[SANDBOX PROJECT ONBOARDING] Submariner

[amye]

Welcome to CNCF Project Onboarding!
This is an issue created to help onboard your project into the CNCF after the TOC has voted to accept your project.
We would like to complete onboarding within one month of acceptance.

From the project side, please ensure that you:

• Understand the project proposal process and reqs: https://github.com/cncf/toc/blob/main/process/project_proposals.adoc#introduction
• Understand the services available for your project at CNCF https://www.cncf.io/services-for-projects/
• Ensure your project meets the CNCF IP Policy: https://github.com/cncf/foundation/blob/master/charter.md#11-ip-policy
• Review the online programs guidelines: https://github.com/cncf/foundation/blob/master/online-programs-guidelines.md
• Understand the trademark guidelines: https://www.linuxfoundation.org/en/trademark-usage/
• Has your project adopted open governance already? see http://opengovernance.dev
• Slack: Are your slack channels migrated to the Kubernetes or CNCF Slack?
• Is your project in its own separate neutral github organization?
• Submitted a Pull request to add your project as a sandbox project to https://landscape.cncf.io

Things that CNCF will need from the project:

• Owners file: Please add a link to your owners file to this issue, this is used to be able to create your maintainers mailing list.
• Create maintainer list + added to aggregated https://maintainers.cncf.io list
• Domain: transfer domain to the CNCF - please send a transfer code to [email protected]
• Trademarks: transfer any trademark and logo mark assets over to the LF - https://github.com/cncf/foundation/tree/master/agreements has agreements
• GitHub: ensure 'thelinuxfoundation' and 'caniszczyk' are added as initial org owners, this helps us make sure we have continuity of GH ownership
• GitHub: ensure DCO or CLA are enabled for all GitHub repositories of the project
• Artwork: Ensure logos present on https://github.com/cncf/artwork
• Website: ensure LF footer is there and website guidelines followed
• Website: Analytics transferred to [email protected]
• Adopt a license scanning tool, like FOSSA or Snyk
• CII: Start on a CII best practices badge https://bestpractices.coreinfrastructure.org/en

Things that the CNCF will do or help the project to do:

• Devstats: add to devstats https://devstats.cncf.io/
• Marketing: update relevant intro + slide decks
• Events: update CFP + Registration + CFP Area forms
• ServiceDesk: confirm maintainers have read https://www.cncf.io/services-for-projects/
• CNCF Welcome Email Sent to confirm maintainer list access, welcome email has monthly project sync details
• Create space for meetings/events on community.cncf.io, e.g., https://community.cncf.io/pravega-community/

[amye]

Getting owners file from https://github.com/submariner-io/submariner/blob/devel/CODEOWNERS.in

[amye]

Welcome in @mangelajo, @Oats87, @skitt, @tpantelis! We'll be tracking work in here.

[skitt]

Thanks!

A few items we can check already:

• Slack: our channel is #submariner on the Kubernetes Slack
• The project is in the separate, neutral, Submariner organisation
• We already have GitHub Actions in place to enforce the DCO (see here for example), but I’ve added the DCO bot (and we’ll remove the separate GHA)

[amye]

Marking off those three!
Deadline for these is May 27th, so we have some time.

[mangelajo]

Thank you! :)

[lukaszgryglicki]

DevStats test page added, will add prod one soon.

[lukaszgryglicki]

The prod page added as well.

[mangelajo]

Ok, owner invitations sent to 'thelinuxfoundation' and 'caniszczyk' for submariner-io, @amye let me know if those arrive correctly.

[lukaszgryglicki]

All new 6 Sandbox projects added to All CNCF page, also added all of them in Projects health.

[amye]

@skitt, checking back in here!
Project side:
Understand the project proposal process and reqs: https://github.com/cncf/toc/blob/main/process/project_proposals.adoc#introduction
Understand the services available for your project at CNCF https://www.cncf.io/services-for-projects/
Ensure your project meets the CNCF IP Policy: https://github.com/cncf/foundation/blob/master/charter.md#11-ip-policy
Review the online programs guidelines: https://github.com/cncf/foundation/blob/master/online-programs-guidelines.md
Understand the trademark guidelines: https://www.linuxfoundation.org/en/trademark-usage/
Has your project adopted open governance already? see http://opengovernance.dev
Submitted a Pull request to add your project as a sandbox project to https://landscape.cncf.io
Domain: transfer domain to the CNCF - please send a transfer code to [email protected]
Trademarks: transfer any trademark and logo mark assets over to the LF - https://github.com/cncf/foundation/tree/master/agreements has agreements
GitHub: ensure 'thelinuxfoundation' and 'caniszczyk' are added as initial org owners, this helps us make sure we have continuity of GH ownership
Artwork: Ensure logos present on https://github.com/cncf/artwork
Website: ensure LF footer is there and website guidelines followed
Website: Analytics transferred to [email protected]
Adopt a license scanning tool, like FOSSA or Snyk
CII: Start on a CII best practices badge https://bestpractices.coreinfrastructure.org/en

Thanks!

[dfarrell07]

Hey @amye! Thanks for checking in, be assured we're working to get everything done. We're maintaing details about our progress on submariner-io/submariner#1297. A few things we can check off I think:

• Website: Analytics transferred to [email protected]
  • We don't have analytics. 😅
• CII: Start on a CII best practices badge https://bestpractices.coreinfrastructure.org/en
  • We've definitely started, we have a few more TODOs.
  • https://bestpractices.coreinfrastructure.org/en/projects/4865

For this one, I think we need an admin to accept our invite.

• GitHub: ensure 'thelinuxfoundation' and 'caniszczyk' are added as initial org owners, this helps us make sure we have continuity of GH ownership
  • caniszczyk
  • thelinuxfoundation sent but not accepted?

[amye]

Marking those two off, checking on the GH piece.

[skitt]

@amye, regarding the license scanning tool, I’ve been looking at Snyk and FOSSA for a little while but we get a lot of false-positives (bringing back memories of similar efforts on OpenDaylight and discussions with Steve Winslow).

I’m integrating lichen into our CI and local builds for now; this checks the licenses for all the components we end up actually including in the binaries we ship, and fails the build if any component is introduced with an invalid or unknown license. See submariner-io/lighthouse#537 for a merged PR implementing this in one of our projects, and submariner-io/submariner#1326 for proof that this approach catches issues — the PR fails there because we include go-ipify, which doesn’t meet the CNCF’s Allowlist licensing requirements and doesn’t have an exception (we’re working on replacing that).

Could you confirm whether that’s OK or not?

I see this isn’t a requirement for onboarding, but we’ll be adding similar jobs to check for security issues, both periodically across all projects, and on PRs to check that newly-introduced dependencies don’t come with known security issues.

[idvoretskyi]

@skitt I'll let @caniszczyk comment as well, but IMO it's fine to use a different tool as long as it's working properly - cncf/foundation#109 (comment)

At the same time, we're using FOSSA across the board for most of our projects, and I'm happy to assist with setting it up for you if needed.

[skitt]

At the same time, we're using FOSSA across the board for most of our projects, and I'm happy to assist with setting it up for you if needed.

Thanks for the offer @idvoretskyi, I’m currently waiting for FOSSA support to get back to me regarding issues I’m having setting my account up there, but I’ll probably take you up on it once that’s sorted out!

[dfarrell07]

I think we can also check these off, as we have a critical mass of the committers signed-off as understanding them:

• Understand the project proposal process and reqs: https://github.com/cncf/toc/blob/main/process/project_proposals.adoc#introduction
• Understand the services available for your project at CNCF https://www.cncf.io/services-for-projects/
• Review the online programs guidelines: https://github.com/cncf/foundation/blob/master/online-programs-guidelines.md
• Understand the trademark guidelines: https://www.linuxfoundation.org/en/trademark-usage/

[amye]

Quick check in here, artwork? https://github.com/cncf/artwork/tree/master/projects would be where to submit a PR into.

[dfarrell07]

Quick check in here, artwork?

Yeah, that's one of the last ones still fully TODO, not in review. Was just slowly poking at gimp trying to make it happen.

I guess there's not support for this editing? 😅 Looking at the project's PRs, it does seem like LF staff create a lot of them.

[caniszczyk]

@dfarrell07 yes we can do it if you point us to some form of graphics

[dfarrell07]

Thank you, that would be a huge help! This is the SVG I was basing everything on: https://submariner.io/images/logo-submariner.svg

And sampling a logo in gimp, I get the color code 2bdfc4 for our green and 3a4747 for the text color.

[skitt]

@dfarrell07 for SVG, Inkscape is a better tool than the Gimp ;-).

@amye, regarding the IP policy:

• (a) is tracked elsewhere;
• (b) / (c): we’ve been requiring DCOs for a long time, the bot is enabled, and all our code is licensed under the Apache Software License, version 2.0;
• (d) see above;
• (e) the licenses of our dependencies comply with the CNCF’s requirements, and this is enforced by license-checking jobs on all our projects producing outgoing binaries (see https://github.com/submariner-io/lighthouse/runs/2663488968?check_suite_focus=true for example; we still have Add a license-checking job submariner-io/submariner#1326 pending to complete the license check jobs);
• (f) our docs are already licensed under the Creative Commons Attribution 4.0 International License;
• (g) no other licenses are required.

[dfarrell07]

I think we can now check off:

• Ensure your project meets the CNCF IP Policy: https://github.com/cncf/foundation/blob/master/charter.md#11-ip-policy
  • Details in @skitt's comment above
• Website: ensure LF footer is there and website guidelines followed
  • Add copyright notice to footer submariner-io/submariner-website#516
  • Add Linux Foundation trademark guidelines submariner-io/submariner-website#522
  • Add CNCF logo and Sandbox statement to menu footer submariner-io/submariner-website#523
• Adopt a license scanning tool, like FOSSA or Snyk
  • Add a license-checking job submariner-io/submariner#1326
  • Add a license-checking job submariner-io/submariner-operator#1366
  • Add a license-checking job submariner-io/lighthouse#537

Regarding adding @thelinuxfoundation as an Org owner, our invite had expired but we re-sent it today.

[skitt]

@amye can you confirm that there are the website guidelines? The link in the issue description points to the copyright guidelines.

[caniszczyk]

+1 these are website guidelines: https://github.com/cncf/foundation/blob/master/website-guidelines.md

…

On Tue, May 25, 2021 at 11:25 AM Stephen Kitt ***@***.***> wrote: @amye <https://github.com/amye> can you confirm that there are the website guidelines <https://github.com/cncf/foundation/blob/master/website-guidelines.md>? The link in the issue description points to the copyright guidelines. — You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub <#244>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AAAPSIJ5YR4KKEHHSGP6D2TTPPFOFANCNFSM43VLP52Q> .

-- Cheers, Chris Aniszczyk https://aniszczyk.org

[dfarrell07]

I think we can check-off the open governance TODO now that submariner-io/submariner-website#520 and submariner-io/submariner#1391 are agreed on and merged.

If the domain transfer is good on your end @amye we can also check that one off, leaving only the trademark transfer.

[amye]

Domain transfer is complete!

[amye]

@dfarrell07: any updates on trademarks? Thanks!

[dfarrell07]

@amye I think it's still with SUSE's legal department. Any update/ETA @Oats87?

[dfarrell07]

Chris confirmed that the trademark transfer is still making progress through SUSE's legal team. He says "ETA at this point is unknown as they are determining 'how high up the chain' it has to go" and "I got hold of the correct VP that can work on this stuff".

[amye]

Last thing -- @dfarrell07 - trademarks is the last one!

[dfarrell07]

Yeah, very sorry for the delay @amye. My last update from Chris was that it has to be brought up at a SUSE Board meeting for their approval. Seems a bit absurd to me, but I guess no one else in the leadership chain is willing to step up and say "yes".

[amye]

That explains that!

[amye]

@dfarrell07 - checking back in on trademarks, anything I can do to move that forward?

[dfarrell07]

@Oats87 Is there someone in SUSE leadership we can talk to about this? It doesn't seem like the current process is really working. It seems we need to try something else.

[amye]

@Oats87 Is there someone in SUSE leadership we can talk to about this? It doesn't seem like the current process is really working. It seems we need to try something else.

If you need me to help with a call, I am happy to do so!

[Oats87]

@amye @dfarrell07 I really do apologize for my late reply here.

I'm dealing with some procedure issues for the trademark transfer; I expect it to go through, but I keep having to bark up different trees only to find that the squirrel I'm looking for is not in the tree I'm barking up. This is seemingly a side effect of the recent Rancher acquisition by SUSE, but by no means a complete barrier to trademark transfer. Once I find the correct tree, I am hoping things will get transferred in an expedited fashion.

[amye]

Got it! I will keep this open, good luck with the squirrels. 🌳

[dfarrell07]

Thanks for the update @Oats87, we appreciate the tree-barking!

[dfarrell07]

@Oats87 I see SUSE/Rancher Legal was able to help with the K3s trademark transfer to CNCF: #276

Maybe that team can help you find the right people to ask?

[dfarrell07]

(I talked with Chris on Slack, he sent another round of emails to try to move this forward)

[amye]

Any luck here?

[dfarrell07]

@amye I pinged @Oats87 again to ask for another update. Again, soo sorry about how long this trademark transfer has taken.

[amye]

@amye I pinged @Oats87 again to ask for another update. Again, soo sorry about how long this trademark transfer has taken.

But you're almost done!

[amye]

@amye I pinged @Oats87 again to ask for another update. Again, soo sorry about how long this trademark transfer has taken.

Checking back in here!

[dfarrell07]

Thanks for checking in again @amye. Chris has pinged SUSE legal at least twice since the last update here. Last I heard SUSE legal was aware that this looks bad, like they are dragging their feet. I pinged Chris to ask him to check again. Again, so sorry about the delay, I wish there was something I could do.

[dfarrell07]

@amye SUSE Legal says that they have finished the trademark transfer! Did that make it to you, is the trademark transfer complete?

Sorry again for the delay, but very excited to (hopefully) have it done!

[amye]

Not yet, where should I be looking?

[dfarrell07]

@amye IDK, but I CC'd you to an email thread with the Suse folks to figure it out. Thanks!

[amye]

Closing as Trademarks are with Legal now

[skitt]

Fantastic!

[dfarrell07]

Nice! Thanks for the patience @amye and ToC!