09-04-2025 Summer Mentorship Lightning Talks  ## Metadata - Author: [[OpenSSF]] - Full Title: 09-04-2025 Summer Mentorship Lightning Talks - Category: #articles - Document Note: --- tags: - #OpenSource - #Mentorship - #DeveloperExperience Author: Multiple (Amina, Shinjay Da, Singjoy, Rathore, Chin, Mentors) Source: Summer Mentorship Lightning Talks Reference: [YouTube - Summer Mentorship Lightning Talks 09-04-2025](https://www.youtube.com/watch?v=_U-A7AD_Qks) date created: 2025-09-05 12:00 --- # Title: Summer Mentorship Lightning Talks 2025: Developer Experience, Security, and Visualization in Open Source ## Table of Contents - [📝 Summary](#-summary) - [📖 Main Content](#-main-content) - [00:29 Amina: Developer Experience & First Open Source Steps](#0029-amina-developer-experience--first-open-source-steps) - [08:05 Functional Testing & Security Contributions](#0805-functional-testing--security-contributions) - [12:32 Confidence and Ongoing Contributions](#1232-confidence-and-ongoing-contributions) - [14:54 Shinjay Da: Entering Open Source via AI & Security](#1454-shinjay-da-entering-open-source-via-ai--security) - [19:42 Scalable Hash Bins & Delegation](#1942-scalable-hash-bins--delegation) - [22:10 Signing Ceremony & Secure Publishing](#2210-signing-ceremony--secure-publishing) - [27:54 Security Performance & Race Conditions](#2754-security-performance--race-conditions) - [30:15 Key Bugs & Future Features](#3015-key-bugs--future-features) - [35:09 API Visualization for Debugging](#3509-api-visualization-for-debugging) - [37:02 Integer Overflow in Complex Codebases](#3702-integer-overflow-in-complex-codebases) - [41:03 Signos: Open Source Telemetry Analyzer](#4103-signos-open-source-telemetry-analyzer) - [43:14 API Request Handling & Logs](#4314-api-request-handling--logs) - [47:09 GitHub Metadata Visualization](#4709-github-metadata-visualization) - [49:23 Mentorship Process Analysis Platform](#4923-mentorship-process-analysis-platform) - [53:33 Visualization for Newcomers](#5333-visualization-for-newcomers) - [55:50 Podcast Opportunities for Mentees](#5550-podcast-opportunities-for-mentees) - [🗒️ Notes](#️-notes) - [📖 References](#-references) - [🗣️ Paraphrase](#️-paraphrase) - [📰 Newsletter](#-newsletter) - [✅ Action Items](#-action-items) - [🧪 Hypotheses](#-hypotheses) - [📊 Methodology](#-methodology) - [❓ Questions](#-questions) - [🔮 Future Research](#-future-research) - [💡 Implications](#-implications) - [🧠 Learning Styles Assessment](#-learning-styles-assessment) - [📊 Accessibility Assessment](#-accessibility-assessment) - [🌍 DEIB Assessment](#-deib-diversity-equity-inclusion-and-belonging-assessment) - [✅ Logical Validity](#-logical-validity) - [🔍 DARVO Analysis](#-darvo-analysis) - [🔍 SEO Evaluation](#-seo-evaluation) - [🎯 Conclusion](#-conclusion) --- ## 📝 Summary The 2025 Summer Mentorship Lightning Talks showcased mentee experiences improving developer experience, strengthening security, and building visualization tools. Key themes included functional testing, scalable delegation models, signing ceremonies, bug discovery, telemetry analyzers, and metadata visualization. Beyond technical outcomes, participants emphasized mentorship’s role in boosting confidence, fostering community, and shaping professional growth in open source. --- ## 📖 Main Content ### [00:29 Amina: Developer Experience & First Open Source Steps](https://www.youtube.com/watch?v=_U-A7AD_Qks&t=29) - Transitioned from software engineering to cybersecurity. - Inspired by Pi Ladies and her first PyCon sprint in 2016. - Mentorship project: developer experience + functional tests. ### [08:05 Functional Testing & Security Contributions](https://www.youtube.com/watch?v=_U-A7AD_Qks&t=485) - Focus on functional testing to ensure reliability/security. - Reduced duplicate test writing. - Improved onboarding for contributors. ### [12:32 Confidence and Ongoing Contributions](https://www.youtube.com/watch?v=_U-A7AD_Qks&t=752) - Enhanced test coverage from 65% to 75%. - Refactored scripts for clarity/reusability. - Mentorship gave confidence to continue contributing. ### [14:54 Shinjay Da: Entering Open Source via AI & Security](https://www.youtube.com/watch?v=_U-A7AD_Qks&t=894) - Began with AI-focused repos (Hugging Face). - Overcame intimidation → mentorship acceptance. - Contributed to security + infrastructure projects. ### [19:42 Scalable Hash Bins & Delegation](https://www.youtube.com/watch?v=_U-A7AD_Qks&t=1182) - Combined hash bins with custom delegations. - Improved artifact management scalability. - Supported new signing schemes. ### [22:10 Signing Ceremony & Secure Publishing](https://www.youtube.com/watch?v=_U-A7AD_Qks&t=1330) - Required multiple signatures (online + remote maintainers). - Created new curl repository configurations. - Published artifacts securely with new delegation model. ### [27:54 Security Performance & Race Conditions](https://www.youtube.com/watch?v=_U-A7AD_Qks&t=1674) - Emphasis on detail-oriented contributions. - Future plans: offline/online keys, role-based access. ### [30:15 Key Bugs & Future Features](https://www.youtube.com/watch?v=_U-A7AD_Qks&t=1815) - Identified two major bugs for RS Release 10. - Work tied into scientific papers on security models. - Next release will include enhanced signing features. ### [35:09 API Visualization for Debugging](https://www.youtube.com/watch?v=_U-A7AD_Qks&t=2109) - Timeline visualization of API requests/functions. - Aided in bug detection and optimization. - Built on OpenTelemetry + Signos. ### [37:02 Integer Overflow in Complex Codebases](https://www.youtube.com/watch?v=_U-A7AD_Qks&t=2222) - Overflows hidden in simple resets. - Debugging harder with multiple files. - Visualization exposed hidden errors. ### [41:03 Signos: Open Source Telemetry Analyzer](https://www.youtube.com/watch?v=_U-A7AD_Qks&t=2463) - Positioned as OSS alternative to DataDog. - Integrated with dev environments. - Slower performance due to early stage. ### [43:14 API Request Handling & Logs](https://www.youtube.com/watch?v=_U-A7AD_Qks&t=2594) - Fast API interface demo. - Showed customizing tags for debugging. ### [47:09 GitHub Metadata Visualization](https://www.youtube.com/watch?v=_U-A7AD_Qks&t=2829) - Improved handling of large repos. - Visualization identified bottlenecks. ### [49:23 Mentorship Process Analysis