provide trustable framework template #27

masc2023 · 2025-06-04T07:53:57Z

Template is based now on sphinx-needs, in contrast to origin used doorstop

trustable framework needs, eclipse-score/process_description#27 add security tag to the document need Resolves: eclipse-score/score#947

github-actions · 2025-06-04T09:52:34Z

The created documentation from the pull request is available at: docu-html

aschemmel-tech

I only comment not to block during my absence

aschemmel-tech · 2025-06-06T11:52:38Z

process/trustable/index.rst

+XYZ trustable overview
+----------------------
+
+.. needtable::


recommend to have a headline for all of these tables

aschemmel-tech · 2025-06-06T11:57:59Z

process/trustable/index.rst

+Tenets and Assertions according your project and evidences.
+
+Especially replace "XYZ" software or SW with the name of your project, e.g.
+"This release of S-CORE is trustable".


I do not think we should write this. Rather: This realease of XYZ was analyzed for trustability and reaches a score of ...

aschemmel-tech · 2025-06-06T11:59:45Z

process/trustable/index.rst

+   tenets/tenets
+   assertions/assertions
+
+.. tsf:: TRUSTABLE SOFTWARE


I do not understand: shouldn't this type and its uses be defined in our metamodel?

There are defined, otherwise it would not build. But it is used only for the definition here, the projects should use our needs, e.g. component requirements, document to define the evidences and link it to the definitions here

aschemmel-tech · 2025-06-06T12:01:24Z

process/trustable/index.rst

+   :status: draft
+   :links: tenet__trust__tt-provenance, tenet__trust__tt-construction, tenet__trust__tt-changes, tenet__trust__tt-expectations, tenet__trust__tt-results, tenet__trust__tt-confidence
+
+    This release of XYZ is Trustable.


see above comment

aschemmel-tech · 2025-06-06T12:02:37Z

process/trustable/index.rst

+    The algorithm for aggregation may involve weighting of specific Tenets or
+    Assertions based on project priorities or experience.
+
+The graphs below presents statistics:


I do not see what these statistics should show.

aschemmel-tech · 2025-06-06T12:35:45Z

process/trustable/tenets/tenets.rst

+
+.. tenet:: TT-PROVENANCE
+   :id: tenet__trust__tt-provenance
+   :status: draft


I would not see the need of a status here, because my understanding is that tenets and assertions are static like standards requirements. And to replace "XYZ" with the project name is would not be something I would expect to set these to "valid"
I would rather add a "satisfied" value in percent which would need to be later calculated somehow. Based on the linked workproducts/evidences.

aschemmel-tech · 2025-06-06T12:47:45Z

process/trustable/index.rst

+consideration of trust must be based on evidence.*
+
+You can copy the folder and use this as a template to measure your OSS project trust.
+Link your evidences to the Trustable Assertions (TA) and update the content of the


as I understand TSF methodology the "Evidences" would be something like written statements("premises") of the project and the "workproducts" would be linked to those. And the tenets and assertions are not modified. See also https://codethinklabs.gitlab.io/trustable/trustable/methodology.html#applying-tsf - second picture

as I understand TSF methodology the "Evidences" would be something like written statements("premises") of the project and the "workproducts" would be linked to those. And the tenets and assertions are not modified. See also https://codethinklabs.gitlab.io/trustable/trustable/methodology.html#applying-tsf - second picture

I used this as input: https://gitlab.com/richardmaw-codethink/safety-monitor/-/tree/main/trustable?ref_type=heads

Template is based now on sphinx-needs, in contrast to origin used doorstop

Resolves: eclipse-score/score#1009 Signed-off-by: Philipp Ahmann <[email protected]>

process/trustable/index.rst

pahmann · 2025-06-13T07:43:52Z

process/trustable/index.rst

+You can use these tenets and assertion defined here to measure your OSS project trust score.
+Link your evidences to the Trustable Assertions (TA).


Suggested change

You can use these tenets and assertion defined here to measure your OSS project trust score.

Link your evidences to the Trustable Assertions (TA).

The tenets and assertions defined in the Trustable Software Framework can be used to measure an (OSS) project trust score.

To calculate the score link evidences to the Trustable Assertions (TA).

process/trustable/index.rst

process/index.rst

pahmann · 2025-06-13T07:59:00Z

process/trustable/assertions/assertions.rst

Assertions and tenets are using some "level: x.y.z" identifier in the original sources of Trustable. I guess they may be optional, but at least want to mention this in the review.

pahmann · 2025-06-13T08:02:02Z

process/trustable/assertions/assertions.rst

+..
+   # *******************************************************************************
+   # Copyright (c) 2025 Contributors to the Eclipse Foundation
+   #
+   # See the NOTICE file(s) distributed with this work for additional
+   # information regarding copyright ownership.
+   #
+   # This program and the accompanying materials are made available under the
+   # terms of the Apache License Version 2.0 which is available at
+   # https://www.apache.org/licenses/LICENSE-2.0
+   #
+   # SPDX-License-Identifier: Apache-2.0
+   # *******************************************************************************
+


You need to be careful here. You are re-using the text and content from Trustable here, but you are changing the original license.

