Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

add zarf as an openssf sandbox project #341

Merged
merged 7 commits into from
Jun 20, 2024
Merged

add zarf as an openssf sandbox project #341

Show file tree
Hide file tree
Changes from 3 commits
Commits
Show all changes
7 commits
Select commit Hold shift + click to select a range
5c49bae
docs: add zarf as an openssf sandbox project
salaxander Jun 5, 2024
f9fe62a
Merge branch 'main' into zarf_sandbox
salaxander Jun 5, 2024
13bea90
update README for zarf membership
salaxander Jun 5, 2024
33d0e09
Update README.md
salaxander Jun 5, 2024
95fa17b
correct spelling in a github username
salaxander Jun 6, 2024
7ac28d2
Merge branch 'main' into zarf_sandbox
salaxander Jun 14, 2024
37b1a57
add results from LF license scanning
salaxander Jun 20, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -87,6 +87,7 @@ The following Technical Initiatives have been approved by the TAC. You may learn
| Sigstore | https://github.com/sigstore | [Meeting Notes](https://docs.google.com/document/d/1bsl-Y0KulSD7O_nTekad1sAKOVRb80wyGb-Q5x-zdg0/edit) | OpenSSF TAC | [Graduated](process/project-lifecycle-documents/sigstore_graduated_stage.md) |
| SLSA | https://github.com/slsa-framework/slsa | [Meeting Notes](https://docs.google.com/document/d/1PwhekVB1iDpcgCQRNVN_aesoVdOiTruoebCs896aGxw/edit#heading=h.gjdgxs) | Supply Chain Integrity WG | TBD |
| SLSA Tooling | https://github.com/ossf/wg-supply-chain-integrity/blob/main/slsa-tooling.md | [Meeting Notes](https://docs.google.com/document/d/18oj3CLJQhZj1dMHKDTq_1kKg0syysKCS7pLyXlw1SRc/edit#heading=h.yfiy9b23vayj) | Supply Chain Integrity WG | TBD |
| Zarf | https://github.com/defenseunicorns/zarf | [Meeting Notes](https://docs.google.com/document/d/1Ww5XOICluxIY_bAsyVieLe9GU9FpXJ3LwSCZxqOSLaM/edit#heading=h.wq25h5ks8vsu) | Supply Chain Integrity WG | [Sandbox](process/project-lifecycle-documents/SBOMit_sandbox_stage.md) |
salaxander marked this conversation as resolved.
Show resolved Hide resolved

### OpenSSF affiliated projects

Expand Down
34 changes: 34 additions & 0 deletions process/project-lifecycle-documents/zarf_sandbox_stage.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,34 @@
## Application for creating a new project at Sandbox stage

### List of project maintainers
The project must have a minimum of three maintainers with a minimum of two different organizational affiliations.
* Sarah Christoff, Defense Unicorns, @sscristoff-du
* Austin Abro, Defense Unicorns, @AustinAbro321
* Lucas Rodriguez, Defense Unicorns, @lucasrpd16
* Danny Gershman, Radius Method, @dgershman

### Sponsor
Most projects will report to an existing OpenSSF Working Group, although in some cases a project may report directly to the TAC. The project commits to providing quarterly updates on progress to the group they report to.
* WG Supply Chain Integrity

### Mission of the project
The project must be aligned with the OpenSSF mission and either be a novel approach for existing areas, address an unfulfilled need, or be initial code needed for OpenSSF WG work. It is preferred that extensions of existing OpenSSF projects collaborate with the existing project rather than seek a new project.

* Zarf eliminates the complexity of air gap software delivery for Kubernetes clusters and cloud-native workloads using a declarative packaging strategy to support DevSecOps in offline and semi-connected environments.

### IP policy and licensing due diligence
When contributing an existing Project to the OpenSSF, the contribution must undergo license and IP due diligence by the Linux Foundation (LF).
* Not applicable - There has been no formal trademark filed by Defense Unicorns.
salaxander marked this conversation as resolved.
Show resolved Hide resolved

### Project References
The project should provide a list of existing resources with links to the repository, and if available, website, a roadmap, contributing guide, demos and walkthroughs, and any other material to showcase the existing breadth, maturity, and direction of the project.

| Reference | URL |
|---------------------|----------------------------------------------------------------------------------------------------|
| Repo | https://github.com/defenseunicorns/zarf |
| Website | https://zarf.dev |
| Contributing guide | https://github.com/defenseunicorns/zarf/blob/main/.github/CONTRIBUTING.md |
| Security.md | https://github.com/defenseunicorns/zarf/blob/main/.github/SECURITY.md |
| Roadmap | https://docs.zarf.dev/docs/roadmap |
| Demos | https://youtu.be/CBJ3HYV4UoU?si=g2Hx76Zil_kGxdan, https://youtu.be/zur-TjemtcA?si=krcJjBcWncrT4V03 |
| Other | [System76 podcast](https://pca.st/dztuzwe3) |
Loading