Platform](https://www.youtube.com/watch?v=_U-A7AD_Qks&t=2963) - Tree/graph formats for repository exploration. - Beginner/advanced contributor modes. - JSON sharing for repo structures. ### [53:33 Visualization for Newcomers](https://www.youtube.com/watch?v=_U-A7AD_Qks&t=3213) - Visual tools reduced intimidation for new contributors. - Mentors praised mentees for RS Release 10 involvement. ### [55:50 Podcast Opportunities for Mentees](https://www.youtube.com/watch?v=_U-A7AD_Qks&t=3350) - Plans for Open SSF podcast episodes. - Highlight mentee voices and experiences. --- ## 🗒️ Notes - Mentorship built technical confidence and community belonging. - Functional testing = critical for security + onboarding ease. - Visualization emerged as a central theme (APIs, metadata, logs). - Signing ceremonies reinforced distributed trust. - Mentees directly contributed to RS Release 10 → immediate impact. - Opportunities extended beyond code: podcasts, professional visibility. --- ## 📖 References - [Summer Mentorship Lightning Talks, YouTube](https://www.youtube.com/watch?v=_U-A7AD_Qks) - OpenSSF resources and mentorship programs. --- ## 🗣️ Paraphrase 1. Original: “Being part of Pi Ladies gave me confidence to enter open source.” Paraphrase: Community support networks like Pi Ladies helped Amina overcome barriers and find her first open source contribution. 2. Original: “Visualization helps newcomers understand complex codebases.” Paraphrase: Graphical tools lower barriers by giving contributors an immediate, intuitive grasp of complex projects. --- ## 📰 Newsletter **🌟 Summer Mentorship Lightning Talks Recap** This week’s open source spotlight: the 2025 Summer Mentorship Lightning Talks. Mentees shared stories of overcoming intimidation, boosting test coverage, discovering bugs, and building visualization tools that mak - Summary: Presented by OpenSSF BEAR Working Group Community Office Hour 09-04-2025 - URL: https://www.youtube.com/watch?v=_U-A7AD_Qks Hello folks. >> Hello. Hello everyone. Is coming on shortly. Um, how's everyone doing today? >> Oh, good. Thank you. >> How we doing? Good. >> Good. Yep. >> It's good. All right, we'll give it um a few. But uh Kyro, did you have a certain um agenda or flow that you wanted to take this? >> Um let me check. Marcela shared uh I think an agenda for us. Let me now I need to find it. >> I'm sending it in the chat. All right, cool. So, it looks like Amina, you're you're up first. You want to go ahead and kick off? And it looks like you have Yes. Yes, I can start. I just share my screen. Just a minute. Can you all see the presentation? >> Yes. >> Yeah. >> Okay. Okay. So, let's get started. So, I'm Camila. I'm going to talk about the project that I worked on at repos for top during this summer mentorship. I worked to improving the developer experience. um and giving a little bit of background about myself and how I started looking to open source and how I end up finding about the this project. Um I actually have not I actually have a picture of the first time I discover open source I contributed to open source. It was in 2016. Uh so I'm a software engineer and I uh migrated to cyber security. I when I start my career it was really hard and you know as a woman in tech all the challenges and the you know the struggles. So something that really helped me was being part of a community. So I was part of PI ladies and I went to this Python conference in 2016 and then in the end of the conference everyone got together to do a sprint and it was to contribute to open source. Uh it was when I found out what open source was and it was in October and it was happening the October fest and I I left the conference amazed by that community and about open source and I was like I really want to be part of this. I want to contribute. Um so I continue my career close to the Python community but open source was something far away from me you know something that like you know distant and I never really did anything about it. Uh and then um I when I was migrating to cyber security I I was looking for a community to be a part of the same way I did when I was in in software engineer. So I discovered the open assess um you know I started looking at the projects and the working groups and everything but I never found something that I could engage or I was a bit afraid of doing things. So I I I kept my distance but I was always paying attention to what was happening and then was when they shared about I think was kind of post was linked about the mentorship program and then I was like oh that's cool something that I could you know really engage and you know have that time to be dedicated to do things. So I did and then it was really I was really happy when I I was selected to this program. Um but yeah so I worked the the project that I was working was to develop uh improve the developer experience um especially related to functional tests and you know uh test in general. So the functional tests are very critical not only for our stuff but for software in general. So it's very important to have test in place to make sure that they work um the new features are added uh don't break what's already in place and you know we don't have weird behaviors and things like that that are all the security issues. Um so having the test in place is very important. So this was a challenge for this uh for this project. So uh it was to improve the maintainability and the re the ability of the test suits. Uh to reduce the duplicated effort in writing test uh to make the onboarding of new contributors easier and to ensure the cons consistency across different test scenarios. Uh besides that the challenge that I had when I first started working on that was to understand the project and the and the components and how they work together because we have like the three parts right we have in this project the API the CLI the worker and the umbrella that put all that together. So I spent some time understanding how that you know worked and also to understand how to run the project and you know the technical structure of it and my experience um running the project because I was working with improving the developer experience helped me think about how a new contributor would do that and you know the challenges that I was facing would be the same that the new a new contributor would face as