[Incubation] ORAS Incubation Application

# Review Project Moving Level Evaluation
- [x] I have reviewed the TOC's [moving level readiness triage guide](https://github.com/cncf/toc/blob/main/operations/dd-toc-guide.md#initial-triageevaluation-prior-to-assignment), ensured the criteria for my project are met before opening this issue, and understand that unmet criteria will result in the project's application being closed.

# ORAS Incubation Application
v1.6
This template provides the project with a framework to inform the TOC of their conformance to the Incubation Level Criteria.

Project Repo(s): https://github.com/oras-project
Project Site: https://oras.land/
Sub-Projects:
* ORAS CLI project https://github.com/oras-project/oras/
* ORAS Rust SDK https://github.com/oras-project/rust-oci-client/
* ORAS Go SDK https://github.com/oras-project/oras-go/
* ORAS Website https://github.com/oras-project/oras-www/
* ORAS Python SDK https://github.com/oras-project/oras-py/
* ORAS Java SDK https://github.com/oras-project/oras-java/
* ORAS Dotnet SDK https://github.com/oras-project/oras-mcp
* ORAS GitHub action https://github.com/oras-project/setup-oras/
* ORAS MCP https://github.com/oras-project/oras-mcp/

Communication: https://cloud-native.slack.com/archives/CJ1KHJM5Z

Project points of contacts:
- Andrew Block, ablock@redhat.com
- Feynman Zhou, feynmanzhou@microsoft.com
- Terry Howe, terrylhowe@gmail.com
- Shiwei Zhang, shizh@microsoft.com
- Sajay Antony, sajaya@microsoft.com

### Application Level Assertion

- [x] This project is currently Sandbox, accepted on 20210713, and applying to Incubation.
- [x] This project is applying to join the CNCF at the Incubation level.

### Adoption Assertion

ORAS adopters has been listed at https://oras.land/adopters

## Application Process Principles

### Suggested

N/A

### Required

- [ ] **Engage with the domain specific TAG(s) to increase awareness through a presentation or completing a General Technical Review.**
- We will go to [CNCF TAG Workloads Foundation](https://github.com/cncf/toc/blob/main/tags/tag-workloads-foundation/charter.md) to present ORAS in their TAG meeting after KubeCon NA.

- [ ] **TAG provides insight/recommendation of the project in the context of the landscape**

- [x] **All project metadata and resources are [vendor-neutral](https://contribute.cncf.io/maintainers/community/vendor-fity/).**

- Yes. ORAS is utilizing vendor neutral resources for communication, testing , hosting and governance.

- [x] **Review and acknowledgement of expectations for [Sandbox](https://sandbox.cncf.io) projects and requirements for moving forward through the CNCF Maturity levels.**
- Met during Project's application on 2021.07.13

- [ ] **Due Diligence Review.**

- To be done by TOC

Completion of this due diligence document, resolution of concerns raised, and presented for public comment satisfies the Due Diligence Review criteria.

- [x] **Additional documentation as appropriate for project type, e.g.: installation documentation, end user documentation, reference implementation and/or code samples.**
- Installation guide: https://oras.land/docs/installation
- User documentation: https://oras.land/docs/category/how-to-guides
- Concepts and reference: https://oras.land/docs/category/concepts

## Governance and Maintainers

Note: this section may be augmented by the completion of a Governance Review from the Project Reviews subproject.

### Suggested

- [x] **Governance has continuously been iterated upon by the project as a result of their experience applying it, with the governance history demonstrating evolution of maturity alongside the project's maturity evolution.**
- [ORAS community governance doc](https://github.com/oras-project/community/blob/main/governance/GOVERNANCE.md)

- [x] **Clear and discoverable project governance documentation.**
* [ORAS Community Documentation](https://oras.land/community/community_resources)
* [Project Governance](https://github.com/oras-project/community/blob/main/governance/GOVERNANCE.md)

- [x] **Governance is up to date with actual project activities, including any meetings, elections, leadership, or approval processes.**
* ORAS project governance has iterated organically as it has gained experienced over the years. The Project has currently 15 active maintainers and it has received contributions from 267 contributors who come from different companies. The ORAS project holds bi-weekly community meetings ([notes](https://hackmd.io/5jBuSmL1QjG-_C1PUNonCQ?view)) where many topics, including those that are goverance related, are discussed.

