Standardization Process
December 2020
Introduction
This is a meritocratic, consensus-based community project. Anyone with an interest in the project can join the community, contribute to the project design and participate in the decision making process.
Community members who want to be involved in the standards process should be familiar with the CycloneDX Project Guiding Principles and the CycloneDX Specification Design Principles.
For more information on project governance please refer to CycloneDX Project Governance. Community members who want to participate in voting should also refer to CycloneDX Voting Process.
Standardization Process
Proposed modifications and additions to the core specification and official extensions start as a discussion in the specification RFC tracker.
Creation of, and providing feedback on, RFCs is open to all members of the CycloneDX community.
The purpose of the RFC is to gather community feedback on real world use cases and requirements. The RFC is used to record all relevant discussions on the proposal. This may include discussions directly in the RFC tracker but will also be used as the public record of meeting minutes and other relevant discussions.
All RFCs will be announced via the CycloneDX mailing list. If a meeting is planned to discuss a proposal it will be open to the community and announced in the same way.
The deadline for comments is typically 4 weeks but will be specified when the RFC is created. Although extensions may be granted to ensure sufficient feedback is received from relevant subject matter experts in the community. Any extensions will be at the discretion of the CycloneDX Core Team.
At the end of the RFC period the CycloneDX community will vote, by lazy consensus, to accept or reject the proposal and the initial in scope use cases and requirements that have been discussed. This will be announced via the CycloneDX mailing list. Community members wishing to participate in the voting process should take into consideration the CycloneDX Project Guiding Principles and CycloneDX Specification Design Principles. For more details on the voting process refer to CycloneDX Voting Process.
Once the proposal is accepted, it will be recorded in the specification issue tracker to track implementation. The issue will be linked to the initial RFC discussion and assigned to the CycloneDX community member responsible for leading the implementation.
The implementation of changes to the specification are submitted as a pull request in the specification repository. The purpose of the pull request is to gather community feedback on the final implementation. However, all feedback should be relevant to the decided in scope use cases and requirements. Pull requests can be initially created in “draft” to enable early community feedback. When the pull request is ready for formal review, the CycloneDX community will vote, by lazy consensus, to accept or reject the pull request.
