Requirements for Projects releasing internal projects to 3rd party contributor

[christian-bromann]

Hey there 👋

the WebdriverIO project recently added a feature that made a whole set of dependencies obsolete as their functionality got built-into the main project. One of the projects we don't find much use anymore is selenium-standalone. Actually we took over maintenance of this project at some point prior joining the OpenJSF and a core contributor has been donating the project to the WebdriverIO org. The license actually never got updated.

Since the project has, with roughly 50k daily downloads, still some impact to the JS ecosystem it would be nice if we could give it away for maintenance to interested maintainers.

Do we have any policies around transferring projects to 3rd party maintainers if a project doesn't have a use for those anymore? A similar issue has been opened in #1059 that describes the opposite use case.

[tobie]

Also relevant: proposals/incubating/PROJECT_EXIT_CRITERIA.

[tobie]

Feels like whatever we end up with belongs in the project progression doc, as simplified subsets of intake and sunsetting.

[PaulaPaul]

Related to #1277 and #718 ?

[mcollina]

I'm generically worried about "giving project away", mostly because it has been used in the past as a viable attack vector.

A much better approach would be if they want to spin off into their own project inside the Foundation or even sunset that and fork it with a new name.

[tobie]

Agreed, @mcollina. That's why we brought this conversation back to the attention of the CPC.

[ljharb]

185,584 weekly downloads is small enough that I'm not hugely concerned about the attack vector angle, and I have lots of personal experience with the tragedy of having to fork a project because the "big org" that owns it won't properly maintain it, nor give it away.