Other

OASIS Participants Code of Conduct (14 October 2022)

Our Pledge

We, as members, contributors, and leaders pledge to do our best to ensure that participating in work at OASIS Open is free of harassment for everyone, regardless of physical, personal, professional, or cultural characteristics.

We pledge to act and interact in ways that contribute to an open, welcoming, diverse, inclusive, healthy, and productive community.

Our Standards

Examples of behavior that contributes to a positive environment for our communities include:

  • Demonstrating empathy and kindness toward other people
  • Being respectful of differing opinions, viewpoints, and experiences
  • Accepting the consensus of the group after making our point if the collective decision does not go our way
  • Giving and gracefully accepting constructive feedback
  • Accepting responsibility and apologizing to those affected by our mistakes, and learning from the experience
  • Focusing on what is best not just for us as individuals, but for the overall community

Examples of unacceptable behavior include, but are not limited to:

  • The use of sexualized language or imagery, and sexual attention or advances of any kind
  • Trolling, insulting or derogatory comments, and personal or political attacks
  • Public or private harassment
  • Publishing others’ private information, such as a physical or email address, without their explicit permission
  • Other conduct which could reasonably be considered inappropriate in a professional setting
  • Disparaging an organization, its activities, its employees, or its products and services within the context of OASIS-related activities

Enforcement Responsibilities

OASIS staff are responsible for clarifying and enforcing our standards of acceptable behavior and will take appropriate and fair corrective action in response to any behavior that they deem inappropriate, threatening, offensive, or harmful.

OASIS staff have the right and responsibility to remove, edit, or reject comments, commits, code, wiki edits, issues, and other contributions that are not aligned to this Code of Conduct, and will communicate reasons for moderation decisions when appropriate. Staff may also take action to sanction behaviors that it judges to be in violation of this code of conduct, up to and including expelling individuals from a project if, in their judgment, the circumstances warrant it.

Decisions or actions by OASIS staff are subject to appeal to the OASIS Board of Directors.

Scope

This Code of Conduct generally applies to the actions of individuals. It applies both within online spaces and in public spaces when an individual is participating in or representing the project or its community. Examples include using an official project e-mail address or mailing list, posting via an official social media account or chat, participating in a project meeting, or representing the project or OASIS at an online or in-person event.

What are the boundaries of the OASIS community?

There are no hard boundaries of the community, but common places we are asked to extend guidance to are:

  • Official project communication channels
  • Events and meetups
  • Media and web presences
  • Social media

In some cases, where individual social media messages or other activities not related to a specific project are reported to the OASIS staff, we might choose to act.

Enforcement

Instances of abusive, harassing, or otherwise unacceptable behavior may be reported to the OASIS staff at code-of-conduct@oasis-open.org. All complaints will be reviewed and investigated promptly and fairly and in confidence and will result in a response that is deemed necessary and appropriate to the circumstances. All parties involved in an incident are obliged to maintain confidentiality with regard to the reporter and the accused. Further details of specific enforcement policies may be posted separately.

All community leaders are obligated to respect the privacy and security of the parties involved in the incident.

Enforcement Guidelines

OASIS staff will generally follow these Community Impact Guidelines in determining the consequences for any action they deem in violation of this Code of Conduct, though they may escalate more quickly if the circumstances appear to warrant it:

1. Correction

Community Impact: Use of inappropriate language or other behavior deemed unprofessional or unwelcome in the community.

Consequence: A private, written warning from OASIS staff providing clarity around the nature of the violation and an explanation of why the behavior was inappropriate. A public apology may be requested.

2. Warning

Community Impact: A violation through a single incident or series of actions.

Consequence: A warning with consequences for continued behavior. No interaction with the people involved, including unsolicited interaction with those enforcing the Code of Conduct, via any OASIS-provided or maintained mechanism (ie email lists, Github, Slack, etc.) for a specified period of time. This includes avoiding interactions in community spaces as well as external channels like social media. Violating these terms may lead to a temporary or permanent ban.

3. Temporary Ban

Community Impact: A serious violation of community standards, including sustained inappropriate behavior.

Consequence: A temporary ban from any sort of interaction or public communication with members of the community via any OASIS-provided or maintained mechanism (ie email lists, Github, Slack, etc.) for a specified period of time, not to exceed one month. No public or private interaction with the people involved, including unsolicited interaction with those enforcing the Code of Conduct, is allowed during this period. Violating these terms may lead to a permanent ban.

4. Permanent Ban

Community Impact: Demonstrating a pattern of violation of community standards, including sustained inappropriate behavior, harassment of an individual, or aggression toward or disparagement of classes of individuals.

Consequence: A permanent ban from any sort of interaction within the community. Removal from community tools like repositories or chat groups.

Appeals

Actions taken by staff under this policy may be appealed to the OASIS Executive Director and the Board of Directors.

An appeal must be sent to the board comment list (oasis-board-comment@lists.oasis-open.org) within 30 days of the action being appealed. The Board shall hold a hearing within 45 days of receipt of the appeal. The Board shall render its decision within 30 days of the hearing. The decision of the Board shall be final.

The OASIS Board of Directors has the authority to effect such remedial action as may be necessary to remedy a complaint.

OASIS Vulnerability Handling & Disclosure Policy

This version of the OASIS Vulnerability Handling & Disclosure Policy was approved by the OASIS Board of Directors on 14 June 2023 and became effective immediately.

For details on how the policy is implemented, see the Vulnerability Handling & Disclosure Process.

Table of Contents

1. Purpose
2. Definitions
3. Procedures
3.1 Receiving a report of a possible vulnerability
3.2 Notifying OASIS staff and responsible parties
3.3 Notifying affected stakeholders
3.4 Notifying reporting organizations
3.5 Forming a vulnerability response team
3.6 Setting up a secure workspace
3.7 Addressing the vulnerability
3.8 Approving the remediation
3.9 Disclosure
3.10 Addressing vulnerability reports when there is no Responsible Party
3.11 Security Researcher Hall of Fame
3.12 Legal Obligation

1. Purpose

The OASIS Vulnerability Handling and Disclosure Policy governs how OASIS committees and staff receive and address reports of potential vulnerabilities. Vulnerability disclosure helps implementers and users of technical work assess their risk, protect their systems and data, and prioritize defensive actions. It also helps establish OASIS work product as trustworthy and legitimate in the user and developer community.

This document ensures that OASIS members understand their role in responding to reports of potential vulnerabilities or flaws and have a clear set of directions for addressing such reports. It also addresses OASIS’s role in providing neutral oversight and ensuring that records of the actions taken are maintained comparable to that done for a committee’s routine work. The policy also addresses when and how such a record should be made public.

The procedures outlined in this document may temporarily suspend other requirements of OASIS policies, most notably those for transparency and public records of proceedings.

This policy provides:

  • guidelines on receiving and responding to reports of potential vulnerabilities;
  • guidelines and procedures for assessing and addressing reported vulnerabilities.

2. Definitions

Most defined terms in this document have the meaning provided in OASIS Defined Terms. Additional definitions specific to the OASIS Intellectual Property Rights (IPR) Policy can be found in that document.

  • Embargo period – a period of time during which a reported vulnerability is kept confidential by OASIS and the responsible party to allow a solution to be determined and disseminated to affected stakeholders.
  • Executive Session – closed meetings of members of the responsible party for purposes of addressing a report of a vulnerability without making its details public.
  • Flaw – synonym for “vulnerability.”
  • Remediation – the steps taken by a responsible party to assess, address, and propagate a fix to a reported vulnerability or the steps to be taken by stakeholders to implement the fix.
  • Responsible Party – An individual or set of individuals who ensure that the report is investigated and addressed. The Responsible Party is the person(s) in a position to make sure a response team is formed and gets the resources it needs. Generally, in the case of an OASIS Technical Committee, the Responsible Party consists of the TC Administrator, as well as the full TC led by the chair(s) of that Technical Committee. In the case of an OASIS Open Project, the Responsible Party consists of the Project Governing Board
  • Stakeholders – parties whose work product may be adversely affected by the vulnerability but who are not directly responsible for fixing it (for example, a vendor whose product implements an OASIS Standard), other members of a Technical Committee beyond the Responsible Party and the response team or the public in general.
  • Vulnerability – any element in a specification or technical implementation that could allow an implementation to be exploited in ways that violate its proper intended use.
  • Vulnerability response team or response team – people appointed by the full membership of the responsible party to remediate the flaw. May include non-OASIS members under conditions described in the following sections.

3. Procedures

3.1 Receiving a report of a possible vulnerability

OASIS members and staff have an obligation to receive, record, and act on any report or claim of a vulnerability in any OASIS work product or deliverable that is brought to their attention, whether the flaw seems feasible or not.

OASIS will provide the OASIS Vulnerability Disclosure Process and make it accessible from the OASIS home page, and provide SEO terms to make it easily discoverable via internet search.

An OASIS member or staff may receive a report of a vulnerability in a variety of ways: through the OASIS Vulnerability Disclosure Process, through communications to or within the TC, or through personal, private communications (i.e. by email or phone). Regardless of how a report is received, the recipient must act on it.

If it is not provided in the initial disclosure, the recipient of the report should attempt to collect:

  • The name, version, and a link to the standard, specification, site, package, or code module;
  • If possible, the recipient’s assessment of the vulnerability severity (low/medium/high);
  • Description of the vulnerability, including how it was found and if it can be exploited;
  • In the case of a vulnerability discovered in a standard or specification, any known implementations of the standard or specification that the vulnerability has been discovered on;
  • Steps to reproduce, if relevant and available;
  • The reporters contact information (name and email), unless the reporter requests to remain anonymous.

The recipient must acknowledge receipt of the information from the reporter within 72 hours. See the Vulnerability Disclosure Process for detailed instructions.

3.2 Notifying OASIS staff and responsible parties

The recipient of a vulnerability report must notify the responsible parties for the affected specification or technical work. In the event a report is not received via the OASIS Vulnerability Disclosure Process, the recipient must either enter the report via the Disclosure Process themselves, ask the reporting party to do so, or promptly notify a member of the OASIS staff so that they can add the report. Staff will coordinate with the recipient and responsible parties on the steps needed to respond.

If the recipient is not a member of a responsible party or does not expect to be directly engaged in remediation, OASIS staff will take over working with the responsible party. The recipient must keep the report confidential but otherwise shall have no further obligations regarding the reported vulnerability.

Details of the vulnerability must not be communicated via any means that could be publicly visible (for example, by an email to a committee mailing list).

The responsible party can be notified, in a regular or specially-called meeting, or via other secure communications channels accessible only by members of the responsible party and OASIS staff.

Disclosures of vulnerabilities are not to be made public, for example in meeting minutes. If the responsible party is notified in a meeting, the meeting may be organized and held in Executive Session so that the topic and discussion are kept confidential. OASIS staff must be invited to such a meeting, and minutes must be taken although they will not be required to be published on the committee mailing list as is normally required by section 1.7 of the OASIS Committee Operations Process. The minutes must note that work was taken in Executive Session.

OASIS staff will report regularly to the Executive Director and the OASIS Board of Directors that vulnerabilities have been reported. Details may be provided in a meeting of the Board but must not be shared via any means that could be publicly visible.

3.3 Notifying affected stakeholders

As part of its evaluation of the vulnerability report, the responsible party shall decide when and how to notify affected stakeholders. Depending on the potential severity of a flaw or the scale of implementations, the responsible party may choose to alert stakeholders immediately or may choose to wait until steps to remediate have been defined. The responsible party shall make reasonable efforts to locate and notify stakeholders, however neither OASIS nor the responsible party guarantee that all stakeholders can be located and contacted.

