2017-11-09 22:41:53 +00:00
# TUF governance
This document covers the project's governance and committer process. The
project consists of the TUF
[specification ](https://github.com/theupdateframework/specification ) and
2021-09-01 10:14:55 +00:00
[reference implementation ](https://github.com/theupdateframework/python-tuf ).
2017-11-09 22:41:53 +00:00
2017-11-13 16:03:44 +00:00
## Maintainership and Consensus Builder
2017-11-13 15:43:18 +00:00
The project is maintained by the people indicated in
2018-01-24 19:09:48 +00:00
[MAINTAINERS ](MAINTAINERS.txt ). A maintainer is expected to (1) submit and
2017-11-13 15:43:18 +00:00
review GitHub pull requests and (2) open issues or [submit vulnerability
2021-09-01 10:14:55 +00:00
reports](https://github.com/theupdateframework/python-tuf#security-issues-and-bugs).
2017-11-09 22:41:53 +00:00
A maintainer has the authority to approve or reject pull requests submitted by
2022-01-13 16:55:30 +00:00
contributors.
2019-11-05 14:00:35 +00:00
More significant changes in the project, such as those that require a TAP or
2022-01-13 16:55:30 +00:00
changes in governance, are guided by a maintainer called the Consensus
Builder (CB). The project's Consensus Builder (CB) is Justin Cappos
2019-11-09 17:33:48 +00:00
< jcappos @ nyu . edu , @JustinCappos > , who has a lifetime appointment.
2017-11-09 22:41:53 +00:00
## Contributions
2026-03-23 10:19:19 +00:00
Contributors can submit pull requests to the project's repositories. They must
follow the project's [code of conduct ](CODE-OF-CONDUCT.md ), the
[developer certificate of origin ](https://developercertificate.org/ ), and the
repository specific contribution guidelines, such as
[CONTRIBUTING.rst ](CONTRIBUTING.rst ).
2017-11-09 22:41:53 +00:00
## Changes in maintainership
A contributor to the project must express interest in becoming a maintainer.
2017-11-13 16:02:26 +00:00
The CB has the authority to add or remove maintainers.
2017-11-09 22:41:53 +00:00
## Changes in governance
2019-10-30 10:31:33 +00:00
2022-01-13 16:55:30 +00:00
The CB supervises changes in governance, but a majority of maintainers must vote +1 on the PR.
2019-11-09 17:33:48 +00:00
## Changes in the consensus builder
The consensus builder may be appointed for a fixed term or it may be a lifetime appointment. To initiate a change of consensus builder, or a change in the length of the appointment, a GitHub PR must be opened. If a fixed term is specified, the PR should be opened no earlier than 6 weeks before the end of the CB's term. If there is not a fixed term appointment, the PR may be opened at any time. In either case, the PR must be kept open for no less than 4 weeks. Additionally, the PR can only be merged with more +1 than -1 in the binding votes.
2019-10-30 10:31:33 +00:00
Anyone from the community can vote on the PR with either +1 or -1.
Only votes from maintainers that have been listed in the top-level [MAINTAINERS ](MAINTAINERS.txt ) file before the PR is opened are binding.
When there are conflicting PRs about changes in the consensus builder, the PR with the most binding +1 votes is merged.
The consensus builder can volunteer to step down.
