vbatts/cncf-toc
1
0
Fork 0
Code Issues Pull requests Releases Wiki Activity

Merge 822588a8bf into da565be915

Browse source
This commit is contained in:
Justin Cappos 2018-11-15 06:35:29 +00:00 • committed by GitHub
commit f259b88376
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
1 changed files with 65 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

65
reviews/tuf-graduation.md Normal file
View file

@ -0,0 +1,65 @@
# TUF Graduation Application
The Update Framework (TUF) helps developers maintain the security of a software update system, even against attackers that compromise some repository or signing keys. TUF provides a flexible framework and specification that developers can adopt into any software update system.
## TUF fulfills all the incubating and graduation criteria:
### Document that it is being used successfully in production by at least three independent end users which, in the TOC’s judgement, are of adequate quality and scope.
* TUF is used in production by Cloudflare, Datadog, DigitalOcean, Docker, IBM, Kolide, LEAP, Microsoft, RedHat, VMware, and many others. [Uptane](https://uptane.github.io/), the automotive variant of TUF, is sold by major automotive vendors and is being adopted by automakers with over 1/3 of the cars on US roads in their forthcoming cars. Uptane is included as part of [Automotive Grade Linux](https://www.automotivelinux.org/), another Linux Foundation project.
* While these implementations all use the TUF specification, the implementations vary. Datadog, OTAinfo, and LEAP use the Python reference implementation, most cloud companies use Notary, and most automobiles use custom variants written by different automotive vendors.
* More detail about adoption, including some of the in progress adoptions, can be found here: https://theupdateframework.github.io/adoptions.html
### Have a healthy number of committers. A committer is defined as someone with the commit bit; i.e., someone who can accept contributions to some or all of the project. The committers should come from at least two organizations.
As an intentionally minimal security specification / framework, we deliberately do not have a high degree of feature additions in the project. Effort comes on either the implementations, such as Notary or the Python reference implementation, or the specification itself.
* Python reference implementation / specification (8 committers, 2 organizations)
* Justin Cappos (NYU), Trishank Karthik Kuppusamy (Datadog / NYU), Lukas Puehringer (NYU), Santiago Torres (NYU), Vladimir Diaz, Sebastien Awwad (NYU), Joey Pabalinas (NYU), Marina Moore (NYU), Lois Anne Delong (NYU)
* Notary (8 committers, 3 organizations)
* Ying Li, Diogo Mónica, Evan Cordell (RedHat / CoreOS), David Lawrence, HuKeping (Huawei), Justin Cormack (Docker), Nathan McCauley, Riyaz Faizullabhoy
### Demonstrate a substantial ongoing flow of commits and merged contributions.
We have had active contributions from an array of contributors across the CNCF landscape, more traditional software projects, and automakers. One way to see this is via the substantial changes that made their way into the specification.
Changes to the TUF standard largely come in the form of TAPs (TUF Augmentation Proposals). There are 7 active, non-informational TAPs (TAP 3-6 and 8-10).
The 5 accepted TAPs have authors from 5 different organizations:
* [TAP3](https://github.com/theupdateframework/taps/blob/master/tap3.md) and [TAP4](https://github.com/theupdateframework/taps/blob/master/tap4.md), by Trishank Karthik Kuppusamy (Datadog / NYU), Sebastien Awwad (NYU), Evan Cordell (CoreOS / RedHat), Vladimir Diaz, Jake Moshenko (CoreOS / RedHat), Justin Cappos (NYU)
* [TAP6](https://github.com/theupdateframework/taps/blob/master/tap6.md) by David Lawrence (Docker), Vladimir Diaz, Justin Cappos (NYU)
* [TAP9](https://github.com/theupdateframework/taps/blob/master/tap9.md) by heartsucker (ATS)
* [TAP10](https://github.com/theupdateframework/taps/blob/master/tap10.md) by Vladimir Diaz
There are 2 TAPs that are currently under consideration (both of which are likely to be accepted) with authors from 4 organizations:
* [TAP5](https://github.com/theupdateframework/taps/blob/master/tap5.md) by Trishank Karthik Kuppusamy (Datadog / NYU), Sebastien Awwad (NYU), Evan Cordell (CoreOS / RedHat), Vladimir Diaz, Jake Moshenko (CoreOS / RedHat), Justin Cappos (NYU)
* [TAP8](https://github.com/theupdateframework/taps/blob/master/tap8.md) by Hannes Mehnert (OCaml / Cambridge University), Justin Cappos (NYU)
These demonstrate the breadth of contributions from different adopters and the way in which contributions are merged into the specification.
Each part of TUF has seen activity both from core committers and external parties. Of course the fewest commits have come in the TAPs and spec itself. The TAPs have had 516 commits by 10 contributors (5 external, 2 were non-TAP authors). The specification has had 59 commits by 7 contributors (4 external contributors). Notary has had more than 2.8K commits from 60 contributors (52 external). TUF's Python reference implementation has had more than 3.3K commits, by 33 contributors (26 external). This demonstrates both activity and committer diversity.
### Have achieved and maintained a Core Infrastructure Initiative Best Practices Badge.
We have both the basic best practices badge and the silver badge.
https://bestpractices.coreinfrastructure.org/projects/1351
### Adopt the CNCF Code of Conduct.
TUF follows the CNCF code of conduct. https://github.com/theupdateframework/tuf/blob/develop/docs/CODE-OF-CONDUCT.md
This is linked multiple places, including the footer of [TUF's homepage](https://theupdateframework.github.io/).
### Explicitly define a project governance and committer process. This preferably is laid out in a GOVERNANCE.md file and references an OWNERS.md file showing the current and emeritus committers.
These documents may be found here:
* https://github.com/theupdateframework/tuf/blob/develop/docs/GOVERNANCE.md
* https://github.com/theupdateframework/tuf/blob/develop/docs/CONTRIBUTORS.rst
### Have a public list of project adopters for at least the primary repo (e.g., ADOPTERS.md or logos on the project website).
Our website has an [adoptions page](https://theupdateframework.github.io/adoptions.html) on it that lists the different projects. We also have an [ADOPTERS.MD](https://github.com/theupdateframework/tuf/blob/develop/docs/ADOPTERS.md) which contains much the same information.