If notification of the vulnerability includes steps for implementing a fix, the responsible party may provide an embargo period before making the report public to enable affected stakeholders to implement the fix. Neither OASIS nor the responsible party shall have any obligation to confirm that all stakeholders have implemented the fix before making the reported vulnerability public.

The decision on when and how to notify stakeholders shall rest with the Responsible Party except for the reporting provision in section 3.9. However the OASIS Executive Director or Board of Directors may direct OASIS staff to report the vulnerability publicly if, in their opinion, continued secrecy presents an unacceptable risk of damage to affected stakeholders or to the reputation and standing of OASIS. OASIS staff may review and require changes to any written communication regarding the vulnerability and its remediation prior to its being sent.

3.4 Notifying reporting organizations

As part of its evaluation of the vulnerability report, the responsible party shall decide if, when, and how to notify vulnerability databases such as the NIST National Vulnerability Database (https://nvd.nist.gov/), MITRE’s Common Vulnerabilities and Exposures (CVE® ) (https://cve.mitre.org/), or Carnegie Mellon University Software Engineering Institute’s CERT/CC Vulnerability Notes Database (https://www.kb.cert.org/vuls/). Consideration should be given to notifying relevant industry and global reporting organizations. OASIS staff will assist in the decision on request.

3.5 Forming a vulnerability response team

The responsible party shall consult with members of the committee as a whole in order to decide who shall assess the reported vulnerability to determine whether it agrees that a flaw exists.

The responsible party may request additional information, such as proof of concept code, before reaching a conclusion. If the responsible party does not agree that the vulnerability exists or believe that it poses no clear risk to stakeholders, the party shall notify OASIS staff and prepare a response to the reporter. The response shall contain an explanation of the reasons the party disagrees with the report and include a statement of how to appeal the decision to OASIS staff following the same procedures described in section 3.2 Appeals in the OASIS TC Process. The party shall store a copy of the response in its archives but no further action will be required.

If the responsible party agrees that the flaw exists, it shall notify OASIS that remedial action is needed and form a vulnerability response team made up of members deemed to have the expertise and interest to identify, analyze, correct and document the fix to the flaw.

The responsible party may invite outside experts, including the reporter of the flaw, to assist in addressing the vulnerability if it deems such expertise necessary. The party must notify OASIS staff of their request. OASIS shall offer to such invited expert a temporary, no-cost membership in OASIS for the duration of the remedial work. The invited expert shall be required to sign the OASIS Membership Agreement and take whatever actions are necessary to become a Member of the responsible party (e.g. join an OASIS Technical Committee). If the expert declines to take these actions, they shall not be allowed to participate directly in the remedial work although they may offer input and feedback via approved OASIS feedback channels.

3.6 Setting up a secure workspace

Unless the vulnerability is determined by the responsible party to be minor and quickly resolved, OASIS shall set up a secure, private team workspace. The workspace will provide all the functions of the responsible party’s regular set of collaborative tools but it will only be visible only to the members of the team and OASIS staff supporting the work. The workspace shall be visible to members of the responsible party unless such visibility cannot be provided without exposing the contents to the public.

Team members shall follow the normally applicable OASIS processes while working in the secure workspace (e.g. meeting minutes, ballots). Team members should maintain appropriate professionalism while working in the private workspace and expect that any or all of its records could become public in the future.

3.7 Addressing the vulnerability

The vulnerability response team shall work together using the secure workspace collaboration tools to identify and document changes needed to fix the affected work product(s). One member of the team shall be assigned the duty of liaison to the full committee and the responsible party and shall provide regular, verbal updates on the work.

If the response team needs copies of documentation or code for its work, OASIS shall create private copies of the resources for the use of the team. These resources shall only be accessible and visible to the team during the remediation. Changes to these resources to be applied to the existing work of the TC shall be merged back once the report of the vulnerability has been made public.

The response team shall be responsible for communicating with other stakeholders as needed, for example to communicate how to address the flaw in their implementations. The response team shall take reasonable care to keep such communications private, however neither the response team, the responsible party, nor OASIS guarantee privacy.

3.8 Approving the remediation

When the response team deems its work to be finished, it shall prepare a final report that includes the fix(es) that address the vulnerability, and present the report to the full committee and the Responsible Party. The full committee shall determine how to incorporate the fix(es) into the committee’s work products. Approval requires the appropriate level of vote for the OASIS work product the vulnerability is being reported against. For example, a vulnerability fix for an issue discovered in a Committee Specification, requires a Special Majority Vote, while a vulnerability fix for an issue discovered in a Committee Specification Draft requires a Full Majority Vote.

Once the response team’s final report is presented to the committee, its role is ended.

Merging any proposed changes into work products developed by the committee shall proceed under the normal procedures followed by the party (e.g. working drafts of Technical Committee specifications).

3.9 Disclosure

In addition to the requirements of section 3.3 and 3.4 above, OASIS staff shall, after a maximum of 90 days, make information about the vulnerability publicly accessible, unless instructed not to do so by the Executive Director or the OASIS Board of Directors or external legal authority. If permitted, the disclosure may happen sooner on appeal from any member(s) of the responsible party, stakeholder, or in response to a legitimate legal demand.

OASIS may, at its discretion, issue a press release or provide other information on the vulnerability. However, OASIS shall not be required to make any formal public announcement or release of information regarding the vulnerability.

3.10 Addressing vulnerability reports when there is no Responsible Party

In the event that the party responsible for the work affected by the vulnerability report is closed or otherwise unavailable to respond, and no other group has taken responsibility for maintenance of the work, it shall be the responsibility of OASIS staff to determine how best to respond.

Staff shall have the responsibility to identify experts who can evaluate and address the flaw. OASIS shall make best efforts to assemble a response team and address the vulnerability however OASIS shall not guarantee that it can remediate the flaw.

3.11 Security Researcher Hall of Fame

Following the processes outlined in section 3.9, OASIS will create a Security Researcher Hall of Fame page, or optionally, attach it as an addendum on the page containing the OASIS Vulnerability Disclosure Process. Any researchers who submit first-of-a-kind vulnerabilities for which the processes outlined in sections 3.6, 3.7, 3.8, and 3.9 are executed, should be listed on this page if they desire.

OASIS reserves full and final judgment on which researchers may be listed on the Hall of Fame. Researchers may be added and removed from the Hall of Fame at any time on the sole discretion of OASIS.

OASIS commits to not pursue or support any legal action related to vulnerabilities disclosed according to the OASIS Vulnerability Disclosure Process, recognizing that OASIS can not make commitments on behalf of its membership.

OASIS Vulnerability Handling & Disclosure Process

This version of the OASIS Vulnerability Handling & Disclosure Process was approved by the OASIS Board of Directors on 14 June 2023 and became effective immediately.

This process implements the policies described in the Vulnerability Handling & Disclosure Policy.

Table of Contents

Process

Vulnerability reports should be reported to vulnerabilities@oasis-open.org. In the report, we request that you include:

  • The name, version, and a link to the standard, specification, site, package, or code module;
  • If possible, your assessment of the vulnerability severity (low/medium/high) using an industry standard mechanism such as CVSS v3;
  • Description of the vulnerability, including how it was found and if it can be exploited;
  • Steps to reproduce, if available;
  • If possible, any suggested suggestions, fixes, and/or patches;
  • How you would like to be credited (name, url or email) if this issue is accepted, or if you would prefer to remain anonymous.

Please send one plain-text email for each vulnerability you are reporting. We ask that you not submit your report using PDFs, HTML, word processor files, etc. as digital media can provide their own security concerns.

By submitting any vulnerability report to OASIS, you hereby grant to OASIS and all OASIS members a perpetual, irrevocable, non-exclusive, transferable, sub-licensable, worldwide, royalty-free license to use, copy, reproduce, display, modify, adapt, transmit, distribute, and incorporate your submission or any parts thereof into standards, products, services, or test systems, without any further obligations or notices to you beyond those described in this document or in the OASIS Vulnerability Handling & Disclosure Policy.

Researcher Requirements

We require that all researchers:

  • Make every effort to avoid privacy violations, disruption or degradation of service to OASIS systems, and destruction of data during all security testing;
  • Perform research only within the various scopes set out below;
  • Use the identified communication channels to report vulnerability information to us;
  • Maintain confidentiality of any vulnerability you’ve discovered for 45 days, or until OASIS indicates that the vulnerability has been resolved. After 45 days, if OASIS has been unable or unwilling to provide a vulnerability disclosure timeline, the contents of the Report may be publicly disclosed by the Finder. We believe transparency is in the public’s best interest in these extreme cases

OASIS Obligations

If you follow these guidelines when reporting an issue to us, we commit to follow the OASIS Vulnerability Handling & Disclosure Policy. This policy includes but is not limited to:

  • Confirm receipt of your report within 72 hours;
  • Recognizing that OASIS can not make commitments on behalf of its membership, not pursue or support any legal action related to your research;
  • Work with you, relevant OASIS members, and, as appropriate, outside experts to understand and resolve the issue quickly if applicable, following the OASIS Vulnerability Handling & Disclosure Policy;
  • If applicable and desired, to recognize your contribution if you are the first to report the issue.

Scope

The scope of works covered by this process shall be any work on any OASIS-managed platform, including but not limited to:

Where projects already have vulnerability reporting policies or processes already in place, we encourage you to use those and consider this OASIS-wide process as a backup option.

The following test types are excluded from scope:

  • Any attempt to modify or destroy data;
  • Findings derived primarily from social engineering (e.g. phishing);
  • Findings from applications or systems not listed in the ‘Scope’ section;
  • Network level Denial of Service (DoS/DDoS) vulnerabilities or any other attempt to interrupt or degrade the services OASIS offers to its members, including impacting the ability for end users to use the service;
  • Any attempts to access a user’s account or private data;
  • Anything not permitted by applicable law, unless permitted by this document.

Out Of Scope

  • Implementations of OASIS standards and OASIS Committee Specifications that are not included in the Scope section above, regardless of their nature, including but not limited to commercial, freely available, or open source implementations. In these cases, the report should be made to the entity or organization who produces the product or implementation;
  • Any services hosted by third-party providers (which will be promptly submitted by OASIS staff to the contracted provider);
  • Anything else not explicitly named in the Scope section above.

Code of Conduct Incident Reporting and Response Process

Overview of the Code of Conduct workflow for OASIS staff when receiving and responding to an incident report.

Incident reporting and response process

This document outlines the workflow for OASIS staff when receiving and responding to an incident report falling under the Code of Conduct. As each report is unique, the process is described at a high level.

Incident Reports

What is an incident report?

An incident report or complaint is a description of an event, interaction, or public statement submitted to OASIS staff, which the reporter feels violates the Code of Conduct.

Who can submit a report?

OASIS accepts reports from anyone who interacts in an OASIS activity (OP, TC, etc.) with the project community, contributor or otherwise. This includes, but is not limited to, the following:

  • Contributors and maintainers
  • Members of the community Slack instance
  • Attendees and vendors at community events

Reports can be written or spoken and may be brought to any OASIS staff. OASIS must have a report to take action. At times, we may encourage community members to contact us if an incident is ongoing and we have not been contacted.

Where do private incident reports happen?

Incident reports may be made directly to any OASIS staff or sent to  code-of-conduct@oasis-open.org.

How is the privacy of a report protected?

All incident-related discussions happen in private spaces between incident reporters and OASIS staff. Staff maintain the confidentiality of incidents to the extent permitted by law.

Where incidents relate to unintentionally or non-consensually publicly-visible content or messages, we may, or may request others to, delete that content to help preserve the privacy of involved parties.

Why does this process exist?

The reporting process exists to provide the community with mechanisms to keep people safe, and to ensure that poor behavior, regardless of who the initiator is, is not accepted.

