Return to GOVERNANCE.md CVS log

Up to [ELWIX - Embedded LightWeight unIX -] / embedaddon / curl / docs

Annotation of embedaddon/curl/docs/GOVERNANCE.md, revision 1.1.1.1

1.1       misho       1: # Decision making in the curl project
                      2: 
                      3: A rough guide to how we make decisions and who does what.
                      4: 
                      5: ## BDFL
                      6: 
                      7: This project was started by and has to some extent been pushed forward over
                      8: the years with Daniel Stenberg as the driving force. It matches a standard
                      9: BDFL (Benevolent Dictator For Life) style project.
                     10: 
                     11: This setup has been used due to convenience and the fact that is has worked
                     12: fine this far. It is not because someone thinks of it as a superior project
                     13: leadership model. It will also only continue working as long as Daniel manages
                     14: to listen in to what the project and the general user population wants and
                     15: expects from us.
                     16: 
                     17: ## Legal entity
                     18: 
                     19: There is no legal entity. The curl project is just a bunch of people scattered
                     20: around the globe with the common goal to produce source code that creates
                     21: great products. We are not part of any umbrella organization and we are not
                     22: located in any specific country. We are totally independent.
                     23: 
                     24: The copyrights in the project are owned by the individuals and organizations
                     25: that wrote those parts of the code.
                     26: 
                     27: ## Decisions
                     28: 
                     29: The curl project is not a democracy, but everyone is entitled to state their
                     30: opinion and may argue for their sake within the community.
                     31: 
                     32: All and any changes that have been done or will be done are eligible to bring
                     33: up for discussion, to object to or to praise. Ideally, we find consensus for
                     34: the appropriate way forward in any given situation or challenge.
                     35: 
                     36: If there is no obvious consensus, a maintainer who's knowledgeable in the
                     37: specific area will take an "executive" decision that they think is the right
                     38: for the project.
                     39: 
                     40: ## Donations
                     41: 
                     42: Donating plain money to curl is best done to curl's [Open Collective
                     43: fund](https://opencollective.com/curl). Open Collective is a US based
                     44: non-profit organization that holds on to funds for us. This fund is then used
                     45: for paying the curl security bug bounties, to reimburse project related
                     46: expenses etc.
                     47: 
                     48: Donations to the project can also come in form of server hosting, providing
                     49: services and paying for people to work on curl related code etc. Usually, such
                     50: donations are services paid for directly by the sponsors.
                     51: 
                     52: We grade sponsors in a few different levels and if they meet the criterias,
                     53: they can be mentioned on the Sponsors page on the curl web site.
                     54: 
                     55: ## Commercial Support
                     56: 
                     57: The curl project does not do or offer commercial support. It only hosts
                     58: mailing lists, runs bug trackers etc to facilitate communication and work.
                     59: 
                     60: However, Daniel works for wolfSSL and we offer commercial curl support there.
                     61: 
                     62: ## Key roles
                     63: 
                     64: ### Maintainers
                     65: 
                     66: A maintainer in the curl project is an individual who has been given
                     67: permissions to push commits to one of the git repositories.
                     68: 
                     69: Maintainers are free to push commits to the repositories at their own will.
                     70: Maintainers are however expected to listen to feedback from users and any
                     71: change that is non-trivial in size or nature *should* be brought to the
                     72: project as a PR to allow others to comment/object before merge.
                     73: 
                     74: ### Former maintainers
                     75: 
                     76: A maintainer who stops being active in the project will at some point get
                     77: their push permissions removed. We do this for security reasons but also to
                     78: make sure that we always have the list of maintainers as "the team that push
                     79: stuff to curl".
                     80: 
                     81: Getting push permissions removed is not a punishment. Everyone who ever worked
                     82: on maintaining curl is considered a hero, for all time hereafter.
                     83: 
                     84: ### Security team members
                     85: 
                     86: We have a security team. That's the team of people who are subscribed to the
                     87: curl-security mailing list; the receivers of security reports from users and
                     88: developers. This list of people will vary over time but should be skilled
                     89: developers familiar with the curl project.
                     90: 
                     91: The security team works best when it consists of a small set of active
                     92: persons. We invite new members when the team seems to need it, and we also
                     93: expect to retire security team members as they "drift off" from the project or
                     94: just find themselves unable to perform their duties there.
                     95: 
                     96: ### Server admins
                     97: 
                     98: We run a web server, a mailing list and more on the curl project's primary
                     99: server. That physical machine is owned and run by Haxx. Daniel is the primary
                    100: admin of all things curl related server stuff, but Björn Stenberg and Linus
                    101: Feltzing serve as backup admins for when Daniel is gone or unable.
                    102: 
                    103: The primary server is paid for by Haxx. The machine is physically located in a
                    104: server bunker in Stockholm Sweden, operated by the company Portlane.
                    105: 
                    106: The web site contents are served to the web via Fastly and Daniel is the
                    107: primary curl contact with Fastly.
                    108: 
                    109: ### BDFL
                    110: 
                    111: That's Daniel.
                    112: 
                    113: # Maintainers
                    114: 
                    115: A curl maintainer is a project volunteer who has the authority and rights to
                    116: merge changes into a git repository in the curl project.
                    117: 
                    118: Anyone can aspire to become a curl maintainer.
                    119: 
                    120: ### Duties
                    121: 
                    122: There are no mandatory duties. We hope and wish that maintainers consider
                    123: reviewing patches and help merging them, especially when the changes are
                    124: within the area of personal expertise and experience.
                    125: 
                    126: ### Requirements
                    127: 
                    128: - only merge code that meets our quality and style guide requirements.
                    129: - *never* merge code without doing a PR first, unless the change is "trivial"
                    130: - if in doubt, ask for input/feedback from others
                    131: 
                    132: ### Recommendations
                    133: 
                    134: - we require two-factor authentication enabled on your github account to
                    135:   reduce risk of malicious source code tampering
                    136: - consider enabling signed git commits for additional verification of changes
                    137: 
                    138: ### Merge advice
                    139: 
                    140: When you're merging patches/PRs...
                    141: 
                    142: - make sure the commit messages follow our template
                    143: - squash patch sets into a few logical commits even if the PR didn't, if
                    144:   necessary
                    145: - avoid the "merge" button on github, do it "manually" instead to get full
                    146:   control and full audit trail (github leaves out you as "Committer:")
                    147: - remember to credit the reporter and the helpers!
                    148: 
                    149: ## Who are maintainers?
                    150: 
                    151: The [list of maintainers](https://github.com/orgs/curl/people). Be aware that
                    152: the level of presence and activity in the project vary greatly between
                    153: different individuals and over time.
                    154: 
                    155: ### Become a maintainer?
                    156: 
                    157: If you think you can help making the project better by shouldering some
                    158: maintaining responsibilities, then please get in touch.
                    159: 
                    160: You will be expected to be familiar with the curl project and its ways of
                    161: working. You need to have gotten a few quality patches merged as a proof of
                    162: this.
                    163: 
                    164: ### Stop being a maintainer
                    165: 
                    166: If you (appear to) not be active in the project anymore, you may be removed as
                    167: a maintainer. Thank you for your service!