IP Review Comments and Resolution assistance

[Kevin Sutter]

Hi,
We finally received comments back on our initial Contributions to Eclipse via https://dev.eclipse.org/ipzilla/show_bug.cgi?id=12628.

You can read through all of the details if you wish, but I wanted to highlight a few things and ask for some assistance.

1. Evolution Process cleanup
   The material in this repo still has several references/URLs back to the old microprofile.io site.  There are also references to being "derived" from Swift Evolution Process.  You can see that I have tried to explain some of this away.  But, I also know that we're trying to revamp the "evolution process" into something a bit more simplified.  As we continue with those efforts, please try to clean up any errant URL references, etc.
   
   
2. 3rd Party Content
   All 3rd Party dependencies need to have a CQ (Contribution Questionnaire) filed.  This is where I need the most assistance.  Our samples and conference apps, and maybe some of our component development (config, fault tolerance, jwt, etc) probably have references and dependencies on 3rd party content.  These all need to be registered with Eclipse[1].
   
   
3. Copyright and Notices files
   We went round-and-round on the Copyright requirements.  We finally determined that the use of a Notices file should be sufficient and acceptable[2].  They would like confirmation and demonstration that this process is being followed.  If we could demonstrate this with Config immediately, and with the other components soon thereafter, then I think that would be good.
   
   
4. Rest of comments...
   I'll continue to push on the other comments to get clarifications.  But, if I could get some volunteers to help with these other items, I would appreciate it.  Thanks.
   

[1]  https://eclipse.org/org/documents/Eclipse_Policy_and_Procedure_for_3rd_Party_Dependencies_Final.pdf
[2]  https://groups.google.com/forum/#!topic/microprofile/sRqsnPTkkKE

[Kevin Sutter]

I've created the following Issues for tackling the 3rd party clearance work items.  Each affected component has a corresponding issue.  I tried to remove duplicates within a component, and I noticed several duplicates across components.  I think the key ones to focus on first are microprofile-config, microprofile-bom, and microprofile-conference.  Once we get these resolved, then that should cover most of the duplicates with the other components.  Beware...  The microprofile-conference issue may require a team effort since it spans many vendors...

We will need to get these CQ Issues created (and maybe resolved?) before we can properly release config-1.0 and/or microprofile-1.1.  So, this is a critical work request.  Thanks for your help.

https://github.com/eclipse/microprofile-bom/issues/2
https://github.com/eclipse/microprofile-config/issues/170
https://github.com/eclipse/microprofile-conference/issues/153

https://github.com/eclipse/microprofile-samples/issues/39
https://github.com/eclipse/microprofile-fault-tolerance/issues/29
https://github.com/eclipse/microprofile-health/issues/5

Another issue that needs to be looked at is the use of the JavaOne2016 speaker list (part of the Conference app).  I've assigned this to Andy G for now...
https://github.com/eclipse/microprofile-conference/issues/154

We should clean up the evolution-process repo per the process improvements we've been discussing.  I've created a generic Issue for this work and assigned it to Ken for now since he's been driving some of the process improvements and simplifications.  This is not urgent, work in progress.
https://github.com/eclipse/microprofile-evolution-process/issues/35

And, the final thing we need to provide in each of our component repos is a CONTRIBUTING.adoc file.  I'm experimenting with one in the microprofile-bom component.  Once I get something that is workable, then we can duplicate it in the other components.

Thanks for your help!
Kevin

[Kevin Sutter]

A bit more information on this CQ processing...  I've just submitted three CQs for our jax-rs 2.0, cdi 1.2, and json 1.0 api usage.  Here's what I figured out...

Creation of the CQ is done via the link on the right hand side of our project page (under Committer tools, under Intellectual Property...):
https://projects.eclipse.org/proposals/eclipse-microprofile
https://projects.eclipse.org/projects/technology.microprofile/cq/create

Only Committers can submit CQs.

Once you select to create a CQ, you should select 3rd Party Code Request as the type of CQ.  (The majority of our initial CQ's will be 3rd Party.)

