search

in-toto / community

in-toto is a framework to secure the software supply chain.
https://in-toto.io/
69 stars 10 forks source link

Create MAINTAINERS.md #20

Open JustinCappos opened 7 months ago

JustinCappos commented 7 months ago

Copied from in-toto/in-toto (for now). We should iterate on this list.

JustinCappos commented 7 months ago

I'd like to propose that we have our missing ITSC members @colek42 @trishankatdatadog and @06kellyjac added. I would also propose adding @jkjell as well.

We also likely can remove a few folks. Sebastien can be removed.

What do others think?

06kellyjac commented 7 months ago

Thanks @JustinCappos Ill pop my details in on Monday if that's ok. Feel free to merge early if you'd like, it can always come in a follow up PR.

adityasaky commented 7 months ago

I don't fully understand the rationale here. Is there a difference in responsibilities between the "maintainer" of this repository (which in my mind is the stewardship of the in-toto project as a whole) and the ITSC? If this is to have a MAINTAINERS file for the repository (as governance suggests), could it just point to (could even be a symlink) to the committee members file?

JustinCappos commented 7 months ago

It's more that I'm trying to clean up the governance so that from a legalistic read of the document. Since there is a lot of confusion, I'm either not explaining this well or misreading something.

If anyone wants to give me a hand with cleaning up the governance, let me know!

adityasaky commented 7 months ago

I think we can apply the governance as-is by just clarifying that the "maintainers" for this specific repository, i.e. the representative repo for the in-toto project as a whole, is the ITSC. Perhaps a MAINTAINERS.md file that says as much is sufficient? I think having "maintainers" for the in-toto umbrella and a steering committee is confusing. Maintainers for each implementation / subproject is of course fine...