Add detailed metadata for marketplace apps

[marshall007]

Fields that need to be incorporated and their possible values:

app_name: "App Name"
vendor: "Vendor Name"
Vendor URL: "URL"
icon:
  description: "Cartoon cat with rocket hat"
product_overview: |
  This is where the paragraphs of product overview information will go.
  You can include multiple lines of text here, describing the product in detail.
  The vertical bar '|' allows for multi-line text input in YAML.
contracting_details:
  contracting_number: "string"
  contracting_vehicle:
    - "GSA Schedule"
    - "SIBR III"
    - "Tradewinds"
  pricing_model:
    - "FOSS"
    - "SASS"
    - "Per Instance"
    - "Per User"
  small_business_status:
    - "Small Business "
    - "Small Disadvantaged Businesses"
    - "Veteran-Owned Small Business"
    - "Service-Disabled Veteran-Owned Small Businesses"
    - "Woman-Owned Small Business"
    - "HUBZone"
    - "8(a) Small Businesses"
  delivery_timeline: "2 weeks*"
  business_category:
    - "ai/ml"
    - "arcade"
    - "business"
    - "database"
    - "kubernetes"
    - "networking
    - "productivity"
    - "security"
    - "web"
authorization_details:
  authority_to_operate: boolean
  fedramp:
    - "In Progress"
    - "Authorized"
    - "N/A"
  fips_compliant_image: boolean
  nist_800_53:
    - "Available"
    - "N/A"
  cve_report: boolean
  sbom: boolean
technical_details:
  infrastructure:
    - "AWA"
    - "Azure"
    - "On-prem"
    - "Airgapped"
  architecture:
    - "arm-64"
    - "amd-64"
  k8s_distros:
    - "RKE2"
    - "EKS"
    - "K3s"
resources:
  - "Application Docs"
  - "Helm Chart"
  - "Product Website"
  - "Reference Architecture"

Some open questions:

1. What does technical_details.infrastructure/k8s_distros imply in the short term for MVC? We do not currently test against all distros/cloud providers, so what do we say for current packages?
2. Should we have fedramp and authority_to_operate fields? What does this mean for zarf packages? (FedRAMP is a process for SaaS platforms, ATO is not something we can directly provide)
3. What is delivery timeline? @austenbryan mentioned that it "should evolve into 'test against infrastructures'", but per (1) what does this mean for MVC?

[marshall007]

@austenbryan: Authorization - remove fedRAMP and add SBOM but like the other fields

@Madeline-UX So adding weather or not an app has been through FedRAMP was requested by the contracting officer. In the interview with Cody Paul i asked if knowing an app was even going through the fedramp process would help drive a buy decision and he said yes.

@Madeline-UX FedRAMP is only relevant to SaaS services. We cannot say a package "is FedRAMP compliant". I will remove for now but feel free to continue discussion.

[austenbryan]

I think it is worth a synchronous convo this week on meta data. We need to decide

• Current exhaustive list we want to have
• What is available by architecture we have to date across the company
• What is about to be available
• What has no plan yet

This will drive the roadmap for future releases. I will schedule time Friday

[Madeline-UX]

Updated metadata design based on all the convos we had this week.

app_name: "App Name" vendor: "Vendor Name" Vendor URL: "URL" icon: description: "Cartoon cat with rocket hat" product_overview: | This is where the paragraphs of product overview information will go. You can include multiple lines of text here, describing the product in detail. The vertical bar '|' allows for multi-line text input in YAML. contracting_details: contracting_vehicle: "available" pricing_model:

• "Free"
• "Bring Your Own License" business_category:
• "ai/ml"
• "arcade"
• "business"
• "database"
• "kubernetes"
• "networking
• "productivity"
• "security"
• "web" security_and_compliance: fips_compliant_image: boolean nist_800_53-control_mapping:
• "Available"
• "N/A" impact_level:
• "2"
• "4"
• "5"
• "6" cve_report: boolean sbom: boolean technical_details: infrastructure:
• "AWA"
• "Azure"
• "On-prem"
• "Airgapped" architecture:
• "arm-64"
• "amd-64"

resources:

• "UDS Package Repo"
• "Application Docs"
• "Helm Chart"
• "Product Website"
• "Reference Architecture"