OASIS staff have the authority and responsibility to address harms as needed and appropriate to restore community safety after any incident(s).

Incident report workflow

Initial triage

OASIS staff will respond to all reports in a timely manner, usually within a few days.

When an incident report is received, it is reviewed for severity. The initial member(s) review the report and determine severity and urgency. If necessary, we may alert other members and call for an urgent meeting, but in most cases, we discuss asynchronously and develop a response plan.

Recusal

Before beginning an investigation on an incident, staff members can recuse themselves from addressing the incident if they feel a relationship with someone involved may hinder their impartiality or create a perception of impropriety with respect to individuals involved in the reported incident.

Building a plan

The staff will privately discuss the incident report and may or may not decide that we need more information prior to determining whether to take any action.

We consider the following at this stage:

  • Do we need clarification from the reporter beyond the initial report?
  • Do we need clarification from other individuals who may have been involved in, or witnesses to, the incident?
  • Is there a public record of the incident which we can review, such as a chat log or video recording?
  • Are there any privacy or safety considerations that we must take into account? For example, if we reach out to an individual named in the report, could this jeopardize the safety of the reporter or other individuals?

Reaching out to involved parties

It is our intention to put as little emotional labor on those who have been harmed as possible, and to protect the safety (both physical and emotional) of all community members. We labor to be supportive and non-judgmental and to make the reporting process as safe and low anxiety as possible.

In all instances these clarifying discussions are confidential.

Clarifying discussions typically take the form of email, Slack DM, or Zoom meeting 1:1 between a staff member selected during our triaging of an incident report and the individual from whom clarification is sought. Staff may seek to include an observer/scribe agreed by both parties.

Incident response workflow

Deciding on a Course of Action

We do not act recklessly, and in deciding on a course of action, we work as a team to include diverse perspectives, support the immediate safety needs of our community members, and support the long-term health of this community.

Our decisions on a course of action are informed by the following goals:

  • Continuously working towards a community that is a safe and professional space in which individuals from any background can do their best work, authentically and free from harassment
  • Preferring non-punitive punishments when possible
  • Prioritizing the safety of individuals to support the overall health of the community
  • Prioritizing education and coaching for those involved, when possible
  • Prioritizing the protection of contributing members of a project over external parties. This does not mean that we protect people with a higher number of commits or more seniority in the project, however.

In general, the committee strives for unanimous consensus before taking an action.

For example, we may choose to do nothing, to issue a private warning, to offer coaching, to recommend organizational changes, or to ban someone from a community platform.

Taking Actions and Communicating our Recommendations

When we have decided on a course of action, we do the following:

  • We clearly communicate our decision to those who need to hear it, without violating the confidentiality of those who requested it during an investigative process (if one was undertaken).
  • If and only if it is needed, we may engage with OASIS leadership or outside counsel if necessary.

In rare cases, we might find it necessary to issue a public statement, either jointly or separately.

OASIS Participants Code of Conduct

The OASIS Board of Directors approved this revised Code of Conduct on 14 June 2023 (https://www.oasis-open.org/wp-content/uploads/2023/08/OASIS-Board-of-Directors-Quarterly-Meeting-Minutes-2023-06-14-Public.pdf)

The original Code of Conduct as approved 14 October 2022 can be found at https://www.oasis-open.org/policies-guidelines/oasis-participants-code-of-conduct/oasis-participants-code-of-conduct-14-october-2022/

Our Pledge

We, as members, contributors, and leaders of OASIS Open pledge, act and interact in ways that contribute to an open, welcoming, diverse, inclusive, healthy, and productive community.

We pledge to do our best to ensure that participating in work at OASIS Open is free of harassment for everyone, regardless of physical, personal, professional, or cultural characteristics or disagreements about technical or policy matters.

Our Standards

Examples of behavior that contributes to a positive environment for our communities include:

  • Being respectful of differing opinions, viewpoints, and experiences
  • Accepting the consensus of the group after making our point if the collective decision does not go our way
  • Giving and gracefully accepting constructive feedback
  • Demonstrating empathy and kindness toward other people
  • Accepting responsibility and apologizing to those affected by our mistakes, and learning from the experience
  • Focusing on what is best not just for us as individuals, but for the overall community

Examples of unacceptable behavior include, but are not limited to:

  • Personal (ad hominem) attacks that emphasize the speaker rather than the message
  • Refusal to allow orderly statements of opposing points of view, within the reasonable time boundaries of group meetings or shared communication channels
  • The use of sexualized language or imagery, and sexual attention or advances of any kind
  • Trolling, insulting or derogatory comments
  • Public or private harassment
  • Publishing others’ private information without their explicit permission
  • Other conduct which could reasonably be considered inappropriate in a professional setting
  • Disparaging an organization, its activities, its employees, or its products and services within the context of OASIS-related activities
  • Promoting specific commercial or competitive solutions or products, to the exclusion of others. OASIS committees, boards and groups are intended to promote interoperability among multiple, independent implementations and services. In addition to members’ obligations under the OASIS Antitrust Guidelines, it is out of order for OASIS activities to express preferences for an exclusive or pre-emptive single solution, or to preferentially host or endorse a specific solution’s promotional statements. Any testing activities must be inclusive, based only on objective, functional criteria, without reference to a single product.

Enforcement Responsibilities

OASIS staff are responsible for clarifying and enforcing our standards of acceptable behavior and will take appropriate and fair corrective action in response to any behavior that they deem inappropriate, threatening, offensive, or harmful.

The chairs and conveners of OASIS committees, boards and groups are empowered to run their meetings, according to our applicable process rules, and to make reasonable agenda and speaking order decisions to facilitate those meetings.  However, those chairs and conveners should seek assistance from OASIS staff when significant or repetitive inappropriate behaviors as described in this Code are encountered.

OASIS staff have the right and responsibility to remove, edit, or reject comments, commits, code, wiki edits, issues, and other contributions that are not aligned to this Code of Conduct, and will communicate reasons for moderation decisions when appropriate. Staff may also take action to sanction behaviors that it judges to be in violation of this code of conduct, up to and including expelling individuals from a project if, in their judgment, the circumstances warrant it.

Decisions or actions by OASIS staff are subject to appeal to the OASIS Board of Directors.

Scope

This Code of Conduct generally applies to the actions of individuals. It applies both within online spaces and in public spaces when an individual is participating in or representing the project or its community. Examples include using an official project e-mail address or mailing list, posting via an official social media account or chat, participating in a project meeting, or representing the project or OASIS at an online or in-person event.

What are the boundaries of the OASIS community?

There are no hard boundaries of the community, but common places we are asked to extend guidance to are:

  • Official project communication channels
  • Events and meetups
  • Media and web presences
  • Social media

In some cases, where individual social media messages or other activities not related to a specific project are reported to the OASIS staff as violating this Code, we might choose to act.

Enforcement

Instances of abusive, harassing, or otherwise unacceptable behavior may be reported to the OASIS staff at code-of-conduct@oasis-open.org. All complaints will be reviewed and investigated promptly and fairly and in confidence and will result in a response that is deemed necessary and appropriate to the circumstances. All parties involved in an incident are obliged to maintain confidentiality with regard to the reporter and the accused. Further details of specific enforcement policies may be posted separately.

All community leaders are obligated to respect the privacy and security of the parties involved in the incident.

Enforcement Guidelines

OASIS staff will generally follow these Community Impact Guidelines in determining the consequences for any action they deem in violation of this Code of Conduct, though they may escalate more quickly if the circumstances appear to warrant it:

1. Correction

Community Impact: Use of inappropriate language or other behavior deemed unprofessional or unwelcome in the community.

Consequence: A private, written warning from OASIS staff providing clarity around the nature of the violation and an explanation of why the behavior was inappropriate. A public apology may be requested.

2. Warning

Community Impact: A violation through a single incident or series of actions.

Consequence: A warning with consequences for continued behavior. No interaction with the people involved, including unsolicited interaction with those enforcing the Code of Conduct, via any OASIS-provided or maintained mechanism (ie email lists, Github, Slack, etc.) for a specified period of time. This includes avoiding interactions in community spaces as well as external channels like social media. Violating these terms may lead to a temporary or permanent ban.

3. Temporary Ban

Community Impact: A serious violation of community standards, including sustained inappropriate behavior.

Consequence: A temporary ban from any sort of interaction or public communication with members of the community via any OASIS-provided or maintained mechanism (ie email lists, Github, Slack, etc.) for a specified period of time, not to exceed one month. No public or private interaction with the people involved, including unsolicited interaction with those enforcing the Code of Conduct, is allowed during this period. Violating these terms may lead to a permanent ban.

4. Permanent Ban

Community Impact: Demonstrating a pattern of violation of community standards, including sustained inappropriate behavior, harassment of an individual, or aggression toward or disparagement of classes of individuals.

Consequence: A permanent ban from any sort of interaction within the community. Removal from community tools like repositories or chat groups.

Appeals

Actions taken by staff under this policy may be appealed to the OASIS Executive Director and the Board of Directors.

An appeal must be sent to the board comment list (oasis-board-comment@lists.oasis-open.org) within 30 days of the action being appealed. The Board shall hold a hearing within 45 days of receipt of the appeal. The Board shall render its decision within 30 days of the hearing. The decision of the Board shall be final.

The OASIS Board of Directors has the authority to effect such remedial action as may be necessary to remedy a complaint.

OASIS Committee Operations Process (22 July 2020)

This version of the OASIS Committee Operations Process was approved by the OASIS Board of Directors on 22 July 2020 and became effective 01 December 2020. The change was announced in https://lists.oasis-open.org/archives/members/202011/msg00011.html 

The previous version, approved 22 May 2018 and effective immediately, can be found at https://www.oasis-open.org/policies-guidelines/oasis-committee-operations-process/oasis-committee-operations-process-2018-05-22/.

Table of Contents

1. Committees
1.1 Purpose of Committees
1.2 Committee Formation
1.3 Committee Membership and Participation
1.3.1 Technical Committees
1.3.2 Open Projects and Project Governing Board
1.3.3 Member Sections
1.4 Chairs
1.5 Committee Visibility and Transparency
1.5.1 Mail Lists
1.5.2 Web Pages
1.5.3 Announcements
1.6 Operations
1.7 Meetings
1.8 Voting
1.9 Closing a Committee

1. Committees

1.1 Purpose of Committees

Work at OASIS is done primarily through its committees. An OASIS committee is a group of Eligible Persons comprised of at least Minimum Membership, formed and conducted according to the provisions of this Committee Process, any other applicable policy document such as the OASIS TC Process for Technical Committees, the OASIS Open Project Rules, the OASIS Member Section Policy, or Roberts Rules of Order Newly Revised.

Each current version of the OASIS Committee Process applies to previously established committees upon its adoption.

Participation in the work of committees is open to any interested person subject to any specific requirements for the type of committee.

Defined terms in this document have the meaning provided in OASIS Defined Terms. Other OASIS policies may also apply depending on the type of committee. The complete set of OASIS policy documents can be found at https://www.oasis-open.org/policies-guidelines.

1.2 Committee Formation

The detailed requirements for starting a committee vary depending on the type of committee. In general, however, beginning a committee requires:

1.2.1 At least Minimum Membership of Eligible Persons committed to participating in the work,

1.2.2 A charter or equivalent founding document submitted to OASIS describing what the committee intends to do and other conditions pertinent to its operation, and

1.2.3 A sequence of steps followed by OASIS staff to publicize the committee, encourage others to join and participate, and set up its required infrastructure support.

For the specific requirements to start an OASIS Technical Committee, see the OASIS TC Process Section 1.2 TC Formation. For the specific requirements to start an OASIS Open Project, see the OASIS Open Project Rules. For the specific requirements to start an OASIS Member Section, see section 4 Creating a Member Section in the Member Section Policy.