well. So kept that in mind to help improve that part as well and I had a lot of support from Kaido and to understand all this and from the rest of the group as well the other mentees and and other contributors too. Uh so in the end the work that I end up doing this last three months was to improve the code coverage. So when I started looking at the project I started with the test. So I looked at the units test to help me understand you know the features that were in place and the tests that were in place. So uh I saw that they in the worker we had uh coverage of 65% in one part of it and the rest of was 100% but this part was 65. So I wrote a few unit test to help me you know get started and then end up getting to 75% still wants to get to 100 but a work in progress. uh to refactor this. Another thing that I worked was to refactor the scripts to make them cleaner and more reusable and to make easier for new contributors to run the functional tests locally cuz that was a challenge that I had in the beginning. So it's something that I worked on this. I also did other small changes like adding security site files, update the maintenance information, uh things that were outdated when I when I was working, fix a bug that uh that I found as well. So all these small contributions helped me you know understand how the process work to open a PR in this project and you know have all that process of until you get merged. um is not done. So the three months went really fast. Uh so I still have things to do um like to add new functional tests for the custom delegation mode that we didn't have in place. Still I'm still working on that. Uh add other tests for the new features that are being worked on that is going to talk about uh continue to improve the coverage um to get to 100% and to improve the documentation as well. and for the future like the mentorship is is finished but I still want to continue contribute to our stuff. I want to continue contribute to other open source projects and open SSF uh working groups like this one and um like in the beginning when I first heard about open source I always felt like these were very distance to me and I feel like being part of this you know helped helped me gain the confidence that I needed uh to you know keep myself closed and I feel like it made me closer to that person I want to be cuz I always thought like oh being an open source contributor is really cool. Um, and I think I'm in the right place. So, I'm really grateful for this experience and it's been really good. Thank you. I think that was it. Oh, this is awesome. Thank you so much. And, uh, I know when my putting this together a couple months ago to get it, um, you know, this is this is kind of the vision we have for folks to be able to contribute and see, you know, their place. So, um, thank you, Chameleia. And then up next we're are uh >> let me just uh few words about that. Yeah. Uh the functional tests are very critical for our stuff because um as you much must know uh the opate framework works uh with a cryptography and making uh the clients to trust what they are downloading from uh any kind of repository. Breaking functionality it means it means uh breaking the consistent and breaking the security. So yeah, Camila was uh really uh able to understand how the product works because it's very complex and yeah, she did a a great job and I hope to continue work with Camila in the project. Thank you Camila. Awesome. Awesome. Uh we have apologies since Joy. >> Uh yeah. Um share my screen. Uh is my screen good? >> Yes. >> Yes. >> Yeah. So hi everyone. Um I'm Shinjay Da and I have been working on the other part of the project uh for a new feature that was to support hashmin delegations under custom delegations. Uh a little about me is uh I'm currently a final year undergraduate in computer science and engineering from India. Uh I started my open source journey a year back uh when I was in my uh third year. So it went like in a random evening um I used to work on mostly stuff on AI. So I used to work on hugging face a lot. So a random evening I thought maybe let's look for open-source repositories that I can contribute to. So I just saw a LinkedIn post where someone said there are good first issues for that particular repository. So I went there in hugging face and a huge repository. So I was very intimidated. Then uh I was like maybe I could do it or should I do it? Maybe I would get myself embarrassed things would happen. But I just gave it a go and since then I not looked back and it was really a good experience. It was I learned a lot from uh the maintainers from the projects and how to contribute and and I've grown immensely since then and uh then I started looking for u mentorship programs like Google summer of code and LFX also came into uh KFX was also on another mentorship program. So I just started looking for projects that I would be interested in. I was looking at the projects and I gave it a go for our stuff and our stuff was something that caught my eye because I it was something that I have not worked before. So it made me very interested that this is something that I could work and that could uh be meaningful and I something that I could learn about it as well. So it was something of a security intersection with uh infrastructure. So it was really intriguing for me to go ahead with this. So yeah, I gave it a go. I looked for a few issues. I started reading the code base. Started trying to understand about what RS and more importantly what tough is about because it is what RS is based on. And then uh submitted that proposal and yeah I got accepted and it was really happy for it was happy moment for me and then I started working on the feature. So coming to the feature we um like I said I've been working on uh introducing hashbin delegation and the custom delegations. So in the tough delegation model and rstop 1000 we have currently two types of delegations. Uh first mode is uh succent hashbin delegations. So in this delegation pattern um in the under the targets uh role there are lot of hash pins created. So that could range from anything between powers of two from 1 to 16. So it can go from two to something like 45,000 45 52,000 something like that. So there are a lot of hash pins that are created. So it is meant for mainly large