Skip to content

Commit 8142fee

Browse files
DeepDiver1975claude
DeepDiver1975
and
claude
authored
docs(ospo): add community health files (#637)
Incorporate the Kiteworks OSPO community health rollout v2 (adapted from owncloud/web#13815) into this repository, with all repo-specific facts replaced to match this Docker image build repo (MIT license, Dockerfile + overlay layout, GitHub Actions build) rather than the web frontend. - README.md: append Community & Support, Contributing, Security and About the ownCloud OSPO sections plus an OSPO badge (additive — the existing Docker reference is kept since it is synced to Docker Hub) - agents.md: new AI-agent context file describing the Docker build, overlay structure, CI and OSPO policy - CODE_OF_CONDUCT.md, CONTRIBUTING.md, SECURITY.md, SUPPORT.md: new community health files - CHANGELOG.md: dated entry following the existing convention The OSPO/license section is adapted to MIT (permissive, already Apache-2.0 compatible) — the AGPL copyleft-migration prerequisites from the source PR do not apply here. Signed-off-by: Thomas Müller <1005065+DeepDiver1975@users.noreply.github.com> Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
1 parent c396860 commit 8142fee

7 files changed

Lines changed: 221 additions & 0 deletions

File tree

‎CHANGELOG.md‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,12 @@
11
# Changelog
22

3+
## 2026-06-12
4+
5+
* Added
6+
* OSPO community health files (agents.md, CODE_OF_CONDUCT.md, CONTRIBUTING.md,
7+
SECURITY.md, SUPPORT.md) and README community/OSPO sections as part of the
8+
Kiteworks OSPO community health rollout v2
9+
310
## 2025-04-29
411

512
* Changed

‎CODE_OF_CONDUCT.md‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,8 @@
1+
# Code of Conduct
2+
3+
This project follows the ownCloud Code of Conduct.
4+
5+
Please read the full Code of Conduct at:
6+
**<https://owncloud.com/contribute/code-of-conduct/>**
7+
8+
By participating in this project, you agree to abide by its terms.

‎CONTRIBUTING.md‎

Lines changed: 30 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,30 @@
1+
# Contributing
2+
3+
Thank you for your interest in contributing to this project!
4+
5+
Please read the full contributing guidelines at:
6+
**<https://owncloud.com/contribute/>**
7+
8+
## About this repository
9+
10+
This repository builds the official **ownCloud Server** Docker image. It is not
11+
the ownCloud Server source code — it packages a release tarball on top of the
12+
[`owncloud/base`](https://github.com/owncloud-docker/base) image. See the
13+
[README](README.md) for build details, supported tags and usage.
14+
15+
## Pull requests
16+
17+
- **Rebase Early, Rebase Often!** We use a rebase workflow. Rebase on the target
18+
branch before submitting a PR; do not create merge commits.
19+
- **Signed commits**: All commits **must** be PGP/GPG signed. See
20+
[GitHub's signing guide](https://docs.github.com/en/authentication/managing-commit-signature-verification).
21+
- **DCO Sign-off**: Every commit must carry a `Signed-off-by` line:
22+
```
23+
git commit -S -s -m "your commit message"
24+
```
25+
- **Conventional Commits**: PR titles must follow the
26+
[Conventional Commits](https://www.conventionalcommits.org/) format — this is
27+
enforced by CI, and the PR title becomes the squash-merge commit message.
28+
- **GitHub Actions Policy**: Workflows may only use actions that are (a) owned by
29+
`owncloud`, (b) created by GitHub (`actions/*`), or (c) verified in the GitHub
30+
Marketplace. Pin all actions to their full commit SHA.

‎README.md‎

Lines changed: 55 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -5,6 +5,7 @@
55
[![GitHub contributors](https://img.shields.io/github/contributors/owncloud-docker/server)](https://github.com/owncloud-docker/server/graphs/contributors)
66
[![Source: GitHub](https://img.shields.io/badge/source-github-blue.svg?logo=github&logoColor=white)](https://github.com/owncloud-docker/server)
77
[![License: MIT](https://img.shields.io/github/license/owncloud-docker/server)](https://github.com/owncloud-docker/server/blob/master/LICENSE)
8+
[![ownCloud OSPO](https://img.shields.io/badge/OSPO-ownCloud-blue)](https://kiteworks.com/opensource)
89

910
Official [ownCloud](https://owncloud.com) Docker image. It's designed to work with a data volume in the host filesystem and with a standalone MariaDB and Redis container. For a guide how to get started please take a look at our [documentation](https://doc.owncloud.com/server/latest/admin_manual/installation/docker/).
1011

