that for me And I'm using the two of them instead of just using the smaller brush, which a lot of people would do I used to do that. I Don't get that nice big flat area So all that nice big flat color is going to not give me a thousand brush strokes There's a lot of my paintings for just tons of my beginning ones Just came out looking like I had done death by a thousand brush strokes, and I still do that But on a painting like this, I wanted to keep it very Streamline so I was working really hard to make sure that I was not over brush stroking everything and putting too too too much fussiness in it Using that big fat brush for as much as I could of those leaves and then just dragging a little color With the smaller brush gives me some control in the really tight areas But then I get that nice big wide brush stroke So I get something simpler It does take practice to manage a larger brush And to be able to handle getting it into smaller areas There's sometimes when I can do a whole painting like this In that larger brush, but I thought I'd show you a way that you could get around doing that If you're just getting started and you're not really sure how to How to handle a big giant fat brush like that because for some people I know it's intimidating. It was for me when I started So give you some options here But working back and forth between the two brushes works great And you can see how flat all those leaves are coming out. They're starting to be some differentiation in color But they're for the most part just nice big shapes That's really what we're painting. We're not really thinking. Okay. I'm painting a bunch of leaves We're just painting shapes I did some splattering with this mixture of green and wanted to dab it off because I wasn't sure I wanted Quite that much and it really disappeared entirely by the time I dried it You can't even really see any of it anymore Especially in this overhead view, which is a little bright for what I'd like it to be but You know sometimes cameras do things the side view is from my phone So now I've mixed the cascade green up even thicker It's still not thick thick. It's thicker And it's going to start to give me some darker shapes And now that I have a slight difference between The blue green leaves that I painted earlier and the green green leaves Then it's pretty easy for me to track which ones were going to be more blue But this darker color Allows me to kind of push that a little bit extra to the blue side And it's you know watching the photo looking back and forth From your work from your painting to the photo reference And then back the other direction so you don't get lost But then also at some point You may find that your brush made a different leaf that you just ended up having to adjust even from your sketch And yet had to make some changes to it So you know such as life things happen And you're allowed to move a leaf around if you need to Especially on those bottom ones because like how in the heck are we supposed to figure out that? It doesn't make a lot of sense down there When it's all fuzzy and out of out of shape and out of focus So I'm mixing up a little bit more of that green wish I had done that earlier To get it a little bit closer to what it had been but I think I've got a pretty good one I wanted something as dark or a little bit darker than that cascade mix for the second half of this pass So remember I was just doing the cascade color onto the leaves that were bluish And then every time that there's a leaf that has like a darker tip to it like that one I just put a little bit at the end and then use water to paint all the way down This leaf I wanted to just wash over the whole leaf and darken it And so that's that's more of pure glazing when you're just taking a whole shape And going over it with a color so that you can change the color of it And that's changing the value of it as well as the color But sometimes you'll just have something that's A pinkish purple and you need it to be a bluish purple so you can just wash over it with some blue And here I just did that with some green in order to darken up that color Every pass of this just makes everything slightly richer slightly darker And increases the contrast but it doesn't do it with like Giant stroke with very dark thick paint Which you can do but I did a first one on this painting my first try Came out quite terrible because I leapt into it with very dark color first This paper did not like that did not like it one bit And it all started pilling up So that's why I decided to try soft glazed glazed glazed layers So that I could maybe not have it do that and this worked much better than trying to go in with A big bold stroke of dark when I got to the shadows Because it took over everything and then it got really modeled and It just wasn't flat color anymore. It was just a big blobby dark shape that Had too many variations in it. You could see all the little tiny brush strokes in it I did have a little bit more of that trouble when I got into the very darks in the next pass But it wasn't nearly as much as I'd had the first time So I did more spritzing with the paint Splattering all over the place and left much darker color this time Worked much better to have a stronger Type of color, but I did wipe it off or dab it off of the leaves themselves Just had the spray of water and paint on the outside Now for the color that I'm going to use for the deepest shadows I'm mixing cascade, but I'm throwing in some alizarin crimson Permanent alizarin crimson. There are two alizarin crimsons. One is permanent and one is fugitive So I have the permanent one so it won't disappear out of my painting But you can see that that darkens and Desaturates the green a bit and that's because these are complementary colors