Governance
This page says who decides what in Holger, who holds which role, and what happens if one person is gone. It is part of the project's OpenSSF Best Practices answers (silver level).
Owners
Holger is owned jointly, 50/50, by Ignalina ApS and Vetra Automation AB. The two companies hold the copyright, the trademarks (see TRADEMARKS.md) and the rights granted by contributors under the CLA (CLA.md). Holger is licensed under AGPL-3.0-only and under a commercial licence (COMMERCIAL-LICENSING.md).
How decisions are made
- Day-to-day changes are decided in review: a change is a pull request on git.gunnar.rs, a maintainer reviews it, and it is merged with
git merge --no-ffonly when the review and the checks in CONTRIBUTING.md are green. - Direction (what Holger will and will not do, licensing, releases, the hosted service) is decided by the owners. The maintainer proposes; a decision that changes the licence, the ownership or the CLA needs both owners.
- Security reports follow SECURITY.md: the security contact decides whether a report is a vulnerability, and the fix and its publication date are agreed with the reporter.
- Decisions that change how people use Holger are written down: in the CHANGELOG, in the docs, or in the commit message that makes them.
Roles
| Role | Duties | Held by |
| Owners | direction, licensing, the CLA, the hosted service | Ignalina ApS and Vetra Automation AB |
| Maintainer | reviews and merges pull requests, keeps CI green, triages issues | Rickard Lundin (Ignalina ApS) |
| Release manager | cuts releases, signs them with the release key (YubiKey), publishes them | Rickard Lundin |
| Security contact | receives and handles vulnerability reports | the address in SECURITY.md |
| Contributors | propose changes under the CLA | anyone, see CONTRIBUTING.md |
Continuity
- Rights. Two companies own Holger, so the legal right to continue the project does not rest with one person.
- Code and history. The repository lives on git.gunnar.rs and can be cloned by anyone (
ssh://anonymous@git.gunnar.rs:2222/nordisk/holger.git); every clone holds the whole history. - Known gap (bus factor). Today one person holds the maintainer and release-manager roles, the forge's admin key and the release signing key (a YubiKey, see slsa/README.md). The project's goal is a bus factor of two: a second maintainer with admin access to the repository and to the hosted service, and a second release key named beside the first in
slsa/. Until then, continuity rests on the two owners and on the public history.