Add a GOVERNANCE file describing what is the role of maintainers and …

…how one can become maintainer.

Signed-off-by: Silvin Lubecki <silvin.lubecki@docker.com>

GOVERNANCE.md

@@ -0,0 +1,11 @@
+# Governance
+
+## Project Maintainers
+
+[Project maintainers](CODEOWNERS) are responsible for activities around maintaining and updating CNAB-TO-OCI, a library for the [CNAB spec](https://github.com/cnabio/cnab-spec). Final decisions on the project reside with the project maintainers.
+
+Maintainers MUST remain active. If they are unresponsive for >3 months, they will be automatically removed unless a [super-majority](https://en.wikipedia.org/wiki/Supermajority#Two-thirds_vote) of the other project maintainers agrees to extend the period to be greater than 3 months.
+
+New maintainers can be added to the project by a [super-majority](https://en.wikipedia.org/wiki/Supermajority#Two-thirds_vote) vote of the existing maintainers.
+
+A maintainer may step down by submitting an [issue](https://github.com/cnabio/cnab-to-oci/issues/new) stating their intent.