1.3 Committee Membership and Participation

The work of a committee is conducted by Members who voluntarily contribute in one or more defined roles. The rules for joining the committee, the specific activities members can perform, the commitments they make, and requirements they must fulfill in order to participate vary depending on the type of committee. The roles for each type of committee are summarized in this section.

A committee Member is considered to have resigned from a committee upon sending notice of their resignation to the committees general email list. For some committees, formal resignation may have bearing upon ongoing commitments the member may have made upon joining the committee.

Persons who lose Eligible Person status shall have their committee membership terminated. Persons who lose Eligible Person status for reasons including, but not limited to, change of employment shall have up to 14 days of membership as an OASIS Individual Member in which to re-establish eligibility and continue participating in the committee. A Member shall lose membership on the 15th day after losing Eligible Person status if it is not re-established.

Termination of membership in an OASIS committee shall automatically end all rights and privileges of participation including any voting rights in that committee.

1.3.1 Technical Committees

Membership, participation requirements, voting rights and other aspects of participating in an OASIS Technical Committee (TC) are explained in the OASIS TC Process beginning at section Section 1.4 TC Membership and Participation.

TCs operate with four types of role: Observer, Member, Voting Member, or Persistent Non-Voting Members. The following table summarizes these roles.

Observer

Member

Persistent
Non-Voting Member

Voting Member

Can attend meetings

YES

YES

YES

YES

Can participate in meetings

NO

YES

YES

YES

Receives email from TC list

YES

YES

YES

YES

Can send email to TC list

NO

YES

YES

YES

Can contribute documents, etc.

NO

YES

YES

YES

Can use JIRA, Wiki, etc.

NO

YES

YES

YES

Can gain voting rights

NO

YES

NO (must first become a Member)

N/A

Can lose voting rights

NO

NO

NO

YES

Has voting rights

NO

NO

NO

YES

Counts towards quorum

NO

NO

NO

YES

Can make & second motions

NO

NO

NO

YES

Is publicly listed on TC roster, minutes, etc

NO

YES

YES

YES

Is obligated by TC IPR Mode

NO

YES

YES

YES

1.3.2 Open Projects and Project Governing Board

Membership, participation requirements, voting rights and other aspects of participating in an OASIS Open Project and its Project Governing Board (PGB) are explained in the OASIS Open Project Rules beginning at Section 4 Participants and Contributors.

Open Projects operate with five types of role: Participant, Contributor, Maintainer, PGB Member, and Chair. The following table summarizes these roles.

Participant

Contributor

Maintainer

Project Governing Board (PGB)

Chair

Functions

         

May provide comments and bug reports

YES

YES

YES

YES

YES

May submit pull requests

NO

YES

YES

YES

YES

Respond to pull requests, etc.

NO

NO

YES

NO

NO

Appoint and supervise Maintainer(s)

NO

NO

NO

YES

N/A

Authorize creation of repositories

NO

NO

NO

YES

N/A

Approve releases

NO

NO

NO

YES

N/A

Approve submissions of qualifying releases for Project Specification approvals (as defined below)

NO

NO

NO

YES

N/A

Approve external submissions of its OASIS Standards (if any) to de jure standards bodies

NO

NO

NO

YES

N/A

Elect Chair

NO

NO

NO

YES

N/A

Call and preside over any meetings

NO

NO

NO

NO

YES

Requirements

         

Must be OASIS Member

NO

NO

NO

YES

YES

Must sign Contributor License Agreement (CLA)

NO

YES

YES

YES

YES

1.3.3 Member Sections

An OASIS Member Section is a group within the consortium that advances the interests of a specific community or technology. The rules governing the formation, structure, and activities of a Member Section are explained in the Member Section Policy.

1.4 Chairs

Each committee must have a Chair or two co-Chairs. Only members of the committee are eligible to be Chair or co-Chair. A Chair is initially elected at the first meeting of a committee. The Chair is elected by Full Majority Vote of the committee. If a committee does not have a Chair then all activities, with the exception of the selection of a new Chair, are suspended. If a committee does not have a Chair for 120 days, the OASIS TC Administrator may close the committee.

The responsibilities of a Chair are as described in Roberts Rules of Order Newly Revised save for any specific responsibilities detailed in OASIS policy and rules documents.

The responsibilities of the Chair of a committee may be discharged by no more than two co-Chairs. The committee may vote at any time to elect a co-Chair, if only one Chair is seated, or to leave a second seat vacant. In the event that the Chair position is so shared each co-Chair is equally responsible for the Chair duties and responsibilities. Throughout this Committee Process, whenever a notification to the Chair is required, it must be made to both co-Chairs.

A committee Chair may be removed by action of the Board of Directors. A TC Chair may be removed at any time by a Special Majority Vote of the TC. A PGB Chair may be removed at any time by a Full Majority Vote of the PGB. In the event that a committee has co-Chairs, each may be removed individually or both may be removed by a single action.

A vacancy in chairing a committee shall be deemed to exist when (i) the Chair or one or both co-Chairs has been removed, (ii) the Chair or one or both co-Chairs has resigned the position, or (iii) the Chair or one or both co-Chairs ceases to be a member of the committee. Vacancies in chairing a committee shall be filled by election from the committee Members.

Every two years a Committee must re-appoint its chair(s). A call for candidates must be requested through the committee’s general email list inviting candidacy to be posted to that list. Committee members have 7 days after being notified to propose themselves as a candidate. All Committee members are eligible to apply including current and past chairs; no term limits apply. After the 7 Days candidacy period, if seats are contested, a ballot must be run to select the chair(s).

If no candidates come forward the work of the Committee must stop until a chair can be found.

For TCs, the timing of the process to re-appoint chairs should coincide with the TC Vitality check (Section 1.10) such that every four years the TC Charter and its chairs are reviewed.

Any provisions in the rules and policies applicable to a specific type of committee (such as Leaves of Absence for TCs) shall apply to the Chair or co-Chair of the committee in the same manner as they do to other committee members.

1.5 Committee Visibility and Transparency

The official copies of all resources of a committee and any associated subcommittees, including web pages, documents, email lists and any other records of discussions, must be located only on facilities designated by OASIS. Committees may not conduct official business or technical discussions, store documents, or host web pages on servers or systems not designated by OASIS. All web pages, documents, ballot results and email archives of all committees and subcommittees shall be publicly visible.

1.5.1 Mail Lists

Each committee shall be provided upon formation with a general discussion email list and a means to collect public comments.

All committee email lists shall be archived for the duration of the corporation, and all committee email archives shall be publicly visible.

For committees that hold meetings, the minutes of each meeting including a record of all decisions made shall be posted to that committee’s general email list.

The purpose of the committee’s public comment facility is to receive comments from the public. Comments shall be publicly archived.

1.5.2 Web Pages

OASIS shall provide each committee with a publicly accessible web page. The committee may keep the following information current on its web page: the committee name, charter, any standing rules and other adopted procedures, meeting schedules, anticipated deliverables and delivery dates, lists of members, the name and email address of the Chair or co-Chairs as well as other positions such as secretaries, editors, maintainers, etc., any subcommittees, links to the various works of the committee, and links to any IPR declarations made to the committee.

1.5.3 Announcements

OASIS shall maintain a publicly archived list for announcements from OASIS regarding its committees. Any Eligible Person shall be able to subscribe to this list. Every important change in committee status shall be posted to the announcement list. Such changes shall include but not be limited to: committee or project formation; committee charter revisions; start of public reviews; approval of work products such as Committee Specifications and Project Specifications; submission of specifications as a Candidate OASIS Standard; and approval or rejection of a proposed OASIS Standard.

1.6 Operations

Except where otherwise indicated by the rules and policies applicable to a specific type of committee, the operation of committees shall be governed by Robert’s Rules of Order Newly Revised, insofar as such rules are not inconsistent with or in conflict with this Committee Process, the OASIS Bylaws, other Board-approved policies, or with provisions of law. The duration of a committee shall be considered a single session. Formal actions of committees shall be governed by the same rules regardless of the language in which the work is taking place.

Standing rules may be adopted, amended, or rescinded by Full Majority Vote of a committee. The committee may not adopt standing rules or other Resolutions related to IPR, quorum requirements, membership, voting, participation, or that otherwise conflict with or supersede any OASIS Board-approved policy. Standing rules, and any amendments to them, must be communicated to the OASIS TC Administrator or Open Project Administrator as applicable, who may rescind them if they are in conflict with OASIS policy, and, in order to be enforceable, must be posted on the committee’s web page.

1.7 Meetings

Committee meetings must be properly called and scheduled in advance using the OASIS collaborative tools. Meetings scheduled or conducted in such a manner as to exclude the participation of any Member are subject to appeal. Meetings may be conducted face-to-face or via telephone conference or other electronic media that allow participation of all Members of the committee. In order to enable the openness of committee proceedings, meetings should be scheduled and conducted so as to permit the presence of as many participants as is logistically feasible. Meeting minutes must be recorded and posted to the committee’s general email list.

Individual attendance must be recorded in the meeting minutes. Without a Quorum present discussions may take place at a meeting but no Resolutions may be approved; those present may act as a “Committee of the Whole” as defined in Robert’s Rules of Order Newly Revised, and make a report to the entire committee. However, the foregoing rule does not prohibit the discussion of and initiation of calls for consensus addressed to committee members asynchronously. For committees that maintain voting rights, meetings without Quorum shall still count towards attendance for purposes of Members gaining, maintaining, or losing voting rights.

1.8 Voting

When a committee uses a vote as part of their Resolution or decision making process, all votes require a Simple Majority Vote to pass except as noted elsewhere in this document or in the rules applicable to the type of committee. Any votes requiring a Special Majority Vote for approval must be conducted by the OASIS TC Administrator.

Some types of committees require members to obtain voting rights before being eligible to vote on ballots. The rules governing obtaining and maintaining voting rights are described in the relevant rules document for those types of committees. Committees may not adopt rules governing voting or voting rights or the rights of members that conflict with or supersede any OASIS Board-approved policy.

For committees using voting rights, a Member must have voting rights at the time a ballot is opened in order to vote on that ballot. Proxies shall not be allowed in committee voting.

Committees may conduct electronic ballots. An electronic ballot may be conducted during a meeting using any tool available to the TC including email and the results must be recorded in the minutes. Electronic ballots outside of a meeting shall be made either by using the committee’s general mail list or the publicly archived electronic voting functionality provided by OASIS and must remain open for a minimum of 7 days. Eligible voters must be able to change their vote up until the end of the voting period.

1.9 Closing a Committee

Unless otherwise provided in the rules and policies applicable to a specific type of committee, a committee may be closed by Full Majority Vote of that committee, by Resolution of the OASIS Board of Directors, or by the OASIS TC Administrator, OP Administrator, or Member Section Administrator as applicable.

The relevant Administrator may close a committee that is unable to fill its Chair position for 120 days.

Unless otherwise provided in the rules and policies applicable to a specific type of committee, the relevant Administrator may close a committee whose membership falls below the Minimum Membership necessary or that fails to show activity or progress towards achieving its purpose for an extended period of time.

Open Project Rules (25 January 2022)

This version of the OASIS Open Project (OP) Rules was approved by the OASIS Board of Directors on 25 January 2022 and became effective immediately. The change was announced to OASIS members on 03 February 2022 in https://lists.oasis-open.org/archives/members/202202/msg00000.html

Table of Contents

1. Purpose of Open Projects

An OASIS Open Project (or Project) is a program hosted by OASIS for the development of code, specifications and other artifacts under open source licenses, under one or more of the Applicable Licenses listed in Section 15, and selected by the Project as specified below. OASIS Open Projects are conducted according to the provisions of these Rules. The OASIS Committee Operations Process provides general provisions concerning the operation of all committees that may apply to the work of a Project Governing Board (PGB). Certain defined terms used in this document have the meaning provided in the OASIS Defined Terms.