On the next page, be creative with your Search.  The most likely name to use for your search is the artifact-id from your pom.xml dependency.  Try to find the name and version of the piece of software you are using.  If you can find one already in use and approved, then your job is very easy.  In this case, we just have to create a piggy-back CQ that references this existing approved usage.

If you can't find a match, then there's a bit more work.  You need to fill out a short questionnaire that describes our usage.  You will need to provide a pointer to the project's website, the source of the 3rd party software, and a few other questions.  Nothing too major at this point.  I would guess that most of our 3rd party usage will be pretty easy to approve, but we won't know until we start to submit them and interacting with the Eclipse IPO team.

Once the CQ questionnaire is finished, then an IPZilla bug tracker is created.  This is then used as your interface with the IPO team.  For some examples, here are the ones that were created for my jax-rs 2.0, cdi 1.2, and json 1.0 api CQs:
https://dev.eclipse.org/ipzilla/show_bug.cgi?id=13738
https://dev.eclipse.org/ipzilla/show_bug.cgi?id=13740
https://dev.eclipse.org/ipzilla/show_bug.cgi?id=13739

I'm going to push ahead with these other items as I have time...  Please help out since we have so many of them.

Thanks!
Kevin

[Kevin Sutter]

One more thing...

You need to select Type B - Full IP Due Diligience (License, Provenance, Scanning) as the Due Diligence Type.  The Type A is just a quick short cut, but eventually we would need to do the full Type B anyway, so we might as well start with it.

Thanks, Kevin

[Kevin Sutter]

Learn something new every day...

It turns out that we can group our build and test dependencies into a single CQ.  This should greatly simplify our effort in this area.  I'm doing my experimentation with this process with the microprofile-bom and microprofile-config repos.  I'll keep you posted on the progress.

Still looking for assistance with the other repos...

--  Kevin

[Wayne Beaton]

The so called Type A due diligence is not a short cut. It's a different path.

With Type A, we do a license scan and certify the content based on the results of that. With the Type B due diligence, the IP Team engaged in a very complete review that includes verification of the provenance and scans for various other sorts of anomalies (e.g. code that may have been copied from another source).

Both are valid paths through the process. Type A gets you to the point where you can do releases quickly. Type B reviews can be very lengthy. For that reason, we tend to start new projects in Type A and push for a first release in that mode. Projects can opt to switch to Type B at any point. We have some projects that do a "Type B" release every year (for example), but have several Type A releases in between.

Type A is a completely valid (i.e. not a short cut) path through the IP Process, and--frankly--is still more rigorous an intellectual property process than basically everybody else does (including the Apache Foundation).

Wayne

--
You received this message because you are subscribed to the Google Groups "MicroProfile" group.
To unsubscribe from this group and stop receiving emails from it, send an email to microprofile+unsubscribe@googlegroups.com.
To post to this group, send email to microp...@googlegroups.com.

To view this discussion on the web visit https://groups.google.com/d/msgid/microprofile/45b337b5-4ece-43da-a1c7-e8129acc4e8d%40googlegroups.com.

For more options, visit https://groups.google.com/d/optout.

--

Wayne Beaton

Director of Open Source Projects

The Eclipse Foundation

[Kevin Sutter]

Thanks, Wayne, for monitoring our discussions on this topic...

The reason for my "short cut" comment was the description of Type A vs Type B in this document [1].  In this doc, it sounded like the scan and analysis would have to be done by the Project and submitted to the EMO.  So, instead of us figuring out yet another tool and process, I figured it was better to just stick with Type B and let the EMO do the scanning and analysis.

If you are indicating that the process is simpler than that with Type A, and we are trying to expedite the process so that we could release Config 1.0 and MicroProfile 1.1, then maybe I should be changing all of our CQs to Type A instead of Type B?  Including our Initial Contribution CQ [2]?  I'll do anything for a quicker path through this release process...  :-)

Please clarify.  Thanks!

Kevin

[1]  https://eclipse.org/org/documents/Eclipse_IP_Policy.pdf
[2]  https://dev.eclipse.org/ipzilla/show_bug.cgi?id=12628

[Wayne Beaton]

In the process of implementing the policy, we sorted out that we could invoke the tools automatically. Just submit the CQ, designate it as Type A, and magic happens.

