1= Tips & Tricks for PMC Chair 2:toc: left 3// Licensed to the Apache Software Foundation (ASF) under one 4// or more contributor license agreements. See the NOTICE file 5// distributed with this work for additional information 6// regarding copyright ownership. The ASF licenses this file 7// to you under the Apache License, Version 2.0 (the 8// "License"); you may not use this file except in compliance 9// with the License. You may obtain a copy of the License at 10// 11// http://www.apache.org/licenses/LICENSE-2.0 12// 13// Unless required by applicable law or agreed to in writing, 14// software distributed under the License is distributed on an 15// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY 16// KIND, either express or implied. See the License for the 17// specific language governing permissions and limitations 18// under the License. 19 20Congratulations on becoming the Chair of the Lucene PMC! Thank you for accepting the role. 21 22The primary responsibilities of the Chair are: 23 24. <<Grant Karma to New Committers,Grant karma for new committers>> 25. <<Grant Karma to new PMC Members,Grant karma for new members of the PMC>> 26. Deal with <<Security Issues,security issues>> and reports of vulnerabilities 27. Make <<Board Reports,quarterly reports>> to the ASF Board 28. Handle <<Miscellaneous Requests,miscellaneous requests>> for Git repos, mailing lists, Jenkins access, etc. 29 30== Tools to Help You 31As a member of the PMC, you should have already been granted permission to the necessary systems. As Chair, in some cases you have higher permissions. 32 33The following Apache systems help automate some of the things you need to do: 34 35* Whimsy: https://whimsy.apache.org/. The official project roster is stored in Whimsy. This is where you go to add new committers or PMC members, and grant Jenkins permissions. 36* Reporter Tool: https://reporter.apache.org/. A wizard here will help you file the quarterly report. 37* Apache Self-Serve: https://selfserve.apache.org/. Several tools to help if you need to create new Jira projects, Confluence spaces, GitHub repos, mailing lists, etc. 38 39== Grant Karma to New Committers 40 41When the PMC votes to make a contributor into a committer, the Chair does not usually have to do anything. 42 43Traditionally we expect the person who recommended the new committer to handle inviting the person to become a committer, ensuring their accounts get set up properly, and announcing the change to the dev@lucene list. 44 45If the person is not yet a committer on any other Apache project, they will need to submit an Individual Contributor License Agreement (ICLA) before their account can be created. 46 47Once their ICLA is on file, the Infra team will set up their account and grant them committer permissions. 48 49If the person already has an ICLA on file, anyone on the PMC can go to the https://whimsy.apache.org/roster/committee/lucene[Lucene roster in Whimsy] and add the person. 50 51See also http://apache.org/dev/pmc.html#noncommitter for details on the process. 52 53=== Jira and Confluence Permissions 54 55Jira and Confluence use Apache's LDAP system for authentication, so once the new committer has been granted the permissions to make commits, they will have updated permissions in those systems also. They will not automatically have Jenkins or GitHub permissions, however. 56 57=== GitHub Permissions 58 59For a new committer to have permissions to make commits via GitHub and to also create, merge, or close GitHub pull requests via the GitHub interface, they must first link their Apache and GitHub user IDs. They can do this by going to https://id.apache.org and filling in the "Your GitHub Username" field. 60 61After adding their GitHub ID, it can take 3-4 hours for the permissions in GitHub to be updated. The committer will need to make sure they have two-factor authentication (2FA) enabled in GitHub in order for the permissions to be granted. 62 63See also https://reference.apache.org/committer/github. 64 65== Grant Karma to new PMC Members 66 67Once a vote to add a new member of the PMC has passed, the Chair must send the proposed change to the Board by sending an email to board@apache.org with a link to the Vote & Result thread from the archives (https://lists.apache.org/). 68 69The board will not respond. After 72 hours, check that the mail appears in the Board archives by sending mail to `board-index@apache.org`. The response should show the notification to the Board was received. 70 71Once the 72 hours has passed, the Chair can go to the https://whimsy.apache.org/roster/committee/lucene[Lucene roster in Whimsy] and change the person from a Committer to a member of the PMC. 72 73See also: http://www.apache.org/dev/pmc.html#newpmc. 74 75== Security Issues 76 77Apache has a dedicated security team that helps handle reports of vulnerabilities in all Apache software. 78 79The standard process for handling vulnerability reports is defined at https://www.apache.org/security/committers.html#vulnerability-handling. 80 81*All vulnerability reports must be handled with discretion and should not be discussed outside the Apache Security team and the PMC.