Repository Reorganization: Directory Structure, License Consolidation, and File Cleanup #1283
Conversation
✅ Deploy Preview for tag-security ready!
To edit notification comments on pull requests, go to your Netlify site configuration. |
- Created directories: community/working-groups, community/events, community/resources. - Moved `audio-versions` to `community/publications/`. - Moved `supply-chain-security`, `compliance`, `policy` to `community/working-groups`. - Moved `design`, `security-lexicon`, `security-whitepaper`, `landscape`, `security-fuzzing-handbook` to `community/resources/`. - Moved `cloud_native_security.md` and `past-events.md` to `community/events/`. - Deleted unused files: `policy-wg-merging.md`, `roadmap.md`, `safe_kubecon.md`, - Merged readmes for working groups and old folders Signed-off-by: Andrés Vega <[email protected]> Signed-off-by: Andrés Vega <[email protected]> Signed-off-by: Andrés Vega <[email protected]>
Signed-off-by: Andrés Vega <[email protected]> Signed-off-by: Andrés Vega <[email protected]> Signed-off-by: Andrés Vega <[email protected]>
Signed-off-by: Andrés Vega <[email protected]> Signed-off-by: Andrés Vega <[email protected]> Signed-off-by: Andrés Vega <[email protected]>
Signed-off-by: Andrés Vega <[email protected]> Signed-off-by: Andrés Vega <[email protected]> Signed-off-by: Andrés Vega <[email protected]>
Signed-off-by: Andrés Vega <[email protected]> Signed-off-by: Andrés Vega <[email protected]> Signed-off-by: Andrés Vega <[email protected]>
Signed-off-by: Andrés Vega <[email protected]> Signed-off-by: Andrés Vega <[email protected]> Signed-off-by: Andrés Vega <[email protected]>
Signed-off-by: Andrés Vega <[email protected]>
…path Signed-off-by: Andrés Vega <[email protected]>
- Adjust rsync commands to include community publications and move resources to the correct paths. - Ensure the `rsync` command creates necessary directories with `--mkpath`. - Maintain the structure and readability of markdown files. - Update commands to move graphics and logos. - Preserve Hugo's ability to serve content and generate the site effectively. Co-authored-by: Brandt Keller <[email protected]> Signed-off-by: Andrés Vega <[email protected]>
- Remove unsupported `--mkpath` option from `rsync` command. - Ensure directories are created before moving resources. - Adjust `rsync` commands to include community publications and move resources to correct paths Co-authored-by: Brandt Keller <[email protected]> Signed-off-by: Andrés Vega <[email protected]>
Signed-off-by: Andrés Vega <[email protected]>
LICENSE.md
Outdated
There was a problem hiding this comment.
I have thought about this in recent weeks, but wasn't sure where this gets into CNCF legal territory.
There was a problem hiding this comment.
What's the question? To simplify the repository structure and provide clarity on licensing terms, the three existing license files (LICENSE-code, LICENSE-document, LICENSE.md) were merged into a single LICENSE.md file. To be clear there are no licensing changes made here. The updated license file covesr both code and documentation, as follows:
LICENSE.md
# License
## Source Code
The source code in this repository is licensed under the MIT License. See below for the full license text.
## Documentation
The documentation in this repository is licensed under the Creative Commons Attribution 4.0 International License. See below for the full license text.
### MIT License
[Full text of the MIT]
### Creative Commons Attribution 4.0 International License
[Full text of the CC BY 4.0 License]
There was a problem hiding this comment.
Yep, just looking for input from anyone else who can confirm what I agree with you on— merging these files looks like a good way to consolidate the presence of both licenses.
There was a problem hiding this comment.
You mentioned CNCF legal, so I tagged them. Also, @joannalee333 can help with a thumbs up here.
There are several online resources on multi-licensing and declaring those multiple licenses. One of GitHub’s support recommendations is to use one LICENSE file in the root of your repository and add subsections for any 3rd party material, code, etc. which is the approach being pursued here.
An improvement complementary to this approach is to clearly mention the terms in the README.md:
The source code in this repository is licensed under the MIT License. The documentation is licensed under the Creative Commons Attribution 4.0 International License.
There was a problem hiding this comment.
Heard back from CNCF legal. They said on 6/24:
Hi Andres, I reviewed. From a purely legal perspective, I have no concerns. I want to check with someone on the team here thought to make sure the change will still work with license header scanning tools used by CNCF projects.
I don't know that TAG folders are scanned, but there seems to be no issue here.
anvega
added
the
information architecture
| As a final red flag, no part of the web-store posting has been updated to account | ||
| for this. [@greatsuspender](https://github.com/greatsuspender) remains listed as | ||
| the maintainer, and the privacy policy makes no mention of the new tracking or | ||
| the maintainer, and a privacy policy makes no mention of the new tracking or |
There was a problem hiding this comment.
What's happening with this word change? It seems like an impactful tweak, considering that it shifts from discussing the policy for the linked repo to implying that many policies may exist. Better to leave this for a suggested change that the WG can respond to.
There was a problem hiding this comment.
The page doesn't exist anymore and the repository doesn't have a privacy policy. I adjusted enough to say there was a policy but that policy isn't the policy.
There was a problem hiding this comment.
This effort is part of addressing your feedback highlighted during the approval discussion of the IA document, specifically regarding 'broken links throughout the repo that we'll need to find and clean up,' but fine by me either way.
The wording probably should be a 'privacy policy that existed for a period of time' or 'at the time.' I tried Wayback Machine to replace it with that but it wasn't able to pull it
There was a problem hiding this comment.
