Skip to content
Permalink
Browse files
Merge branch 'patch-10' of https://github.com/cottage14/comdev-site i…
…nto cottage14-patch-10
  • Loading branch information
bdelacretaz committed Jun 21, 2021
2 parents 1219799 + 2068856 commit 3029c328e3385db481b6781f9e1928b9c954a43f
Showing 1 changed file with 45 additions and 52 deletions.
@@ -6,54 +6,53 @@ The **Apache Project Maturity Model** provides a suggested framework for evaluat

# Overview

The goal of this maturity model is to describe how Apache projects operate, in a concise and high-level way, and to provide a basic framework that projects may choose to use to evaluate themselves.
The goals of this maturity model are to describe how Apache projects operate in a concise and high-level way, and to provide a basic framework that projects may choose to use to evaluate themselves.

It is meant to be usable outside of Apache as well, for projects that might want to adopt some or all of these principles. Projects that envision moving to Apache at some point might start working towards this to prepare for their move.
It is usable outside of Apache as well, for projects that might want to adopt some or all of these principles. Projects that envision moving to Apache at some point might start working towards this to prepare for their move.

It does not describe all the details of how our projects operate, but aims to capture the invariants of Apache projects and point to additional information where needed. To keep the main model as concise as possible we use footnotes for anything that's not part of the core model.
It does not describe all the details of how our projects operate, but aims to capture the invariants of Apache projects and point to additional information where needed. To be as concise as possible we use footnotes for anything that's not part of the core model.

Contrary to other maturity models, we do not define staged partial compliance levels. A mature Apache project complies with all the elements of this model, and other projects are welcome to pick and choose the elements that suit their goals.
Contrary to other maturity models, we do not define staged partial compliance levels. A mature Apache project complies with all the elements of this model, and other projects are welcome to adopt the elements that suit their goals.

Note that we try to avoid using the word "must" below. The model describes the state of a mature project, as opposed to a set of rules.

Projects which incubate at Apache might not fit into all the parts of this model, however a major goal of incubation is to bring the project's community closer to it.
Projects which incubate at Apache might not fit into all the parts of this model; however a major goal of incubation is to bring the project's community closer to it.

Questions and feedback about this model are welcome on the <a href="https://lists.apache.org/list.html?dev@community.apache.org">comdev mailing list</a>.
We welcome Questions and feedback about this model on the <a href="https://lists.apache.org/list.html?dev@community.apache.org" target="_blank">comdev mailing list</a>.

# The Apache Project Maturity Model

Each item in the model has a unique ID to allow them to be easily referenced elsewhere.
Each item in the model has a unique ID to allow it to be easily referenced elsewhere.

## Code

<dl>
<dt id="CD10">CD10</dt>
<dd>
The project produces Open Source software, for distribution to the public at no charge.
The project produces Open Source software for distribution to the public, at no charge.
<sup><a href="#fnref-a2e0cd066fd8f45af4e87bcdbf8d9abd3ad40872" id="fndef-a2e0cd066fd8f45af4e87bcdbf8d9abd3ad40872-0">1</a></sup>
</dd>

<dt id="CD20">CD20</dt>
<dd>
The project's code is easily discoverable and publicly accessible.
Anyone can easily discover and access the project's code.
</dd>

<dt id="CD30">CD30</dt>
<dd>
The code can be built in a reproducible way using widely available standard tools.
Anyone using standard, widely-available tools, can built the code can be built in a reproducible way.
</dd>

<dt id="CD40">CD40</dt>
<dd>
The full history of the project's code is available via a source code
control system, in a way that allows any released version to be
recreated.
control system, in a way that allows anyone to recreate any released version.
</dd>

<dt id="CD50">CD50</dt>
<dd>
The provenance of each line of code is established via the source code control system, in a reliable way based on strong authentication of the
committer. When third-party contributions are committed, commit messages provide reliable information about the code provenance.
The source code control system establishes the provenance of each line of code in a reliable way, based on strong authentication of the
committer. When thirdparties contribute code, commit messages provide reliable information about the code provenance.
<sup><a href="#fnref-1a581282a720702d3a9e11f81f8c9eeddbee55a9" id="fndef-1a581282a720702d3a9e11f81f8c9eeddbee55a9-1">2</a></sup>
</dd>

@@ -63,7 +62,7 @@ committer. When third-party contributions are committed, commit messages provide

<dl>
<dt id="LC10">LC10</dt>
<dd>The code is released under the Apache License, version 2.0.
<dd>The Apache License, verison 2.0, covers the released code.
</dd>

<dt id="LC20">LC20</dt>
@@ -80,13 +79,13 @@ The libraries mentioned in LC20 are available as Open Source software.

