CII Badge Program Checklist

• Overview at https://www.coreinfrastructure.org/programs/badge-program
• Existing submissions are at https://bestpractices.coreinfrastructure.org/projects
• Example of a certifying submission at https://bestpractices.coreinfrastructure.org/projects/1 (multiple tabs)

Draft of submission, including some open issues and questions below.

Basics

Basic Project Website Content

✓ The project website MUST succinctly describe what the software does (what problem does it solve?).
The Xen ProjectTM is the leading open source virtualization platform that is powering some of the largest clouds in production today. Amazon Web Services, Aliyun, Rackspace Public Cloud, Verizon Cloud and many hosting services use Xen Project software. Plus, it is integrated into multiple cloud orchestration projects like OpenStack.

✓ The project website MUST provide information on how to: obtain, provide feedback (as bug reports or enhancements), and contribute to the software.
http://wiki.xenproject.org/wiki/Reporting_Bugs_against_Xen_Project
http://xenproject.org/help/contribution-guidelines.html

✓ The information on how to contribute MUST explain the contribution process (e.g., are pull requests used?)
http://xenproject.org/developers/governance.html http://xenproject.org/help/contribution-guidelines.html

✓ The information on how to contribute SHOULD include the requirements for acceptable contributions (e.g., a reference to any required coding standard).
http://wiki.xenproject.org/wiki/Submitting_Xen_Project_Patches

FLOSS License

✓ What license(s) is the project released under?
Mostly GPLv2 with some files being released under more permissive licenses to allow interaction with other open source projects

✓ The software MUST be released as FLOSS.
The project is mostly GPLv2, with some exceptions which all must be be OSI approved licenses.

✓It is SUGGESTED that any required license(s) be approved by the Open Source Initiative (OSI).
The project is mostly GPLv2, with some exceptions which all must be be OSI approved licenses.

✓The project MUST post license(s) in a standard location.
http://xenbits.xen.org/gitweb/?p=xen.git;a=blob;f=COPYING
Other repositories by the project also have a COPYING file in the top level of the tree

Documentation

✓The project MUST provide basic documentation for the software.
The project creates man pages and other documentation via http://xenbits.xen.org/docs/

✓The project MUST include reference documentation that describes its interface.
http://xenbits.xen.org/docs/ contains interface definitions, protocol specifications, designs, ...

Other

✗The project sites (website, repository, and download URLs) MUST support HTTPS using TLS.
This is in progress via ticket "[OSSC #77650] Migrating Xen Project websites from http to https"
Notes:

• xenbits.xenproject.org, wiki.xenproject.org, lists.xenproject.org, downloads.xenproject.org are straightforward and can be done by Credativ
• blog.xenproject.org is already done, but does not redirect
• xenproject.org will have to be done via cloudaccess.net at an additional cost of USD 100 per year
• bits.xensource.com does have an https variant without redirect and we do not know who controls the Akamai instance: download links from xenproject.org should use https rather than http

✓The project MUST have one or more mechanisms for discussion (including proposed changes and issues) that are searchable, allow messages and topics to be addressed by URL, enable new people to participate in some of the discussions, and do not require client-side installation of proprietary software.
http://www.xenproject.org/help/mailing-list.html

✓The project SHOULD include documentation in English and be able to accept bug reports and comments about code in English.
Besides in-tree documentation as highlighted earlier, the project has an entire website and wiki dedicated to documentation. See http://wiki.xenproject.org/ and http://www.xenproject.org/

Change Control

Public version-controlled source repository

✓The project MUST have a version-controlled source repository that is publicly readable and has a URL.
Repositories are at http://xenbits.xen.org/gitweb/

✓The source repository MUST track what changes were made, who made the changes, and when the changes were made.
Uses git to track.

✓To enable collaborative review, the project's source repository MUST include interim versions for review between releases; it MUST NOT include only final releases.
Interim versions are put on git, not just final versions.

✓It is SUGGESTED that common distributed version control software be used (e.g., git).
Uses git.

Version numbering

✓The project MUST have a unique version number for each release intended to be used by users.
The primary single user uses git commit records to identify releases.

✓It is SUGGESTED that the Semantic Versioning (SemVer) format be used for releases.
Major changes are recorded using Semantic Versioning (SemVer), beginning with version 2.0.0

✓It is SUGGESTED that projects identify each release within their version control system. For example, it is SUGGESTED that those using git identify each release using git tags. Full releases are tagged using 'git tag'.

Release Notes (ChangeLog)

✓The project MUST provide, in each release, release notes that are a human-readable summary of major changes in that release.
Release notes for major and minor releases are available from download pages, e.g. http://xenproject.org/downloads/xen-archives/xen-46-series/xen-460.html and http://xenproject.org/downloads/xen-archives/xen-46-series/xen-461.html.

✓The release notes MUST identify every publicly known vulnerability that is fixed in each new release.
We do this explicitly for point releases (e.g. http://xenproject.org/downloads/xen-archives/xen-46-series/xen-461.html). However, we do not explicitly list fixed vulnerabilities for major releases which by default contain fixes for all known vulnerabilities as listed in http://xenbits.xen.org/xsa/ up to the release date, unless there has been an oversight (note that this has not happened yet), in which case this would be stated in release notes.

Reporting

Bug reporting process

✓The project MUST provide a process for users to submit bug reports (e.g., using an issue tracker or a mailing list).
http://wiki.xenproject.org/wiki/Reporting_Bugs_against_Xen_Project

✓The project SHOULD use an issue tracker for tracking individual issues.
http://wiki.xenproject.org/wiki/Xen_Bug_Management_Interface

✓The project MUST acknowledge a majority of bug reports submitted in the last 2-12 months (inclusive); the response need not include a fix.
The vast majority of bug reports are acknowledged.

✗The project SHOULD respond to most enhancement requests in the last 2-12 months (inclusive). The project MAY choose not to respond.
It is up to contributors to submit enhancement requests: the Xen Project developers almost never accept "enhancement requests" on their own, unless these are very popular requests from https://xenorg.uservoice.com/forums/172169-xen-development.

✓The project MUST have a publicly available archive for reports and responses for later searching.
Reports and responses are handled as described in http://wiki.xenproject.org/wiki/Reporting_Bugs_against_Xen_Project http://wiki.xenproject.org/wiki/Reporting_Bugs_against_Xen_Project]. Many reports are initially handled via mailing lists, which are searchable via http://xen.markmail.org/ (subject:BUG). The bug tracker is also used (and is searchable); it is described at http://wiki.xenproject.org/wiki/Xen_Bug_Management_Interface

Vulnerability reporting process

✓The project MUST publish the process for reporting vulnerabilities on the project site.
See http://xenproject.org/security-policy.html

✓If private vulnerability reports are supported, the project MUST include how to send the information in a way that is kept private.
See http://xenproject.org/security-policy.html

✓The project's initial response time for any vulnerability report received in the last 6 months MUST be less than or equal to 14 days.
The project's security team typically responds within one working day.