ADP keywords ideas & questions

[Shane Curcuru <as...@shanecurcuru.org>]

Thanks to Daniel to the pointer!  Outside the ASF I'm involved in a few 
research projects that are looking to improve security and 
discoverability around FOSS software, so I know there are people out 
there who will be excited to see ADP running someday as users.

- The WIP fields list for ADP seemed super-minimalist: is this an 
explicit design decision, or merely because we're early on in the process?

For example, Is there any plan for coordination between ADP tooling/data 
and SBOM or SPDX generators, i.e. by including various ADP fields that 
could be directly exported to part of one of those formats?

- Is there any interest in adding more specific linking fields?  In 
particular, I think artifacts should at least have an explicit "project" 
or "homepage" field that's a URL back to the PMC that manages the 
project as a whole.

- Why is "description" mutable?  From a history perspective, I'd expect 
a field this short would not change for the life of the artifact.  For 
example, since the tarball (or whatever) wouldn't physically change, 
there's no reason to change the Some Product Version 2.3 string either. 
It's also likely something that users might search on, independently of 
the URL to the artifact itself.

Or am I over-thinking the role of security and features to prevent 
future shenanigans here?

Thanks!

-- 
- Shane
   Member
   The Apache Software Foundation


---------------------------------------------------------------------
To unsubscribe, e-mail: artifacts-unsubscribe@infra.apache.org
For additional commands, e-mail: artifacts-help@infra.apache.org

Re: ADP keywords ideas & questions

[Dave Fisher <wa...@apache.org>]

Hi Shane,

The answers to your questions will be put into greater focus once we contract the tooling engineer.

> On Jan 5, 2025, at 1:51 PM, Shane Curcuru <as...@shanecurcuru.org> wrote:
> 
> Thanks to Daniel to the pointer!  Outside the ASF I'm involved in a few research projects that are looking to improve security and discoverability around FOSS software, so I know there are people out there who will be excited to see ADP running someday as users.
> 
> - The WIP fields list for ADP seemed super-minimalist: is this an explicit design decision, or merely because we're early on in the process?

I would say that it is early.

> For example, Is there any plan for coordination between ADP tooling/data and SBOM or SPDX generators, i.e. by including various ADP fields that could be directly exported to part of one of those formats?

We will investigate alignment with SBOM metadata, but will also make sure that we also include attestations that are aligned with ASF Release policies both Infra’s and Legal’s. If adjustments to ASF policy are indicated then we will ask in the appropriate channel.

> - Is there any interest in adding more specific linking fields?  In particular, I think artifacts should at least have an explicit "project" or "homepage" field that's a URL back to the PMC that manages the project as a whole.

IMO the ADP metadata at some level should become automated DOAP for a project and its releases. Artifacts are Releases of Products of Projects of the Foundation. All of that metadata should be available from within ADP. In my view just like for the Incubator Clutch analysis the ADP metadata skeleton for a project can be autogenerated from svn, committee info, and any existing DOAP. 

> - Why is "description" mutable?  From a history perspective, I'd expect a field this short would not change for the life of the artifact.  For example, since the tarball (or whatever) wouldn't physically change, there's no reason to change the Some Product Version 2.3 string either. It's also likely something that users might search on, independently of the URL to the artifact itself.

Let’s discuss this type of concern in detail once our new contractor is in seat and we are defining the Statement of Work.

> Or am I over-thinking the role of security and features to prevent future shenanigans here?

Better to overthink this now, but perhaps keep your powder dry for a few more weeks.

Best,
Dave

> 
> Thanks!
> 
> -- 
> - Shane
>  Member
>  The Apache Software Foundation
> 
> 
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: artifacts-unsubscribe@infra.apache.org
> For additional commands, e-mail: artifacts-help@infra.apache.org
> 


---------------------------------------------------------------------
To unsubscribe, e-mail: artifacts-unsubscribe@infra.apache.org
For additional commands, e-mail: artifacts-help@infra.apache.org