I'll see what we can do to revise the wording in the Eclipse IP Policy to avoid confusion.

Wayne

On Wed, Jun 14, 2017 at 2:32 PM, Kevin Sutter <kwsu...@gmail.com> wrote:

Thanks, Wayne, for monitoring our discussions on this topic...

The reason for my "short cut" comment was the description of Type A vs Type B in this document [1].  In this doc, it sounded like the scan and analysis would have to be done by the Project and submitted to the EMO.  So, instead of us figuring out yet another tool and process, I figured it was better to just stick with Type B and let the EMO do the scanning and analysis.

If you are indicating that the process is simpler than that with Type A, and we are trying to expedite the process so that we could release Config 1.0 and MicroProfile 1.1, then maybe I should be changing all of our CQs to Type A instead of Type B?  Including our Initial Contribution CQ [2]?  I'll do anything for a quicker path through this release process...  :-)

Please clarify.  Thanks!

Kevin

[1]  https://eclipse.org/org/documents/Eclipse_IP_Policy.pdf
[2]  https://dev.eclipse.org/ipzilla/show_bug.cgi?id=12628

[Kevin Sutter]

Thanks, Wayne. 

It doesn't look like I can easily change the Type on the IPZilla CQs...  Anything you can do to help expedite our review process if we can utilize Type A instead?

Thanks, Kevin

[Wayne Beaton]

I'll let the IP Team know. They'll wrestle them into the right state.

Wayne

On Wed, Jun 14, 2017 at 3:03 PM, Kevin Sutter <kwsu...@gmail.com> wrote:

Thanks, Wayne. 

It doesn't look like I can easily change the Type on the IPZilla CQs...  Anything you can do to help expedite our review process if we can utilize Type A instead?

Thanks, Kevin

[Kevin Sutter]

Just so that we wouldn't lose or forget all of this wonderful process information, I've updated our Contribution Guidelines:
https://wiki.eclipse.org/MicroProfile/ContributingGuidelines

As I learn more about this process, I'll continue to update it.

--  Kevin

[Kevin Sutter]

Just a quick update since I'm sure most of you are not paying attention to all of the CQs...  :-)

The only CQs left to approve are related to our Build and Test tools (arquillian, junit, testng, etc).  I don't expect any hiccups with these, but you never know.  I still have a few other outstanding Issues that need to be addressed, but they are not critical for passing the CQs.  Those items that were required for the CQs were already pushed by me as PRs and have been merged.

--  Kevin

[Emily Jiang]

Thank you Kevin for handling the CQ in the MicroProfile project level, which reduces a lot of duplications from sub moduels!
Emily

To unsubscribe from this group and stop receiving emails from it, send an email to microprofile...@googlegroups.com.

To post to this group, send email to microp...@googlegroups.com.

To view this discussion on the web visit https://groups.google.com/d/msgid/microprofile/45b337b5-4ece-43da-a1c7-e8129acc4e8d%40googlegroups.com.

For more options, visit https://groups.google.com/d/optout.

--

Wayne Beaton

Director of Open Source Projects

The Eclipse Foundation

--

Wayne Beaton

Director of Open Source Projects

The Eclipse Foundation

[Kevin Sutter]

We're getting so close to completing this initial activity...  I have documented the process for future reference as each of you work on the individual components:
https://wiki.eclipse.org/MicroProfile/3rdPartyDependencyProcess

I have also created and linked a spreadsheet to this page to help keep track of all of the software which has been cleared:
https://docs.google.com/spreadsheets/d/170UzbBpMK-K50maXVpwcyQ481x1fSo4u2d6gDlKoPts/edit#gid=0

Hope this helps!
Kevin

[Kevin Sutter]

Finally!  Just got word that our Initial Contribution Questionnaire was just approved!
https://dev.eclipse.org/ipzilla/show_bug.cgi?id=12628

We are now clear to submit the requests for the Config 1.0 and MicroProfile 1.1 IP reviews.  These should go much quicker and smoother since all of this initial legwork has been completed already.

Onwards!
Kevin