Any person or entity, whether or not an OASIS member, may participate in or contribute to a Project, as provided by these rules. Contributions, and the acceptance or merger of contributions into the Project’s work, are managed primarily through one or more open source Project Repositories (as defined in Section 8).

Projects operate under the administrative and process rules described in this document, and are administered by the OASIS Open Project Administrator designated by OASIS.

2. Project Formation

2.1 OASIS Open Projects are initiated by one or more organizations committed to being Project Sponsors and (optionally) persons who intend to make technical contributions to the Project. Any group of at least one or more Project Sponsors whose aggregate project sponsorship dues equal or exceed the minimum threshold established by a resolution of the OASIS Board of Directors, plus one or more named Contributors, may initiate a Project by submitting to the Open Project Administrator a Charter prepared using the Open Project Charter Template maintained and made available by the Open Project Administrator. Additional membership requirements apply to some approval activities as noted below. The Charter shall be written in English and provided to OASIS in electronic form as plain text. The name proposed for the Project shall be subject to approval by the Open Project Administrator for purposes of confirming infringement and appropriate use issues. If the proposed name includes a reference to an OASIS Technical Committee (TC) or specification title, or the name of another Open Project, then the approval of any open OASIS TC or Open Project who uses that name or has authored that specification is required in advance. No information other than that requested in the template may be included in the proposal. Any documents referenced in the proposal shall be publicly available.

The Charter must include a brief statement of purpose and a scope of work for the Project. The scope of work serves as a limit on the approval of Project Standards Track Work Products. The statement of purpose is only informative, not normative. The Charter also must state the number of Project Repositories initially requested to support the Project, and the Applicable License to be applied to each requested repository.

2.2 The Open Project Administrator shall reply in writing with its approval or other disposition of the proposal described above. OASIS shall post a public notice of each approved Project to its announced public mailing list.

2.3 After formation, the Charter of an Open Project may be amended only as provided in Section 5.6.

3. Roles of Parties in the Project

The work of a Project and its administration are conducted by parties who voluntarily contribute in one or more of the following defined roles: Contributor, Maintainer, Project Governing Board (PGB), Technical Steering Committee (TSC), and Chair. A detailed and definitive description of those roles follows in Sections 4, 5, 6 ,and 7 below. A table summarizing those roles can be found in the OASIS Committee Operations Process.

4. Contributors

4.1 Any person (whether or not an OASIS member) may participate in a Project as a Contributor by providing comments or bug reports to a Project Repository, subject to the licensing rules in Sections 14, 15 and 16 below.

4.2 Any person (whether or not an OASIS member) may agree to a Contributor License Agreement (CLA), as provided in the licensing rules below, as a prerequisite for acceptance of their pull requests or other substantive contributions. If a person who signs and submits an individual CLA indicates that they represent an entity, then that individual CLA will only be deemed effective if that entity has signed and submitted an entity CLA. The Project Governing Board and Maintainers shall only act on pull requests or other substantive contributions made by project Contributors who are listed in the OASIS system as having agreed to the relevant CLA. The Project shall maintain a record of all Contributors who have made contributions to a Project.

5. Project Governing Board and Project Sponsors

5.1 Overall guidance for the Project is provided by its Project Governing Board (or PGB). The PGB is composed of one voting member from each Project Sponsor who elects to appoint a PGB member, and at least one voting at-large expert representative from the community of contributors, elected or appointed by the Technical Steering Committee (TSC). The PGB may create additional PGB member seats for expert representatives to be elected by the TSC or appointed by the PGB.

A list of PGB members shall be maintained and posted at the general information web page designated by OASIS for the Project. Certain actions taken by the PGB require affirmative action by Project Approval Minimum Membership, as defined below.

5.2 PGB members must:

  • (a) have signed and submitted an individual CLA, and if appointed by an entity, that entity must have signed and submitted an entity CLA naming that project; and
  • (b) either (i) represent an organization that has paid the appropriate Backer dues for that Open Project or (ii) has been appointed or elected as an expert representative as provided above.

5.3 Project Approval Minimum Membership, where it explicitly is required for the PGB’s approval of an action under these rules, means at least two Project Sponsors seated on the PGB.

5.4 The PGB shall:

Decisions by the PGB shall be made in a manner consistent with the requirements of Section 10.

5.5 Status as a PGB member who represents an organization accrues to the organizational Project Sponsor, and is transferable by that Project Sponsor from person to person, as evidenced by a notice in writing from its Primary Representative to the OASIS Open Project Administrator. A Project Sponsor may resign from PGB membership at any time, by notifying the Open Project Administrator and the PGB Chair(s) in writing.

5.6 The PGB may amend the Charter after the Project’s formation in the following manner:

(a) An amendment to the binding scope of work may only be made for the purpose of removing ambiguity or for narrowing the scope of work, and requires a Special Majority Vote  of the PGB. Such an amendment may also at the PGB’s option update the statement of purpose, list of planned deliverables and/or list of repositories and licenses.
(b) Any amendment to other elements of the Charter may be made by a Full Majority Vote  of the PGB, so long as and any additions to the list of deliverables are within the scope of
work.
(c) In any case, any amended Charter must comply with the requirements of Section 2.1, and shall not take effect until approved by the PGB and announced by the Open Project Administrator.

6. Technical Steering Committees

The PGB shall form a Technical Steering Committee (or TSC) by a resolution of the PGB. A Project’s TSC members shall be composed of the persons, selected in the manner, and chaired by such person as is provided by that resolution. The PGB must create and publish process documentation, outlining the requirements for joining and voting in the project’s TSC. The TSC shall have the duties to advise the PGB and such others as are specified by the PGB, so long as consistent with these Rules and OASIS policies. The following activities may not be delegated by the PGB, although it may consult with the TSC regarding them at the PGB’s option: election or termination of PGB Chairs, approval of any Releases, Group Releases, Project Specification Drafts, Project Specifications, and approval of candidates for OASIS Standards or external submissions.

TSC members must have signed and submitted an individual CLA, and if appointed by an entity, that entity must have signed and submitted an entity CLA. A list of TSC members shall be maintained and posted at the general information web page designated by OASIS for the Project. An individual may resign from TSC membership at any time, by notifying the Open Project Administrator and the Chair(s) in writing.

7. Project Chairs and Maintainers

7.1 The PGB shall select one or two of its members as Chairs by a Full Majority Vote, to coordinate and manage Project decision-making and logistics. The PGB may remove a Chair at any time by a Full Majority Vote. The Chair(s) of the Project shall:

  • (a) be responsible for the coordination and polling of any decisions of the PGB
  • (b) convene and make arrangements for any desired virtual or physical face-to-face meetings of the PGB and/or Contributors
  • (c) assist and support the Maintainer(s) as appropriate
  • (d) be responsible as the Project’s principal point of contact with OASIS staff and resources as needed
  • (e) manage or provide for the management of communications with Contributors, any liaisons and the public as may be desirable in support of the Project’s goals.

If a PGB does not have at least one Chair then all PGB activities, with the exception of the selection of a new Chair, are suspended. If a PGB does not have a Chair for 180 days, the Open Project Administrator may declare the PGB closed. After closure of the PGB, the Project may no longer take actions that require the approval of the PGB.

7.2 The PGB shall ensure that there are one or more Maintainers to serve as the principal editor(s) of the Project’s technical work managed within its Project Repositories. Maintainers shall exercise editorial responsibility over the contents of the Project’s repositories, including by:

  • (a) evaluating and responding to pull requests
  • (b) designating main or recommended branches of each repository
  • (c) designating deprecated branches or contributions.

Maintainers should act to carry out the technical consensus of the TSC, Contributors, and PGB, and may be removed by the PGB at any time, after notice to the Maintainer and the TSC, for failure to perform their functions as determined by the PGB. No contributed information or pull requests may be deleted from any Project Repository, due to the open nature of the Applicable Licenses and the Archival Permanence rules in Section 9.2. The appointment of a Maintainer survives the closure of the PGB, and thereafter the remaining Maintainer(s) or the Open Projects Administrator may appoint additional or replacement Maintainers.

8. Repositories and Project Tools

8.1 OASIS will support official repositories for each Project (Project Repositories) using tools selected by staff that are clearly marked as a distinct resource. The repositories listed in the Project’s Charter will be opened by OASIS staff in connection with the Project’s launch. Subject to the requirements of this Section 8, subsequent Project Repositories may be opened by (a) a decision of the PGB, or (b) if the PGB elects to adopt a Standing Rule that permits it, then a TSC or a designated maintainer may also do so. However, adding new Applicable Licenses requires PGB approval: any Project Repository that applies an Applicable License (as provided in Section 15.1) that is already not in use in other Repositories of that Project must first be approved by a Special Majority Vote of the PGB.

8.2 Each Project Repository will serve as a distinct open source project, including issue tracking, comment facilities, and such other facilities as are normally available by default.

8.3 The Project’s official Project Tools include the Project’s Repositories and these additional tools: A principal web page for each Project, which may be the home resource page of the Project’s first Project Repository, and optionally, one or more mailing lists for administration of the Project. Subscription to such lists, which shall be subject to the OASIS Mailing List Guidelines, shall be open to anyone.

9. Visibility and Archival Permanence

9.1 Visibility. Contributions, comments, decisions, records of decisions and all other resources of the Project, including web pages, documents, mailing lists and any other records of discussions, must be located only on the Project Tools designated or authorized by OASIS. Projects may not conduct official business or technical discussions, store documents, or host web pages on servers or systems not designated by OASIS. All Project Tools shall be publicly visible, and all threaded and mail list discussions shall be publicly archived.

9.2 Archival Permanence. OASIS warrants that it will not inhibit open and free access to all of the material contributed to each Project Repository, as open and freely available resources. This warranty is perpetual and will not be revoked by OASIS or its successors or assigns; however, neither OASIS nor its assigns shall be obligated to:

  • (a) perpetually maintain its own existence, nor
  • (b) provide for the perpetual existence of a website or other public means of accessing such material, nor
  • (c) maintain any material which it is legally required to remove from publication.

Some contributed material may be treated as superseded or deprecated by Maintainers or by version control methods, as provided in these rules, but neither Maintainers nor any other party shall delete content. The original form of each contribution shall continue to be available for review, and use according to its licensure, through appropriate version control or document management methodologies.

9.3 Repository Lifecycle. Once a Project Repository has been created, it will remain open as a resource for public use and reference, and continuing repository contributions or comments, regardless of closure of the Project, under the Archival Permanence rule above, with such remaining Maintainers as may have been appointed.

9.4 Announcements. The Open Project Administrator shall create a publicly archived, subscribable list for announcements and public notices from OASIS regarding Open Projects. Every important change in Project status shall be posted to that list, including Project formation; opening of a new Project Repository; Releases; Group Releases; Draft Project Specifications; Project Specifications; Candidate OASIS Standards; and proposed external submissions.

10. Project Governance: Decisions and Meetings

10.1 Decisions by the PGB regarding the matters allocated to them by these rules normally should be made after reasonable notice to and consultation with the Project’s Contributors, and should be made by consensus except in cases where a specific majority vote is required by these rules. The Chair(s) of the Project are responsible for conducting and administrating the decision processes of the PGB and the Project, consistent with these rules.