Your opposites on the color wheel and anytime you're looking to darken a color Try mixing it with its complement to see if that's what's going to make it darker Because it's not always going to be adding black to try to make it look dark Now this is going to let make it look more natural if it's got just a bit of red in it because red is opposite of green You may need to try out a couple of reds and see which one works because some of them You know if I were to use like a pyrrole scarlet in here, I might end up with a brown It may depend on how much of each color is in it, but I don't want to end up with that I want it to feel like a very dark green and the alizarin crimson did that rather permanent alizarin crimson I'm going to say the right name did that very well for me So I'm starting to really get that pop of The super darks in the center portions of the plant And then the lighter colors around it Moving all the way out to those very light tips on the leaves This dark area is one place where you can make up for some of the other things that may have gone wrong There's some places where there may not be much of a shadow But if I had a few stray brushstrokes that didn't go so well This is a great time to Pretend that there's a shadow in there and on a plant like this It's so complex. Nobody's really going to stress out over it There are some that might be garish shadows if you jump in there with them But if you have a spot that you just need a little extra TLC for If you put a color maybe on you know to the left or to the right of a bad edge That can kind of fix them At least until you're Getting better at your painting and you realize that you're making that error before you end up getting to the error It does take a long time. I can say that from experience Because we make a lot of mistakes along the way But mistakes are not a bad thing mistakes are just a way to figure out how to not Do that thing again Down here. I had just this weird area I was trying to do some of that repair work With a bit of the dark trying to figure out how much of that to make dark because it just something it underneath of it hadn't worked out right and Just played around with those shapes a bit to try to make them nice and crisp But it's looking better than the first one that I did Because this paper just did not like going in with really thick paint. It doesn't tend to go on really smoothly I might even have to try this on my my own in my sketchbook On another paper try it on arches and see if it's easier or if it's just A symptom of the colors and the technique that I was using But I did find it was much easier to accomplish this On this paper using light layers of glaze And not really getting dark until I got to this last phase And even then it's not like super thick dark, but since it has enough color underneath of it I didn't need it to go super super dark either And here i'm just adding touches of bright yellow Because that first yellow wash remember it looked so strong in those areas where I dropped it in where the flowers were going to be Well at this point It's not looking so strong those colors weaken next to something else. I'm just adding more yellow on top of them And then on a few of those edges of the leaves that are just feeling too white Just going to go over them real quick with a glaze of a yellow yellow green kind of color And that's going to take the sting out of them. So they're not feeling quite so much like they are screamy yellow bright kind of color And then if there's a you know little spot once everything's dry If there's something I can do in like one two three areas Maybe just don't go crazy with one more pass Of the really dark in just the very very very darkest Because the more contrast you have the more the eye recognizes what the shape is that it's looking At because we we notice things we see the shapes and the differences between one shape and another Simply because of their value Sometimes their color, but typically their value especially when it's a whole green plant So there's the achia plant achia. I don't know if i'm saying that right But I've got the lovely splashes on it If you're interested in the green thumb watercolor sketches class then go check that out It's just a few bucks And I'll see you again in my next video. Take care. See you guys later. Bye. Bye


Anyone want to give me a name? Because the first one that always pops in my mind is Sarah. And I've never had sex with a girl called Sarah, ever. A girl's name, anyone? What? Brittany. Brittany. Do I look seriously, Robbie?  All right, here we go. I'm just trying to visualize her now. OK, straight to camera, just to be serious. Now, when do you do this? It's important. Not directly after sex. So you just roll off and you go, so I hope you're not taking this too seriously. Oh, you're getting dressed, all right.  Awesome, thank you. This is exactly what I want. Much more than you would expect. When I first started, well, I set myself a goal one year. After my first year in game, my goal was rack up as many girls as possible. Did that. Second year, I thought, all right, what I want to do is I want to have five really hot, really high self-esteem girls who are way smarter than me. That was my goal. So I said about that.  Surprisingly, it was the other way around. More than 70% of the girls were like, at least, OK, let's try this. This is another myth that we have in our mind. That girls don't want this kind of relationship.  Lots of girls have had other experience, but that's pretty common. So when you come along and go, well, actually, I've got a different option, I mean, I have to sell it really well, because she needs to know what she gets out of it. Human beings are selfish.  