[Technical Initiative Funding Request]: UI/UX support for attestations on software repos

[di]

Technical Initiative

Securing Repositories Working Group

Lifecycle Phase

Graduated

Funding amount

$144,000

Problem Statement

Software repositories like npmjs.org, pypi.org and rubygems.org have begun supporting the publishing of attestations (both SLSA build provenance, and/or publish attestations) on the repositories themselves.

Attestation documents are served via an API to make them easily machine-readable, but for human consumers attestations and corresponding signing certificates contain a lot of information, which the average user is unfamiliar with, and which has varying degrees of usefulness.

As a result, displaying attestations to a user via a web interface is challenging: it’s necessary to ensure that important information from within the attestation (like the upstream source repository, build infrastructure, etc) is surfaced to the user in a way that is both meaningful and clearly trustworthy. Additionally, this new UI/UX must be added to the existing interface that software repos already have.

Who does this affect?

Users who consume attestations from software repositories that support them.

Have there been previous attempts to resolve the problem?

Currently, repositories that support attestations have added UI/UX around attestations with minimal (if any) guidance from UI/UX staff. These interfaces are a minimal best-effort and are less than ideal user experiences, partly due to the lack of UI/UX support, and partly due to the nascent feature that attestations represent and lack of much prior art in how they should be displayed to an end user.

Additionally, the UI/UX is not consistent between multiple repositories, which may cause user confusion when moving from one ecosystem to another.

Examples:

• PyPI: https://pypi.org/project/sigstore/3.6.0/#sigstore-3.6.0.tar.gz
• RubyGems: https://rubygems.org/gems/sigstore-cli
• npm: https://www.npmjs.com/package/sigstore#provenance

Why should it be tackled now and by this TI?

We’re at a point where more repositories are interested in adding support for attestations. If we can pre-empt this work by providing a style guide, and aligning existing implementations, we likely will have a better outcome in the way that users perceive and consume attestations.

If we don’t do this work now, we run the risk of each implementation having a sub-par UI/UX, which may impact user perception and overall adoption of attestations.

Additionally, by providing a style guide, we are making it easier for repositories that do not support attestations to do the work to support them & provide a consistent UI.

Give an idea of what is required to make the funding initiative happen

We propose that the OpenSSF fund UI/UX work to:

• create a style guide for displaying Sigstore-signed attestations and SLSA build provenance to an end user
  • To be provided as a guide by the Securing Software Repos WG
• Improve the existing UI/UX of software repositories that provide attestations:
  • pypi.org
  • rubygems.org
  • npmjs.com (provide suggestions)

We propose contracting a UI/UX designer to:

• Perform UI/UX research on attestations
• Create a style guide and publish it at repos.openssf.org
• Work 1:1 with repositories to implement the style guide

What is going to be needed to deliver this funding initiative?

A UI/UX engineer.

Are there tools or tech that still need to be produced to facilitate the funding initiative?

No.

Give a summary of the requirements that contextualize the costs of the funding initiative

The costs are estimated at a $150 hourly rate for a UI/UX designer to perform the following tasks:

• 5 weeks: Perform UI/UX research on attestations
• 5 weeks: Create a style guide and publish it at repos.openssf.org
• 14 weeks: Work 1:1 with repositories to implement the style guide
  • 6 weeks: PyPI.org implementation
  • 6 weeks: RubyGems.org implementation
  • 2 weeks: npmjs.com (provide guidance)

Who is responsible for doing the work of this funding initiative?

We recommend Ian Taylor, [email protected] (RubyGems designer) and/or https://kabucreative.com/ (previous PyPI UI/UX contractor) depending on availability and rates.

The PSF has previously used Simply Secure (now branded SuperBloom) for a pip UX study: https://simplysecure.org / https://superbloom.design

Who is accountable for doing the work of this funding initiative?

Dustin Ingram, co-chair of Securing Repos Working Group

If the responsible or accountable parties are no longer available, what is the backup contact or plan?

Zach Steindler, co-chair of Securing Repos Working Group

What license is this funding initiative being used under?

