toc icon indicating copy to clipboard operation
toc copied to clipboard

Published 20 hours ago • verified publisher icon cncf

[SANDBOX PROJECT ONBOARDING] OpenFGA

Open amye opened this issue 3 years ago • 16 comments

Welcome to CNCF Project Onboarding! This is an issue created to help onboard your project into the CNCF after the TOC has voted to accept your project. We would like to complete onboarding within one month of acceptance.

From the project side, please ensure that you:

Things that CNCF will need from the project:

  • [x] Provide emails for the maintainers added to https://maintainers.cncf.io in order to get access to the maintainers mailing list and ServiceDesk
  • [ ] Trademarks: transfer any trademark and logo mark assets over to the LF - https://github.com/cncf/foundation/tree/master/agreements has agreements
  • [ ] GitHub: ensure 'thelinuxfoundation' and 'caniszczyk' are added as initial org owners, this helps us make sure we have continuity of GH ownership
  • [ ] GitHub: ensure DCO or CLA are enabled for all GitHub repositories of the project
  • [ ] GitHub: ensure that hat the CNCF Code of Conduct (or your adopted version of it) are explicitly referenced at the project's README on GitHub
  • [ ] Website: ensure LF footer is there and website guidelines followed (if your project doesn't have a dedicated website, please adopt those guidelines to the README file of your project on GitHub).
  • [x] Website: Analytics transferred to [email protected]
  • [x] CII: Start on a CII best practices badge https://bestpractices.coreinfrastructure.org/en

Things that the CNCF will do or help the project to do:

amye avatar Sep 13 '22 18:09 amye

@amye our CI/CD pipeline currently uses tools like Semgrep/Snyk for vulnerability scanning/FOSSA for licensing, in their non-free tiers, paid by Okta. Those runs from Github Actions.

I see we can get FOSSA with CNCF's help, not sure if we can get Snyk for vulnerability scanning.

Can we keep using Snyk for vulnerability scanning and the paid Semgrep tier, or should we move to free tiers?

Thanks

aaguiarz avatar Sep 16 '22 17:09 aaguiarz

  • [X] Understand the project proposal process and reqs: https://github.com/cncf/toc/blob/main/process/project_proposals.md#introduction
  • [X] Understand the services available for your project at CNCF https://www.cncf.io/services-for-projects/
  • [X] Ensure your project meets the CNCF IP Policy: https://github.com/cncf/foundation/blob/master/charter.md#11-ip-policy
  • [X] Review the online programs guidelines: https://github.com/cncf/foundation/blob/master/online-programs-guidelines.md
  • [X] Understand the trademark guidelines: https://www.linuxfoundation.org/en/trademark-usage/
  • [X] Understand the license allowlist: https://github.com/cncf/foundation/blob/master/allowed-third-party-license-policy.md#approved-licenses-for-allowlist
  • [X] Is your project working on written, open governance? see https://contribute.cncf.io/maintainers/governance/
  • [] Slack: Are your slack channels migrated to the Kubernetes or CNCF Slack? (see https://slack.com/help/articles/217872578-Import-data-from-one-Slack-workspace-to-another for more details)

We are currently using Discord. Should we start using Slack?

  • [X] Create maintainer list + add to aggregated https://maintainers.cncf.io list by submitting a PR to it https://github.com/cncf/foundation/pull/422
  • [X] Provide emails for the maintainers added to https://maintainers.cncf.io in order to get access to the maintainers mailing list and ServiceDesk

Adrian Tam [email protected] (@adriantam) Andres Aguiar <[email protected] (@aaguiarz) Craig Pastro [email protected] (@craigpastro) Damian Schenkelman [email protected] (@dschenkelman) Jakub Hertyk [email protected] (@curfew-marathon) Jonathan Whitaker [email protected] (@jon-whit) Maria Ines Parnisari [email protected] (@miparnisari) Mat Dupont [email protected] (@matldupont) Matthew Pereira [email protected] (@matthewpereira) Raghd Hamzeh [email protected] (@rhamzeh) Yamil Asusta [email protected] (@elbuo8)

