Move Californium to a dedicated GitHub organization

Californium's team is willing to move a dedicated GitHub organization in order to be able to use security advisories.

The current active repos are

• https://github.com/eclipse/californium
• https://github.com/eclipse/californium.tools
• https://github.com/eclipse/californium.actinium

The others, e.g. https://github.com/eclipse/californium.core, https://github.com/eclipse/californium.scandium are not longer maintained.

The team would like to start with a single one https://github.com/eclipse/californium.tools first.

Thanks!

added prioritylow ~16280 severitynormal statetodo team:infra labels

/cc @akraus @jvermillard @khudalla @mkovatsch @sbernard

added team:security label

I prefer

https://github.com/eclipse/californium.tools -> https://github.com/eclipse-californium/californium.tools

that changes only one part in the path "eclipse" to "eclipse-californium".

changed the description

I've created the eclipse-californium organization. Is there a time that works best for the project to transfer the repos? There will be some loss of access(an hour or so) until the sync tooling catches up.

For californium.tools any time will work ;-). Just let us know, when you want to start it.

assigned to @mward

Ok I'll start the move here in a few minutes. Once it's complete committers should update their local repos to point at the new remote URLs.

The move should now be finished. Committers that have added their Github IDs to their Eclipse.org accounts will receive access in an hour or so when the sync tooling runs.

Since they are no longer maintained(per this issue) can I move:

californium.element-connector.git
californium.scandium.git
californium.core.git

into the eclipse-archived org?

Yes, from my side ;-).

@khudalla can you please +1 as the PL?

+1

Alright I"ve moved those repos int the eclipse-archived organization and marked them as archived. I've also updated the project metadata.

Hmmm ....

eclipse-californium/californium

I considered, that only "californium.tools" is moved.

But it seems, that the main repo and californium.actinium has also moved.

If so, OK, lets try it. If this is just a wrong forward, please leave the core and actinium unchanged, as I proposed.

Sorry about that. I can put californium and californium.actinium back into the eclipse org if you want to do your testing just with the tools repo.

No, don't move it back. From my point, it's OK. we will test it.

Great!

The only loss so far seems to be the build-status in

Developer Resources

(bottom).

"response status code: 404"

That was from before the move. The linked job was californium-master which does not exists on your Jenkins instance. I've changed it to https://ci.eclipse.org/californium/job/californium-main/ and the build status is back to green.

Let me know once you're all set so I can configure the security managers.

BTW, I'll need to know if you want all the committers to have access to this feature, or only project leads.

Yes, we switched from "master" to "main" for political correctness ...

BTW, I'll need to know if you want all the committers to have access to this feature, or only project leads.

In the past, all interested committers have been involved in such bugs.

One "+" for all is, that Simon an Kai run the upstream projects and are so also affected by vulnerabilities. And, as you may have noticed, I'm usually the one, who is fixing it ;-).

I've set the committers team as the security managers. You should now be able to create security advisories and and private forks from those to work on fixes privately. See https://docs.github.com/en/organizations/managing-peoples-access-to-your-organization-with-roles/managing-security-managers-in-your-organization for details.

Let us know how this works for you.

added Awaiting Feedback label

changed due date to September 16, 2022

Sorry, I currently work on Californium 2065, which was reported on Monday this week. (And a lot of other stuff out-side of open source.)