omnibor / spec

A draft standard for communicating a cryptographic record of build inputs for software artifacts.

Home Page:https://omnibor.io

Geek Repo:Geek Repo

Github PK Tool:Github PK Tool

Add contact details to the Code of Conduct

torgo opened this issue · comments

Hi - Just an editorial / process point. The Code of Conduct needs a contact name / address. Right now it says "[INSERT EMAIL ADDRESS]". :)

@AevaOnline How would you suggest handling this?

Looks like this is still an open issue to resolve. A quick check shows that, at least for logged-out users, Aeva and I are the only ones listed publicly on the OmniBOR organization. So I'd expect, at least in the short term, that people wanting to report a CoC violation might end up going to Aeva or myself.

This connects to a broader point, which is that the CoC references "Project Maintainers," but I think this project has a bit of an amorphous "ownership" structure. There are several lists of overlapping people here:

  • Owners of the GitHub organization (some currently public, some currently private)
  • People with control of the Zoom account we use for working group meetings
  • People with access to the YouTube channel
  • People with access to the Twitter/X account
  • People with access to the domain name registration
  • People with access to the website host
  • People with rights over the Slack channel on the OpenSSF Slack Workspace

This leads to some risk of inability or at least difficulty to hold accountable some individuals who have singular access to some of this infrastructure. It's also just a bit messy to have these distinct and overlapping groups which aren't documented (as far as I know) anywhere.

Anyway, resolving this issue doesn't need to block the more urgent issue of putting in an email address on the Code of Conduct.