Ah, frick. I see how you got there.
Can we get a thumbs up from the WG lead or last committer? If we don't hear back, I'd suggest its better to leave with a broken link than update it with a commit that may not improve the doc.
There was a problem hiding this comment.
This doesn't match the link in the README above, which would place this (perhaps rightfully) as catalog/compromise-definitions.md
There was a problem hiding this comment.
It's unclear what's meant by ./compromise-definitions.md not matching its link in compromises/README.md, as both of these files reside in the same directory. The link is working, and the dot is correctly used as the symbol for the current directory.
By README above you mean community/catalog/compromises/README.md or compromises/README.md?
There was a problem hiding this comment.
Line 11 did have a broken link I failed to catch as was truncated by a break. It pointed to /supply-chain-security/compromises/compromise-definitions.md when it should be community/catalog/compromises/compromise-definitions.m
| @@ -23,7 +23,7 @@ enforcement of one of open sources founding principles, "[Linus's | |||
| Law](https://en.wikipedia.org/wiki/Linus%27s_law)". | |||
|
|
|||
| When submitting an addition, please review the | |||
| [definitions](https://github.com/cncf/sig-security/blob/master/supply-chain-security/compromises/compromise-definitions.md) | |||
| [definitions](./compromise-definitions.md) | |||
There was a problem hiding this comment.
see comment on catalog/compromises/compromise-definitions.md
|
Looks like this needs a rebase + resolving of merge conflicts |
community/publications/README.md
Outdated
There was a problem hiding this comment.
Do we have enough of a consensus on this proposal to nest publications within community/? An alternate proposal was to have publications as a top level directory.
I had been fond of the idea of publications living at the top, but I can also see the justification for nesting it here.
@mnm678 @PushkarJ @mlieberman85 @JustinCappos @ragashreeshekar @ashutosh-narkar @jkjell
There was a problem hiding this comment.
There is a list of select publications in the top-level README.md, along with a link to the publications directory. The publications directory itself doesn't hold any publications; it only contains an index and the directory of audio recordings. That's the structure that we settled on in the doc.
There was a problem hiding this comment.
I have no recollection of the alternate proposal being discussed. The only other discussion involved this PR that was merged, which reinforced the list of selected publications in the README.md and provided an index of source files with their respective locations inside publications/README.md (#1273).
There was a problem hiding this comment.
Cloud Native Security Whitepaper is currently listed on the publications page. Moving it to community resources appears to be an arbitrary downgrade.
There was a problem hiding this comment.
Everything is listed in the publications page. As stated in the IA document, overarching/seminal/tag-wide publications that aren't owned by a workgroup are to be found there as valuable community resources.
There was a problem hiding this comment.
Here is the structure that the group consensus settled on:
community/publications/
Index of published papers, reports, whitepapers, and audio versions of publications. The source files are located in:community/resources/ if they are overarching documents.
community/working-groups/ if they are owned by a working group.
communityassessments/ if they are assessment documents.
There was a problem hiding this comment.
@mnm678 @mlieberman85 @jkjell Please review
There was a problem hiding this comment.
For reviewers this was a merge the contents with the prior README.md,
There was a problem hiding this comment.
The consensus achieved through the IA document discussions settled on the structure captured there:
community/publications/
Index of published papers, reports, whitepapers, and audio versions of publications. The source files are located in:
- community/resources/ if they are overarching documents.
- community/working-groups/ if they are owned by a working group.
- communityassessments/ if they are assessment documents.
If you're proposing something different, we should discuss and plan for it after this current reorganization is complete.
policy-wg-merging.md
Outdated
There was a problem hiding this comment.
Should this be moved into the wg/archive/policy directory?
There was a problem hiding this comment.
None of the key deliverables stated in that file were turned in. Also the Policy workgroup never really merged with TAG security and stayed they stayed their course as a Kubernetes WG.
There was a problem hiding this comment.
This was a file captured in the doc as marked for deletion not move.
roadmap.md
Outdated
There was a problem hiding this comment.
I think this predates all of you. We adopted project boards as captured in this markdown file and migrated everything worth tracking to the board and the leadership notes doc. I don't believe there is anything relevant in the old roadmap other than nostalgic value.
This was captured in the doc as an item marked for deletion.
Signed-off-by: Andrés Vega <[email protected]>
Signed-off-by: Andrés Vega <[email protected]>
- Resolved Netlify build failure caused by incorrect URL formatting - Removed extra parentheses around URLs in cloud-native-security-whitepaper-spanish.md Signed-off-by: Andrés Vega <[email protected]>
Signed-off-by: Andrés Vega <[email protected]> Signed-off-by: Andrés Vega <[email protected]>
|
Yay! I don't know what changed, but suddenly deploy previews and site build logs are viewable once again. The preview error was due to a malformed URL in the Spanish translation of the whitepaper (cloud-native-security-whitepaper-spanish.md). Site is functional. Rebased and a good to go. |
|
@eddie-knight Are you comfortable with the current state before merging? There was extensive commentary, but it wasn’t clear if the feedback required changes. Please let me know if there's anything else you'd like to see addressed. |
Signed-off-by: Andrés Vega <[email protected]>
|
Merging as discussed in the chair and TLs' communications channel, as no concerns were raised following the final review request earlier. |
This pull request includes the initial reorganization of the repository according the Information Architecture proposed, discussed, and approved by all leads to improve accessibility and maintainability. Key changes include: