CNCF Sandbox project checklist

[viccuad]

The CNCF Technical Oversight Committee needs some action from us Kubewarden, so we are listed in https://www.cncf.io/sandbox-projects/. See cncf/toc#858.

This issue is a copy of their published TODO as an epic, so we can mark things as done, and create cards as necessary.

---

From the project side, please ensure that you:

• Understand the project proposal process and reqs: https://github.com/cncf/toc/blob/main/process/project_proposals.md#introduction
• Understand the services available for your project at CNCF https://www.cncf.io/services-for-projects/
• Ensure your project meets the CNCF IP Policy: https://github.com/cncf/foundation/blob/master/charter.md#11-ip-policy
• Review the online programs guidelines: https://github.com/cncf/foundation/blob/master/online-programs-guidelines.md
• Understand the trademark guidelines: https://www.linuxfoundation.org/legal/trademark-usage
• Understand the license allowlist: https://github.com/cncf/foundation/blob/master/allowed-third-party-license-policy.md#approved-licenses-for-allowlist
• Is your project working on written, open governance? see https://contribute.cncf.io/maintainers/governance/
  • not yet
• Slack: Are your slack channels migrated to the Kubernetes or CNCF Slack? (see https://slack.com/help/articles/217872578-Import-data-from-one-Slack-workspace-to-another for more details)
  Is your project in its own separate neutral github organization?
• Submitted a Pull request to add your project as a sandbox project to https://landscape.cncf.io/
• Create maintainer list + add to aggregated https://maintainers.cncf.io/ list by submitting a PR to it
• Have added your project to https://github.com/cncf/contribute
• Artwork: Submit a pull request to https://github.com/cncf/artwork with your artwork #141
• Transfer domain to the CNCF  #142

Things that CNCF will need from the project:

• Provide emails for the maintainers added to https://maintainers.cncf.io/ in order to get access to the maintainers mailing list and ServiceDesk
• Trademarks: transfer any trademark and logo mark assets over to the LF  #143
• GitHub: ensure 'thelinuxfoundation' and 'caniszczyk' are added as initial org owners, this helps us make sure we have continuity of GH ownership
• Feature Request: enable DCO on all our repositories automation#27
• GitHub: ensure that hat the CNCF Code of Conduct (or your adopted version of it) are explicitly referenced at the project's README on GitHub
• Website: ensure LF footer is there and website guidelines followed (if your project doesn't have a dedicated website, please adopt those guidelines to the README file of your project on GitHub).
• Website: Analytics transferred to projects@cncf.io #144
• CII: Start on a CII best practices badge https://bestpractices.coreinfrastructure.org/en

(edit Dec 14th 2023, new requirement, license scan).

• License scan, like Fossa or Snyk (we were already compliant, see CNCF Sandbox project checklist #130 (comment))

[viccuad]

The first 7 tasks (the "Understand" ones) provide a good read and framework, I encourage @kubewarden/kubewarden-developers to have a look.

[flavio]

PR for submission against CNCF's landscape is open: cncf/landscape#2746

[flavio]

PR with list of maintainers: cncf/foundation#428

[flavio]

PR for the contributors website: cncf/tag-contributor-strategy#243

[flavio]

artwork repo: we're missing some images. I've reached out to the SUSE UX team

[viccuad]

For "CII: Start on a CII best practices badge", shall we count it as done, as listed in https://bestpractices.coreinfrastructure.org/en/projects?q=kubewarden ?

[flavio]

For "CII: Start on a CII best practices badge", shall we count it as done, as listed in https://bestpractices.coreinfrastructure.org/en/projects?q=kubewarden ?

I think we are meeting some of the requirements that are still left unchecked. I would leave that open, so that we can go through the list

[viccuad]

Added a new requirement to the list, license scan with tools like Fossa or Synk (see this comment).

Marked as completed, as we have FOSSA enabled in all the user facing repositories (not on our own libraries), each repository has the badge, and is passing. See:

https://github.com/kubewarden/kwctl
https://github.com/kubewarden/kubewarden-controller
https://github.com/kubewarden/policy-server
https://github.com/kubewarden/audit-scanner

[jvanz]

This is done. Closing issue 🥳 🚀