OSV Schema TI Graduation Application by GeauxJD · Pull Request #456 · ossf/tac

GeauxJD · 2025-03-05T21:52:28Z

This is an initial draft of the application with some of the basic information included. Submitting as a draft PR to allow for contributions from others collaborating on this app.

This adds a CONTRIBUTING.md and CODE_OF_CONDUCT.md to address deficiencies and assist with progressing OSV Schema TI Graduation Application (ossf/tac#456) For want of something better, I used what is present at https://github.com/ossf/oss-vulnerability-guide

This adds a CONTRIBUTING.md and CODE_OF_CONDUCT.md to address deficiencies and assist with progressing OSV Schema TI Graduation Application (ossf/tac#456) For want of something better, I used what is present at https://github.com/ossf/oss-vulnerability-guide Signed-off-by: Andrew Pollock <andrew@pollock.id.au> Signed-off-by: Andrew Pollock <andrewpollock@users.noreply.github.com>

andrewpollock

I've suggested a few modifications based on conversations with related parties

This adds a CONTRIBUTING.md and CODE_OF_CONDUCT.md to address deficiencies and assist with progressing OSV Schema TI Graduation Application (ossf/tac#456) For want of something better, I used what is present at https://github.com/ossf/oss-vulnerability-guide Signed-off-by: Andrew Pollock <andrew@pollock.id.au> Signed-off-by: Andrew Pollock <andrewpollock@users.noreply.github.com>

andrewpollock · 2025-06-26T22:36:15Z

+  * The project has a standing agenda item in the Vulnerability Disclosures Working Group meetings. [Meeting Notes](https://docs.google.com/document/d/1TdxiFofLOfpHUEQILlKq7qkjSsRXVab0uApSDJ8c5rI/edit?tab=t.0)
+
+Implements, practices, and refines mature software development and release practices, such as adherence to semantic versioning, and having a declared policy for stable releases and backported fixes.
+  * "link to policy for (or describe here) software development and release practices"


@oliverchang can you suggest an edit here to describe the release process of the schema?

Actually, it'd be better for that to be in something like a RELEASING.md in the osv-schema repo, I think.

I will take a look at making a RELEASING.md file, the current release process is pretty simple:

Bump up the version (patch version bump for new ecosystems, minor version bump for non breaking schema field changes)

Add schema changes to the changelog

Publish github release

Update the github pages branch to the new release.

SecurityCRob

I approve this!

Signed-off-by: Jeff Diecks <55294502+GeauxJD@users.noreply.github.com>

…e.md Co-authored-by: Andrew Pollock <andrewpollock@users.noreply.github.com> Signed-off-by: Jeff Diecks <55294502+GeauxJD@users.noreply.github.com>

…e.md Co-authored-by: Andrew Pollock <andrewpollock@users.noreply.github.com> Signed-off-by: CRob <69357996+SecurityCRob@users.noreply.github.com>

updating based on Oliver's feedback Signed-off-by: CRob <69357996+SecurityCRob@users.noreply.github.com>

…e.md Co-authored-by: Andrew Pollock <andrewpollock@users.noreply.github.com> Signed-off-by: Jeff Diecks <55294502+GeauxJD@users.noreply.github.com>

marcelamelara

It's really exciting to see OSV schema reach this stage! That said, I would like to see a clearer roadmap for a project at this maturity level, so I hope that we can start to clarify this as part of this process.

marcelamelara · 2025-08-04T21:10:35Z

+  * https://github.com/ossf/osv-schema/blob/main/CHARTER.md
+
+Have a defined and documented roadmap and annual goals for the project
+  * https://github.com/ossf/osv-schema/projects?query=is%3Aopen


The project board is currently empty. Do you a have a sense for the open issues (or other tasks) you might prioritize next?

