ossf / wg-securing-critical-projects

Helping allocate resources to secure the critical open source projects we all depend on.
Apache License 2.0
318 stars 34 forks source link

List of Critical Projects links #55

Closed edelsohn closed 1 year ago

edelsohn commented 2 years ago

The Google Sheet with the list of Critical Projects has non-canonical links for some projects for which I would request an update. The Github links for Autotools, Make and GCC are mirrors that are not controlled by the projects (in fact GCC has requested assistance from Github multiple times to move the mirrors to our Github organization)

The link for Autotools also is non-canonical, but there is no official site that encompasses all of the tools. There is no "Autotools" project -- it is term that is used to encompass the GNU Build Tools. Should the projects be listed individually?

david-a-wheeler commented 2 years ago

Yes, I think the tools should listed individually. The umbrella term "autotools" is widely used, though, so mentioning somewhere that "The term 'autotools' includes the following tools: automake, libtool, autoconf, ..." (I know those are part of the autotools, I don't know if others are also considered to be part).

edelsohn commented 2 years ago

The Github pseudo-account autotools-mirror includes autoconf, automake, gettext, libtool, and m4.

I don't know if you want to split out the GNU Toolchain projects individually (GCC, GLIBC, GDB, Binutils) but it would be more clear to refer to it as the GNU Toolchain.

Amir-Montazery commented 1 year ago

A very good point about the importance of considering how granular we want to be. In general, it makes sense to list out the projects.