repositories that have large number of artifacts under it. So it makes it really easy to u work with large number of artifacts without having to explicitly sign each of the hash metadata. So you can still verify the trust with the artifacts but also it is since it is uh been I mean it has a lot large number of hash pins so it is more scalable and the other mode is having custom delegation. So custom delegation is meant for uh projects that want to segregate uh different artifacts into different uh roles. Say you have a project that you might want to have a different role for the releases that are going into the production. You might have a different role that are uh going into the QA testing. So you can segregate those rows and depending on that you can uh choose which artifact to put where. So it gives you more fine grand fine grain control over which artifact you can put where. So this is the part I have worked on is what if you could combine the best of both worlds. What you've you had the power of the scalability of the hash bins as well as you had the fine grain control for the custom delegations. So that could mean that if you had a lot of release artifacts, so you can have arrange those into hash as well as have that granular controller because they're on to the role for releases. So uh so the delegation pattern would look something like this. Uh you have the top level targets role then it delegates to let's say a role A and role B. Role A contains role A further delegates into hash bins. So it supports a new pattern and you can still choose to go for the existing uh delegation pattern the standard custom delegation. Um currently uh the first iteration of this feature we only support uh signing using the global online key. Uh we also plan to extend this feature more so that we can support more uh signing schemes which I will talk about later and I've also prepared a little demo about it. So we will use the artist of CLI and we'll secure uh curs one of the release candidates uh here. So we can see over here uh let's go over it. So we'll perform the ceremony then we'll uh configure repository and then we'll try to download that release candidate and show that it's trust using the new delegation pattern. So we'll secure this uh RC3 tar.gz for the car release candidates. On the right side of the screen that is the endpoint where you see all of the metadata storage u for the metadata storage and the left side is the CI. So currently the ceremony is not done. So we need to do the bootstrapping first and then all of those metadata will show in the right side of the screen. So we are trying to create a new custom role called release candidates as you can see and we have selected uh number of hash pins 16 here and to guide the users better I have also uh added little notes there so users when using the features will know that whatever uh what they're going to expect uh from the feature currently. So and this part is the rest of the ceremony. So currently we are trying to sign the root and set up the online key. So root has currently two signatures and we also know that on tough that root needs to be having offline keys. So let's say and one maintainer signs for now like here JC is signed here. So we need still one more signature to complete the ceremony because we need to have one more signature. Let's say the maintenance lives in another part of the world. So we go here and then sign the other signature of the truth. And there there it's done. Sing it's can see all the metadata files met storage point. You see the role that has number of bins there inside the metadata as well. Now we'll configure the curl repository for our stuff to secure the release candidates. So add a new repository. So all these parameters are we what we need to pass to create this configuration. There we have it. We have created curl repository configuration set edit to current repository and now we'll add an artifact to the release candidates. So we'll add that artifact that I've shown before. There we there we have it. The artifacts is published and you can see that new bin metadata that's persisted that has a new version and contains that artifact meta as well and the snapshot also uh corresponds to that new version. So that we have the trust uh delegated and distrusted and we can see now if we try to download and it is successfully downloaded because now it is trusted and as I said we also have a flexibility to add custom rows without the current uh delegation pattern. So we have uh both options for the uh clients to use using the CLI and here we'll add a new custom role um for the releases that is the downloads for cur. So here we choose no for the hashpin delegations and we can still use the uh standard delegation c standard custom scroll delegation as so when call the stored under the download. So you can add that and we have the options to sign using both online and offline keys. And here you can see the new custom role is also created. You have the new role inside the targets as well and in the snapshot as well. And there was a little demo for the new feature. Um apart from it while I was developing there were a few bugs here and there. So I tried to solve it and those bugs were solved and got those PR merged and included our stuff 1 v one and u it was something really interesting and I I really loved doing a little bit of uh finding it because when you start reading about reading the code and then you see the these quirks coming up while you are testing and then it was something I really enjoyed actually. Um so the challenges was uh understanding the code base obviously because RS is pretty complicated. So understanding the code base was a big factor in uh whether if I'm going to contribute effectively understanding the control flow for each operation like how adding a delegation uh goes the code which part of the code gets invoked and what change I need to do to support this feature without breaking the existing feature. also uh during the 3 months we had various discussions with Kairo uh Martin the other mentees as well. So uh I didn't have real world experience uh in terms of thinking about uh improving performance and thinking about the performance that would also be a factor into a new future. So Kylo gave me new direction on thinking about how you can do