10.2 Meetings of the PGB and any TSC must be properly called by the Chair(s) and scheduled in advance using the OASIS collaborative communication Project Tools. Meetings may be conducted face-to-face or via telephone conference or other electronic media that allow participation of all PGB members. In order to enable the openness of proceedings, meetings also should be scheduled and conducted to permit the presence of as many Contributors as is logistically feasible. A note of each meeting’s outcomes must be posted to a publicly accessible location provided by OASIS. Meetings or decisions scheduled or conducted so as to exclude the participation of any PGB member or Contributor are subject to appeal to the Open Project Administrator.

10.3 Electronic ballots of the PGB, when required by these rules, must be conducted on facilities provided or approved by OASIS, and must remain open for a minimum period for seven days. The Chair(s) may specify a longer voting period for a particular electronic ballot. Eligible voters may change their vote up until the end of the voting period.

11. Progression of Project Work

11.1 In addition to making available the contributions provided by Contributors, via their Project Repositories, Projects may designate specific portions of their output as official Releases, Group Releases, Project Specification Drafts or Project Specifications, and nominate them for further advancement, on the terms set forth in Sections 11, 12, 13 and 14.

12.2 Where the PGB or a consensus among the Contributors indicates that a specific set of contributions should be formally considered as a Release, Group Release, Draft Project Specification or Project Specification, then in preparation for that consideration, the Maintainers shall arrange the relevant material in the relevant Project Repository or repositories so that the set can be accessed and referenced as a distinct branch (a Designated Branch).

12. Releases and Group Releases

12.1 Releases. The PGB may act to approve a Designated Branch as an official Release of the Project, after giving notice to all Contributors via the Project Tools at least fourteen days prior to initiating a PGB vote or consensus call. Such approval decisions are subject to the process, notice and transparency provisions of these rules. Any product of the Project that is composed from contributions to the Project Repositories, of any nature, is eligible for approval as a Release of the Project.

12.2 Group Releases. When desirable to aggregate outputs, the PGB may act to approve any set of the Project’s Releases or subsets of Releases as an official Group Release of the Project, after giving notice to all Contributors via the Project Tools at least fourteen days prior to initiating a PGB vote or consensus call. Such approval decisions are subject to the process, notice and transparency provisions of these rules. Group Releases may include multiple Releases that bear different Applicable Licenses. Aggregate contributions by Maintainers or others which are prepared as potential Project Specifications should instead be approved as Project Specification Drafts, as provided below.

12.3 Licensing. Releases and Group Releases bear only the license rights and covenants provided for each of the contributions included there, as evidenced by the relevant repositories’ Applicable License(s) and the CLAs.

13. Project Specifications

13.1 In order to progress a Release or Group Release by the Project as a Project Specification Draft (or PSD) or a Project Specification (or PS), the PGB and the contents of the release(s) must satisfy the additional criteria of this Section.

13.2 In order to be advanced through the approval process, a proposed Project Specification must conform to the Project Specification template provided by the Open Project Administrator, which includes methods for indicating the relevant Designated Branches and Applicable Licenses. Proposed Project Specification Drafts also should conform to that template, to the extent possible.

13.3 Project Specification Drafts. A PGB having at least Project Approval Minimum Membership may act to approve any set of contributions to the Project, including from its Releases or Group Releases, as an official Project Specification Draft, after giving notice to all Contributors via the Project Tools at least fourteen days prior to initiating a PGB vote or consensus call. Such approval decisions are subject to the process, notice and transparency provisions of these rules.

13.4 Project Specifications. A PGB having at least Project Approval Minimum Membership may act to approve any Project Specification Draft as a Project Specification, by satisfying each of the following requirements:

  • (a) Written notice of that nomination must be given by the PGB to all those involved with the Project and the Open Project Administrator at least fourteen days prior to initiating a ballot. The ballot must be conducted by a Special Majority Vote of the PGB. The approval decision is subject to the process, notice and transparency rules set forth in these rules and the content requirements noted below.
  • (b) Any machine-executable instructions in a specific computer language (code) that are included in the Project Specification must be composed only of one or more Releases or Group Releases bearing Implementer-Class Licenses.
  • (c) Any guidance, descriptions, processes, models for the behavior of a system or service, or other content that is not machine-executable, and is included in the Project Specification, must be composed only of contributions (which may include Releases or Group Releases) previously made to a Project Repository.
  • (d) The proposed Project Specification will be subject to review and confirmation of conformance by the Open Project Administrator before the approval ballot is opened.

13.5 Upon successful conclusion of the Special Majority Vote, the Open Project Administrator must give public written notice thereof, which constitutes approval, and thereafter will publish the Project Specification to the OASIS Library.

13.6 Licensing. Project Specifications bear the license rights and covenants provided for each contribution included there, as evidenced by the relevant repositories’ Applicable License(s) and the CLAs, as well as the Specification NonAssertion Covenant. Project Specifications may bear more than one Applicable License, when composed from Releases or Group Releases from multiple Project Repositories that have different Applicable Licenses.

13.7 Implementations of all kinds are welcome (partial or complete; prototype, proof-of-concept, example, model, or reference implementations), provided that PGBs may not designate any single implementation of a Project Specification as exclusive or privileged.

14. OASIS Standard Approval and External Submissions

Project Specifications are eligible for and may be submitted for approval as OASIS Standards, under the following conditions:

  • (a) After three Statements of Use referencing the PS have been presented to the PGB, a PGB having at least Project Approval Minimum Membership may approve the PS as a candidate for OASIS Standard in the same manner, and subject to the same requirements, as apply to Committee Specifications as provided in Section 3.8 Approval of an OASIS Standard of the OASIS TC Process. Procedural requirements applicable to TCs in that rule apply to the PGB for this purpose, including the Special Majority Vote required to nominate a Project Specification for OASIS Standard. However, a candidate for OASIS Standard submitted by an Open Project shall be subject to the distinct licensing terms in these rules, and not the licensing terms in the OASIS IPR Policy for TCs.
  • (b) Upon a successful conclusion of that PGB vote and all other requirements, the OASIS TC Administrator shall proceed with public review and a call for consent as provided in Sections 3.8.2 and 3.8.3 of the OASIS TC Process. An OASIS Standard submitted by an Open Project and approved as provided above is eligible for further external submissions as provided in and subject to the requirements in the OASIS Liaison Policy. The PGB must have at least Project Approval Minimum Membership at the time of any such action or approval; the other procedural requirements applicable to TCs in that policy apply to the PGB for this purpose.

15. Repository and Specification Licenses

15.1 Applicable Licenses; Copyright Implementation Licenses. Each Project Repository will be subject to a declared Applicable License, selected from the list of licenses in this section. Each Contributor agrees in the CLA to grant the Applicable License designated for a repository to all contributions donated to that repository by posting it or requesting its inclusion in that repository, and to all Releases issued from that repository.

Anyone may offer comments to any Project Repository, on the terms of the foregoing licenses, as evidenced in the manner noted below. Anyone will be entitled to make use of the contents of a Project Repository, according to the terms of its Applicable License.

15.2 When requesting the creation of a Project Repository, the PGB must select that repository’s Applicable License from among the following list:

Other widely-used free and open source licenses may be added to this list after review and acceptance by OASIS and amendment of these rules.

15.3 Special Covenants for Project Specifications. In addition to the Applicable License for each Project Repository, each Contributor also agrees in the CLA to provide the additional covenants in this Section 15.3, as non-assertion covenants in favor of certain Project Specifications (collectively the Specification NonAssertion Covenant):

Contributor Covenant for Specifications. As a Contributor, you irrevocably covenant that you will not assert any patent claims licensable by you that are necessarily infringed by an implementation of your contribution to the extent that contribution is included in a Project Specification approved by the Open Project to which you made the contribution, against OASIS or any other parties who the Applicable License benefits, for making, having made, using, marketing, importing, offering to sell, selling, and otherwise distributing works that Implement or Derive From your contribution.

PGB Covenant for Specifications. For any Project Repository whose Applicable License is an Implementer-Class License, if you (or your representative) are a member of that Open Project’s Governing Board, you irrevocably covenant that you will not assert any patent claims licensable by you that are necessarily infringed by an implementation of a Project Specification approved by that Open Project within the scope of work of its Charter in effect at the time such deliverable was approved, and any Maintenance Deliverable approved for it, against OASIS or any other parties who the Applicable License benefits, for making, having made, using, marketing, importing, offering to sell, selling, and otherwise distributing works that Implement or Derive From that Project Specification and are compliant with all normative portions thereof. If you withdraw from the PGB, then this obligation continues to apply, but only with respect to those Project Specification Drafts approved more than 7 calendar days prior to your withdrawal, and to any Maintenance Deliverables approved for those specifications thereafter.

Scope of Implementations Benefited. As used in this covenant, works that “Implement or Derive From” a contribution or specification include:

  • (a) specifications to the extent derived from code
  • (b) independent code implementations of a specification
  • (c) independent code implementations of a specification to the extent the specification is derived from code.

For purposes of this definition, “specifications” include documentation, data flows, data formats, application programming interfaces and process descriptions.

Withdrawal from Covenant. Your Specification NonAssertion Covenant may be suspended or revoked by you with respect to any person who alleges in writing or files a suit asserting that your Contribution, or the work to which you have contributed, constitutes direct or contributory patent infringement.

16. Trademarks

In order to incorporate a trademark or service mark into a Project, including its use in the name of an OASIS Open Project or any Release, or its inclusion in the body of such work, that mark must be:

  • (a) owned by OASIS; or
  • (b) otherwise as approved by the OASIS Board of Directors.

No person may use an OASIS trademark or service mark in connection with an Open Project, a Release or otherwise, except in compliance with the Applicable License for a Release or otherwise according to such license and usage guidelines as OASIS may from time to time require.

17. CLAs and License Notices

17.1 A Contributor License Agreement (or CLA) shall bind each donor of a repository contribution, issue or comment of any kind to the repository’s Applicable License. All Contributions to Project Repositories shall be subject to an Individual CLA, in the form of Appendix A-1 to these rules, by which all persons making those Contributions are bound. Where Contributions are made by or on behalf of an organization, the responsible individual will designate that organization in their Individual CLA, and that organization will be asked to provide an Entity CLA, in the form of Appendix A-2 to these rules. If that Entity CLA is not obtained, OASIS and the Project must decline contributions from that individual.

Project Sponsors who appoint a member to the PGB must provide an Entity CLA, and the persons appointed by them as PGB members must provide an Individual CLA in order to serve.

Members of OASIS who provide an Entity CLA must provide the signature (or assent) of their OASIS Primary Representative. Individuals who represent an organization also are required by the Individual CLA to obtain an Entity CLA for that organization.

17.2 While some nominal write-access privileges (such as adding issues and comments) may be granted automatically to the public by the Project Tools, only persons who have signed the CLA will be permitted to submit content other than comments or suggestions for Non-Material Changes.

17.3. Each person making a Project Repository contribution must be bound to the terms of the Individual CLA, by obtaining their signature (which may be an equivalent electronic assent) in a manner appropriate to the tools employed to implement that repository; and those signatures shall be recorded and maintained in an auditable manner. Organizational Entity CLA signatures must also be obtained, recorded and maintained in a similar manner.

17.4. Notices of the Applicable License applicable to each Project Repository shall be conspicuously visible both from each repository’s contribution channels (for potential submitters of material) and its home resource pages (for potential readers and users).

17.5 Each Repository and its contribution facility shall be conspicuously marked with the following Call for Patent Disclosure:

[OASIS requests that any party contact the OASIS Open Project Administrator if it is aware of a claim of ownership of any patent claims that would necessarily be infringed by implementations of an OASIS Project Specification; and that any such claimant provide an indication of its willingness to grant a Specification Non-Assertion Covenant with respect to such patent claims, or otherwise to negotiate patent licenses free of charge with other parties on a non-discriminatory basis on reasonable terms and conditions.]

