[SANDBOX PROJECT ONBOARDING] SOPS

[amye]

Welcome to CNCF Project Onboarding!
This is an issue created to help onboard your project into the CNCF after the TOC has voted to accept your project.
We would like to complete onboarding within one month of acceptance.

From the project side, please ensure that you:

• Understand the project proposal process and reqs: https://github.com/cncf/toc/blob/main/process/project_proposals.md#introduction
• Understand the services available for your project at CNCF https://www.cncf.io/services-for-projects/
• Ensure your project meets the CNCF IP Policy: https://github.com/cncf/foundation/blob/master/charter.md#11-ip-policy
• Review the online programs guidelines: https://github.com/cncf/foundation/blob/master/online-programs-guidelines.md
• Understand the trademark guidelines: https://www.linuxfoundation.org/en/trademark-usage/
• Understand the license allowlist: https://github.com/cncf/foundation/blob/master/allowed-third-party-license-policy.md#approved-licenses-for-allowlist
• Is your project working on written, open governance? see https://contribute.cncf.io/maintainers/governance/
• Slack: Are your slack channels migrated to the Kubernetes or CNCF Slack? (see https://slack.com/help/articles/217872578-Import-data-from-one-Slack-workspace-to-another for more details)
• Is your project in its own separate neutral github organization?
• Submitted a Pull request to add your project as a sandbox project to https://landscape.cncf.io
• Create maintainer list + add to aggregated https://maintainers.cncf.io list by submitting a PR to it
• Artwork: Submit a pull request to https://github.com/cncf/artwork with your artwork
• Domain: transfer domain to the CNCF - https://jira.linuxfoundation.org/plugins/servlet/theme/portal/2/create/63

Things that CNCF will need from the project:

• Provide emails for the maintainers added to https://maintainers.cncf.io in order to get access to the maintainers mailing list and ServiceDesk - project-onboarding@cncf.io is the best email to send those to
• Trademarks: transfer any trademark and logo mark assets over to the LF - https://github.com/cncf/foundation/tree/master/agreements has agreements
• GitHub: ensure 'thelinuxfoundation' and 'caniszczyk' are added as initial org owners, this helps us make sure we have continuity of GH ownership that we will onboard to our GitHub Enterprise instance: https://github.com/enterprises/cncf
• GitHub: ensure DCO or CLA are enabled for all GitHub repositories of the project
• GitHub: ensure that that the CNCF Code of Conduct (or your adopted version of it) are explicitly referenced at the project's README on GitHub
• Website: ensure LF footer is there and website guidelines followed (if your project doesn't have a dedicated website, please adopt those guidelines to the README file of your project on GitHub).
• Website: Analytics transferred to projects@cncf.io
• OpenSSF Best Practices Badge: Start on an OpenSSF Best Practices Badge https://bestpractices.coreinfrastructure.org/en

Things that the CNCF will do or help the project to do:

• Devstats: add to devstats https://devstats.cncf.io/
• Insights: add to LFX Insights https://insights.v3.lfx.linuxfoundation.org/
• Marketing: update relevant intro + slide decks
• Events: update CFP + Registration + CFP Area forms
• ServiceDesk: confirm maintainers have read https://www.cncf.io/services-for-projects/
• CNCF Welcome Email Sent to confirm maintainer list access
• Book time with the team with http://project-meetings.cncf.io
• Create space for meetings/events on https://community.cncf.io, e.g., https://community.cncf.io/pravega-community/ - (https://github.com/cncf/communitygroups/blob/main/README.md#cncf-projects)
• Adopt a license scanning tool, like FOSSA or Snyk

[lukaszgryglicki]

DevStats page added.
Will also be added to All CNCF around Monday next week.

[lukaszgryglicki]

Also added to All CNCF, table.

[amye]

Checking in on this one: @hiddeco -

• Submitted a Pull request to add your project as a sandbox project to https://landscape.cncf.io/

This both puts your project on the landscape and the CNCF projects page, so it's pretty important!

[amye]

Checking in on this one: @hiddeco -

• Submitted a Pull request to add your project as a sandbox project to https://landscape.cncf.io/

This both puts your project on the landscape and the CNCF projects page, so it's pretty important!

Quick ping on this, this gets you on the sandbox project page on the website. @hiddeco - anyone else I should work with on this?

[hiddeco]

I am still awaiting the official handover from Mozilla Foundation, which is blocking further announcements.

[amye]

I am still awaiting the official handover from Mozilla Foundation, which is blocking further announcements.

Ah, got it! I will hold then.

[hiddeco]

Bit of a jigsaw puzzle here in terms of getting things done in the right order, as we are lacking an artwork at present which seems to be pretty much required for the landscape.

I am working on resolving the maintainers list first, will then get us onto https://maintainers.cncf.io, to then make use of the ServiceDesk.

However, I can confirm at present:

• Understand the project proposal process and reqs: https://github.com/cncf/toc/blob/main/process/project_proposals.md#introduction
• Understand the services available for your project at CNCF https://www.cncf.io/services-for-projects/
• Review the online programs guidelines: https://github.com/cncf/foundation/blob/master/online-programs-guidelines.md
• Understand the trademark guidelines: https://www.linuxfoundation.org/en/trademark-usage/
• Understand the license allowlist: https://github.com/cncf/foundation/blob/master/allowed-third-party-license-policy.md#approved-licenses-for-allowlist
• Slack: Are your slack channels migrated to the Kubernetes or CNCF Slack? (see https://slack.com/help/articles/217872578-Import-data-from-one-Slack-workspace-to-another for more details)
• Is your project in its own separate neutral github organization?

Plus:

• GitHub: ensure DCO or CLA are enabled for all GitHub repositories of the project

[hiddeco]

As licensing scanning tool, my preference would go out to FOSSA.

[amye]

Aha! This explains a bunch of things. Ok.
@RobertKielty for FOSSA for next week.

[RobertKielty]

I'll set up a team, send out invites.

[Cmierly]

@RobertKielty
Hi! Were the FOSSA invites sent?

[hiddeco]

We have been invited, project should be available in FOSSA dashboard now. We are running into a

You are not permitted to edit this project.

however (using a push-only API key generated from my account), see: getsops/sops#1308

[amye]

@RobertKielty - what might be the hangup here?

[krook]

Added to LFX Insights

• Insights documentation
• Insights support
• Insights feedback

[RobertKielty]

I have sent out an email to cncf-SOPS-maintainer@lists.cncf.io with details of the FOSSA Setup and I DM'd @sabre1041 on Slack to share credentials.

I will mark FOSSA setup as complete when @sabre1041 has let me know that that SOPS repos are being scanned.

[RobertKielty]

SOPS Are scanning 5 projects with FOSSA