this. Uh you can think about the performance part as well, think about the race conditions and at the end attention to detail became crucial because it is a security project and it's something that I felt I needed to do to actually u contribute to this feature effectively and more meaningfully. Future work for this feature would be as I said would be to support both offline and online keys. Uh support role specific online keys and multiple levels of custom delegation. Uh that would be really great to have in the future attictions of this feature and uh looking ahead on a personal level uh I would love to stay involved with the community. I loved being a part of this program interacting with the mentees uh as well as contributing to our stuff and it feels like um I'm kind of very interested and I would really love to be uh involved in it more and u I still want to contribute to open source projects explore more about opens other working groups and develop myself as a round well-rounded professional integrate best software development and practices and u I'm still looking for uh new graduate roles for uh after I graduate next year and at the end of all uh just staying curious and keep learning and enjoying what I do uh contributing to open source it's what I would love in the long term as well so thank you so much for this opportunity it has been a really great time with uh the mentees with Kairo with Martin and uh it has been a pleasure to be a part of this. >> Thank you so much. Um yeah, we have maybe a minute for a for questions. Does anyone have a a question for Shinjjo or Cairo? Maybe you want to uh you know um >> yeah here. >> Yeah, of course. Yeah. Um to be uh honest the two interesting things is the two bugs that uh uh uh Singjoy found actually were crucial for uh the RS stuff release 10 that was last week. Um and also uh this feature actually there are some uh I cannot disclose it yet but there are some scientific papers for uh that are using the artist stuff to to um exemplify the model of the security that they are designing and this feature actually is something critical for this paper as well. And not only this but if you think about repositories like Pippi and others that we want to not do just pep 458 that is famous uh about securing using our stuff are using tough. Yeah this uh feature is also crucial to to going with step ahead when the for example developers from certain projects they could sign the uh uh uh releases. So and not only this uh to be honest this become the biggest feature for the next release of the artist stuff 110. So yeah thank you uh stranger joy for for the product. >> Thanks a lot. Thanks a lot for having >> Thank you. So I think uh with that next up we have M who will be presenting on viewing ours tough worker. So yeah, go ahead and share your screen, please. >> Yes, sure. Just while uh SW is preparing uh just to say that uh the functional tests are crucial for this kind of feature as well that do you see the combination from one work to another and how play there. >> Yeah. So, uh can everybody see? >> Hello. >> So, right now we can see your Zoom window. >> Yeah. Okay. Sure. Okay. So, uh I'll just start with my presentation. So let's just begin. Okay. So uh basically uh I'm rather I was LFX 20 for the previous term. I was Yeah. So uh basically I this this title is uh not so uh good uh looking into our stuff worker but yeah that's the most creative I could get into it. So okay I'll just uh start with who am I? So I'm a finally a mechanical engineering student at uh the Indian Institute of Technology Vasi. So uh people might have heard of RNA I don't know. So yeah then I was a GitHub enthusiast. I mean uh I used to you know take up uh solving uh like beginner friendly bugs here and there. uh Astro was not my first project but yeah it was my it was my third or fourth project which I was like actively uh contributing started contributing so other things about myself is I'm also at code forces you want to see then uh also also my background because uh I was interested in our stuff because of this was because I had worked on QT networks that is quantum key distribution networks before and some ML algorith algorithms to you know minimize the attack surface. So uh you know that was uh quite interesting. I did it as a part of a course work here though it was like uh yeah I was working with research papers and stuff so stuff felt quite interesting and quite familiar because of that and uh yeah also just to add that I just love photos to this. Okay so in short what did I do this summer? So uh basically everyone of you would have you know uh gone through logs like these. Uh these are just like uh you know you have to exactly find you have to uh make log messages verbose uh put in enough information in those messages so that you can actually uh search for them and pinpoint the logs afterwards stuff like that. So this is like quite complicated and you cannot really get the proper flow of uh execution of a particular API request for example. So what my work was focused on was to convert these uh text based like logs into a kind of a visual appearance to give it a visual appearance and this is going to happen dynamically. So uh instead of seeing these logs the user can directly get this view of what is exactly happening at the back end. So this this view basically I'll just elaborate and go into detail but what this is basically showing is uh this is the timeline at the bottom. So uh basically at this moment at t equal to0 there's some API request coming there's some function which is going to run. So this function is calling some other function which is like at the level two. So it is being called like a stack basically. So this function stacks over this function. Then this function is over that function. And then you can see smaller functions being called repeatedly here and there. So this is a proper visual representation and this basically covers all the aspects of the repository. This is this is covering each and every function of the repository. I mean uh you could have a really good visual view about exactly what is happening throughout the API request and uh you know these can be used for optimizations. These can be used for detecting bugs or detecting some critical cases or even debugging uh some cases which maybe