Skip to content

Commit cabadc6

Browse files
jmarrerocgwalters
jmarrero
and
cgwalters
committed
GOVERNANCE: Add Governance doc for CNCF onboarding
This is implementing https://github.com/cncf/project-template/blob/main/GOVERNANCE-maintainer.md Co-authored-by: Colin Walters <[email protected]> Signed-off-by: Joseph Marrero Corchado <[email protected]> Signed-off-by: Colin Walters <[email protected]>
1 parent 4fe87b3 commit cabadc6

File tree

2 files changed

+171
-0
lines changed

2 files changed

+171
-0
lines changed

Diff for: ‎GOVERNANCE.md

+152
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,152 @@
1+
# Bootc Project Governance
2+
3+
The Bootc project is dedicated to providing transactional, in-place operating system updates using OCI/Docker container images.
4+
This governance explains how the project is run.
5+
6+
- [Values](#values)
7+
- [Maintainers](#maintainers)
8+
- [Becoming a Maintainer](#becoming-a-maintainer)
9+
- [Meetings](#meetings)
10+
- [CNCF Resources](#cncf-resources)
11+
- [Code of Conduct Enforcement](#code-of-conduct)
12+
- [Security Response Team](#security-response-team)
13+
- [Voting](#voting)
14+
- [Modifications](#modifying-this-charter)
15+
16+
## Values
17+
18+
The Bootc and its leadership embrace the following values:
19+
20+
* Openness: Communication and decision-making happens in the open and is discoverable for future
21+
reference. As much as possible, all discussions and work take place in public
22+
forums and open repositories.
23+
24+
* Fairness: All stakeholders have the opportunity to provide feedback and submit
25+
contributions, which will be considered on their merits.
26+
27+
* Community over Product or Company: Sustaining and growing our community takes
28+
priority over shipping code or sponsors' organizational goals. Each
29+
contributor participates in the project as an individual.
30+
31+
* Inclusivity: We innovate through different perspectives and skill sets, which
32+
can only be accomplished in a welcoming and respectful environment.
33+
34+
* Participation: Responsibilities within the project are earned through
35+
participation, and there is a clear path up the contributor ladder into leadership
36+
positions.
37+
38+
## Maintainers
39+
40+
Bootc Maintainers have "gated" write acess to the [project GitHub repository](https://github.com/bootc-dev/bootc).
41+
The current maintainers can be found in [MAINTAINERS.md](./MAINTAINERS.md).
42+
43+
Direct pushes to the code is never allowed. All pull requests require review by a maintainer
44+
*other* than the one submitting it. "Large" changes are encouraged to have a tracking
45+
issue filed beforehand and gather consensus from multiple maintainers and interested community.
46+
47+
Maintainers collectively manage the project's resources and contributors.
48+
49+
This privilege is granted with some expectation of responsibility: maintainers
50+
are people who care about the Bootc project and want to help it grow and
51+
improve. A maintainer is not just someone who can make changes, but someone who
52+
has demonstrated their ability to collaborate with the team, get the most
53+
knowledgeable people to review code and docs, contribute high-quality code, and
54+
follow through to fix issues (in code or tests).
55+
56+
A maintainer is a contributor to the project's success and a citizen helping
57+
the project succeed.
58+
59+
The collective team of all Maintainers is known as the Maintainer Council, which
60+
is the governing body for the project.
61+
62+
### Becoming a Maintainer
63+
64+
To become a Maintainer you need to demonstrate the following:
65+
66+
* commitment to the project:
67+
* participate in discussions, contributions, code and documentation reviews for 6 months or more,
68+
* perform reviews for 20 non-trivial pull requests,
69+
* contribute 10 non-trivial pull requests and have them merged,
70+
* ability to write quality code and/or documentation,
71+
* ability to collaborate with the team,
72+
* understanding of how the team works (policies, processes for testing and code review, etc),
73+
* understanding of the project's code base and coding and documentation style.
74+
75+
A new Maintainer must be proposed by an existing maintainer by opening a PR against the [MAINTAINERS.md](./MAINTAINERS.md), which will prompt a [gitvote](https://github.com/cncf/gitvote). A simple majority vote of existing Maintainers
76+
approves the application. Maintainers nominations will be evaluated without prejudice
77+
to employer or demographics.
78+
79+
Maintainers who are selected will be granted the necessary GitHub rights.
80+
81+
### Removing a Maintainer
82+
83+
Maintainers may resign at any time if they feel that they will not be able to