- [x] **Governance clearly documents [vendor-neutrality](https://contribute.cncf.io/maintainers/community/vendor-neutrality/) of project direction.**
* ORAS is utilizing vendor neutral resources for communication, testing , hosting and governance

- [x] **Document how the project makes decisions on leadership, contribution acceptance, requests to the CNCF, and changes to governance or project goals.**
* The ORAS project uses several open and transparent forums to discuss key project decisions, incluing leadership, contributions and governance
* GitHub Issues in related project repositories (primairly within the [community](https://github.com/oras-project/community) repository)
* [Project Governance](https://github.com/oras-project/community/blob/main/governance/GOVERNANCE.md)
* [Contributor Guide](https://oras.land/community/contributing_guide)
* [Contributor Ladder](https://oras.land/community/contributor_ladder)

- [x] **Document how role, function-based members, or sub-teams are assigned, onboarded, and removed for specific teams (example: Security Response Committee).**
* [Project Governance](https://github.com/oras-project/community/blob/main/governance/GOVERNANCE.md)
* [Contributor Guide](https://oras.land/community/contributing_guide)
* [Contributor Ladder](https://oras.land/community/contributor_ladder)

- [x] **Document a complete maintainer lifecycle process (including roles, onboarding, offboarding, and emeritus status).**
* ORAS includes a thorough document which describes the [Contribtor Ladder](https://oras.land/community/contributor_ladder) that outlines the roles and responsibilities within the project.

- [x] **Demonstrate usage of the maintainer lifecycle with outcomes, either through the addition or replacement of maintainers as project events have required.**
* ORAS demonstrates the lifecycle of maintainers by routinely promoting new maintainers and moving existing maintainers who no longer wish to retain their maintainer role of emeritus status. This can be seen in practice as described within [this article](https://oras.land/blog/welcome-new-oras-owners).
* OWNERS files are located in each project repository which illustrates the individuals who are currently repsonsible including those that have contributed in the past (Emeritus)

- [x] **If the project has subprojects: subproject leadership, contribution, maturity status documented, including add/remove process.**
* ORAS project includes several subprojects. OWNERS files are located within each subproject (Example: [OWNERS](https://github.com/oras-project/oras-go/blob/main/OWNERS.md))
* GitHub Issues are used for discussions related to subprojects within each subproject repository
* Additional discussions are held during bi-weekly community meetings

### Required

- [x] **Document complete list of current maintainers, including names, contact information, domain of responsibility, and affiliation.**

* ORAS Organization maintainers are documented in the Community repository [OWNERS](https://github.com/oras-project/community/blob/main/OWNERS.md) file

- [x] **A number of active maintainers which is appropriate to the size and scope of the project.**

* ORAS has 15 active maintainers for all sub-projects.

- [x] **Code and Doc ownership in Github and elsewhere matches documented governance roles.**
* ORAS project [Contributor Guide](https://oras.land/community/contributing_guide) includes details related to managing code and project ownership

- [x] **Document adoption and adherence to the CNCF Code of Conduct or the project's CoC which is based off the CNCF CoC and not in conflict with it.**
* ORAS follows the CNCF Code of Conduct as detailed [here](https://github.com/oras-project/community/blob/main/CODE_OF_CONDUCT.md)

- [x] **CNCF Code of Conduct is cross-linked from other governance documents.**
* The Code of Conduct is referenced within

- [x] **All subprojects, if any, are listed.**
* The ORAS GitHub organization contains the list of subprojects: https://github.com/oras-project

## Contributors and Community

Note: this section may be augmented by the completion of a Governance Review from the Project Reviews subproject.

### Suggested

- [x] **Contributor ladder with multiple roles for contributors.**
* [Contributor Ladder](https://oras.land/community/contributor_ladder)

### Required

- [x] **Clearly defined and discoverable process to submit issues or changes.**
* [Contribution Guide]( https://oras.land/community/contributing_guide)
* [Developer Guide](https://oras.land/community/developer_guide)
* [Reporting Security Concerns](https://oras.land/community/reporting_security_concerns)

- [x] **Project must have, and document, at least one public communications channel for users and/or contributors.**
* [Contributing Guide Join Our Meeting](https://oras.land/community/contributing_guide#join-our-meetings)
* [Contributing Guide Contact Us](https://oras.land/community/contributing_guide#contact-us)

- [x] **List and document all project communication channels, including subprojects (mail list/slack/etc.). List any non-public communications channels and what their special purpose is.**
* [Contributing Guide](https://oras.land/community/contributing_guide)
* [ORAS slack channel](https://app.slack.com/client/T08PSQ7BQ/CJ1KHJM5Z)
* [Zoom public meeting](https://zoom.us/j/8079328631?pwd=UzN0NUlmbmcvTTN5L0o5VUQ2YndyQT09)

- [x] **Up-to-date public meeting schedulers and/or integration with CNCF calendar.**
* The meeting is biweekly at 00:00 UTC (midnight) at Zoom meeting room with ID 807 932 8631. See meeting notes for more details.
* [Contributing Guide Join Our Meeting](https://oras.land/community/contributing_guide#join-our-meetings)

- [x] **Documentation of how to contribute, with increasing detail as the project matures.**
* The [Contributing Guide](https://oras.land/community/contributing_guide) covers the basics of contribution
* The [Contribution Ladder](https://oras.land/community/contributor_ladder) covers growth and progression
* Governance is covered in [ORAS Organization Governance](https://github.com/oras-project/community/blob/main/governance/GOVERNANCE.md)