users report in the future. Uh they say about uh you know some some some critical cases which weren't thought about but uh which unexpectedly showed themselves in the production environment. So uh I'll just go into more details about how this was exactly done because this is quite vague. Uh yeah so uh okay briefly. So let's start with the questions you know like ask us a questions why do bugs arise you know why do we miss out simple optimizations which we could have done here or there in our codebase and you know what to do if there's a very rare edge case you know because detecting the edge case might take quite a long amount of time uh if somebody is familiar uh with the the binary search I guess there was a very small bug in the Java development kit that the the Java language the compiler about an integer overflowing. Yeah, it was such a rare edge case. I nobody had thought about it. But yeah, there's a point that a major bug can be missed out in very simple things for a longer period of time and then nobody would have noticed it because as soon as something crashes, what we do instinctively is just reset the system, the code works. So don't make any changes which break it. Yeah. So there is no real way to actually visualize and see what is happening. So what could be the answers to these problems? You know, first of all, the complex code format required while writing code that uh the the the tendency to always follow a certain always follow certain rules while writing code or always follow a certain pattern which might not be the best way to represent what is happening but it is the best way to write to write the function to write the working of the code and also handling multiple files. While handling multiple files there's a large uh you know probability of making errors because yeah like multiple files meaning means basically a bigger code base problems with that then the project is just too big to fail sometimes just blindly trust we say this function works so if I'm going to implement some function myself I'm going to trust the function that that function is working properly but sometimes what happens is that the problem is not with my function the problem is with the existing function there's a slight bug so then It just hinders the new contributor or the new any person who is going to develop anything over the project is going to face challenges because he is not sure he or her is not sure if the problem is with their code or if the problem is with the existing code or is it just that it he or she has misunderstood how to uh interwine them, how to make them work together and stuff like that. So like wouldn't you just agree like wouldn't life be just better with some visual aid to the flow of execution, some visual debugging or some visualizations of critical cases of failures and on the go. This is happening on the go. No need of hours of uh hours of you know just uh making the visualizations of visually tracking it, spending hours on that, spending you know teams work on that stuff like that. So uh let me go. So basically my work was basically uh trying to do this exactly. So this was done using uh okay I'll just explain this from the start. So basically there's a worker which works with salary to manage its tasks in the back end. So what my work focused on was integrating open telemetry. Open telemetry is something which which you know uh collects the logs in the back of the system as the system is executing any function any function on the on its own open telemetry has the capability to you know uh collect everything they call it traces spans and uh logs. So traces and spans are uh like uh like for example you were to trace a function. So the tracer begins as soon as the function starts it execution. So function is spanning over some time t. So the span basically contains information of when the function started executing when the function ended its execution and all the sub functions which it is going to call it is going to arrange it in a link list kind of a format in a beautiful tree format in a in a beautiful graph basically just like git graphs like you know uh they just split out features and all and then you know like similar kind of thing happens over here. So this is uh you know this is like packaged this information is collected on the go by open telemetry and it is collected from the cell uh from salary and all the back end workers. So then this information is like packeted for a like uh the packets are made every two or 3 seconds maybe. So then this packets are directly sent over to our visualization dashboard that is signos. Uh signos is very similar to data dog. Signos is an open source alternative for data dog. Data dog is a paid uh telemetry analyzer you can say and signs is an open source telemetry analyzer. Signos has its own defects because uh yeah it is quite slow because it's an open source project which has come up recently. So that is about all the components working in this project. I'll just uh show a brief demo on how this is done. So uh basically whenever so this feature is now limited only to the development environment. So uh if we so generally in our stuff whenever we ran the development environment we just ran make rundev. So here there is just one single extra word you have to add in that to make this work and that is make rundev hotel. So you can see here you just write make rundev hotel and it launches everything as usual but along with the signals and the open telemetry stack along with it. So uh yeah it's going to it's going to take a lot of time that is because of some issues with the signals uh stuff like that it takes a time takes its time uh actually load so it's about 2 minutes 30 seconds so okay yeah it's going to start right now so as so now let's uh go to the part where like let's open the signals dashboard it is hosted at yeah 8081. So it's going to open. Uh there is a short login portal. Uh this uh like uh for the local development environment, you can fill in any uh anything in those fields and it will just open up. In the production environment, there is a there is a uh really quick way to actually add users who are authenticated and users and passwords stuff like that. The configation files are also pushed to the GitHub to rub GitHub. So it can be viewed and seen from there