Governance

[iamwillbar]

As purl adoption increases, and others consider purl adoption, there is a desire for governance of the project to be more clearly defined. At the current size of the project this governance could be pretty lightweight, but even that would give adopters confidence.

@royaljust from GitHub published an article on Minimal Viable Governance (MVG) that we could use as a baseline:
https://github.blog/2021-07-22-minimum-viable-governance-lightweight-community-structure-foss-projects/

Example documents are here:
https://github.com/github/MVG

To implement this, we need to:

• Create a technical steering committee (we could start with the 5 org owners if they agree).
• Create a charter which the steering committee would vote to adopt.
  • Mission (we can derive this from the content we already have)
  • Decision making process (MVG has a proposed lightweight starting one).
  • Trademark policy.
  • Anti-trust policy.
  • Code of conduct (already in place).
• Add the necessary files to the org's repositories.

If there's no objection to MVG as a starting point, I'm happy to pull together the files and create pull requests that the current org owners can review.

[pombredanne]

@iamwillbar Thanks for bringing this up. Would not antitrust policies and trademark policies likely be overkill at this stage?

[torgo]

Hi @iamwillbar thanks this has been on my mind so I'm glad to see someone else has been thinking about it as well. I recognise this might be opening a can of worms but I'd like to see this effort being run under a specification license such as https://github.com/CommunitySpecification/Community_Specification as well.

[pombredanne]

@torgo Thanks for chiming in! Can you articulate your concerns with the current license?

[torgo]

The issue is that the current license is an open source license which is intended for software. Specification licenses generally are better suited towards specifications. The Readme on the Community Spec says it better than I could. For context, I'm used to working in W3C under the W3C Patent Policy and royalty-free license. I don't think we need a heavy weight process like that. But something light-weight like the Community Specification license I linked above or the w3c version that they use for Community Groups might make sense.

[torgo]

For further context, I'm working for Snyk. We are a consumer and user of the PURL spec.

[jlb-bb]

Efforts like CycloneDX and SPDX are referencing PURL. Has it been considered to move PURL under an OWASP or LF umbrella?

[stevespringett]

@jlb-bb the contents of all repos in the purl GitHub org meet all the criteria for an OWASP project, if that's something the group wants to do.

However, moving it under a foundation isn't automatically going to provide the needed governance. Both CycloneDX and SPDX that you reference, have defined their own governance models, which is what we're trying to do here. A foundation would provide certain protections to the project.

[pombredanne]

Efforts like CycloneDX and SPDX are referencing PURL. Has it been considered to move PURL under an OWASP or LF umbrella?

I am not opposed to this on principle, but can you articulate what would be the benefits?

These are also two rather different organizations: AFAIK OWASP is a 501(c)3 non-profit (charity) while the Linux Foundation is a 501(c)6 corporate business league and their projects are owned by an LLC corporation.