I don't seem to have the ability to add / link issues onto that project board, but here are the list of current priorities we are working on, ordered by current priority:

Add a severity source field osv-schema#510 - (Adding severity source field)

Representing end-of-life (EOL) in OSV records osv-schema#519 - (Adding a way to represent (sub)ecosystem EOL)

Tighten guidelines on acceptable IDs osv-schema#547 - (Tightening guidelines on acceptable ID characters)

Suggestion: addition of a symbols field osv-schema#501 - (Some more unified forms of affected symbols)

In addition to these, we are continuously onboarding new ecosystems.

marcelamelara · 2025-08-04T21:13:20Z

+  * https://github.com/ossf/osv-schema/projects?query=is%3Aopen
+
+Project has met at least 4 times over a period of at least 2 months since becoming incubating
+  * The project has a standing agenda item in the Vulnerability Disclosures Working Group meetings. [Meeting Notes](https://docs.google.com/document/d/1TdxiFofLOfpHUEQILlKq7qkjSsRXVab0uApSDJ8c5rI/edit?tab=t.0)


Besides the requirements for graduation, there doesn't seem to be a lot of discussion about OSV in recent meetings. Per my comment about prioritization above, once this application is completed, do you have a sense for what's next?

Since this comment, there's been a decent amount of osv discussions. The primary maintainers are located in Sydney Australia, so can't actually attend the US focused meetings.

marcelamelara · 2025-08-04T21:20:38Z

+|-----------------------|-----|
+| Repo                  | https://github.com/ossf/osv-schema |
+| Website               | https://ossf.github.io/osv-schema/ |
+| Contributing guide    |     |


Can you please add the link to the CONTRIBUTING.md file?

lehors · 2025-08-05T07:01:02Z

+## Project graduation application
+
+### Project has met all Incubating requirements
+  * n/a


Why is this said to be not applicable? It is not optional. A project doesn't have to go through every step of the lifecycle and may apply for a status at any level but it still needs to fulfill all the requirements for the previous ones.

lehors · 2025-08-05T07:06:52Z

This PR should also include the related necessary change to be made to the table in the README.md file.

steiza · 2025-08-05T12:39:54Z

+
+### Security Baseline
+
+The project meets all applicable Security Baseline requirements:


It looks like there are some open issues with respect to meeting the security baseline: https://github.com/ossf/osv-schema/issues?q=state%3Aopen%20label%3A%22security%20baseline%22

…e.md Co-authored-by: Andrew Pollock <andrewpollock@users.noreply.github.com> Signed-off-by: Jeff Diecks <55294502+GeauxJD@users.noreply.github.com>

another-rex · 2026-06-18T03:39:40Z

+
+### List of project maintainers
+The project must have maintainers with a minimum of five different contributors from three different organizational affiliations.
+  * Oliver Chang, Google, @oliverchang


Please replace Oliver Chang with Rex Pan (me), Google, @another-rex
and Jess Lowe, Google, @jess-lowe

another-rex · 2026-06-18T03:50:18Z

+  * https://github.com/ossf/osv-schema/blob/main/CHARTER.md
+
+Have a defined and documented roadmap and annual goals for the project
+  * https://github.com/ossf/osv-schema/projects?query=is%3Aopen


I don't seem to have the ability to add / link issues onto that project board, but here are the list of current priorities we are working on, ordered by current priority:

Add a severity source field osv-schema#510 - (Adding severity source field)

Representing end-of-life (EOL) in OSV records osv-schema#519 - (Adding a way to represent (sub)ecosystem EOL)

Tighten guidelines on acceptable IDs osv-schema#547 - (Tightening guidelines on acceptable ID characters)

Suggestion: addition of a symbols field osv-schema#501 - (Some more unified forms of affected symbols)

In addition to these, we are continuously onboarding new ecosystems.

another-rex · 2026-06-18T03:51:19Z

+  * https://github.com/ossf/osv-schema/projects?query=is%3Aopen
+
+Project has met at least 4 times over a period of at least 2 months since becoming incubating
+  * The project has a standing agenda item in the Vulnerability Disclosures Working Group meetings. [Meeting Notes](https://docs.google.com/document/d/1TdxiFofLOfpHUEQILlKq7qkjSsRXVab0uApSDJ8c5rI/edit?tab=t.0)


Since this comment, there's been a decent amount of osv discussions. The primary maintainers are located in Sydney Australia, so can't actually attend the US focused meetings.

andrewpollock mentioned this pull request Apr 24, 2025

docs: add missing base documentation ossf/osv-schema#349

Merged

andrewpollock suggested changes Apr 24, 2025

View reviewed changes

oliverchang reviewed Apr 24, 2025

View reviewed changes

Comment thread process/project-lifecycle-documents/osv-schema_graduation_stage.md Outdated

Comment thread process/project-lifecycle-documents/osv-schema_graduation_stage.md Outdated