how to do it. So let's quickly uh generate some like uh give an API request. Let's uh this is just exploring the dashboard. So let's uh go and like push in some API request. This is actually an HTTPS HTTP confusion. Uh never mind. So yeah, so this is the ast this is a fast API interface. It's quite simple. So uh let's give a bootstrap initialization like let's initialize a repository. So yeah just there's a problem. So let us just uh click execute over here. So as you can see uh we'll switch the logs and you can see the worker is like generating logs working in the back end and uh decoding this is very very complicated you know like you have to exactly know which function is generating this log when it is being generated and stuff like that. So as you can see here at the end it has notified that you know there's a HTTPS payload sent to AT81 and which we can actually go here and visualize as you can see uh you know we have this full view over here of the breakdown of this API request as I said level one level two level three goes on in the bottom below you can see all the uh names of the functions which were being executed how much time took. There's an optional feature to add tags over here. As you can see, every span has its own tag, set of tags. These can be customized based on what things we are trying to debug. So, that's an optional thing to be added. >> Like that can be customized. >> Yeah. >> Uh you have about a minute. >> Yeah, sure. Yeah. Yeah. So, yeah, that is all that was. So uh let me just quickly speak about the challenges. So uh the main challenge was was working with something that's not so common. The update framework is not so famous not so many lack like tutorials and learning which is exist on YouTube. So it was quite tough reading through all the documentations and everything. So uh yeah and then you know repeatedly reading through docs again and again just because I I got stuck on some bugs. So then uh so uh about first contributions and how I started my contribution. So I just uh you know used to go around uh solve beginner friendly issues then uh even in our stuff I I started as a small time issue solver and then I you know uh continuously read and uh made myself capable of solving some bigger issues. I I solved some two three uh like two or three issues here and there and there there while actually even solving this one. Then uh my tips to new contributors would just be like don't start messing around with the high level stuff because you don't know the production cycle or the uh cycle or the what what is the next most important thing the developer the main maintainer wants to be done. So the main thing is just uh working on small issues which I thought was very helpful. My next steps are basically I just really wanted to contribute to tough implementations everywhere else like in etc. And I really do want to expand the signal dashboard so I can so it can be used in the production environments and yeah uh sometimes for fun I just solve small bugs in our stuff even now and yeah I just want to like you know want companies to actually involved with our stuff. It's quite cool. Uh conclusion is yeah thank you to everyone. So that is my main conclusion over here and uh the main thing I learned in my whole mentorship was like simplicity is key. You just need to make small changes until it just becomes big one day eventually. Yeah. So I guess >> thank you uh Carol >> uh just one >> yeah very quick yeah very quick uh just to say that uh the initial uh challenge was to improve the performance of our stuff because it can handle repositories like pipi with millions on of artifacts and it it to it must to have a good performance but we figured out that First we need to be able to see what is going in the stuff when something goes. So this was the uh so we stepped back and uh uh helped us to make this this uh visualization possible to understand where are the bottlenecks of of performance in the future. Yeah, thank you for helping this. >> Thank you. >> Yeah, great job. Um and our final speaker is Shinmai to talk about the LFX metadata visualizer for GitUp. So yeah, please share your screen. >> Yes, it is. Is it visible? >> Um I can so we can hear you but see your camera. Um yeah. >> Is it visible right now? >> Yes. >> Uh I'm Chin. So I was selected uh at this project which is GitHub where our main task was creating the metadata visualizer and the policy sim policy simulator and and integrating this uh temporary time limited approach system. Other than that uh previously I've contributed to Google sum of code under this organization which is CC extractor. Right now I'm an AI intern at Vfly which is startup based out of uh India. Uh previously I've worked with audio.ai which is also an AI startup. Uh so yes this was about me also I'm currently the maintainer of this uh this project which I work uh in my Google server for tenure. So uh so basically this is the landing page that you have uh wherein you could put the remote repository link or you could put the local local repository link and local directory uh path and it will be loaded in our system and then all the commits uh would be fetched from your repository and these are some of the commits that are done by Anita and then after clicking on any of them you would be able to see this graph uh which is in uh which is in graph format. Uh if we zoom in, we would be able to see more info about a particular node uh which is present in the graph. Uh then we have uh everything in the tree format wherein you can you know expand and uh expand and see those things in you know more uh info manner. Uh then we have beginner and beginner and advanc mode wherein in the beginner mode some of the things would be hidden and uh in advance mode technicality will be shown. Then we have this other feature which is policy verification simulator where when you click on the start story it will be telling you what is happening here. So reporter starts with you know there are uh maintenance and you would be needing needing some approvals. Uh and this is the this is basically the graph that you have. Uh here you have what if mode. So let's suppose a a a maintenance actually approves your uh request then it would be becoming green. Uh so it was previously orange and and it will be becoming green. So it would