Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Apply to donate Minder to the OpenSSF #386

Open
wants to merge 1 commit into
base: main
Choose a base branch
from
+57 −0
Open

Apply to donate Minder to the OpenSSF #386

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -76,6 +76,7 @@ The following Technical Initiatives have been approved by the TAC. You may learn
| gittuf | https://github.com/gittuf/gittuf | TBD | Supply Chain Integrity WG | [Sandbox](process/project-lifecycle-documents/gittuf_sandbox_stage.md) |
| OpenVEX | https://github.com/openvex | [Meeting Notes](https://docs.google.com/document/d/1C-L0JDx5O35TjXb6dcyL6ioc5xWUCkdR5kEbZ1uVQto/edit) | Vulnerability Disclosures WG | [Sandbox](process/project-lifecycle-documents/openvex_for_sandbox_stage.md) |
| OSV Schema | https://github.com/ossf/osv-schema | [Meeting Notes](https://docs.google.com/document/d/1jzqhW9SK9QRA39fQz0RiAkvpRWB0xztt1TAFJEseTlA/edit?usp=sharing) | Vulnerability Disclosures WG | TBD |
| Minder | https://github.com/stacklok/minder (TBD) | New project for inclusion | Security Tooling WG | [Sandbox](process/project-lifecycle-documents/minder_sandbox_stage.md) |
| Model signing | TBD (to be created) | [Meeting Notes](https://docs.google.com/document/d/18oAsfhfKJurH-YTUFe520CAZS3lkORX1WnZmBv4Llkc/edit) | AI/ML Security WG | [Sandbox](process/project-lifecycle-documents/model_signing_sandbox_stage.md) |
| Package Analysis | https://github.com/ossf/package-analysis | [Meeting Notes](https://docs.google.com/document/d/1GFslP6elYCx27TUitdigDr1gsOItYkL0Vq7hTB9y4Lo/edit) | Securing Critical Projects WG | TBD |
| Package Feeds | https://github.com/ossf/package-feeds | [Meeting Notes](https://docs.google.com/document/d/1GFslP6elYCx27TUitdigDr1gsOItYkL0Vq7hTB9y4Lo/edit) | Securing Critical Projects WG | TBD |
Expand Down
56 changes: 56 additions & 0 deletions process/project-lifecycle-documents/minder_sandbox_stage.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,56 @@
## Application for creating a new project at Sandbox stage

### List of project maintainers

The project has [11 maintaners](https://github.com/stacklok/minder/blob/main/MAINTAINERS.md#maintainers-list) from 2 different companies:

* Juan Antonio Osorio, Stacklok, @JAORMX
* Jakub Hrozek, Stacklok, @jhrozek
* Radoslav Dimitrov, Stacklok, @rdimitrov
* Don Browne, Stacklok, @dmjb
* Evan Anderson, Stacklok, @evankanderson
* Eleftheria Stein-Kousathana, Stacklok, @eleftherias
* Yolanda Robla Mota, Stacklok, @yrobla
* Luke Hinds, Stacklok, @lukehinds
* Michelangelo Mori, Stacklok, @blkt
* Adolfo García Veytia, Stacklok, @puerco
* Vyom Yadav, Canonical, @Vyom-Yadav

### Sponsor

Most projects will report to an existing OpenSSF Working Group, although in some cases a project may report directly to the TAC. The project commits to providing quarterly updates on progress to the group they report to.

* [Security Tooling WG](https://github.com/ossf/wg-security-tooling)

### Mission of the project

The project must be aligned with the OpenSSF mission and either be a novel approach for existing areas, address an unfulfilled need, or be initial code needed for OpenSSF WG work. It is preferred that extensions of existing OpenSSF projects collaborate with the existing project rather than seek a new project.

* Minder is a supply chain security platform to enable teams and organizations to define security policies in a consistent way across multiple supply chain assets. Minder helps project owners proactively manage their security posture by providing a set of checks and policies to minimize risk along the software supply chain, and attest their security practices to downstream consumers.

Unlike other projects in this space, Minder supports multiple sets of organization policy across different supply chain assets, and allows users to define their own supply chain security rules using policy rules (Rego) and apply them flexibly to assets using selectors (CEL).

Minder currently supports: repositories on GitHub, builds on GitHub Actions, and artifacts in DockerHub or GHCR.io. Support for GitLab repositories is in progress.


### IP policy and licensing due diligence

When contributing an existing Project to the OpenSSF, the contribution must undergo license and IP due diligence by the Linux Foundation (LF).

* Minder is currently licensed under the Apache 2.0 License, with a CLA for contributors.
* We will initiate this process shortly.

### Project References

The project should provide a list of existing resources with links to the repository, and if available, website, a roadmap, contributing guide, demos and walkthroughs, and any other material to showcase the existing breadth, maturity, and direction of the project.

| Reference | URL |
|---------------------|-----|
| Repo | https://github.com/stacklok/minder |
| Website | https://minder-docs.stacklok.dev |
| Contributing guide | https://github.com/stacklok/minder/blob/main/CONTRIBUTING.md |
| Security.md | https://github.com/stacklok/minder/blob/main/SECURITY.md |
| Roadmap | https://minder-docs.stacklok.dev/about/roadmap |
| Demos | https://www.youtube.com/watch?v=WniqzgNHjJQ (a little dated) |
| Discord Community | https://discord.com/channels/1184987096302239844/1185287949240242258 |
| Other | |