  • [X] GitHub: ensure that hat the CNCF Code of Conduct (or your adopted version of it) are explicitly referenced at the project's README on GitHub https://github.com/openfga/.github/blob/main/CODE_OF_CONDUCT.md
  • [X] CII: Start on a CII best practices badge https://bestpractices.coreinfrastructure.org/en

https://bestpractices.coreinfrastructure.org/en/projects/6374

aaguiarz avatar Sep 16 '22 18:09 aaguiarz

GitHub: ensure DCO or CLA are enabled for all GitHub repositories of the project

Do you have a preference?

We are currently using https://cla-assistant.io/ for CLAs, can we use https://easycla.lfx.linuxfoundation.org/#/ instead?

aaguiarz avatar Sep 16 '22 18:09 aaguiarz

We don't have analytics on the website. Should we integrate an analytics service? Any preference?

aaguiarz avatar Sep 16 '22 20:09 aaguiarz

We don't have analytics on the website. Should we integrate an analytics service? Any preference?

If you don't already have one, no need!

amye avatar Sep 16 '22 20:09 amye

GitHub: ensure DCO or CLA are enabled for all GitHub repositories of the project

Do you have a preference?

We are currently using https://cla-assistant.io/ for CLAs, can we use https://easycla.lfx.linuxfoundation.org/#/ instead?

Yes, the EasyCLA team is at https://jira.linuxfoundation.org/plugins/servlet/theme/portal/4/create/143 - they'll be able to help you out!

amye avatar Sep 16 '22 20:09 amye

@amye our CI/CD pipeline currently uses tools like Semgrep/Snyk for vulnerability scanning/FOSSA for licensing, in their non-free tiers, paid by Okta. Those runs from Github Actions.

I see we can get FOSSA with CNCF's help, not sure if we can get Snyk for vulnerability scanning.

Can we keep using Snyk for vulnerability scanning and the paid Semgrep tier, or should we move to free tiers?

Thanks

@jeefy can help with Synk or FOSSA

amye avatar Sep 16 '22 20:09 amye

  • [X] Website: Analytics transferred to [email protected] We don't have website analytics

aaguiarz avatar Sep 16 '22 20:09 aaguiarz

jeefy can help with Synk or FOSSA

@amye Can we keep Semgrep using our Okta license, or do we need to move to create an account for OpenFGA and move to a free tier?

Thanks!

aaguiarz avatar Sep 16 '22 20:09 aaguiarz

DevStats page added.

lukaszgryglicki avatar Sep 19 '22 14:09 lukaszgryglicki

For transferring the domain here https://jira.linuxfoundation.org/plugins/servlet/theme/portal/2/create/63 should I set it this way?

Project: "None" LF Stakeholder email: @caniszczyk's Community Stakeholder email: mine

Thanks!

aaguiarz avatar Sep 19 '22 15:09 aaguiarz

For transferring the domain here https://jira.linuxfoundation.org/plugins/servlet/theme/portal/2/create/63 should I set it this way?

Project: "None" LF Stakeholder email: @caniszczyk's Community Stakeholder email: mine

Thanks! You want Project to be 'CNCF'.

amye avatar Sep 19 '22 16:09 amye

  • [X] Submitted a Pull request to add your project as a sandbox project to https://landscape.cncf.io/ https://github.com/cncf/landscape/pull/2766

aaguiarz avatar Sep 20 '22 17:09 aaguiarz

  • [X] Artwork: Submit a pull request to https://github.com/cncf/artwork with your artwork https://github.com/cncf/artwork/pull/362

aaguiarz avatar Sep 22 '22 12:09 aaguiarz

@amye Is it OK if we send the agreement in https://github.com/cncf/foundation/tree/main/agreements to @caniszczyk 's email through DocuSign? Should we send it to someone else?

aaguiarz avatar Oct 14 '22 19:10 aaguiarz

@amye Is it OK if we send the agreement in https://github.com/cncf/foundation/tree/main/agreements to @caniszczyk 's email through DocuSign? Should we send it to someone else?

