Issue: New .NET Foundation Project Application : std.uritemplate

baywet commented 9 months ago

Project Name

std.uritemplate

License

Apache 2.0

Contributor

Andrea Peruffo, Vincent Biret (maintainers) and a couple of additional OSS contributors

Existing OSS Project?

Yes

Source Code URL

https://github.com/std-uritemplate/std-uritemplate

Project Homepage URL

No response

Project Transfer Signatories

Andrea Peruffo andrea.peruffo1982@gmail.com Vincent Biret vincent.biret@microsoft.com

Description

A simple, lightweight and fast implementation of Uri Template specification RFC 6570 Level 4 in dotnet.

Name

Andrea Peruffo

Email

andrea.peruffo1982@gmail.com

GitHub Profile URL

https://github.com/AndreaTP

Committers

@andreaTP @baywet

Governance Model

We currently do not have any charter in place to govern who's a member of the organization and gets commit rights. If you have a standard charter to share with us, it'll help us get it setup.

For pull requests, this is not documented today, but a pull request needs to be discussed in an issue first so we're clear on what changes need to be made, value it provides, agreement that it'll be across languages when applicable, etc...

When discussing an issue for the added value, we first want to check the upcoming contribution will conform with RFC6570 if it impacts the way URI templates are being processed. For the rest of the changes it must be in the best interest of developer experience in terms of API surface, breaking changes, etc...

CLA

[ ] If already an OSS project, was a Contribution License Agreement in place for contributions accepted?

How does the project check who has signed one?

no current CLA mechanism in place

CLA Notification Alias

No response

Select the Project Transfer Agreement model

Contribution

Repository Layout

No response

Eligibility Criteria

[X] The project is built on the .NET platform and/or creates value within the .NET ecosystem.
[X] The project produces source code for distribution to the public at no charge.
[X] The project's code is easily discoverable and publicly accessible (preferably on GitHub).
[X] The project contains a build script that can produce deployable artifacts that are identical to the official deployable artifacts, with the exception of code signing (Exception may be granted for strong name keys, though strongly encouraged to be committed. Exception relies on OSS signing being in the build script for public builds).
[X] When applicable, project must use reproducible build settings in its toolchain.
[X] The project uses Source Link.
[X] The project uses either embedded PDBs or publish symbol packages to NuGet (if applicable).
[ ] The project code signs their artifacts as appropriate.
[X] The project organization has 2FA enabled. Requiring 2FA must be done as part of onboarding if not already enabled.
[X] Libraries that are mandatory dependencies of the project are offered under a standard, permissive open source license which has been approved by the .NET Foundation (exceptions include a dependency that is required by the target platform where no alternative open source dependency is available such as the .NET Framework or a hardware specific library).
[ ] Committers are bound by a Contributor License Agreement (CLA) and/or are willing to embrace the .NET Foundation's CLA when the project becomes a Member.
[X] The copyright ownership of everything that the project produces is clearly defined and documented.
[X] The project has a public issue tracker where the status of any defect can be easily obtained.
[ ] The project has a published Security Policy.
[X] The project has a home page which provides high level information about its status and purpose.
[X] The project has a public communication channel where community members can engage with maintainers.
[X] The project has a publicly available location where members can review and contribute to documentation.

PR Plan Summary

This repository is an implementation of RFC 6570 across multiple languages. As discussed in the January call, we're interested to join the .NET foundation to enable code-sign for the dotnet implementation. And we'd like the license agreements + CLA checks to only impact the /csharp path and associated CI/CD workflows.

Infrastructure Requirements Summary

we're using the public GitHub actions hosted machines. no web hosting requirement, if we ever need a website, we'll probably use GitHub pages. Yes, we'll need a code-sign certificate.

Additional Notes

@andreaTP I just enabled 2FA checks for the organization as it seems to be a requirement here and it can't hurt. Please reach out by email if this is causing issues on your end, it should only apply to you and I.

andreaTP commented 9 months ago

2FA is already enabled:

sbwalker commented 7 months ago

@baywet the .NET Foundation BOD voted today and approved std.uritemplate to become a Member project. There are still a few open items which should be addressed during the onboarding:

In your application you specified "Assignment" for Project Transfer Agreement model... but I believe your project should join through the "Contribution" model. Assignment means that you are transferring ownership to the .NET Foundation, Contribution means that you retain ownership and provide a license to the .NET Foundation. Generally, only Microsoft projects join the .NET Foundation via the Assignment model.
We need to determine the appropriate approach for dealing with the fact that std-uritemplate is a mono-repo and contains implementations for many different technologies/languages. It is our understanding that only the .NET implementation of std.uritemplate is becoming a Member of the .NET Foundation - the other implementations should be treated independently. However from an operational perspective, the .NET Foundation requires a CLA agreement be enabled for all of its projects and I believe it can only enabled at the repo level currently. In addition, the .NET Foundation tracks metrics at the repo level - not at a subfolder level. So there are a few logistical items which need to be resolved. @ChrisSfanos can discuss this with you further as part of the onboarding.

andreaTP commented 7 months ago

@baywet might be out of the office those days, so let me take it from here @sbwalker .

