/
2025 Quality & Security Goals

2025 Quality & Security Goals

Overview

@Olaf Renner @Muddasar Ahmed @Amy Zwarico

This is a drafting space for LFN Quality and Security goals to

  1. Define common quality and security goals across LFN projects

  2. Define metrics and tools to measure and verify if goals are reached

  3. Define templates to guide, document and review project progress

Background:
It was agreed in LFN TAC that security of projects should be increased and security best practices should be implemented across LFN. This goal was extended to also define overall quality goals across LFN as the projects health was traditionally reviewed by TAC but it didn’t include security targets and wasn’t done in a consistent automatable way.

Why do we need this:
With regulatory requirements like US cybersecurity executive order and EU Cyber resilience act companies increasingly evaluate how secure and well maintained the open source software is they use in their products. To ensure that LFN continues to be seen as a source for quality software we should review and agree on what goals we want to reach and how to measure and verify them.
With new projects coming to LFN it becomes even more important to have a clear definition of what will be expected and how these goals can be reached.

Working group:

As it is expected that this work will take some time and may require dedicated meetings to discuss the details the formation of a working group is proposed.
Because this is an LFN wide activity, volunteers from the projects are required to help defining and reviewing goals and criteria. Please add your name

Meetings: Register / Join

Mondays: 08:00 Pacific / 15:00 UTC

Participants

Project

Contact

Project

Contact

ONAP

@Amy Zwarico @Muddasar Ahmed @Faseela K

ODL

@Robert Varga

Anuket

@Gergely Csatari @Cédric Ollivier (functest)

Nephio

SIG Security @Faseela K

 

 

Review Matrix

Assessment of existing documentation, guidelines and tools:

As a first step to define goals the following table collects what is currently documented in LFN, what other organizations have defined and what tools could be used for measurement and verification.
The first column collects the quality/security criteria from various source added in the other columns. Colored rows organize criteria in groups and contain sources that can be used for the criteria under the group (if not further detailed in the rows).

As the table lists the status quo some criteria may appear as duplicates although in different context. To mark these related criteria add the table row number of the duplicate/related criteria in the according column.

Quality Goal

Priority

Related

LFN Wiki

 

 

OpenSSF

Key Measures

LFX

GitHub

Notes

Quality Goal

Priority

Related

LFN Wiki

 

 

OpenSSF

Key Measures

LFX

GitHub

Notes

1

Project Vitals

 

 

Project Data Template (currently used both for induction and health review *)

LFN Lifecycle states and guidelines (metrics per lifecycle stage)

LFN Security Forum Best Practices

 

Best Practices

Passing badge

Scorecard

 

 

 

2

Project Name

1 @Amy Zwarico

 

 

 

README-template.md

 

 

PCC Project Definition

 

 

3

Project Creation Date

 

 

 

 

 

 

Age?

PCC Project Definition

 

 

4

Project License

1 @Amy Zwarico

 

 

 

LICENSE; README-template.md

[floss_license][floss_license_osi][license_location]

Degree of FOS

PCC Project Definition

 

 

5

Legal Details and checks

 

 

 

 

 

 

 

 

PCC Project Definition

 

 

6

Community Size

 

 

 

 

 

 

#s

 

 

 

7

Contributing organizations (Diversity)

 

41

 

 

 

#s

 

 

 

8

Number of contributors

1 @Amy Zwarico

 

 

 

 

 

#s

 

 

 

9

Lifecycle Stage

 

 

 

 

 

 

 

PCC Project Definition

 

 

10

Release schedule

 

 

 

 

 

 

Months

 

 

 

11

Adoption

 

 

 

 

 

 

Not sure how to measure. Downloads?

 

 

 

12

Health Review

 

 

 

 

 

CNCF Devstats; CLOmonitor

Criticality Score

 

PCC Health Metrics; Insights

Github health metrics

 

13

Release Information

 

 

 

 

 

 

 

 

 

 

14

Number of commits (over last year)

1 @Amy Zwarico

 

 

 

 

 

 

 

 

 

15

Number of active committers

1 @Amy Zwarico

 

 

 

 

 

 

 

 

 

16

Number of Active committers per organization

1 @Amy Zwarico

 

 

 

 

 

 

 

 

 

17

Number of PR/changeset

 

 

 

 

 

 

 

 

 

 

18

Mailing list activity

 

 

 

 

 

 

 

 

 

 

19

Project & Community Resources

 

 

 

 

 

 

[discussion]

 

 

 

 

20

Website

 

 

 

 

README.md

[description_good]

Yes/NO

PCC Domain

 

 

21

Wiki

 

 

 

 

README.md

 

Yes/NO

PCC Wiki

 

 

22

Mailing List

1 @Amy Zwarico

 

 

 

README.md

 

Yes/NO

PCC mailing list

 

 

23

Slack

 

 

 

 

README.md