[OASIS may include such claims on its website, but disclaims any obligation to do so. OASIS takes no position regarding the validity or scope of any intellectual property or other rights that might be claimed to pertain to the implementation or use of the technology described in an OASIS Project Specification, or the extent to which any license under such rights might or might not be available; neither does it represent that it has made any effort to identify any such rights.]

18. Appeals and Application of Rules

The appeals process provided in Section 4.2 of the OASIS TC Process also shall apply to the actions of the OASIS Open Project Administrator, which may be appealed as provided therein.

Changes to these rules shall apply to previously-established Open Projects upon their adoption. However, OASIS may not change the terms of any signed CLA once it has been delivered to OASIS; if a change is required a new CLA must be executed.


Appendix A-1: Individual CLA

OASIS Open Projects: Individual Contributor License Agreement (CLA)

The text and links to file i-CLAs for Open Projects are available at https://www.oasis-open.org/open-projects/cla/oasis-open-projects-individual-contributor-license-agreement-i-cla/ .


Appendix A-2: Entity CLA

OASIS Open Projects: Entity Contributor License Agreement (CLA)

The text and link to file an e-CLA for an Open Project is available at https://www.oasis-open.org/open-projects/cla/entity-cla-20210630/.

Open Repository Guidelines and Procedures (27 April 2015)

The Open Repository Guidelines and Procedures were approved by the OASIS Board of Directors on 27 April 2015 and became effective on announcement on 21 September 2015 in https://lists.oasis-open.org/archives/members/201509/msg00003.html

Table of Contents

  1. REPOSITORY DEFINITION
  2. REPOSITORIES ARE INITIATED BY OASIS TCs
  3. REPOSITORIES ARE SEPARATE FROM A TC’S SPECIFICATION WORK
  4. REPOSITORY LICENSES AND LICENSING RULES
  5. PURPOSE STATEMENT AND CONTENTS
  6. ARCHIVAL PERMANENCE
  7. REPOSITORY MANAGEMENT
  8. REPOSITORY TOOLS
  9. LICENSE TOOLS AND NOTICES
  10. REPOSITORY LIFECYCLE

Overview OASIS TC Open Repositories are a distinct class of information and sharing portals (for example, a GitHub project), that can be set up to support and complement the work of an OASIS Technical Committee (“TC”). These repositories add the strengths of open source development to OASIS’ existing stable and well-recognized governance process.

1. REPOSITORY DEFINITION

An OASIS TC Open Repository (“TC Open Repository”) is a distinct facility operated by OASIS for collection of voluntarily contributed information relevant to the work of a specific TC, under the rules set forth in these procedures. TC Open Repositories may reside on third-party server resources. See REPOSITORY TOOLS below.

2. REPOSITORIES ARE INITIATED BY OASIS TCs

Any Eligible OASIS TC may create one or more TC Open Repositories at its election, by a simple majority vote of its membership, conducted in the same manner as is used to approve other administrative matters consistent with the OASIS TC Process (an “Administrative Vote”). TC Open Repositories may only be created by, and in connection with the work of, Eligible OASIS TCs.

An “Eligible OASIS TC” is a currently-active OASIS TC that is operating under the Non-AssertionRF on Limited Terms, or RF on RAND IPR Mode as defined by the OASIS IPR Policy.

3. REPOSITORIES ARE SEPARATE FROM A TC’S SPECIFICATION WORK

TC Open Repositories created by a TC are separate and distinct resources from the TC’s specification work. Specification work, sometimes described as the TC’s work product, is governed by the OASIS TC Process, and available under the licensing terms of the OASIS IPR Policy. In contrast, TC Open Repository contents are governed by these rules, and available under an open source license as provided here. Because different licenses apply, there is no guarantee that the licensure of specific material in a TC Open Repository will be compatible with the licensing requirements of an implementation of a TC’s specification.

No TC member shall have any obligation to join, contribute to, or reference, any TC Open Repository. Members of an OASIS TC incur no other licensing or disclosure obligations by reason of any TC Open Repository, unless that member explicitly contributes to it under these rules. See REPOSITORY LICENSES AND LICENSING RULES below.

TC Open Repository contributions (“repo contributions”) and contents are not automatically also contributed to the TC’s Work Product as specification “Contributions” as defined in the OASIS IPR Policy. TC members may choose to use any contents of an Open repository in TC specification development, by taking the separate, additional step of offering that material as their own “Contributions” to the TC’s Work Product under the OASIS IPR Policy. Each member is responsible for determining the suitability of their own contributions.

4. REPOSITORY LICENSES AND LICENSING RULES

Each TC Open Repository will be subject to a declared “Applicable License,” selected from the list of licenses at the end of this section. The Applicable License for a repository will apply to all repo contributions donated to the repository, by posting it or requesting its inclusion in that repository. Anyone, whether an OASIS member or TC member or not, may contribute into a TC Open Repository, subject to the Applicable License, as evidenced in the manner noted in LICENSE TOOLS AND NOTICES below. Anyone (including but not limited to the TC that created it) will be entitled to make use of the contents of a TC Open Repository, according to the terms of its Applicable License.

The TC creating a TC Open Repository will select its Applicable License from among the following list: BSD-3-Clause License (which shall apply if the TC makes no license selection in its approval action); Apache License v 2.0; CC-BY 2.0; CC-BY 4.0; Eclipse Public License v 1.0. (OASIS periodically will review other widely-used free and open source licenses for inclusion in this list by amending these procedures.)

5. PURPOSE STATEMENT AND CONTENTS

Each TC Open Repository should have a purpose statement, indicating its intended contents or topic, declared by the TC that creates it, as part of its approval action. If the TC’s approval action specifies no purpose statement, then the purpose shall be any kind of information including examples, code, implementation details, bug reports, and actual, model or dummy content that may relate to the Work Products to be produced by that TC as defined in its charter.

6. ARCHIVAL PERMANENCE

OASIS warrants that it will not inhibit open and free access to all of the material contributed to each TC Open Repository, as open and freely-available resources. This warranty is perpetual and will not be revoked by OASIS or its successors or assigns; however, neither OASIS nor its assigns shall be obligated to: (a) perpetually maintain its own existence; nor (b) provide for the perpetual existence of a website or other public means of accessing such material; nor (c) maintain any material which it is legally required to remove from publication. Some contributed material may be treated as superseded by Maintainers or by version control methods. See REPOSITORY MANAGEMENT below. However, Maintainers shall not delete content; the original form of each repo contribution shall continue to be available for review, through appropriate version control or document management methodologies.

7. REPOSITORY MANAGEMENT

When a TC creates a TC Open Repository, it shall designate one or two TC members to act as its initial “Maintainer(s)”, by an Administrative Vote, to organize the material in that repository. Maintainers may exercise editorial organization of the contents of their TC Open Repository, including by classifying it, evaluating and responding to pull requests, designating main or recommended branches, and designating deprecated branches or material. However, no contributed information may be deleted from any TC Open Repository, due to the open nature of Applicable Licenses and the ARCHIVAL PERMANENCE rule. In cooperation with the community, the Maintainer(s) and the TC may select additional or successor Maintainer(s) to share responsibilities for the repository. See REPOSITORY LIFECYCLE below.

8. REPOSITORY TOOLS

OASIS will create and support TC Open Repositories using web resource tools, selected and configured by staff, that are clearly marked as a distinct resource, and under different Internet subdomains, from the Work Product of a TC conducted under the OASIS IPR Policy and TC Process. OASIS initially will create TC Open Repositories as either distinct GitHub projects, or distinct Subversion repositories. (OASIS periodically will review other widely-used tools, either hosted by OASIS or from appropriate and commercially-neutral third parties, for inclusion in this list of available platforms, by amending these procedures.)

9. LICENSE TOOLS AND NOTICES

Each TC Open Repository shall be subject to a Contributor License Agreement (“CLA”) by which all persons making repo contributions into it are bound. The CLA shall bind each donor of a repo contribution to the repository’s Applicable License and such other consistent terms as OASIS may require as a publisher to assure its availability. While certain nominal write-access privileges (such as adding issues and comments) may be granted automatically to the public by the tools, only persons who have signed the CLA will be permitted to contribute substantive content. Each person making a repo contribution must be bound to the terms of the CLA, by obtaining their signature (which may be an equivalent electronic assent) in a manner appropriate to the web resources tools employed to implement that repository; and those signatures shall be recorded and maintained in an auditable manner. Notices of the Applicable License or an appropriate link shall be conspicuously visible both from each repository’s contribution channels (for potential contributors of material) and resource pages (for potential readers and users). See the OASIS TC Open Repositories FAQ for details about the form and location of the notices.

10. REPOSITORY LIFECYCLE

Once a TC Open Repository has been created by an Eligible OASIS TC, it will remain open as a resource for public use and reference, and continuing contributions, after the OASIS TC is closed, under the ARCHIVAL PERMANENCE rule above, with such remaining Maintainers as may have been appointed. A TC may, if it so elects, designate a successor Eligible OASIS TC, by an Administrative Vote at any time prior to its closure, to assume its remaining responsibilities to its TC Open Repository.

Keyword Guidelines for OASIS Specifications and Standards

Version 2.0

This document provides guidelines for using keywords based on the IETF definitions (BCP 14, RFC 2119, etc.) and the ISO/IEC Directives when writing specifications. It includes a mapping table between the two keyword types to assist editors changing a specification from one style to the other. The target audience is primarily specification writers and project team members.

Status: TAB-approved deliverable with revisions in 2021.

Editors: Patrick Durusau, Paul Knight


1 Introduction

Keywords establish the requirements that implementers follow in conforming to OASIS specifications and standards.

This guide explains how to use two of the more popular keyword sets, [IETF BCP14] (consisting of both [RFC2119] and [RFC8174]) and [ISO/IEC Directives]. After explaining the basic rules for each keyword set, we provide examples of the keywords in use in OASIS specifications.

In general, OASIS standards-track documents should use the capitalized IETF keywords, unless the developers expect to submit the final OASIS Standard to a standards body requiring the ISO/IEC keywords.

1.1 Changes from earlier OASIS guidelines – IETF keywords

Incorporated IETF RFC 8174 and the expansion of BCP 14 to include RFC 8174 as well as RFC 2119.

Beyond simply adding a reference to RFC8174, the expansion of BCP 14 involves changes to the text describing the use of keywords in a specification:

  • Adds the keyword phrase “NOT RECOMMENDED”
  • Extends the text describing the usage of RFC 2119 or BCP 14 keywords to include the phrase “when, and only when, they appear in all capitals, as shown here.”

1.2 Changes from earlier OASIS guidelines – ISO/IEC keywords

Updated the reference for ISO/IEC keywords from the Fifth Edition to the Eighth Edition. Beyond simply updating the reference, this incorporates changes to the text describing the use of ISO/IEC keywords in a specification:

  • Deprecates “need not”
  • Adds “may” and “may not”.

2 Keywords in OASIS TC specifications and standards

2.1 Introduction to keywords

The term keywords as used in OASIS specifications or standards means terms specified either by [IETF BCP14] or the [ISO/IEC Directives]. Every OASIS specification or standard will choose (and use) one or the other. The two keyword sets are never mixed in a specification or standard.

Keywords identify the requirements for conforming to a specification or standard. RFC 2119 gives the following guidance on keywords (called “imperatives”):

Imperatives of the type defined in this memo must be used with care and sparingly. In particular, they MUST only be used where it is actually required for interoperation or to limit behavior which has potential for causing harm (e.g., limiting retransmissions) For example, they must not be used to try to impose a particular method on implementors where the method is not required for interoperability. RFC2119

For example, ODF 1.2 [OpenDocument-v1.2] went to great lengths to say how the format was written and to specify its semantics. However, not one word was said about how an implementation would accomplish that task. It wasn’t relevant. It could be an in-memory table, graph, key-value data store, etc. The only thing ODF 1.2 constrains is how to interpret the markup and how to write it back out.