Here's the question you should be asking yourself. So, Brittany, look, I just want to have a chat to you about what's happening with us. Now, I don't know where you're at, but I really want to know. But what I think is important is that I tell you what's happening for me, because I respect you, and I just want to be honest about where we're at. All right, so let's pause there. So it's not a big deal. I'm not going, right, so you might want to take a seat now, we need to talk about us. Yeah, I don't need to make a big deal about it. This is me, again, being casually clear about who I am. And what I don't do at the beginning is I don't tell her what she wants. I don't say, look, just so you know, not getting married. I say, I don't know what's going on for you, but I want to know, which is completely true. So it's not going to set her up in some reactive defensive position. And then I tell her why I need to tell her this. Because I have respect for her, and I want to be honest with her. Again, this is completely true. This is just not rhetoric. I've been having an awesome time with you. This has been really cool to hang out.  All right, so here's the good sell. I tell her what I like about it, what I'm enjoying about this relationship that we're having. And I tell her that I do want to keep on seeing her. So straight away, I've set from the beginning, I'm being open and honest, and I want this to continue before I go in there and say, just so you know. But I think it's important that you know that now in my life, I'm not looking for an exclusive relationship, and I'm not offering that. There it is.  Put it out there. And not right now, because maybe in the future or something, it's just like this is my lifestyle, I'm choosing it. And then I can explain to her why that is for you guys that'll all be different. And just own it.  Own it. Make no apology for it. So, I've told her. And I'll understand if that's not what you're after. This phrase or variation upon is really important. I'll understand. This is her get out of jail free card. This is saying you have choice here. You know the fact. I completely understand if that's not cool for you. Because you need to be willing, if you want to have five girlfriends, you need to be willing to let any of them walk at any moment. That was the mindset that I had. And I would, at periodic intervals, just cut all of them off. And just start again. Because that was the life that I was committed to when I went through that last phase. And that's what I'm currently in again. So, I'll understand if that's not cool with you. But you don't have to make a decision about this now, but I want you to just think about it and let me know where you're at with it. Because I would really like to see you, but it's not gonna be all the time or every week. Because that's what I can offer right now. So, what do you reckon? And you put it to her. She can decide then or she can go away and think about it and then it's done. So, that's stage one. Have the talk. Don't do it word for word like I would. Use your own way that you would say it. But the key principle is, open, direct, honest, unapologetic, here's what I can offer. And essentially, in a nice way, take it or leave it. Now, very important is that after that, you follow up this talk with your actions. Because people will hear what you do not necessarily what you say. So, if I give her that talk and then the next day, I call her up and we go for a walk hand in hand and I go and meet her friends.  Then I'm telling her the opposite of what I told her the previous night. And she'll hear what she wants to hear. I slept with this girl once and I spoke of the talk with her, I told her. And afterwards, we went down to the tram stop to send her home. And as we're standing at the tram stop, she just innocently just took me by the hand and just held me there and just started swinging. And I said to her, Brittany, remember that talk we had just before? This is what I mean. That's a bit mean, isn't it? It's a bit nasty. And she looked a little bit shocked. She went, oh, okay. And that was it. Just by me setting that simple boundary, I wasn't being nasty. I was just saying, no, that's what boyfriend and girlfriend do. I know you've done that before with a boyfriend. I'm not angry at her. She just did it absentmindedly. But I'm like, no, that's not my role in your life.  That's what I'm here for. And so after that instance, that's all that she did. It was very clear. So as a guideline, here are some things that you should implement if you wanna have successful long-term multiple relationships. No public displays of affection.  They are totally okay. Running your hand up her thigh while sitting at a restaurant. Also okay. Walking down the street, suddenly shoving her in an alley and pashing her passionately. Do you guys say pash here? It's a bit of an 80s thing in Australia. I'm just waiting to have a pash this going. That's all fine because what is that? Those are the touches of a lover, of a guy you're having an affair with. Not of a long-term boyfriend, typically. Well, it should be, but it's often not.  Because again, she's just gonna hear what she wants to hear or what you're forcing her to hear through your actions. Make sense? Excellent. How often do you see the girl? My general rule was once every eight or nine days. It couldn't be once every seven days because that meant that she would start to monopolize my weekends. Not that weekends really mean anything to me because I've never had a real job. But for others, it's important. So I would see a girl every week and a bit. And that was enough time that we had a connection, that we enjoyed our time together, that we had awesome sex, but not enough time for us to be getting attached. If you see a girl two or three or four times a week, you're done.