Issue: New .NET Foundation Project Application - .NET Modeling Framework (NMF)

[georghinkel]

Project Name

.NET Modeling Framework (NMF)

License

BSD-3

Contributor

RheinMain University of Applied Sciences

Existing OSS Project?

Yes

Source Code URL

https://github.com/NMFCode/NMF/

Project Homepage URL

https://nmfcode.github.io/

Project Transfer Signatories

• Georg Hinkel georg.hinkel@hs-rm.de

Description

This projects aims to support model-driven engineering on the .NET platform, in a broad sense. It is inspired from the Eclipse Modeling Framework (EMF), hence the similarity of names. It provides:

• A framework to organize models in repositories, allowing models to be split over multiple files
• A code generator to generate C# or VB.NET or F# code from a metamodel, compatible with EMFs Ecore
• A serializer that serializes model instances into XMI
• A framework for incremental change propagation
• A model transformation language (for unidirectional model transformations, dedicated support for code generators)
• A model synchronization language (for declarative, bidirectional, incremental model transformations)
• A framework for textual domain-specific languages (DSLs), similar to XText or Langium
• A framework for graphical DSLs, similar to Eclipse GLSP
• much more :)

Name

Georg Hinkel

Email

georg.hinkel@hs-rm.de

GitHub Profile URL

https://github.com/georghinkel

Committers

The current committers include Georg Hinkel (the maintainer) and three current students at the RheinMain University of Applied Sciences.
The project also contains commits authored by 13 other committers, mostly former students.

Discord Ids

No response

Governance Model

New code changes are currently proposed to the project as Pull Requests, verified by automated CI (through AppVeyor) and manually reviewed. New comitters are identified and appointed manually.

CLA

• If already an OSS project, was a Contribution License Agreement in place for contributions accepted?

How does the project check who has signed one?

Currently, a CLA check is not in place.

CLA Notification Alias

georg.hinkel@hs-rm.de

Select the Project Transfer Agreement model

Assignment

Repository Layout

Currently, the documentation is separated into another GitHub repository in order to avoid CI builds when only documentation changes.

Eligibility Criteria

• The project is built on the .NET platform and/or creates value within the .NET ecosystem.
• The project produces source code for distribution to the public at no charge.
• The project's code is easily discoverable and publicly accessible (preferably on GitHub).
• The project contains a build script that can produce deployable artifacts that are identical to the official deployable artifacts, with the exception of code signing (Exception may be granted for strong name keys, though strongly encouraged to be committed. Exception relies on OSS signing being in the build script for public builds).
• When applicable, project must use reproducible build settings in its toolchain.
• The project uses Source Link.
• The project uses either embedded PDBs or publish symbol packages to NuGet (if applicable).
• The project code signs their artifacts as appropriate.
• The project organization has 2FA enabled. Requiring 2FA must be done as part of onboarding if not already enabled.
• Libraries that are mandatory dependencies of the project are offered under a standard, permissive open source license which has been approved by the .NET Foundation (exceptions include a dependency that is required by the target platform where no alternative open source dependency is available such as the .NET Framework or a hardware specific library).
• Committers are bound by a Contributor License Agreement (CLA) and/or are willing to embrace the .NET Foundation's CLA when the project becomes a Member.
• The copyright ownership of everything that the project produces is clearly defined and documented.
• The project has a public issue tracker where the status of any defect can be easily obtained.
• The project has a published Security Policy.
• The project has a home page which provides high level information about its status and purpose.
• The project has a public communication channel where community members can engage with maintainers.
• The project has a publicly available location where members can review and contribute to documentation.

Describe why you are applying for Project Membership.

The project has been around for more than a decade now, starting as an academic project but now with an increasing number of downloads and users. I would like to make the project more public. The project publishes more than 30 NuGet packages where the most popular package currently has more than 800k downloads.

Infrastructure Requirements Summary

The project currently uses AppVeyor to build the deliverables, but that could be changed to GitHub Actions. The documentation is hosted in GitHub Pages.

Additional Notes

I understand that the project currently does not meet all of the eligibility criteria as defined above. However, I would like to start the process and use this issue to discuss necessary steps to become part of the foundation or whether you say that the project is out of scope.

[glennawatson]

Thankyou for your submission. I will be conducting some checks this week to confirm the project matches the basic eligibility criteria. I will let you know once that is complete. Thanks.

[glennawatson]

This project will be discussed in tomorrow's project committee. Thankyou.

[ChrisSfanos]

Hi @georghinkel - the project was accepted by the Board to join the .NET Foundation! I will be sending a project transfer agreement later this week or early next week!

[georghinkel]

Cool! Will go through the remaining points, then.

[georghinkel]

@glennawatson Is there any template security policy and CLA that I can use? Is there a best practice for artifact signing? If the snk is checked into the repository, this seems a bit awkward to me.

[glennawatson]

@georghinkel different type of signing.

You’re talking Strong Name Keys (SNK). This kind of signing added a unique identity (public key + version + culture) to the assembly so that the CLR could verify it hadn’t been tampered with and could resolve dependencies accurately. However, it never guaranteed who produced the code. it only ensured that the bits weren’t altered after compilation. Because of that, SNK signing by itself is considered redundant today for trust purposes; it’s more about assembly identity than actual security.

By contrast, code signing with SSL/TLS-style certificates (Authenticode) establishes authenticity and publisher trust. It uses a certificate from a recognized Certificate Authority (CA) so consumers (whether humans or package managers) can verify both integrity and provenance—that the code really comes from who it claims to. In the .NET Foundation’s case, packages published through its infrastructure are signed using Azure Key Vault–backed certificates for NuGet packages. This means the signing keys are securely managed by Azure, and when developers install a package, they can trust not only that the package hasn’t been altered, but also that it was officially released under the Foundation’s governance.

So basically we provide a code signing certificate but takes a little bit to organise @ChrisSfanos has to organise legal paperwork to create a corporate identity to obtain the certificate against.

We have tools you can use with GitHub actions or azure devops pipelines that allow you to sign your nuget packages against the modern code signing certificates. You won’t have direct access, azure will use the GitHub repo credentials to be able to log you in for sign against the certificate.

[glennawatson]

In terms of the cla bot we can provide you access to ours. @ChrisSfanos can get you installation instructions.

[georghinkel]

So, the best way forward would then be to migrate the CI pipeline from Appveyor to GitHub Actions ind order to make code signing easier?

[glennawatson]

Yeah will likely make the process dramatically easier.

[georghinkel]

Unfortunately, migrating to GitHub Actions might take a bit of time as I would like to use the opportunity to migrate to a modular versioning scheme (instead of the current approach of a uniform version for all components). I do not find a tool to do that. Is there something you can recommend? Is there a fixed time-frame to follow?

[glennawatson]

There's flexibility around the signing certificate. It just helps consumers know it's a valid NuGet package but you can take some time.

I typically have used nerdbank git versioning with the version files. It might do what you need having different version files under different folders.