<dt id="LC40">LC40</dt>
<dd>Committers are bound by an Individual Contributor Agreement (the <a href="https://www.apache.org/licenses/icla.txt">"Apache iCLA"</a>) that
defines which code they are allowed to commit and how they need to
defines which code they may commit and how they need to
identify code that is not their own.
</dd>

<dt id="LC50">LC50</dt>
<dd>
The copyright ownership of everything that the project produces is clearly defined and documented.
The project clearly defines and documents the copyright ownership of everything that the project produces.
<sup><a href="#fnref-258df7a61c975c67bbef17d3cf7851bafd40b8fb" id="fndef-258df7a61c975c67bbef17d3cf7851bafd40b8fb-4">5</a></sup>
</dd>

@@ -103,22 +102,21 @@ formats that are expected to stay readable in the long term.

<dt id="RE20">RE20</dt>
<dd>
Releases are approved by the project's PMC (see CS10), in order to make them an act of the Foundation.
The project's Project Management Committee (PMC) (see CS10) approves each software release in order to make the release an act of the Foundation.
</dd>

<dt id="RE30">RE30</dt>
<dd>
Releases are signed and/or distributed along with digests that can be reliably used to validate the downloaded archives.
Releases are signed and/or distributed along with digests that anyone can be reliably use to validate the downloaded archives.
</dd>

<dt id="RE40">RE40</dt>
<dd>Convenience binaries can be distributed alongside source code but they are not Apache Releases -- they are just a
convenience provided with no guarantee.
<dd>The project can distribute convenience binaries alongside source code, but they are not Apache Releases -- they are provided with no guarantee.
</dd>

<dt id="RE50">RE50</dt>
<dd>The release process is documented and repeatable to the extent that
someone new to the project is able to independently generate the complete
<dd>The project documents a repeatable release process so that
someone new to the project can independently generate the complete
set of artifacts required for a release.
</dd>

@@ -169,27 +167,25 @@ The project has a well-known homepage that points to all the information require
<dt id="CO20">CO20</dt>
<dd>
The community welcomes contributions from anyone who acts in good faith and
in a respectful manner and adds value to the project.
in a respectful manner, and who adds value to the project.
</dd>

<dt id="CO30">CO30</dt>
<dd>
Contributions include not only source code, but also documentation, constructive bug
reports, constructive discussions, marketing and generally anything that
adds value to the project.
Contributions include source code, documentation, constructive bug
reports, constructive discussions, marketing and generally anything that adds value to the project.
</dd>

<dt id="CO40">CO40</dt>
<dd>
The community strives to be meritocratic and over time aims to give more rights and
responsibilities to contributors who add value to the project.
The community strives to be meritocratic and gives more rights and
responsibilities to contributors who, over time, add value to the project.
</dd>

<dt id="CO50">CO50</dt>
<dd>
The way in which contributors can be granted more rights such as commit
access or decision power is clearly documented and is the same for all
contributors.
The project documents, and applies consistently, how contributors can earn more rights such as commit
access or decision power.
</dd>

<dt id="CO60">CO60</dt>
@@ -216,23 +212,20 @@ those contributors.

<dt id="CS20">CS20</dt>
<dd>
Decisions are made by consensus among PMC members
Decisions reqyuire a consensus among PMC members
<sup><a href="#fnref-08fda1a3461c11086b8542178f35e0c27a4a46c3" id="fndef-08fda1a3461c11086b8542178f35e0c27a4a46c3-8">9</a></sup>
and are documented on the project's main communications channel.
Community opinions are taken into account but the PMC has the final word
if needed.
The PMC takes into account community opinions, but the PMC has the final word.
</dd>

<dt id="CS30">CS30</dt>
<dd>
Documented voting rules are used to build consensus when discussion is not sufficient.
The project uses documented voting rules to build consensus when discussion is not sufficient.
<sup><a href="#fnref-9b0cf71f04bcd81dddbf6199f1c771e27566611e" id="fndef-9b0cf71f04bcd81dddbf6199f1c771e27566611e-9">10</a></sup>
</dd>

<dt id="CS40">CS40</dt>
<dd>In
Apache projects, vetoes are only valid for code commits and are
justified by a technical explanation, as per the Apache voting rules
<dd>In Apache projects, vetoes are only valid for code commits. The person exercising the veto mush justify it with a technical explanation, as per the Apache voting rules
defined in CS30.
</dd>

@@ -257,17 +250,17 @@ The project is independent from any corporate or organizational influence.
</dd>

<dt id="IN20">IN20</dt>
<dd>Contributors act as themselves as opposed to representatives of a corporation or organization.
<dd>Contributors act as themselves, not as representatives of a corporation or organization.
</dd>

</dl>

# How To Use The Apache Project Maturity Model

**Remember:** This model is a suggested guide; it is not a requirements document. The model shows what generally good behaviors in an Apache project look like.
**Remember:** This model is a guide; it is not a requirements document. The model shows what generally good behaviors in an Apache project look like.

So far, inside the ASF this model has been used mostly for self-assessment of podlings preparing their graduation
from the [Apache Incubator](https://incubator.apache.org).
So far, inside the ASF, podlings preparing their graduation
from the [Apache Incubator](https://incubator.apache.org) have used this model, mostly for self-assessment.

It might be useful for top-level ASF projects to regularly assess their maturity based on this model, but this is not a requirement at this time.

