What is a Steward and which projects do they manage?

[MikeCamel]

Questions:

• to what body or organisation does the word "steward" map?
• can stewardship responsibilities be delegated, and if so, to whom?
• which projects are "published"?

These turn out to complex questions and ones that we need to answer quite quickly in the context of foundations, in particular.

CRA (19): "...Open-source software stewards include certain foundations as well as entities that develop and publish free and open-source software in a business context, including not-for-profit entities. ..."

Article 3 Definitions: "(14) ‘open-source software steward’ means a legal person, other than a manufacturer, that has the purpose or objective of systematically providing support on a sustained basis for the development of specific products with digital elements, qualifying as free and open-source software and intended for commercial activities, and that ensures the viability of
those products;"

The LF is a legal person, whereas the OpenSSF, CCC, CNCF or OpenWallet Foundation (for example) are not. The official unit of stewardship, per the CRA, is therefore a foundation. In fact, we don't really have an agreed term for these bodies within the LF that makes sense in this context - a sub-foundation? "Directed fund" is a term which seems orthogonal to the context. (The same probably applies to the Apache Foundation, Eclipse Foundation, etc..)

What body has responsibility, then, and can responsibilities be delegated, and if so, to whom? Are Governing Boards going to be happy with this?

Next question is which of their projects do they provide? Definitions such as "sand-box" and "graduated" are often applied to projects, but which should be managed? Not to mention the fact that the definitions of these terms differs between sub-foundations.

We need to work - at least at the LF, and probably more broadly as a community - how to approach these questions: presenting a consistent view to the EU is going to be vital here.

[mkdolan]

Please open a legal ticket internally for legal requests.

[SecurityCRob]

Thanks! As things progress forward we will do that.

[MikeCamel]

I think we need to progress this in short order. We don't have an answer to this one yet, and people are really keen to know what a steward looks like. "Sub-foundations" e.g. OpenSSF, CNCF, CCC also need to understand what their responsibilities are and how they can embrace them.

[mkdolan]

@MikeCamel agree that we will need this. However, I'm reluctant to take a position while the standards are being developed.

[SecurityCRob]

Recital 19 states:
"Taking into account the importance for cybersecurity of many products with digital elements qualifying as free and open-source software that are published, but not made available on the market within the meaning of this Regulation, legal persons who provide support on a sustained basis for the development of such products which are intended for commercial activities, and who play a main role in ensuring the viability of those products (open-source software stewards), should be subject to a light-touch and tailor-made regulatory regime. Open-source software stewards include certain foundations as well as entities that develop and publish free and open-source software in a business context, including not-for-profit entities. The regulatory regime should take account of their specific nature and compatibility with the type of obligations imposed. It should only cover products with digital elements qualifying as free and open-source software that are ultimately intended for commercial activities, such as for integration into commercial services or into monetised products with digital elements. For the purposes of that regulatory regime, an intention for integration into monetised products with digital elements includes cases where manufacturers that integrate a component into their own products with digital elements either contribute to the development of that component in a regular manner or provide regular financial assistance to ensure the continuity of a software product. The provision of sustained support to the development of a product with digital elements includes but is not limited to the hosting and managing of software development collaboration platforms, the hosting of source code or software, the governing or managing of products with digital elements qualifying as free and open-source software as well as the steering of the development of such products. Given that the light-touch and tailor-made regulatory regime does not subject those acting as open-source software stewards to the same obligations as those acting as manufacturers under this Regulation, they should not be permitted to affix the CE marking to the products with digital elements whose development they support."

[maertsen]

The official unit of stewardship, per the CRA, is therefore a foundation.

I believe this is too narrow. See https://github.com/orcwg/cra-hub/blob/main/faq.md#q-what-is-an-open-source-software-steward for a reference to statements made by the EC.