Trustable Software Framework © 2016-25 by Codethink is licensed under Creative
Commons Attribution-ShareAlike 4.0 International. To view a copy of this
license, visit https://creativecommons.org/licenses/by-sa/4.0/ or see the
license text here
The accompanying tools are licensed under Eclipse Public License 2.0,
with support for GPLv2 as a Secondary Clause. See the Eclipse Foundation site
here for more information, or see the
license text here.

See also following links:
https://gitlab.com/CodethinkLabs/trustable/trustable/-/blob/main/LICENCE.md
https://gitlab.com/CodethinkLabs/trustable/trustable/-/blob/main/LICENSE
https://creativecommons.org/licenses/by-sa/4.0/deed.en

The respective SPDX identifier is: CC-BY-SA-4.0

pahmann · 2025-06-13T08:28:17Z

process/trustable/assertions/assertions.rst

+..
+   # *******************************************************************************
+   # Copyright (c) 2025 Contributors to the Eclipse Foundation
+   #
+   # See the NOTICE file(s) distributed with this work for additional
+   # information regarding copyright ownership.
+   #
+   # This program and the accompanying materials are made available under the
+   # terms of the Apache License Version 2.0 which is available at
+   # https://www.apache.org/licenses/LICENSE-2.0
+   #
+   # SPDX-License-Identifier: Apache-2.0
+   # *******************************************************************************


Suggested change

..

# *******************************************************************************

# Copyright (c) 2025 Contributors to the Eclipse Foundation

#

# See the NOTICE file(s) distributed with this work for additional

# information regarding copyright ownership.

#

# This program and the accompanying materials are made available under the

# terms of the Apache License Version 2.0 which is available at

# https://www.apache.org/licenses/LICENSE-2.0

#

# SPDX-License-Identifier: Apache-2.0

# *******************************************************************************

.. SPDX-License-Identifier: CC-BY-SA-4.0

..

note::

This document is based on work by Codethink available at

https://gitlab.com/CodethinkLabs/trustable/trustable.

This modified version is licensed under CC-BY-SA-4.0

in compliance with the original license.

Changes from original:

- levels have been removed

- separated files are aggregated into a single file

- transferred from markdown to rst

- sphinx-needs meta data is added

pahmann · 2025-06-13T08:39:13Z

process/trustable/tenets/tenets.rst

+..
+   # *******************************************************************************
+   # Copyright (c) 2025 Contributors to the Eclipse Foundation
+   #
+   # See the NOTICE file(s) distributed with this work for additional
+   # information regarding copyright ownership.
+   #
+   # This program and the accompanying materials are made available under the
+   # terms of the Apache License Version 2.0 which is available at
+   # https://www.apache.org/licenses/LICENSE-2.0
+   #
+   # SPDX-License-Identifier: Apache-2.0
+   # *******************************************************************************


Suggested change

..

# *******************************************************************************

# Copyright (c) 2025 Contributors to the Eclipse Foundation

#

# See the NOTICE file(s) distributed with this work for additional

# information regarding copyright ownership.

#

# This program and the accompanying materials are made available under the

# terms of the Apache License Version 2.0 which is available at

# https://www.apache.org/licenses/LICENSE-2.0

#

# SPDX-License-Identifier: Apache-2.0

# *******************************************************************************

.. SPDX-License-Identifier: CC-BY-SA-4.0

..

note::

This document is based on work by Codethink available at

https://gitlab.com/CodethinkLabs/trustable/trustable.

This modified version is licensed under CC-BY-SA-4.0

in compliance with the original license.

Changes from original:

- levels have been removed

- separated files are aggregated into a single file

- transferred from markdown to rst

- sphinx-needs meta data is added

pahmann · 2025-06-13T08:45:09Z

process/trustable/index.rst

+..
+   # *******************************************************************************
+   # Copyright (c) 2025 Contributors to the Eclipse Foundation
+   #
+   # See the NOTICE file(s) distributed with this work for additional
+   # information regarding copyright ownership.
+   #
+   # This program and the accompanying materials are made available under the
+   # terms of the Apache License Version 2.0 which is available at
+   # https://www.apache.org/licenses/LICENSE-2.0
+   #
+   # SPDX-License-Identifier: Apache-2.0
+   # *******************************************************************************


Suggested change

..

# *******************************************************************************

# Copyright (c) 2025 Contributors to the Eclipse Foundation

#

# See the NOTICE file(s) distributed with this work for additional

# information regarding copyright ownership.

#

# This program and the accompanying materials are made available under the

# terms of the Apache License Version 2.0 which is available at

# https://www.apache.org/licenses/LICENSE-2.0

#

# SPDX-License-Identifier: Apache-2.0

# *******************************************************************************

.. SPDX-License-Identifier: CC-BY-SA-4.0

..

note::

This document is based on work by Codethink available at

https://gitlab.com/CodethinkLabs/trustable/trustable.