@@ -281,7 +274,7 @@ Here are a few self-assessment examples:

## Other Open Source Project Models

See [https://s.apache.org/apache_maturity_model](https://s.apache.org/apache_maturity_model) for the discussions that led to this. And thanks to the many people who provided input! The links below are both inspirations for our model above, and are some of the other ways that FOSS project participants have tried to quantify ways to measure open source projects.
See [https://s.apache.org/apache_maturity_model](https://s.apache.org/apache_maturity_model) for the discussions that led to this document. Thanks to the many people who provided input! The links below are both inspirations for our model, and are some of the other ways that FOSS project participants have tried to quantify ways to measure open source projects.

* [http://oss-watch.ac.uk/resources/ssmm](http://oss-watch.ac.uk/resources/ssmm)
* [https://osswatch.jiscinvolve.org/wp/2014/12/11/open-or-fauxpen-use-the-oss-watch-openness-rating-tool-to-find-out/](https://osswatch.jiscinvolve.org/wp/2014/12/11/open-or-fauxpen-use-the-oss-watch-openness-rating-tool-to-find-out/)
@@ -299,15 +292,15 @@ v 1.1, October 2016 added RE50.

v 1.2, February 2018, reworked the "how to use" section with more links to self-assessments.

See the <a href="https://svn.apache.org/viewvc/comdev/site/trunk/content/apache-way/apache-project-maturity-model.mdtext?view=log">svn revision history</a> of this document for more details and other minor changes.
See the <a href="https://svn.apache.org/viewvc/comdev/site/trunk/content/apache-way/apache-project-maturity-model.mdtext?view=log" target="_blank">svn revision history</a> of this document for more details and other minor changes.

### Footnotes

<ol>

<li>
<a id="fnref-a2e0cd066fd8f45af4e87bcdbf8d9abd3ad40872"></a>
"For distribution to the public at no charge" is straight from the from the ASF Bylaws at <a class="http" href="https://apache.org/foundation/bylaws.html">https://apache.org/foundation/bylaws.html</a>.
"For distribution to the public at no charge" is straight from the from the ASF Bylaws at <a class="http" href="https://apache.org/foundation/bylaws.html" target="_blank">https://apache.org/foundation/bylaws.html</a>.

(<a href="#fndef-a2e0cd066fd8f45af4e87bcdbf8d9abd3ad40872-0">1</a>)
</li>
@@ -329,7 +322,7 @@ what we are distributing.

<li>
<a id="fnref-3e4d977daeeb59a808fb0c40477b2cd50e913f2e"></a>
<a class="http" href="https://apache.org/legal/resolved.html">https://apache.org/legal/resolved.html</a> has information about acceptable licenses for third-party dependencies
<a class="http" href="https://apache.org/legal/resolved.html">https://apache.org/legal/resolved.html</a> has information about acceptable licenses for third-party dependencies.

(<a href="#fndef-3e4d977daeeb59a808fb0c40477b2cd50e913f2e-3">4</a>)
</li>
@@ -345,14 +338,14 @@ contributions but grant the ASF a perpetual copyright license for them.

<li>
<a id="fnref-d2389850862fcc9bddabb3c2e23b13922d68e3fc"></a>
See <a class="http" href="https://www.apache.org/legal/release-policy.html">https://www.apache.org/legal/release-policy.html</a> for more info on Apache releases
See <a class="http" href="https://www.apache.org/legal/release-policy.html">https://www.apache.org/legal/release-policy.html</a> for more info on Apache releases.

(<a href="#fndef-d2389850862fcc9bddabb3c2e23b13922d68e3fc-5">6</a>)
</li>

<li>
<a id="fnref-89a5257606b929cc5ced2bee207c80b43541d488"></a>
The required level of security depends on the software's intended uses, of course. Expectations should be clearly documented.
The required level of security depends on the software's intended uses, of course. Projects should clearly document security expectations.

(<a href="#fndef-89a5257606b929cc5ced2bee207c80b43541d488-6">7</a>)
</li>
@@ -373,17 +366,17 @@ contributions but grant the ASF a perpetual copyright license for them.

<li>
<a id="fnref-9b0cf71f04bcd81dddbf6199f1c771e27566611e"></a>
For Apache projects, <a class="http" href="https://www.apache.org/foundation/voting.html">https://www.apache.org/foundation/voting.html</a> defines the voting rules.
For Apache projects, <a class="http" href="https://www.apache.org/foundation/voting.html" target="_blank">https://www.apache.org/foundation/voting.html</a> defines the voting rules.

(<a href="#fndef-9b0cf71f04bcd81dddbf6199f1c771e27566611e-9">10</a>)
</li>

<li>
<a id="fnref-d9e7a517f046358463f038f3830fef171e69f78b"></a>
Apache projects have a private mailing list that their PMC is expected to use
Each Apache project has a private mailing list that its PMC is expected to use
only when really needed. The private list is typically used for
discussions about people, for example to discuss and to vote on PMC
candidates privately.
candidates.

(<a href="#fndef-d9e7a517f046358463f038f3830fef171e69f78b-10">11</a>)
</li>

0 comments on commit 3029c32

Please sign in to comment.