How should an open source project signal its stewardship status?

[MikeCamel]

The maintainers of an open source project may wish to signal the status of their project in terms of stewardship. The most obvious information to include is whether the project is considered both stable enough and supported/maintained enough to be used by a Manufacturer, but other information may be provided, as well. In some cases, the Steward of the project (if appointed) may compile/control/disseminate this information.

Information might include:

• date of the information
• expected lifetime of the information
• if a Steward exists, and if so, details
  • name
  • email
  • URI/URL
• whether the maintainers believe that this project is suitable for use by a Manufacturer
• whether the maintainers are willing to support this for use by a Manufacturer
• version(s) of the project
• link to known vulnerabilities/issues

What else might be included?

Proposal: a standard .md file might be created (e.g. steward.md) within a project hierarchy to allow easy "fetchability". It should preferably be in a machine-readable format. It might be considered for inclusion within an SBOM.

[oej]

A few comments:

• Not all projects will have a steward, there is no requirement to have a steward in the CRA
• The EU Commission is proposing a security attestation for open source projects that is not defined yet, that will likely be a way to signal some sort of "readiness" to be used for a manufacturer
• OWASP has a project called "Common Lifecycle Enumeration" that works on product/project status enumeration that may be useful here.