This modified version is licensed under CC-BY-SA-4.0

in compliance with the original license.

Changes from original:

- two paragraphs were combined to single paragraph

- neutral wording instead of "we"

process/trustable/index.rst

Resolves: eclipse-score/score#1009 Signed-off-by: Philipp Ahmann <[email protected]>

pahmann · 2025-06-13T09:39:33Z

Currently the copyright check fails as CC-BY-SA-4.0 is not in the list of https://github.com/eclipse-score/tooling/blob/main/cr_checker/resources/templates.ini

Resolves: eclipse-score/score#1009 Signed-off-by: Philipp Ahmann <[email protected]>

masc2023 requested a review from MaximilianSoerenPollak June 4, 2025 07:54

masc2023 added a commit to eclipse-score/docs-as-code that referenced this pull request Jun 4, 2025

Update metamodel with

801004f

trustable framework needs, eclipse-score/process_description#27 add security tag to the document need Resolves: eclipse-score/score#947

masc2023 mentioned this pull request Jun 4, 2025

Update metamodel with eclipse-score/docs-as-code#69

Merged

masc2023 added a commit to eclipse-score/docs-as-code that referenced this pull request Jun 4, 2025

Update metamodel with

4dd1eed

trustable framework needs, eclipse-score/process_description#27 add security tag to the document need Resolves: eclipse-score/score#947

masc2023 added a commit to eclipse-score/docs-as-code that referenced this pull request Jun 4, 2025

Update metamodel with (#69)

592642d

trustable framework needs, eclipse-score/process_description#27 add security tag to the document need Resolves: eclipse-score/score#947

masc2023 self-assigned this Jun 4, 2025

masc2023 added the documentation Improvements or additions to documentation label Jun 4, 2025

masc2023 force-pushed the masc2023_trustable branch from e15e0c7 to eb28c3b Compare June 4, 2025 09:48

masc2023 marked this pull request as ready for review June 4, 2025 09:49

masc2023 requested a review from aschemmel-tech June 4, 2025 09:49

masc2023 force-pushed the masc2023_trustable branch 3 times, most recently from ec9e511 to da19f14 Compare June 5, 2025 09:10

aschemmel-tech reviewed Jun 6, 2025

View reviewed changes

provide trustable framework template

41ad626

Template is based now on sphinx-needs, in contrast to origin used doorstop

masc2023 force-pushed the masc2023_trustable branch from da19f14 to 41ad626 Compare June 12, 2025 07:10

pahmann self-requested a review June 13, 2025 07:38

trustable: style fixes

b9826fc

Resolves: eclipse-score/score#1009 Signed-off-by: Philipp Ahmann <[email protected]>

pahmann requested changes Jun 13, 2025

View reviewed changes

pahmann added 2 commits June 13, 2025 11:15

trustable: phrase neutral to match general wording

d90bd4d

Resolves: eclipse-score/score#1009 Signed-off-by: Philipp Ahmann <[email protected]>

trustable: add proper license identifier

40e7925

Resolves: eclipse-score/score#1009 Signed-off-by: Philipp Ahmann <[email protected]>

pahmann and others added 2 commits June 13, 2025 11:54

trustable: ignore copyright check in trustable

7148858

Resolves: eclipse-score/score#1009 Signed-off-by: Philipp Ahmann <[email protected]>

Fix formatting

4c8c3b4

pahmann self-assigned this Jun 13, 2025

pahmann approved these changes Jun 25, 2025

View reviewed changes

masc2023 merged commit f064b49 into main Jun 26, 2025
8 checks passed

masc2023 deleted the masc2023_trustable branch June 26, 2025 04:50

		You can use these tenets and assertion defined here to measure your OSS project trust score.
		Link your evidences to the Trustable Assertions (TA).

-..
-   # *******************************************************************************
-   # Copyright (c) 2025 Contributors to the Eclipse Foundation
-   #
-   # See the NOTICE file(s) distributed with this work for additional
-   # information regarding copyright ownership.
-   #
-   # This program and the accompanying materials are made available under the
-   # terms of the Apache License Version 2.0 which is available at
-   # https://www.apache.org/licenses/LICENSE-2.0
-   #
-   # SPDX-License-Identifier: Apache-2.0
-   # *******************************************************************************
+.. SPDX-License-Identifier: CC-BY-SA-4.0
+..
+   note::
+   This document is based on work by Codethink available at
+   https://gitlab.com/CodethinkLabs/trustable/trustable.
+   This modified version is licensed under CC-BY-SA-4.0
+   in compliance with the original license.
+   Changes from original:
+   - levels have been removed
+   - separated files are aggregated into a single file
+   - transferred from markdown to rst
+   - sphinx-needs meta data is added

provide trustable framework template #27

provide trustable framework template #27

Uh oh!

Conversation

masc2023 commented Jun 4, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions bot commented Jun 4, 2025

Uh oh!

aschemmel-tech left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

pahmann commented Jun 13, 2025

Uh oh!

Uh oh!

Uh oh!

masc2023 commented Jun 4, 2025 •

edited

Loading