• Style guide: https://github.com/ossf/wg-securing-software-repos/blob/main/LICENSE
• PyPI: https://github.com/pypi/warehouse/blob/main/LICENSE
• RubyGems: https://github.com/rubygems/rubygems/blob/master/LICENSE.txt

Code of Conduct

• I agree to follow the OpenSSF's Code of Conduct

List the major milestones by date and identify the overall timeline within which the technical initiative plans to accomplish their goals. Any payments for services, sponsorships, etc., will require LF Legal and Financial review.

• T+5 weeks: UI/UX research on attestations is complete
• T+5 weeks: Style guide is published at repos.openssf.org
• T+6 weeks: PyPI.org implementation complete
• T+6 weeks: RubyGems.org implementation complete
• T+2 weeks: npmjs.com guidance provided

If this is a request for funding to issue a contract, then OpenSSF will issue that contract. Please provide a Statement of Work (SOW) that we may review. Any contracting action will take 4-6 weeks to issue.

TBD by the selected contractor.

Edit: formatting

[steiza]

To state the obvious, this is the largest funding request we've ever had at the OpenSSF. However, it does deliver a lot: improved UI/UX to PyPI and RubyGems, as well as guidance for other package repositories.

We've seen how useful these attestations are in responding to supply chain attacks like the attack on the Ultralytics package on PyPI in December 2024.

The Securing Repositories Working Group has a proven track record of package repositories adopting guidance we've published on repos.openssf.org, and this funding proposal will help us expand that guidance with content that PyPI and RubyGems are currently asking us for.

Since this request was published, Maven Central also announced they will verify and store attestations, although Central does not currently display this information in its UI, and its possible they could also benefit from this work.

Not only are these attestations a great security capability that the OpenSSF is driving delivery of to the world, it also brings together several OpenSSF TIs: the Securing Repos WG of course, but also the Sigstore project and SLSA build provenance.

[lehors]

I think this is a worthwhile proposal but feel like it should be divided into several chunks. Start with the first 10 weeks to do the research and development of the style guide. Then do one implementation at a time. This would make the size of the funding requests much smaller and give us the opportunity to have a natural monitoring cadence as new requests come in.

[gkunz]

I support this request and see a lot of value - primarily for package repos and open source developers of course, but also for downstream users, i.e., enterprises who provide dashboards etc. to present project meta-data to internal developers. A good style guide benefits such internal tooling and the developers using it, too.

[bobcallaway]

I'm supportive of this request given that it directly delivers against one of the top-level points in our technical vision

[riaankleinhans]

/vote

[git-vote]

Vote created

@riaankleinhans has called for a vote on [Technical Initiative Funding Request]: UI/UX support for attestations on software repos (#424).

The members of the following teams have binding votes:

Team
@ossf/tac

Non-binding votes are also appreciated as a sign of support!

How to vote

You can cast your vote by reacting to this comment. The following reactions are supported:

In favor	Against	Abstain
👍	👎	👀

Please note that voting for multiple options is not allowed and those votes won't be counted.

The vote will be open for 1month 11days 13h 26m 24s. It will pass if at least 70% of the users with binding votes vote In favor 👍. Once it's closed, results will be published here as a new comment.

[marcelamelara]

+1 The ask is rather large, but I definitely see the need for making this investment in the package repos we work with.

[git-vote]

Vote status

So far 44.44% of the users with binding vote are in favor and 0.00% are against (passing threshold: 70%).

Summary

In favor	Against	Abstain	Not voted
4	0	0	5

Binding votes (4)

User	Vote	Timestamp
bobcallaway	In favor	2025-02-25 13:00:42.0 +00:00:00
steiza	In favor	2025-02-24 20:55:16.0 +00:00:00
gkunz	In favor	2025-02-25 9:41:43.0 +00:00:00
marcelamelara	In favor	2025-02-25 18:58:14.0 +00:00:00
@justaugustus	Pending
@mlieberman85	Pending
@scovetta	Pending
@lehors	Pending
@camaleon2016	Pending

[git-vote]

Vote status

So far 55.56% of the users with binding vote are in favor and 0.00% are against (passing threshold: 70%).

