Consider moving ORT from LF to EF

[sschuberth]

I'd like to consider us moving the ORT project from LF (Linux Foundation) to EF (Eclipse Foundation) for various reasons.

Topics about the LF

Lack of activity:

• Since it's inception in 2019, ACT has not shown any significant activity.
  • LF was not able to attract more members than the founding parties.
  • In fact, some founding projects, like the announced Tern, are dead by now (no commits for 2 years).

Lack of support:

• LF / ACT have never proactively reached out to us to support ORT in any way (funding, marketing, promotion, community building, infrastructure, etc.)
• Email communication to clarify the situation has been unanswered for months despite several tries.
• ORT was removed from LFX Insights (it seems) without telling us.

Problems in communication:

• While there is LF Europe by now, LF remains US-centric. This reflects e.g. in meeting times which are more suitable for the US.
• Several parties (that prefer to not be named) have reported that ACT / TAC meetings tend to wander off into SPDX promotion meetings in disguise, not sticking to SBOM-format-neutral "Automated Compliance Tooling" matters.
• Due to a lack of ACT promotion, even inside LF the project and its tools are unknown. I know of at least two occasions, where LF members in need of compliance tooling were told that LF has no existing Open Source solution for that topic. Instead, LF / the SPDX WG seem to develop a new tool called "Scaffold" (and also something called "Parley" as mentioned, but not ORT).

No good technology fit:

• Let's face it, LF is about Linux and related ecosystems mostly. That includes the Linux kernel, embedded systems, containers etc. to a large extend. Which is technology that ORT was not made for: ORT is about application compliance for managed enterprise software, not (Linux) distribution / container compliance.
• As a result, LF has no inherent interest to use ORT itself.
  • They seem to favor using / promoting FOSSology instead.
• Also "spirit-wise", the thinking and communities do not seem to fit well.

Topics about the EF

Good relationship:

• The EF has been interested in ORT from the point it learned about it, up to the point where the considered to revamp their internal CQ process with ORT (which failed due to a lack of scalability, which is something that's being resolved now with the server).
  • Even paid some of us for consultancy and custom development, despite ORT formally being an LF project.

Closer collaboration:

• EF is much more EU based.
• EF has an inherent interest in ORT for its own use.
• The ORT Server already is an EF project.
  • Good experience with project on-boarding.
• Double Open (like Bosch) is an EF member organization.
  • Double Open and nexB / AboutCode will work closely with EF as part of EU-funded OCCTET project.

Better technology fit:

• Many EF projects have their home in the Java / JVM community.
  • Much easier to attract ORT developers coming from other EF projects.
• "Neutral" ground in terms of SBOMs as not associated with SPDX (or any other format) only.

Better community match:

• Think of EF SDV et al

Potential Obstacles

• Transferring the ORT (unregistered) trademark from LF to EF.
  • Applies to all IP.
• Clarify whether you can commit to EF projects on behalf of an organization that is not an EF member organization.

Process (according to @tsteenbe)

• Change charta (with 2/3 votes) to allow ourselves to move the project.
• Then formally vote to perform the move.
• Original owner / donator (HERE Technologies) also needs to agree.

[sschuberth]

Just to get an initial feel about whether we should proceed with this further. @oss-review-toolkit/tsc please vote on this post with

• 👍🏻 if you are in favor with proceeding with the LF -> EF move
• 👎🏻 if you are not in favor with proceeding with the LF -> EF move
• 👀 if you want to abstain from voting

[sschuberth]

As there is a simple majority vote, we're going to proceed further:

Next step would be email communication with LF, involving all TSC members.