be easy for a new contributor to get familiar with our system. Also you can uh add your own uh approvals and uh their you know uh and other policies etc. is that you can actually share your uh whatever you are thinking or uh what your how your overall structure of your repository looks like. You can actually download the JSON and you can share it to other person. Uh so this was basically what I worked in my LFX mentorship also. Other than that, I worked on this time proestation feature wherein let's suppose there's a bug that appeared on in 4 a.m. in the morning and you want to push something in the repository but there are not you know uh not sufficient approvals to your PR right so you can actually uh uh you you can actually push this commit without this approval for a limited time period of time period of time so this is also I worked on uh also uh how I heard about this mentorship was uh one of my friend actually contacted me he was like okay uh there's this opening at uh LFX is actually accepting the request. So I actually applied to this project. Uh after that uh the challenges that I faced during uh during the process was understanding the whole core structure and I really want to thank Patrick about uh the whole help that he gave uh that he provided to me in in the whole uh time span. he was always ready to help me and uh you know uh told me the whole control flow that uh I need to implement uh in the Golang code base also my first contribution was in this uh application which is ultimate alarm clock which was an project wherein I solved good first issues and later on I contributed in the same org as the contributor also I also the hints that I want to give to the new contributors is uh just to get started. Uh try to small small uh try to fix small bugs and uh you'll be good to go. And uh what's next is uh I want to really stick to github and open sssf and you know contribute to other projects and yes I and and I also want to improve this feature uh wherein I would be adding some other visualization stuff which uh which would be helpful for new contributors to you know get more familiar with our system and uh the process of contributing will be much easier. So yes, this was it. Also, I I I didn't really had a you know website open because it was my birthday. I was at my relative house. So yeah. >> Yeah. Thank you so much. >> Yeah. Um yeah. Any questions for Chennai? >> Uh nope. I don't really had questions, but yeah, I really enjoyed the mentorship. Uh and I really want to you know continue to open. >> Thank you. Yeah, I was also asking if other folks here have questions for you actually >> about your project. >> I'll quickly chime chime in. Um thanks Ch. Um it was it was an awesome summer. Um I have to say we >> get had a problem um Cairo might be familiar with this. um where the maintainers and people that work on it are very familiar with the codebase, but when it comes to having other people be introduced to that project, uh it just it's just super difficult. And we figured that, you know, we said, why not let's try the visualizer and I think um I've showed it to some people. They definitely have a much better understanding of good stuff now. So um it was definitely an awesome summer and we'd love to have you contribute more chin. So, thank you and yeah, everything's awesome. >> Great. Thank you. Yeah, I I was trying to see some some sort of common themes in in the summer's projects and visualization is definitely one of those. Um because yeah, I mean I like you said Patrick, I think that's that's very helpful um for for newcomers and projects. Yeah. Um I think uh with a few minutes left I'll just say thank you again to all of our speakers and congrats on a great summer to all of the mentees. Um definitely want to keep seeing you around. Um and I think uh yeah I think also has a an >> like his thoughts on that one. Yeah. No, I just want to say that uh all the my mentees our stuff 10 zero was released last week at the open summit and all uh mentees they uh have uh contributions to one zero release. So they are part of one zero release as well. So glad to see it. >> That sounds very cool. yet to close out. So, I am the co-host of the Open SSF podcast. I was speaking to the folks um on the side as you were presenting. We're going to figure out logistics. Um and I know Cairo has your contact information, but I think it would be awesome to um be able to get your voices on the podcast and talk about your summer mentorship and you know uh it would be a shorter because it would probably be all four of you in the same call. um we'll figure that piece out. But if you are interested, just let us know in the Slack channel. Um and then we can set that up and Cairo will also do one with you and Marcela on this fullblown program. I think it's great and to be able to get your voice out there. If you're not comfortable with podcast, don't worry about it. Uh right now we only do audio. Um but we are looking to do video so you let us know your comfort level. Um, but this is an opportunity for you to kind of shine, get your voice out and get more of that like um the things that you worked on in different forms of content that you can share with future employers and really highlight. So once again, just let us know on Slack, let Cyro know and we're going to be handling just logistics in the background. And with that, thank you so much everyone. This was fantastic. I'm getting like I was getting a tear guy in some of the presentations because this is great. Um >> Marcela, I'll let you close out. >> Oh, sure. Thank you. Um yeah, I don't think I have much more to add then. Yeah, I'm I'm very glad that the first cohort of of the mentorship went went so well and we definitely hope to expand the program a bit next year. So if you know people that want to join um people who want to mentor um sort of ask mentors you're absolutely welcome to to keep mentoring or if this was uh a good experience but you know you don't have the time to commit that's totally understandable too. Um yeah either way um we hope to see you around and yeah have a great rest of your year. >> Yeah. Thank you everyone. >> Thank you. >> Thank you. >> Thank you. Thank you. Thank you guys. Thank you guys., 09-04-2025 Summer Mentorship Lightning Talks, OpenSSF, 01k4ctn2rt0082hyqsv96p0g6b.