84+
continue fulfilling their project duties.
85+
86+
Maintainers may also be removed after being inactive, failure to fulfill their
87+
Maintainer responsibilities, violating the Code of Conduct, or other reasons.
88+
Inactivity is defined as a period of very low or no activity in the project
89+
for a year or more, with no definite schedule to return to full Maintainer
90+
activity.
91+
92+
A Maintainer may be removed at any time by a 2/3 vote of the remaining maintainers.
93+
94+
Depending on the reason for removal, a Maintainer may be converted to Emeritus
95+
status. Emeritus Maintainers will still be consulted on some project matters,
96+
and can be rapidly returned to Maintainer status if their availability changes.
97+
This requires two votes from active maintainers.
98+
99+
## Meetings
100+
101+
Time zones permitting, Maintainers are expected to participate in the public
102+
developer meeting, which occurs at 3:30 PM ET on Thursdays via [Zoom](TODO).
103+
104+
Maintainers will also have closed meetings in order to discuss security reports
105+
or Code of Conduct violations. Such meetings should be scheduled by any
106+
Maintainer on receipt of a security issue or CoC report. All current Maintainers
107+
must be invited to such closed meetings, except for any Maintainer who is
108+
accused of a CoC violation.
109+
110+
## CNCF Resources
111+
112+
Any Maintainer may suggest a request for CNCF resources, either in the
113+
[bootc discussions](https://github.com/bootc-dev/bootc/discussions), or during a
114+
meeting. A simple majority of Maintainers approves the request. The Maintainers
115+
may also choose to delegate working with the CNCF to non-Maintainer community
116+
members, who will then be added to the [CNCF's Maintainer List](https://github.com/cncf/foundation/blob/main/project-maintainers.csv)
117+
for that purpose.
118+
119+
## Code of Conduct
120+
121+
[Code of Conduct](https://github.com/cncf/foundation/blob/main/code-of-conduct.md)
122+
violations by community members will be discussed and resolved
123+
by the maintainers privately. If a Maintainer is directly involved
124+
in the report, the Maintainers will instead designate two Maintainers to work
125+
with the CNCF Code of Conduct Committee in resolving it.
126+
127+
## Security Response Team
128+
129+
The Maintainers will appoint a Security Response Team to handle security reports.
130+
This committee may simply consist of the Maintainer Council themselves. If this
131+
responsibility is delegated, the Maintainers will appoint a team of at least two
132+
contributors to handle it. The Maintainers will review who is assigned to this
133+
at least once a year.
134+
135+
The Security Response Team is responsible for handling all reports of security
136+
holes and breaches according to the [security policy](./SECURITY.md).
137+
138+
## Voting
139+
140+
While most business in Bootc is conducted by "[lazy consensus](https://community.apache.org/committers/lazyConsensus.html)",
141+
periodically the Maintainers may need to vote on specific actions or changes.
142+
A vote can be taken using [gitvote](https://github.com/cncf/gitvote) or
143+
privately for security or conduct matters. Any Maintainer may demand a vote be taken.
144+
145+
Most votes require a simple majority of all Maintainers to succeed, except where
146+
otherwise noted. Two-thirds majority votes mean at least two-thirds of all
147+
existing maintainers.
148+
149+
## Modifying this Charter
150+
151+
Changes to this Governance and its supporting documents may be approved by
152+
a 2/3 vote of the Maintainers.

Diff for: ‎SECURITY.md

+19
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
# Security Policy
2+
3+
## Reporting a Vulnerability
4+
5+
If you find a potential security vulnerability in bootc, please report it by following these steps:
6+
7+
### 1. **Use the GitHub Security Tab**
8+
This repository is set up to allow vulnerability reports through GitHub's Security Advisories feature. To report a vulnerability:
9+
10+
1. Navigate to the repository's main page.
11+
2. Select the [**Security**](https://github.com/bootc-dev/bootc/security) tab.
12+
3. Select **Advisories** from the left-hand sidebar.
13+
4. Click on **Report a vulnerability**.
14+
5. Fill in the required details and submit the report.
15+
16+
Following this process will create a private advisory for our maintainers to review.
17+
18+
### 2. **Do Not Open Public Pull Requests, Issues, or Discussions**
19+
Please **do not** discuss the issue, create PRs, or start discussions about the vulnerability. This ensures the vulnerability is not widely exploited before a fix is provided.

0 commit comments

Comments
 (0)