@@ -62,6 +63,60 @@ This image defines no environment variables of its own. Configuration is done
6263
through the variables inherited from the base images linked under
6364
[Inherited environments](#quick-reference) above.
6465
66+
## Community & Support
67+
68+
- [ownCloud Website](https://owncloud.com)
69+
- [Community Discussions](https://github.com/orgs/owncloud/discussions)
70+
- [Matrix Chat](https://app.element.io/#/room/#owncloud:matrix.org)
71+
- [Documentation](https://doc.owncloud.com)
72+
- [Enterprise Support](https://owncloud.com/contact-us/)
73+
- [OSPO Home](https://kiteworks.com/opensource)
74+
75+
See [SUPPORT.md](SUPPORT.md) for the full list of support channels.
76+
77+
## Contributing
78+
79+
We welcome contributions! Please read the [Contributing Guidelines](CONTRIBUTING.md)
80+
and our [Code of Conduct](CODE_OF_CONDUCT.md) before getting started.
81+
82+
- **Rebase Early, Rebase Often!** We use a rebase workflow — rebase on the target
83+
branch before submitting a PR.
84+
- **Signed commits**: All commits **must** be PGP/GPG signed and carry a DCO
85+
`Signed-off-by` line (`git commit -S -s`).
86+
- **Conventional Commits**: PR titles must follow the
87+
[Conventional Commits](https://www.conventionalcommits.org/) format — enforced
88+
by CI.
89+
- **GitHub Actions Policy**: Workflows may only use actions owned by `owncloud`,
90+
created by GitHub (`actions/*`), or verified in the GitHub Marketplace, pinned
91+
to a full commit SHA.
92+
93+
## Security
94+
95+
**Do not open a public GitHub issue for security vulnerabilities.**
96+
97+
Report vulnerabilities at **<https://security.owncloud.com>** — see [SECURITY.md](SECURITY.md).
98+
99+
Bug bounty: [YesWeHack ownCloud Program](https://yeswehack.com/programs/owncloud-bug-bounty-program)
100+
101+
## About the ownCloud OSPO
102+
103+
The [Kiteworks Open Source Program Office](https://kiteworks.com/opensource), operating under
104+
the [ownCloud](https://owncloud.com) brand, launched on May 5, 2026, to steward the open source
105+
ecosystem around ownCloud's products. The OSPO ensures transparent governance, license compliance,
106+
community health, and sustainable collaboration between the open source community and
107+
[Kiteworks](https://www.kiteworks.com), which acquired ownCloud in 2023.
108+
109+
- **OSPO Home**: <https://kiteworks.com/opensource>
110+
- **GitHub**: <https://github.com/owncloud>
111+
- **ownCloud**: <https://owncloud.com>
112+
113+
For questions about the OSPO or licensing, contact ospo@kiteworks.com.
114+
115+
This repository is licensed under the permissive **MIT License**, which is already
116+
compatible with the [Apache License 2.0](https://www.apache.org/licenses/LICENSE-2.0)
117+
that the OSPO is adopting across the ecosystem. No relicensing or copyleft
118+
dependency audit is required.
119+
65120
## License
66121

67122
This project is licensed under the MIT License - see the [LICENSE](https://github.com/owncloud-docker/server/blob/master/LICENSE) file for details.

‎SECURITY.md‎

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
# Security Policy
2+
3+
## Reporting a Vulnerability
4+
5+
**Do NOT open a public GitHub issue for security vulnerabilities.**
6+
7+
Please report security issues responsibly via:
8+
**<https://security.owncloud.com>**
9+
10+
You can also report vulnerabilities through our YesWeHack bug bounty program:
11+
**<https://yeswehack.com/programs/owncloud-bug-bounty-program>**

‎SUPPORT.md‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,10 @@
1+
# Support
2+
3+
For support with this project, please use the following channels:
4+
5+
- **Enterprise Support**: <https://owncloud.com/contact-us/>
6+
- **Community discussions**: <https://github.com/orgs/owncloud/discussions>
7+
- **Matrix Chat**: <https://app.element.io/#/room/#owncloud:matrix.org>
8+
- **Documentation**: <https://doc.owncloud.com>
9+
10+
Please do not use GitHub issues for general support questions.

‎agents.md‎

Lines changed: 100 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,100 @@
1+
# agents.md — server
2+
3+
## Repository Overview
4+
5+
This repository builds the official **ownCloud Server** Docker image
6+
(`owncloud/server` on Docker Hub). It does not contain the ownCloud Server
7+
source code — it packages a release tarball on top of the
8+
[`owncloud/base`](https://github.com/owncloud-docker/base) image and adds an
9+
optional root-filesystem overlay. Images are multi-architecture and built via
10+
GitHub Actions.
11+
12+
- **Classification:** Docker image build
13+
- **Activity Status:** Active
14+
- **License:** MIT
15+
- **Language:** Dockerfile, Shell
16+
17+
## Architecture & Key Paths
18+
19+
- `v22.04/` — Ubuntu 22.04 based image (ownCloud 10.x stable)
20+
- `v22.04/Dockerfile.multiarch` — image definition (`FROM owncloud/base:22.04`)
21+
- `v22.04/overlay/` — files copied into the image root (`ADD overlay /`); currently empty
22+
- `v22.04/<version>/.trivyignore` — accepted-CVE exclusions for the Trivy scan
23+
- `v24.04/` — Ubuntu 24.04 based image (ownCloud 11.0.0-prealpha)
24+
- `v24.04/Dockerfile.multiarch`, `v24.04/overlay/`, `v24.04/<version>/.trivyignore` — as above
25+
- `docs/` — design/spec notes
26+
- `images/` — README screenshots
27+
- `.github/workflows/main.yml` — **active** CI (build, smoke test, scan, publish)
28+
- `.github/workflows/lint-pr-title.yml` — Conventional-Commit PR-title enforcement
29+
- `.github/dependabot.yml` — weekly GitHub Actions dependency updates
30+
- `.drone.star` — **legacy** Drone CI config (inactive; superseded by GitHub Actions)
31+
- `.renovaterc.json` — Renovate preset for Docker digest updates
32+
- `.editorconfig` — formatting rules (2-space indent, LF, trailing newline)
33+
- `CHANGELOG.md` — flat, date-based changelog at repo root
34+
- `LICENSE` — MIT
35+
36+
## Build & CI
37+
38+
There is no local application build (no Node/pnpm/Make toolchain). The image is
39+
built by `.github/workflows/main.yml`, which calls reusable workflows from
40+
[`owncloud-docker/ubuntu`](https://github.com/owncloud-docker/ubuntu):
41+
42+
- Matrix builds two releases: `10.16.3` (base `v22.04`) and `11.0.0-prealpha`
43+
(base `v24.04`), each via `<base>/Dockerfile.multiarch`.
44+
- The ownCloud version is injected with the `TARBALL_URL` build arg — there is no
45+
version pinned inside the Dockerfile.
46+
- Smoke test: `http://localhost:8080/status.php`.
47+
- Trivy vulnerability scan (per-version `.trivyignore`).
48+
- On `master`: push to Docker Hub and sync the README as the image description.
49+
50+
To build locally:
51+
52+
```bash
53+
docker build \
54+
--build-arg TARBALL_URL=<owncloud-complete-tarball-url> \
55+
-f v22.04/Dockerfile.multiarch v22.04
56+
```
57+
58+
The image exposes port `8080`, declares volume `/mnt/data`, and inherits its
59+
`ENTRYPOINT` / `occ` dispatcher (`/usr/bin/owncloud`) from `owncloud/base`.
60+
61+
## Development Conventions
62+
63+
- Date-based `CHANGELOG.md` at repo root — **not** a `changelog/unreleased/`
64+
directory. Prepend a new `## YYYY-MM-DD` section for notable changes.
65+
- Conventional-Commit PR titles, enforced by `lint-pr-title.yml`.
66+
- `.editorconfig` governs formatting.
67+
- GitHub Actions are pinned to full commit SHAs.
68+
69+
## OSPO Policy Constraints
70+
71+
### GitHub Actions
72+
- **Only** use actions owned by `owncloud`, created by GitHub (`actions/*`),
73+
verified on the GitHub Marketplace, or verified by the ownCloud Maintainers.
74+
- Pin all actions to their full commit SHA (not tags): `uses: actions/checkout@<SHA> # vX.Y.Z`.
75+
- Never introduce actions from unverified third parties.
76+
77+
### Dependency Management
78+
- Dependabot is configured for GitHub Actions updates; Renovate handles Docker
79+
base-image digest updates.
80+
- Review and merge dependency PRs as part of regular maintenance.
81+
82+
### Git Workflow
83+
- **Rebase policy**: Always rebase; never create merge commits.
84+
- **Signed commits**: All commits **must** be PGP/GPG signed (`git commit -S`).
85+
- **DCO sign-off**: Every commit needs a `Signed-off-by` line (`git commit -s`).
86+
- **Conventional Commits & Squash Merge**: PR titles must follow
87+
[Conventional Commits](https://www.conventionalcommits.org/); the PR title
88+
becomes the squash-merge commit message and is enforced by CI.
89+
90+
## Context for AI Agents
91+
92+
- This is a small Docker-image packaging repo, not an application codebase.
93+
- The two `v*/` directories are near-identical; changes usually apply to both.
94+
- The `overlay/` directories are the image root filesystem — add files there to
95+
ship them in the image; the entrypoint and `occ` subcommand live in the base image.
96+
- The active build system is GitHub Actions (`main.yml`); ignore `.drone.star`.
97+
- The README is published verbatim as the Docker Hub image description — keep it
98+
accurate and self-contained.
99+
- License is **MIT** (permissive, already compatible with Apache-2.0); no
100+
copyleft dependency audit is required for relicensing.

0 commit comments

Comments
 (0)