- [x] **Demonstrate contributor activity and recruitment.**
* 74 contributors to the ORAS CLI project https://github.com/oras-project/oras/graphs/contributors
* 68 contributors to the ORAS Rust SDK https://github.com/oras-project/rust-oci-client/graphs/contributors
* 10 contributors to the ORAS Go SDK https://github.com/oras-project/oras-go/graphs/contributors
* 47 contributors to the ORAS web site https://github.com/oras-project/oras-www/graphs/contributors
* 33 contributors to the ORAS Python SDK https://github.com/oras-project/oras-py/graphs/contributorx
* 10 contributors to the ORAS Java SDK https://github.com/oras-project/oras-java/graphs/contributors
* 9 contributors to the ORAS github action https://github.com/oras-project/setup-oras/graphs/contributors

## Engineering Principles

### Suggested

- [x] **Roadmap change process is documented.**
* [Roadmap Process](https://github.com/oras-project/community/blob/main/Roadmap.md)

- [x] **History of regular, quality releases.**

* Each subproject has their own release process, but this is the general [release process](https://github.com/oras-project/community/blob/main/governance/RELEASE-PROCESS.md). The ORAS CLI has a couple production grade [releases a year and several prereleases](https://github.com/oras-project/oras/releases).

### Required

- [x] **Document project goals and objectives that illustrate the project’s differentiation in the Cloud Native landscape as well as outlines how this project fulfills an outstanding need and/or solves a problem differently. _This can also be satisfied by completing a General Technical Review._**
* [Overview of what ORAS does and its differentiation in the CNCF ecosystem](https://oras.land/)

- [x] **Document what the project does, and why it does it - including viable cloud native use cases. This can also be satisfied by completing a General Technical Review.**
* [Introduction to ORAS](https://oras.land/docs/)
* [What ORAS does](https://oras.land/docs/category/how-to-guides)

- [x] **Document and maintain a public roadmap or other forward looking planning document or tracking mechanism.**

Depending on the complexity of the project, the public roadmap is maintained with either github milesstones or issues:

* [ORAS CLI milestones](https://github.com/oras-project/oras/milestones)
* [C# SDK milestones](https://github.com/oras-project/oras-dotnet/milestones)
* [Go SDK milestones](https://github.com/oras-project/oras-go/milestones)
* [Java SDK milestones](https://github.com/oras-project/oras-java/milestones)
* [Python SDK issues](https://github.com/oras-project/oras-py/issues)
* [Rust SDK issues](https://github.com/oras-project/rust-oci-client/issues)

- [x] **Document overview of project architecture and software design that demonstrates viable cloud native use cases, as part of the project's documentation.
* [ORAS Library technical design](https://oras.land/docs/client_libraries/overview/)
* [Core concepts of ORAS](https://oras.land/docs/concepts/artifact)
* [How to use ORAS](https://oras.land/docs/category/how-to-guides)

- [x] **Document the project's release process.**

* [Process details]( https://oras.land/community/release-process)
* [General release process guideline](https://github.com/oras-project/community/blob/main/governance/RELEASE-PROCESS.md)

## Security

### Suggested

N/A

### Required

Note: this section may be augmented by a joint-assessment performed by TAG Security and Compliance.

- [x] **Clearly defined and discoverable process to report security issues.**
* ORAS [Security Policy](https://oras.land/community/reporting_security_concerns)

- [x] **Enforcing Access Control Rules to secure the code base against attacks (Example: two factor authentication enforcement, and/or use of ACL tools.)**

- [x] **Document assignment of security response roles and how reports are handled.**

* See the doc https://github.com/oras-project/community/blob/main/SECURITY.md

- [ ] **Document [Security Self-Assessment](https://tag-security.cncf.io/community/assessments/guide/self-assessment/).**
* This is WIP and tracked in https://github.com/oras-project/community/issues/76

- [x] **Achieve the Open Source Security Foundation (OpenSSF) Best Practices passing badge.**
* [OpenSSF Best Practices passing badge](https://www.bestpractices.dev/en/projects/5562)

## Ecosystem

### Suggested

N/A

### Required

- [x] **Publicly documented list of adopters, which may indicate their adoption level (dev/trialing, prod, etc.)**
* ORAS adopters has been listed at https://oras.land/adopters

- [x] **Used in appropriate capacity by at least 3 independent + indirect/direct adopters, (these are not required to be in the publicly documented list of adopters)**

The project provided the TOC with a list of adopters for verification of use of the project at the level expected, i.e. production use for graduation, dev/test for incubation.

- [ ] **TOC verification of adopters.**
* To be done by TOC (ORAS adopters has been listed at https://oras.land/adopters)

- [x] **Clearly documented integrations and/or compatibility with other CNCF projects as well as non-CNCF projects.**

These information has been documented in https://oras.land/adopters.

## Additional Information