You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Review and acknowledgement of expectations for graduated projects and requirements for moving forward through the CNCF Maturity levels.
Met during Project's application on DD-MMM-YYYY.
Completion of this due diligence document, resolution of concerns raised, and presented for public comment satisifies the Due Diligence Review criteria.
Additional documentation as appropriate for project type, e.g.: installation documentation, end user documentation, reference implementation and/or code samples.
Governance and Maintainers
Note: this section may be augmented by the completion of a Governance Review from TAG Contributor Strategy.
Suggested
Governance has continuously been iterated upon by the project as a result of their experience applying it, with the governance history demonstrating evolution of maturity alongside the project's maturity evolution.
Required
Clear and discoverable project governance documentation.
Governance is up to date with actual project activities, including any meetings, elections, leadership, or approval processes.
Governance clearly documents vendor-neutrality of project direction.
Document how the project makes decisions on leadership roles, contribution acceptance, requests to the CNCF, and changes to governance or project goals.
Document how role, function-based members, or sub-teams are assigned, onboarded, and removed for specific teams (example: Security Response Committee).
Document complete list of current maintainers, including names, contact information, domain of responsibility, and affiliation.
A number of active maintainers which is appropriate to the size and scope of the project.
Document a complete maintainer lifecycle process (including roles, onboarding, offboarding, and emeritus status).
Demonstrate usage of the maintainer lifecycle with outcomes, either through the addition or replacement of maintainers as project events have required.
Project maintainers from at least 2 organizations that demonstrates survivability.
Code and Doc ownership in Github and elsewhere matches documented governance roles.
Document agreement that project will adopt CNCF Code of Conduct.
CNCF Code of Conduct is cross-linked from other governance documents.
All subprojects, if any, are listed.
If the project has subprojects: subproject leadership, contribution, maturity status documented, including add/remove process.
Contributors and Community
Note: this section may be augmented by the completion of a Governance Review from TAG Contributor Strategy.
Suggested
Contributor ladder with multiple roles for contributors.
Required
Clearly defined and discoverable process to submit issues or changes.
Project must have, and document, at least one public communications channel for users and/or contributors.
List and document all project communication channels, including subprojects (mail list/slack/etc.). List any non-public communications channels and what their special purpose is.
Up-to-date public meeting schedulers and/or integration with CNCF calendar.
Documentation of how to contribute, with increasing detail as the project matures.
Demonstrate contributor activity and recruitment.
Engineering Principles
Document project goals and objectives that illustrate the project’s differentiation in the Cloud Native landscape as well as outlines how this project fulfills an outstanding need and/or solves a problem differently.
Document what the project does, and why it does it - including viable cloud native use cases.
Document and maintain a public roadmap or other forward looking planning document or tracking mechanism.
Roadmap change process is documented.
Document overview of project architecture and software design that demonstrates viable cloud native use cases, as part of the project's documentation.
Document the project's release process and guidelines publicly in a RELEASES.md or equivalent file that defines:
Release expectations (scheduled or based on feature implementation)
Tagging as stable, unstable, and security related releases
Information on branch and tag strategies
Branch and platform support and length of support
Artifacts included in the release.
Additional information on topics such as LTS and edge releases are optional. Release expectations are a social contract between the project and its end users and hence changes to these should be well thought out, discussed, socialized and as necessary agreed upon by project leadership before getting rolled out.
History of regular, quality releases.
Security
Note: this section may be augemented by a joint-assessment performed by TAG Security.
Suggested
Achieving OpenSSF Best Practices silver or gold badge.
Required
Clearly defined and discoverable process to report security issues.
Enforcing Access Control Rules to secure the code base against attacks (Example: two factor authentication enforcement, and/or use of ACL tools.)
Document assignment of security response roles and how reports are handled.
Document Security Self-Assessment.
Third Party Security Review.
Moderate and low findings from the Third Party Security Review are planned/tracked for resolution as well as overall thematic findings, such as: improving project contribution guide providing a PR review guide to look for memory leaks and other vulnerabilities the project may be susceptible to by design or language choice ensuring adequate test coverage on all PRs.
Achieve the Open Source Security Foundation (OpenSSF) Best Practices passing badge.
Ecosystem
Suggested
N/A
Required
Publicly documented list of adopters, which may indicate their adoption level (dev/trialing, prod, etc.)
Used in appropriate capacity by at least 3 independent + indirect/direct adopters, (these are not required to be in the publicly documented list of adopters)
The project provided the TOC with a list of adopters for verification of use of the project at the level expected, i.e. production use for graduation, dev/test for incubation.
TOC verification of adopters.
Refer to the Adoption portion of this document.
Clearly documented integrations and/or compatibility with other CNCF projects as well as non-CNCF projects.
Adoption
Adopter 1 - $COMPANY/$INDUSTRY
If the Adopting organization needs to remain anonymous, stating the industry vertical is sufficient.
MONTH YEAR
Adopter 2 - $COMPANY/$INDUSTRY
If the Adopting organization needs to remain anonymous, stating the industry vertical is sufficient.
MONTH YEAR
Adopter 3 - $COMPANY/$INDUSTRY
If the Adopting organization needs to remain anonymous, stating the industry vertical is sufficient.
MONTH YEAR
Why is this needed?
No response
Anything else?
No response
The text was updated successfully, but these errors were encountered:
Contact Details
No response
Is there an existing issue for this?
What would you like to be added?
Project Repo(s): https://github.com/cubefs/cubefs
Project Site: https://cubefs.io
Communication: cubefs.slack.com
Project points of contacts: leon chang, changliang@oppo.com
Graduation Criteria Summary for CubeFS
Adoption Assertion
The project has been adopted by the following organizations in a testing and integration or production capacity:
https://github.com/cubefs/cubefs/edit/master/ADOPTERS.md
Criteria
Application Process Principles
Required
Completion of this due diligence document, resolution of concerns raised, and presented for public comment satisifies the Due Diligence Review criteria.
Governance and Maintainers
Note: this section may be augmented by the completion of a Governance Review from TAG Contributor Strategy.
Suggested
Required
Contributors and Community
Note: this section may be augmented by the completion of a Governance Review from TAG Contributor Strategy.
Suggested
Required
Engineering Principles
Document the project's release process and guidelines publicly in a RELEASES.md or equivalent file that defines:
Security
Note: this section may be augemented by a joint-assessment performed by TAG Security.
Suggested
Required
Third Party Security Review.
Ecosystem
Suggested
N/A
Required
The project provided the TOC with a list of adopters for verification of use of the project at the level expected, i.e. production use for graduation, dev/test for incubation.
Refer to the Adoption portion of this document.
Adoption
Adopter 1 - $COMPANY/$INDUSTRY
If the Adopting organization needs to remain anonymous, stating the industry vertical is sufficient.
MONTH YEAR
Adopter 2 - $COMPANY/$INDUSTRY
If the Adopting organization needs to remain anonymous, stating the industry vertical is sufficient.
MONTH YEAR
Adopter 3 - $COMPANY/$INDUSTRY
If the Adopting organization needs to remain anonymous, stating the industry vertical is sufficient.
MONTH YEAR
Why is this needed?
No response
Anything else?
No response
The text was updated successfully, but these errors were encountered: