community : Contributor ladder

[naveensrinivasan]

Description

I am opening this to ask if there's a contributor ladder defined for slsa-framework.

How do I become an org member?

I would be happy to help do PR's reviews here, hoping to work towards maintainership.

1 . slsa-framework/slsa-github-generator-go#54
2. slsa-framework/slsa-github-generator-go#52
3. slsa-framework/slsa-github-generator-go#44
4. slsa-framework/slsa-github-generator-go#42
5. slsa-framework/slsa-github-generator#352
6. slsa-framework/slsa-github-generator#351
7. slsa-framework/slsa-verifier#101
8. slsa-framework/slsa-verifier#100
9. slsa-framework/slsa-verifier#99
10. slsa-framework/slsa-verifier#98
11. slsa-framework/slsa-verifier#33

cc @inferno-chromium

[joshuagl]

Hi Naveen. We don't yet have a contributor ladder defined, but we are working on formalising our governance and I'd like to see a contributor ladder defined in future.

Maintainer status is currently handled on a per-project basis, so I think the question of becoming a maintainer of slsa-github-generator and slsa-verifier would be handled by the maintainers of those projects. AIUI more maintainers for those projects would be very welcome. cc @ianlewis @laurentsimon @asraa

[inferno-chromium]

Hi Naveen. We don't yet have a contributor ladder defined, but we are working on formalising our governance and I'd like to see a contributor ladder defined in future.

+1. Discussions are already happening in #405 and this should get resolved in near future.

Maintainer status is currently handled on a per-project basis, so I think the question of becoming a maintainer of slsa-github-generator and slsa-verifier would be handled by the maintainers of those projects. AIUI more maintainers for those projects would be very welcome. cc @ianlewis @laurentsimon @asraa

for those 3 repos, are those contributions sufficient enough to be added as maintainer. @ianlewis @laurentsimon @asraa - thoughts?

[ianlewis]

Hi!

The Kubernetes contributor ladder for reference:
https://github.com/kubernetes/community/blob/master/community-membership.md

@naveensrinivasan I discussed with @laurentsimon. For now, if you would like ownership to slsa-github-generator/slsa-verifier could you submit a PR to each repo with an "application" adding yourself to OWNERS and some links attesting to the items below in lieu of a formal process (assuming the SLSA one will ultimately look similar to the Kubernetes ladder). The links can be some of those above.

(taken from the k8s Approver role)

• Reviewer of the codebase for at least 3 months
• Primary reviewer for at least X substantial PRs to the codebase
• Reviewed or merged at least 10X PRs to the codebase
• Nominated by a subproject owner (this could be me)
  • With no objections from other subproject owners
  • Done through PR to update the top-level OWNERS file

/cc @laurentsimon @asraa

[naveensrinivasan]

A friendly ping! It's been 16 days since I opened the issue. Are there any blockers?

[inferno-chromium]

14 days ago

I think you just need to submit a PR for OWNERS file as recommended by @ianlewis, with links to your own PRs and some reviews done. If reviews are missing, just do a few reviews on new PRs uploaded by others. I think like 10PRs of each should be ok.

[naveensrinivasan]

14 days ago

I think you just need to submit a PR for OWNERS file as recommended by @ianlewis, with links to your own PRs and some reviews done. If reviews are missing, just do a few reviews on new PRs uploaded by others. I think like 10PRs of each should be ok.

I have already opened the PRs on 6/28

• Request for membership slsa-github-generator#428
• Request for membership slsa-verifier#113

and here are the contributions

• https://github.com/slsa-framework/slsa-github-generator/pulls?q=naveensrinivasan
• https://github.com/slsa-framework/slsa-verifier/pulls?q=naveensrinivasan

[laurentsimon]

Hey @naveensrinivasan yes please review 10 PRs as suggested by @inferno-chromium and take a feature you'd like as "onboarding" to familiarize yourself with code (the one on hash computation using TS sounds like a good one you started working on), then we can add you as maintainer. Does that sound reasonable? We can continue the conversation on individual repos.
Excited to have you onboard!

[naveensrinivasan]

Hey @naveensrinivasan yes please review 10 PRs as suggested by @inferno-chromium and take a feature you'd like as "onboarding" to familiarize yourself with code (the one on hash computation using TS sounds like a good one you started working on), then we can add you as maintainer. Does that sound reasonable? We can continue the conversation on individual repos.
Excited to have you onboard!

Sounds good! Thanks

[ianlewis]

Also for reference: ossf/allstar#238

[naveensrinivasan]

https://github.com/sigstore/community/blob/34e766c7404696797640f0f3a702bfff9d306eff/community-membership.md

cc @cpanato

[naveensrinivasan]

I was able to get my membership in slsa-framework/slsa-github-generator#428 for one of the above.

Thanks everyone!

[cpanato]

@naveensrinivasan let me know where i can help :)