Skip to content

Apply for sandbox stage with OpenBao #461

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
kj-powell merged 1 commit into from
May 5, 2025
Merged

Apply for sandbox stage with OpenBao #461

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
45 changes: 45 additions & 0 deletions process/project-lifecycle-documents/openbao_sandbox_stage.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,45 @@
## Application for creating a new project at Sandbox stage

### List of project maintainers

Per [project documents](https://github.com/openbao/openbao/blob/main/MAINTAINERS.md):

- Dan Ghita, Wallix, @DanGhita
- Jan Martens, Independent, @JanMa
- Nathan Phelps, IBM, @naphelps
- Alex Scheel, GitLab, @cipherboy

In scoped roles:

- Dave Dykstra, Fermilab, @DrDaveD; committer for `auth/jwt`

We also have four moderators with no commit privileges.

### Sponsor

- OpenSSF Security Tooling WG

### Mission of the project

Per [our website](https://openbao.org/):

- OpenBao exists to maintain and improve a software solution to manage, store, and distribute sensitive data including secrets, certificates, and keys. The OpenBao community will provide this software under an OSI-approved open-source license, led by a community run under open governance principles.

Comment on lines +26 to +27

@marcelamelara marcelamelara Apr 1, 2025

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I noticed that OpenBao is currently licensed under an MPL 2 license. Since OpenSSF typically prefers Apache 2.0 or MIT licenses for software projects, I'm think there may be an additional review of the license step by the Governing Board.

@cipherboy cipherboy Apr 1, 2025

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks @marcelamelara and @lehors for the discussion on the call! I've pushed an update to the IP licensing requirements linking to our charter and the OpenSSF TAC charter.

I'm told the more unusual thing was that our core documentation was under MPLv2, but this was an artifact of upstream's documentation license.

### IP policy and licensing due diligence

- Applicable; OpenBao's [code and core documentation](https://github.com/openbao) are licensed [under the MPLv2](https://github.com/openbao/openbao/blob/main/LICENSE) due to upstream licensing.
- Remaining out-of-core-repo documentation is under the [Creative Commons Attribution v4.0 International License](https://openbao.org/assets/OpenBao-Technical-Charter-Final-2024-05-08.pdf) per organization charter (Section 7.b.iv).

This will require review and exception approval [from the TAC per charter](https://openssf.org/about/charter/).

### Project References

| Reference | URL |
|---------------------|-----|
| Repo | https://github.com/openbao/openbao/ |
| Website | https://openbao.org/ |
| Contributing guide | https://openbao.org/docs/contributing/, https://github.com/openbao/openbao/blob/main/CONTRIBUTING.md |
| Security.md | https://openbao.org/docs/internals/security/#threat-model, https://github.com/openbao/.github/blob/main/SECURITY.md |
| Roadmap | https://github.com/openbao/openbao/issues/569 |
| Demos | n/a |
| Other | https://insights.lfx.linuxfoundation.org/foundation/lfedge/overview/github?project=openbao&repository=&routedFrom=Github |