[Prometheus] Initial integration

[AdamKorcz]

This PR adds initial integration of the Cloud Native Computing Foundation graduated project, Prometheus.

A selection of the projects users can be found on the Prometheus website.

@juliusv is in the loop as well for this integration application.

[TravisBuddy]

Travis tests have failed

Hey @AdamKorcz,
Please read the following log in order to understand the failure reason.
It'll be awesome if you fix what's wrong and commit the changes.

TravisBuddy Request Identifier: bf22dea0-96b2-11ea-a4b4-15e25fe479ac

[TravisBuddy]

Hey @AdamKorcz,
Your changes look good to me!

View build log

TravisBuddy Request Identifier: 0d63deb0-96b4-11ea-a4b4-15e25fe479ac

[juliusv]

👍 from my / Prometheus's side, thanks :)

[inferno-chromium]

+1 to Prometheus.

[juliusv]

Hi @AdamKorcz we got an email about a fuzzing issue, but we are not able to access the issue, although we are part of the Google group prometheus-team@googlegroups.com that you added as a primary contact. Reading https://google.github.io/oss-fuzz/getting-started/accepting-new-projects/, it seems the address has to be both a direct Google account, as well as an established committer in the project commit logs. Would we maybe have to add all of our personal email addresses here?

[AdamKorcz]

@juliusv I am not sure that members of a group will have access to the bug reports. As far as I know, the email addresses that are listed in the project.yaml file will have access.
I don't think that maintainers have to be committers either in order to access the bug reports.
To get access, it will probably help to add personal email addresses to the maintainers list and log in with these. Feel free to leave them here in the thread, and I will be happy to add them.

[juliusv]

@AdamKorcz Thanks! From https://google.github.io/oss-fuzz/getting-started/accepting-new-projects/ it does sound like those are the requirements. I'll send a PR to update the configuration. As much as I'm thankful for the initial setup, I would also propose to remove your email from the direct bug report CCs, as security-sensitive issues should probably only be disclosed to the team managing the OSS project?

[AdamKorcz]

@juliusv Not a problem with removing my email from the bug reports.
The team behind the OSS-fuzz project have access to the bug reports, and usually project maintainers have different policies regarding the access to the bug reports. Since security vulnerabilities may come up, it can be a good idea to limit the access to the reports and have this group report further to relevant contributors.
If you are putting in a PR to update the project.yaml, would you mind removing my email in the same go?

[juliusv]

@AdamKorcz Makes sense! Yep, will do! :)

[roidelapluie]

I also hope that we will be able to see retrospectively the fuzzing issue.

[AdamKorcz]

@roidelapluie You will. FYI: I have experienced that it takes up to a day to view old bugs after having gained access.

[AdamKorcz]

@juliusv There is one more thing that needs an update: The maintainer in the Dockerfile.

[juliusv]

@AdamKorcz Damn, now we actually have to maintain it ;) Thanks for pointing that out, here's a PR: #3906