Summary

In favor	Against	Abstain	Not voted
5	0	1	3

Binding votes (6)

User	Vote	Timestamp
steiza	In favor	2025-02-24 20:55:16.0 +00:00:00
lehors	Abstain	2025-02-26 17:53:07.0 +00:00:00
mlieberman85	In favor	2025-02-27 18:57:43.0 +00:00:00
bobcallaway	In favor	2025-02-25 13:00:42.0 +00:00:00
gkunz	In favor	2025-02-25 9:41:43.0 +00:00:00
marcelamelara	In favor	2025-02-25 18:58:14.0 +00:00:00
@justaugustus	Pending
@scovetta	Pending
@camaleon2016	Pending

[riaankleinhans]

/check-vote

[git-vote]

Vote status

So far 55.56% of the users with binding vote are in favor and 0.00% are against (passing threshold: 70%).

Summary

In favor	Against	Abstain	Not voted
5	0	1	3

Binding votes (6)

User	Vote	Timestamp
bobcallaway	In favor	2025-02-25 13:00:42.0 +00:00:00
marcelamelara	In favor	2025-02-25 18:58:14.0 +00:00:00
gkunz	In favor	2025-02-25 9:41:43.0 +00:00:00
mlieberman85	In favor	2025-02-27 18:57:43.0 +00:00:00
steiza	In favor	2025-02-24 20:55:16.0 +00:00:00
lehors	Abstain	2025-02-26 17:53:07.0 +00:00:00
@justaugustus	Pending
@scovetta	Pending
@camaleon2016	Pending

[riaankleinhans]

/check-vote

[git-vote]

Vote status

So far 66.67% of the users with binding vote are in favor and 0.00% are against (passing threshold: 70%).

Summary

In favor	Against	Abstain	Not voted
6	0	1	2

Binding votes (7)

User	Vote	Timestamp
mlieberman85	In favor	2025-02-27 18:57:43.0 +00:00:00
scovetta	In favor	2025-03-11 3:00:58.0 +00:00:00
marcelamelara	In favor	2025-02-25 18:58:14.0 +00:00:00
steiza	In favor	2025-02-24 20:55:16.0 +00:00:00
gkunz	In favor	2025-02-25 9:41:43.0 +00:00:00
bobcallaway	In favor	2025-02-25 13:00:42.0 +00:00:00
lehors	Abstain	2025-02-26 17:53:07.0 +00:00:00
@justaugustus	Pending
@camaleon2016	Pending

[riaankleinhans]

Based on vote threshold change PR #455 this vote passed with 66%

[riaankleinhans]

@afmarcum can you please review for final approval

[afmarcum]

Approved.

@di @steiza Please let me know if TPM support is needed to track/drive this work so we can ensure Kris Borchers has bandwidth.

[di]

Yes, that would be helpful!

[git-vote]

Vote status

So far 66.67% of the users with binding vote are in favor and 0.00% are against (passing threshold: 70%).

Summary

In favor	Against	Abstain	Not voted
6	0	1	2

Binding votes (7)

User	Vote	Timestamp
steiza	In favor	2025-02-24 20:55:16.0 +00:00:00
scovetta	In favor	2025-03-11 3:00:58.0 +00:00:00
marcelamelara	In favor	2025-02-25 18:58:14.0 +00:00:00
lehors	Abstain	2025-02-26 17:53:07.0 +00:00:00
gkunz	In favor	2025-02-25 9:41:43.0 +00:00:00
mlieberman85	In favor	2025-02-27 18:57:43.0 +00:00:00
bobcallaway	In favor	2025-02-25 13:00:42.0 +00:00:00
@justaugustus	Pending
@camaleon2016	Pending

[riaankleinhans]

/cancel-vote

[git-vote]

Vote cancelled

@riaankleinhans has cancelled the vote in progress in this issue.

[di]

@afmarcum Is it possible to get the mentioned TPM support? What are next steps here?

[afmarcum]

@kborchers please work with Dustin and Zach if you were not able to attend today's WG meeting to discuss kicking off this effort.

[di]

@afmarcum Thanks. At what point does this move from "Budget Approved" to "Funding Approved"?

[kborchers]

@di @steiza I sent a message in Slack to set up some time to discuss.

[Erioldoesdesign]

Hi hi, As both an employee of Superbloom and as a core maintainer over at https://github.com/opensourcedesign i'd love to help inform how this develops. If there's any info that i can provide to help please lemme know