Send it to [email protected]

amye avatar Oct 14 '22 20:10 amye

  • [X] Trademarks: transfer any trademark and logo mark assets over to the LF - https://github.com/cncf/foundation/tree/master/agreements has agreements

aaguiarz avatar Oct 18 '22 20:10 aaguiarz

  • [X] Is your project in its own separate neutral github organization?
  • [X] GitHub: ensure 'thelinuxfoundation' and 'caniszczyk' are added as initial org owners, this helps us make sure we have continuity of GH ownership

aaguiarz avatar Oct 19 '22 22:10 aaguiarz

@jeefy could you please help me with Synk and FOSSA?

aaguiarz avatar Oct 19 '22 22:10 aaguiarz

@amye In our notice.txt files we have "Copyright 2022 Okta, Inc.". I see other projects use "The <Project> Authors". Is it OK if we use "The OpenFGA Project Authors"? Should we mention CNCF?

aaguiarz avatar Oct 20 '22 13:10 aaguiarz

Andres, please see: https://github.com/cncf/foundation/blob/main/copyright-notices.md#copyright-notices

On Thu, Oct 20, 2022 at 8:44 AM Andrés Aguiar @.***> wrote:

@amye https://github.com/amye In our notice.txt files we have "Copyright 2022 Okta, Inc.". I see other projects use "The Authors". Is it OK if we use "The OpenFGA Project Authors"? Should we mention CNCF?

— Reply to this email directly, view it on GitHub https://github.com/cncf/toc/issues/921#issuecomment-1285568975, or unsubscribe https://github.com/notifications/unsubscribe-auth/AAAPSINN5DWYJGCXCUWY6Z3WEFEELANCNFSM6AAAAAAQLVWZDI . You are receiving this because you were mentioned.Message ID: @.***>

-- Cheers,

Chris Aniszczyk https://aniszczyk.org

caniszczyk avatar Oct 20 '22 21:10 caniszczyk

  • [X] Website: ensure LF footer is there and website guidelines followed (if your project doesn't have a dedicated website, please adopt those guidelines to the README file of your project on GitHub).

Check https://openfga.dev/

aaguiarz avatar Oct 21 '22 12:10 aaguiarz

Also make sure you work on any issues found here :) https://clomonitor.io/projects/cncf/openfga

On Fri, Oct 21, 2022 at 7:28 AM Andrés Aguiar @.***> wrote:

Check https://openfga.dev/

— Reply to this email directly, view it on GitHub https://github.com/cncf/toc/issues/921#issuecomment-1286896194, or unsubscribe https://github.com/notifications/unsubscribe-auth/AAAPSIOQTJUNDPE5WQXRYVTWEKD7ZANCNFSM6AAAAAAQLVWZDI . You are receiving this because you were mentioned.Message ID: @.***>

-- Cheers,

Chris Aniszczyk https://aniszczyk.org

caniszczyk avatar Oct 21 '22 13:10 caniszczyk

@jeefy now the Github org is part of CNCF's org, would it be possible to setup the integration with Synk and FOSSA? Thanks a lot.

aaguiarz avatar Oct 24 '22 21:10 aaguiarz

@amye can you confirm if I should use @caniszczyk 's emails as "LF Stakeholder" when transferring the domains? Thanks!

aaguiarz avatar Nov 01 '22 14:11 aaguiarz

It can be me, that's fine.

amye avatar Nov 01 '22 16:11 amye

  • [X] Domain: transfer domain to the CNCF - https://jira.linuxfoundation.org/plugins/servlet/theme/portal/2/create/63

https://jira.linuxfoundation.org/plugins/servlet/desk/portal/2/IT-24780

aaguiarz avatar Nov 01 '22 16:11 aaguiarz

I think we are done from our side, we still need help to:

  • Setup EasyCLA
  • Setup FOSSA/Snyk

Thanks for your help!

aaguiarz avatar Nov 01 '22 16:11 aaguiarz