* The reason for this is to prevent the vulnerability from being exploited before we have a chance to come up with proper mitigation steps and/or bug fixes. 82 83=== How Vulnerabilities are Reported 84The mailing list security@lucene.apache.org has been set up to handle vulnerability reports. This list includes the Apache Security team, so they do not need to be cc'd on mails to that list. PMC members are unfortunately not automatically subscribed to this list, they must subscribe themselves. 85 86The Apache Security team should be kept in the loop regarding how we decide to handle any vulnerability report. They are not cc'd on mails to private@lucene.apache.org, so if discussion happens there, security@apache.org should be copied where appropriate. 87 88Vulnerabilities may also be reported via Jira. When this happens, the Security Level field in the issue must be set to "Private", which means it can only be viewed by members of the PMC. 89 90If the vulnerability is reported via email, ensure that security@apache.org has a copy of the report, and also file a Jira issue for discussion about mitigation and fix. 91 92=== Mitigation and Fixes 93 94It's up to the PMC as a whole to provide workarounds and/or fixes for all vulnerability reports. Your job as Chair is to ensure that it's happening in a timely manner and according to the process. There's nothing specific you have to do unless others are not doing it. 95 96== Board Reports 97 98The Chair must submit a quarterly report to the Apache Board of Directors. Our schedule is to file reports in March, June, September, and December of any year. 99 100=== Schedule 101 102Reports are due quarterly. A bot will send a reminder that a report is due before the monthly ASF Board meeting; 103the report is due a week before the scheduled meeting. 104 105It's customary to send a draft of the report to the PMC for review prior to sending it to the Board. 106 107=== Template & Wizard 108 109A report template is available from https://reporter.apache.org. 110 111To make creating the report easier, a reporting wizard is available at https://reporter.apache.org/wizard/. 112 113The wizard will provide a blank template with the sections already defined. As you use the wizard to write the report, it will show you data and examples to assist you in completing the report. 114 115Open security issues should be reported to the Board. Since Board reports are generally public, discussion of the issues should be in `<private>` tags so they are removed from the report when the Board makes it public after their monthly meeting. This helps prevent details of vulnerabilities from leaking out before they have been mitigated. 116 117=== Board Feedback 118 119After the Board meeting, they may have feedback on the quarterly report. They may simply make a comment, or they may request something as follow-up. Respond to the feedback as appropriate. 120 121== Miscellaneous Requests 122 123=== Add Jenkins Rights 124 125This will allow the user to configure Jenkins jobs. 126 127Just add the committer to the `hudson-jobadmin` group in Whimsy: https://whimsy.apache.org/roster/group/hudson-jobadmin 128 129=== IP Clearance 130 131Code donations are kept in https://svn.apache.org/repos/asf/incubator/public/trunk/content/ip-clearance. For the process, see https://incubator.apache.org/ip-clearance/. 132 133=== Licenses and Passwords 134 135Private PMC files: https://svn.apache.org/repos/private/pmc/lucene/ 136 137=== Changing the Chair 138The Lucene PMC traditionally rotates the Chair once a year. 139 140When it's time to change Chairs, think of a member of the PMC to replace you and ask if they will be willing to serve a term as Chair. 141If they agree, you can start a VOTE thread in private@lucene.apache.org nominating your successor. 142 143Assuming the vote passes, you can send a resolution to the Board for their approval to change the Chair. Include the vote thread in the resolution. 144You do not need to wait until the usual quarterly report is due to change the Chair. 145 146Resolution example/template: 147 148---- 149A. Change the Apache Lucene Project Chair 150 151 WHEREAS, the Board of Directors heretofore appointed <old Chair> 152 (<apache id>) to the office of Vice President, Apache Lucene, and 153 154 WHEREAS, the Board of Directors is in receipt of the resignation 155 of Adrien Grand from the office of Vice President, Apache 156 Lucene, and 157 158 WHEREAS, the Project Management Committee of the Apache Lucene 159 project has chosen by vote to recommend <new Chair> (<apache id>) 160 as the successor to the post; 161 162 NOW, THEREFORE, BE IT RESOLVED, that <old Chair> is relieved 163 and discharged from the duties and responsibilities of the office 164 of Vice President, Apache Lucene, and 165 166 BE IT FURTHER RESOLVED, that <new Chair> be and hereby is 167 appointed to the office of Vice President, Apache Lucene, to serve 168 in accordance with and subject to the direction of the Board of 169 Directors and the Bylaws of the Foundation until death, 170 resignation, retirement, removal or disqualification, or until a 171 successor is appointed. 172 173 Thread: <link to vote thread> 174---- 175 176The Board will vote to adopt the resolution in their next meeting. 177 178Thank you for being Chair! 179