Is it possible for Commonhaus to become a CNA for its member projects?

[JooHyukKim]

Is it possible for Commonhaus to become a 🔗CNA?

Expected benefit is that we have some control over what becomes of, and handling a CVE.
Then this will cut down on some individual effort of many of the Commonhaus projects.

cc. @cowtowncoder

[ebullient]

Assuming you mean this: https://www.cve.org/PartnerInformation/Partner#CNA, I think it is something we could collectively explore, sure.

Official application would likely wait until we're through the bootstrap phase, but I'd love to hear what the rest of the @commonhaus/cf-egc team has to say.

[aalmiray]

Ideas like this is what I'd like to see coming from Commonhaus such that, the foundation may serve as a focal point to collect concerns and offer guidance/help without being prescriptive.

Say CF helps a member project with handling CVEs or setting up OpenSSF Scorecards or whatever. If such settings happen to be of use to other member projects then such collaboration (that started at a single member) could be refactored and donated to CF. If so, CF then would broadcast to other member projects to see if anyone else is interested and the refactoring takes place. We document the thing and make sure to inform new members as they join or periodically depending on the use case, such that CF shares toys with everyone that's willing to share. Those that do not need these things or don't want them (for any reason) can remain as they are. WDYT?

[JooHyukKim]

So to put it simply, work on a single case (a project) first, then expand and systemize as we go, did I understand correctly?
Sounds very efficient and realistic way of achieving the suggested CNA issue.
No objection here.

[aalmiray]

Correct, with the caveat that once we push up to CF we don't force it downstream to all members. We notify and let them use the new thing if they want/need it.

[maxandersen]

Was literally on a call yesterday with product security and how opensource projects best deal with CVE's and becoming your own CNA was discussed.

Github is also a CNA and have a whole infrastructure to support project admins to do CVE's but don't afaik grab artifact names.

+1 on exploring.