First off, thanks for accepting the project, that's great news!

the "Contribution" model works for us, if you can edit the initial message feel free to correct it
All you said is correct, I think we have a couple of options to move forward:
- fix the tooling to work even on monorepos
- have an automated CI that will populate a separate repository containing only the dotnet implementation (in a similar way we are publishing e.g. PHP )

Happy to discuss those details further! What would be the next step?

baywet commented 6 months ago

(catching up here) This is great news! In agreement that we should switch things to a Contribution model. Just updated the initial comment. As for the repo configuration, can @ChrisSfanos confirm whether a CLA check configuration for a sub-directory in a repo is possible anytime soon? If not we'll have to setup a separate repo and direct people to contribute only to that separate repo so they sign the CLA, which we'll automatically sync to the mono-repo where the publishing CI is in place.

ChrisSfanos commented 6 months ago

No, there is not an option for a sub-directory level for the CLA service. So yes a separate repo is going to be the best way to go in this situation

andreaTP commented 6 months ago

No, there is not an option for a sub-directory level for the CLA service.

There is not even way to exclude specific files or folders?

Sorry for asking, but the separate repo is my least favorite option as it breaks the current setup by adding up maintenance.

ChrisSfanos commented 6 months ago

Sorry the service currently does not offer that option - I can propose it to the dev team, but at this time it is not an option

andreaTP commented 6 months ago

Thanks for the feedback @ChrisSfanos , please propose the changes to the dev team, as, in the last meeting, someone argued that those settings should be available.

Meanwhile, likely tomorrow, I'll prepare the separate repo and we move on from there.

andreaTP commented 6 months ago

@ChrisSfanos I extracted the .NET implementation to an external repo (and released 0.0.57 to verify everything): https://github.com/std-uritemplate/std-uritemplate-csharp The next steps should be:

setup the CLA bot
setup the artifact singing

I'm looking for documentation or guidance on how to perform those steps. Also, let me know if any further adjustment of the repo is required. Thanks in advance 🙏

andreaTP commented 6 months ago

@ChrisSfanos @sbwalker any ETA for following up on this subject? Is this the right communication channel to reach out to you?

Do I need to take any extra action or have I missed anything?

Thanks in advance.

ChrisSfanos commented 6 months ago

Sorry several other things going on - I will put together and send out the signing agreement tomorrow and include the onboarding checklist here

andreaTP commented 6 months ago

Thanks @ChrisSfanos ! 🙏 We have users knocking on the door too 😅

ChrisSfanos commented 6 months ago

Got to this during a break - agreement is out for signing

ChrisSfanos commented 6 months ago

We will follow the onboarding checklist below

CLA

[x] Project Agreement Signing via DocuSign
[x] CLA Onboarding via GitHub

Project Onboarding

[x] Public Announcement via the .NET Foundation site/etc
[x] Joining the Project leader mailing list
[x] Joining the Project leader Slack channel
[x] Updating license/copyright in the repo + updating file headers
[x] Reviewing the .NET Foundation Code of Conduct
[x] Add Project to the .NET Foundation project list
[x] Project layout cleanup (as appropriate)
[x] README Guidance updates
[x] Project website updates (outside of GitHub)
[x] Enable two-factor authentication (2FA) for GitHub organization and all users

baywet commented 6 months ago

signed on my end.

andreaTP commented 6 months ago

Signed too, thanks for getting this going!

andreaTP commented 6 months ago

@ChrisSfanos I think that "Project Agreement Signing via DocuSign" should be ticked and we are waiting on instructions for: "CLA Onboarding via GitHub"

ChrisSfanos commented 6 months ago

Yep hadn't gotten back to this - CLA instructions sent out

ChrisSfanos commented 6 months ago

CLA config is complete - I'll be sending out the remaining instructions later today/tomorrow

andreaTP commented 6 months ago

🎉 thanks @ChrisSfanos , I'll test the CLA tomorrow :+1:

ChrisSfanos commented 6 months ago

Everything is done with the onboarding (the comms team was notified to include this in the next newsletter) - onboarding is complete - welcome to the .NET Foundation :-)

baywet commented 6 months ago

@ChrisSfanos I might have missed communications, apologies if that's the case. How do we onboard to the signing infrastructure now?

ChrisSfanos commented 6 months ago

https://github.com/dotnet-foundation/projects/issues/new/choose and pick the Code Signing Cert request. We are sorting out some onboarding issues with the provider, so this make take a week or two before we can start the process

baywet commented 6 months ago

done https://github.com/dotnet-foundation/projects/issues/378

dotnet-foundation / projects