Comment thread process/project-lifecycle-documents/osv-schema_graduation_stage.md Outdated

andrewpollock reviewed Jun 26, 2025

View reviewed changes

SecurityCRob approved these changes Jul 18, 2025

View reviewed changes

SecurityCRob added the TI Lifecycle Issue/PR related to TIs' lifecycle status. Needs 5 approvals, 10d review. label Jul 18, 2025

SecurityCRob marked this pull request as ready for review July 18, 2025 15:43

SecurityCRob requested a review from a team as a code owner July 18, 2025 15:43

andrewpollock reviewed Jul 21, 2025

View reviewed changes

Comment thread process/project-lifecycle-documents/osv-schema_graduation_stage.md Outdated

GeauxJD and others added 7 commits August 4, 2025 13:51

Create initial draft of OSV application

951b0d3

Signed-off-by: Jeff Diecks <55294502+GeauxJD@users.noreply.github.com>

Update process/project-lifecycle-documents/osv-schema_graduation_stag…

cab00d8

…e.md Co-authored-by: Andrew Pollock <andrewpollock@users.noreply.github.com> Signed-off-by: Jeff Diecks <55294502+GeauxJD@users.noreply.github.com>

Update process/project-lifecycle-documents/osv-schema_graduation_stag…

940511f

…e.md Co-authored-by: Andrew Pollock <andrewpollock@users.noreply.github.com> Signed-off-by: Jeff Diecks <55294502+GeauxJD@users.noreply.github.com>

Update process/project-lifecycle-documents/osv-schema_graduation_stag…

5d818c1

…e.md Co-authored-by: Andrew Pollock <andrewpollock@users.noreply.github.com> Signed-off-by: Jeff Diecks <55294502+GeauxJD@users.noreply.github.com>

Update process/project-lifecycle-documents/osv-schema_graduation_stag…

600c67c

…e.md Co-authored-by: Andrew Pollock <andrewpollock@users.noreply.github.com> Signed-off-by: CRob <69357996+SecurityCRob@users.noreply.github.com>

Update osv-schema_graduation_stage.md

704a5ba

updating based on Oliver's feedback Signed-off-by: CRob <69357996+SecurityCRob@users.noreply.github.com>

Update process/project-lifecycle-documents/osv-schema_graduation_stag…

e7f7d7b

…e.md Co-authored-by: Andrew Pollock <andrewpollock@users.noreply.github.com> Signed-off-by: Jeff Diecks <55294502+GeauxJD@users.noreply.github.com>

marcelamelara force-pushed the osv-schema-app branch from e28c7eb to e7f7d7b Compare August 4, 2025 20:51

marcelamelara reviewed Aug 4, 2025

View reviewed changes

lehors reviewed Aug 5, 2025

View reviewed changes

steiza reviewed Aug 5, 2025

View reviewed changes

andrewpollock reviewed Sep 25, 2025

View reviewed changes

Comment thread process/project-lifecycle-documents/osv-schema_graduation_stage.md Outdated

andrewpollock reviewed Sep 25, 2025

View reviewed changes

Comment thread process/project-lifecycle-documents/osv-schema_graduation_stage.md Outdated

GeauxJD and others added 2 commits December 18, 2025 15:27

Update process/project-lifecycle-documents/osv-schema_graduation_stag…

e5a1bf5

…e.md Co-authored-by: Andrew Pollock <andrewpollock@users.noreply.github.com> Signed-off-by: Jeff Diecks <55294502+GeauxJD@users.noreply.github.com>

Update process/project-lifecycle-documents/osv-schema_graduation_stag…

127cbd6

…e.md Co-authored-by: Andrew Pollock <andrewpollock@users.noreply.github.com> Signed-off-by: Jeff Diecks <55294502+GeauxJD@users.noreply.github.com>

GeauxJD mentioned this pull request Dec 23, 2025

Technical Initiatives Documentation Updates #557

Open

13 tasks

Merge branch 'main' into osv-schema-app

04e26b1

another-rex reviewed Jun 18, 2026

View reviewed changes


		### Security Baseline

		The project meets all applicable Security Baseline requirements:

Uh oh!

Conversation

GeauxJD commented Mar 5, 2025

Uh oh!

andrewpollock left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

SecurityCRob left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

marcelamelara left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

lehors commented Aug 5, 2025

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

8 participants