diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md index 4568c20..1bbceca 100644 --- a/CONTRIBUTING.md +++ b/CONTRIBUTING.md @@ -2,42 +2,95 @@ **Welcome to the Eclipse Keyple Community!** -We are thrilled to have you onboard and look forward to your contributions. Whether you're a coder, designer, -documenter, or enthusiast, your involvement is invaluable to us. Here's how you can start contributing to Eclipse +We are thrilled to have you onboard and look forward to your contributions. Whether you're a coder, designer, +documenter, or enthusiast, your involvement is invaluable to us. Here's how you can start contributing to Eclipse Keyple: +## Project Description + +Eclipse Keyple is an open source middleware that simplifies the development of ticketing terminal applications based +on the Calypso standard, implementing the Ticketing Terminal APIs defined by the Calypso Networks Association through +the Eclipse Keypop project. + +This repository provides the Maven Bill of Materials (BOM) aligning the versions of the Eclipse Keyple Java +components. + +* Project home: https://projects.eclipse.org/projects/iot.keyple +* Developer resources: https://projects.eclipse.org/projects/iot.keyple/developer + ## Quick Start 1. **Read the Contribution Guidelines**: Before starting, please visit our detailed contributing guide at the -[Eclipse Keyple Contribution Guide](https://keyple.org/community/contributing/). +[Eclipse Keyple Contribution Guide](https://keyple.org/community/contributing/). This guide covers all the necessary information about contributing to the project. -2. **Join the mailing list**: Connect with other contributors on our -[mailing list](https://accounts.eclipse.org/mailing-list/keyple-dev/). +2. **Sign the Eclipse Contributor Agreement**: See the [Eclipse Contributor Agreement](#eclipse-contributor-agreement) +section below. + +3. **Join the mailing list**: Connect with other contributors on our +[mailing list](https://accounts.eclipse.org/mailing-list/keyple-dev/). It's a great place to ask questions, share ideas, and collaborate. -3. **Explore Open Issues**: Check out the issues tab in our GitHub repository. +4. **Explore Open Issues**: Check out the issues tab of this GitHub repository. ## How to Contribute -- **Code**: Submit pull requests with bug fixes, new features, and improvements. Make sure to follow the code style and +- **Code**: Submit pull requests with bug fixes, new features, and improvements. Make sure to follow the code style and testing guidelines. - **Documentation**: Help us improve our documentation by fixing errors, adding examples, or writing tutorials. -- **Feedback**: Share your experience using Eclipse Keyple. Feedback on usability, features, and your overall experience +- **Feedback**: Share your experience using Eclipse Keyple. Feedback on usability, features, and your overall experience is incredibly valuable. -- **Community Support**: Answer questions on the community forums, help with user support, and participate in +- **Community Support**: Answer questions on the mailing list, help with user support, and participate in discussions. +**Security issues must not be reported through public issues or pull requests.** Please follow the process described +in the [Security Policy](SECURITY.md). + +## Eclipse Contributor Agreement + +In order to be able to contribute to Eclipse Foundation projects you must electronically sign the Eclipse Contributor +Agreement (ECA). + +* https://www.eclipse.org/legal/ECA.php + +The ECA provides the Eclipse Foundation with a permanent record that you agree that each of your contributions will +comply with the commitments documented in the Developer Certificate of Origin (DCO). Having an ECA on file associated +with the email address matching the "Author" field of your contribution's Git commits fulfils the DCO's requirement +that you sign-off on your contributions. + +For more information, please see the Eclipse Committer Handbook: +https://www.eclipse.org/projects/handbook/#resources-commit + +## Project License + +This project is licensed under the Eclipse Public License 2.0 (see the [LICENSE](LICENSE) file). Contributions are +received under the terms of the project license. + +## Eclipse Foundation Development Process + +This Eclipse Foundation open project is governed by the Eclipse Foundation Development Process and operates under the +terms of the Eclipse IP Policy. + +* https://www.eclipse.org/projects/dev_process +* https://www.eclipse.org/org/documents/Eclipse_IP_Policy.pdf + +This repository is subject to the Terms of Use of the Eclipse Foundation. + +* https://www.eclipse.org/legal/termsofuse.php + +## Code of Conduct + +Please adhere to the [Eclipse Foundation Community Code of Conduct](CODE_OF_CONDUCT.md) when participating in this +project. + ## Need Help? -If you have any questions or need assistance, please reach out on the +If you have any questions or need assistance, please reach out on the [mailing list](https://accounts.eclipse.org/mailing-list/keyple-dev/). --- _Your contribution is the key to the success of Eclipse Keyple. Let's build something amazing together!_ - ---- \ No newline at end of file diff --git a/NOTICE.md b/NOTICE.md index 70e8c6f..4805f01 100644 --- a/NOTICE.md +++ b/NOTICE.md @@ -20,7 +20,7 @@ listed source code repository logs. This program and the accompanying materials are made available under the terms of the Eclipse Public License v. 2.0 which is available at -http://www.eclipse.org/org/documents/epl-2.0/EPL-2.0.html +https://www.eclipse.org/legal/epl-2.0/ SPDX-License-Identifier: EPL-2.0 diff --git a/SECURITY.md b/SECURITY.md index d0a3a3d..cd13073 100644 --- a/SECURITY.md +++ b/SECURITY.md @@ -1,9 +1,35 @@ # Security Policy -This project implements the Eclipse Foundation Security Policy +This Eclipse Foundation Project adheres to the [Eclipse Foundation Vulnerability Reporting Policy](https://www.eclipse.org/security/policy/). -* https://www.eclipse.org/security +## How To Report a Vulnerability -## Reporting a Vulnerability +If you think you have found a vulnerability in this repository, please report it to us through coordinated disclosure. -Please report vulnerabilities to the Eclipse Foundation Security Team at security@eclipse.org \ No newline at end of file +**Please do not report security vulnerabilities through public issues, discussions, or change requests.** + +Instead, report it using one of the following ways: + +* Create a [confidential issue](https://gitlab.eclipse.org/security/vulnerability-reports/-/work_items/new?issue[confidential]=true) in the Eclipse Foundation Vulnerability Reporting Tracker +* Report a [vulnerability](https://github.com/eclipse-keyple/keyple-java-bom/security/advisories/new) directly via private vulnerability reporting on GitHub + +You can find more information about reporting and disclosure at the [Eclipse Foundation Security page](https://www.eclipse.org/security/). + +Please include as much of the information listed below as you can to help us better understand and resolve the issue: + +* The type of issue (e.g., buffer overflow, SQL injection, or cross-site scripting) +* Affected version(s) +* Impact of the issue, including how an attacker might exploit the issue +* Step-by-step instructions to reproduce the issue +* The location of the affected source code (tag/branch/commit or direct URL) +* Full paths of source file(s) related to the manifestation of the issue +* Configuration required to reproduce the issue +* Log files that are related to this issue (if possible) +* Proof-of-concept or exploit code (if possible) + +This information will help us triage your report more quickly. + +## Supported Versions + +Security fixes are provided for the latest released major version of each Keyple component. +Older major versions do not receive security updates; users are encouraged to upgrade.