Normative contents don’t always use keywords. Often a descriptive or declarative style reads better than an imperative style based on keywords. In that case, such content may still be referred to by a more general statement — e.g., in a conformance clause — where normative keywords are used to clearly indicate what is expected from a conforming implementation.

In a very real sense, ODF 1.2 is a collection of statements about elements and attributes, which are then referred to by keywords, should you want to conform to the ODF 1.2 standard.

For example, under section 19.402 Presentation Node Type, one would not say:

The presentation:node-type attribute MUST specify a node type for an animation element. (incorrect)

Rather, as the standard reports:

The presentation:node-type attribute specifies a node type for an animation element.

The defined values for the presentation:node-type attribute are:

This has the advantage of freeing the author to write in simple, declarative prose and to save the hard part of keywords for conformance clauses.

2.2 Keywords and normative text

“Normative” text includes the parts of a specification or standard that set forth definitions, rules, conformance clauses and other statements that are part of a standard.

By way of contrast, “informative” text contains material that may help understand the standard or give examples of its use, but that don’t have to be followed in order to implement the specification or standard.

The distinction is an important one because keywords cannot appear as keywords in informative text. Readers might confuse purely informative text with normative text if keywords were found in informative text.

Conformance to a standard requires that everyone recognize normative and informative text the same way. Use of keywords in informative text interferes with a uniform reading of text as normative or informative.

Some examples of informative text include: notices, tables of contents, introductions, notes, examples, etc.

2.3 IETF BCP14 rules

2.3.1 Introduction to IETF BCP14 rules

[IETF BCP14] keywords are the most common keywords used in OASIS TC specifications and standards to define normative statements and conformance clauses.

IETF BCP14 keywords are written in UPPERCASE. When IETF BCP14 keywords are written in lowercase, they have only their normal English usage meaning. In lowercase, IETF BCP14 keywords do not state normative or conformance requirements.

WARNING: Changing an IETF BCP14 keyword, such as lowercase “must” to UPPERCASE “MUST”, changes the conformance requirements of a specification. If that happens, it may constitute a Material Change that requires a public review under OASIS rules.

The following section provides the [IETF BCP14] definitions of keywords, along with examples of their use in some existing OASIS specifications.

2.3.2 IETF BCP14 examples in OASIS specifications

2.3.2.1 MUST

Definition in BCP 14

MUST   This word, or the terms “REQUIRED” or “SHALL”, means that the definition is an absolute requirement of the specification.

Example

“A PullRequest signal message always indicates in its header (see Section 5.2.3.1) the MPC on which the message must be pulled. If no MPC is explicitly identified, the default MPC MUST be pulled from. The pulled message sent in response MUST have been assigned to the indicated MPC.”

  • ([EBMS-v3.0], section 3.4.3. Definition and Usage Requirements.)

Discussion

Note that “must” appears in both lower and upper case. In the first sentence, “must” only indicates the intended objective or effect one wants to produce. The second and thirds uses, in upper case, are requirements that must be met in order to conform to the specification.

2.3.2.2 MUST NOT

Definition in BCP 14

MUST NOT   This phrase, or the phrase “SHALL NOT”, means that the definition is an absolute prohibition of the specification.

Example

“OData-defined system query options are prefixed with “$”. Services may support additional query options not defined in the OData specification, but they MUST NOT begin with the “$” or “@” character.”

  • ([OData-Part1], section 6.1 Query Option Extensibility.)

Discussion

Here MUST NOT appears in upper case and announces a requirement conforming to OData.

Definition in BCP 14

SHOULD   This word, or the adjective “RECOMMENDED”, mean that there may exist valid reasons in particular circumstances to ignore a particular item, but the full implications must be understood and carefully weighed before choosing a different course.

Example

“If the eb:PartyId/@type attribute is not present, the content of the PartyId element MUST be a URI [RFC2396], otherwise the Receiving MSH SHOULD report a “ValueInconsistent” error with severity “error”. It is strongly RECOMMENDED that the content of the eb:PartyId element be a URI.”

  • ([EBMS-v3.0], section .5.2.2.4. eb:Messaging/eb:UserMessage/eb:PartyInfo/eb:From/eb:PartyId.)

Discussion

The use of IETF BCP14 SHOULD and RECOMMENDED are shown by use of upper case. The example specification has numerous uses of “should” in lower case, i.e., in normal English usage. The “strongly RECOMMENDED” does not require “report[ing of] a ValueInconsistent error,” but the implications of not doing so must be understood before making that choice.

Definition in BCP 14

SHOULD NOT   This phrase, or the phrase “NOT RECOMMENDED” mean that there may exist valid reasons in particular circumstances when the particular behavior is acceptable or even useful, but the full implications should be understood and the case carefully weighed before implementing any behavior described with this label.

Example

“OData services SHOULD NOT require any query options to be specified in a request. Services SHOULD fail any request that contains query options that they not understand and MUST fail any request that contains unsupported OData query options defined in the version of this specification supported by the service.”

  • ([OData-Part1], section 6.1 Query Option Extensibility.)

Discussion

The example shows a correct usage of SHOULD NOT.

2.3.2.5 MAY or OPTIONAL

Definition in BCP 14

MAY   This word, or the adjective “OPTIONAL”, mean that an item is truly optional. One vendor may choose to include the item because a particular marketplace requires it or because the vendor feels that it enhances the product while another vendor may omit the same item. An implementation which does not include a particular option MUST be prepared to interoperate with another implementation which does include the option, though perhaps with reduced functionality. In the same vein an implementation which does include a particular option MUST be prepared to interoperate with another implementation which does not include the option (except, of course, for the feature the option provides).

Example

“The element encapsulates the authorization decision produced by the PDP. It includes a sequence of one or more results, with one element per requested resource. Multiple results MAY be returned by some implementations, in particular those that support the XACML Profile for Requests for Multiple Resources [Multi]. Support for multiple results is OPTIONAL.”

  • [XACML-v3.0], section 5 Syntax (normative, with the exception of the schema fragments)

Discussion

A correct usage of MAY as a keyword, but also an illustration of designating part of a section as normative. Note that OPTIONAL is an alternative to MAY, when required by the syntax of the text.

2.4 ISO/IEC Directives

2.4.1 ISO/IEC Directives introduction

Unlike [IETF BCP14], section 7, “Verbal forms for expression of provisions” of [ISO/IEC Directives] does not require or even discuss the use of upper case forms of its keywords. Using the [ISO/IEC Directives], an author can write keywords in upper or lower case.

The ISO/IEC Directives do define equivalent expressions for keywords, to be used only in certain cases when the preferred form cannot be used for linguistic reasons.

The ISO/IEC Directives define five classes of keywords or “provisions”:

  • requirements
  • recommendations
  • permissions
  • possibilities
  • capabilities

The ISO/IEC Directives provide a table for each class of provision, defining the preferred form and the equivalent expressions.

Writers of OASIS specifications that use ISO/IEC keywords should consult [ISO/IEC Directives] Section 7 for the normative definitions of those keywords. For use with the mapping table in Section 5 below, a synopsis of ISO/IEC Directives Section 7 reads as follows:

Requirements:

  • shall – to indicate requirements strictly to be followed in order to conform to the standard and in which no deviation is permitted. Do not use “must” as an alternative for “shall”.
  • shall not – converse of shall. Do not use “must not” instead of “shall not”.

Recommendations:

  • should – to indicate that among several possibilities one is recommended as particularly suitable, without mentioning or excluding others.
  • should not – converse of should.

Permissions:

  • may – to indicate a course of action permissible within the limits of the standard. Do not use “can” instead of “may”
  • may not – to indicate a course of action is not required. (converse of may) (“need not” was used in ISO/IEC 5th Edition)

Possibilities and capabilities:

  • can – statement of possibility and capability, whether material, physical, or causal.
  • cannot – converse of can.

2.4.2 ISO/IEC Directives examples in an OASIS specification

In the following ISO/IEC examples, note that keywords do not require UPPER case or bolding in order to be keywords. They are keywords by definition, not typography.

The following examples are derived from the OASIS Standard Open Document Format for Office Applications (OpenDocument) Version 1.2 ([OpenDocument-v1.2]). The section numbers listed are from that specification.

shall

“An OpenDocument document shall meet the following requirements:”

  • (section 2.2.1 OpenDocument Document.)

shall not

“OpenDocument extended documents may contain elements and attributes not defined by the OpenDocument schema. Elements and attributes not defined by the OpenDocument schema are called foreign elements and attributes. Foreign elements and attributes shall not be associated with a namespace that is listed in tables 1, 2 or 3 of section 1.5.”

  • (section 3.17 Foreign Elements and Attributes.)

should

“The generator string should allow OpenDocument consumers to distinguish between all released versions of a producer.”

  • (section 4.3.2.1 <meta:generator>.)

should not

“consumers should not permit characters defined by the [SQL] feature F392 for new or changed names of tables, views, columns, and queries.”

  • (section 19.49 db:enable-sql92-check.)

need not

“letters in a custom shape need not have the same height.”

  • (section 19.224 draw:text-path-same-letter-heights.)

can

“The draw:transform attribute specifies a list of transformations that can be applied to a drawing shape.”

  • (section 19.228 draw:transform.)

cannot

“If an OpenDocument producer that creates a document cannot provide an identifier string, the producer shall not export this element. “

  • (section 4.3.2.1 <meta:generator>)

3 OASIS Committee Notes and Project Notes

OASIS Committee Notes and Project Notes are not standards-track documents, and should not contain specification-like language.

IETF BCP 14 capitalized keywords should not be used in these documents, except when quoting another document.

ISO/IEC keywords should not be used in these documents to indicate requirements.


4 Frequently asked questions

  • When are [IETF BCP 14] keywords (or other keywords) required?
    All OASIS work products that will become OASIS Specifications or OASIS Standards, should use the IETF BCP 14 keywords.
  • When are IETF BCP 14 keywords (or other keywords) to be avoided?
    An OASIS Committee (or Project) Note, also known as a “non-standards track” work product, should not use IETF BCP14 keywords, to avoid confusion with OASIS Specifications and Standards.
  • Do keywords only appear in conformance clauses?
    No. Keywords appear in normative parts of a document that are then referred to by clauses in a conformance clause.
  • As an editor, why would I use [ISO/IEC Directives] keywords instead of IETF BCP 14 in a specification?
    If you are planning on submitting an OASIS Standard to ISO/IEC, you can use IETF BCP 14 keywords on a first submission. However, on subsequent submissions, you will be required to conform to the ISO/IEC Directives, which will require use of ISO/IEC keywords.
  • Is “MAY NOT” an IETF BCP 14 keyword?
    No, although it is an ISO/IEC key word in the Eighth Edition of the ISO/IEC Directives.

5 Mapping table for IETF and ISO/IEC keywords

Table 1 lists semantic equivalents between IETF BCP 14 and ISO/IEC keywords. Where there is an empty cell, this means there is no equivalent in that set. If specification writers restrict themselves to keywords that have semantic equivalents, conversion between IETF BCP 14 and ISO/IEC, or vice versa will be easier. In developing this table, we consider IETF BCP 14 treatment of interoperability to be narrow, and interpret requirements as broadly as possible in the manner interpreted by ISO/IEC. The third column in the table lists synonyms that may be considered when specification writers are trying to avoid using one the formal keywords.

Table 1
IETF BCP 14ISO/IECEquivalent phrases, only if necessary
MUST, SHALL, REQUIREDshallis to, is required to, it is required that, has to, only … is permitted, it is necessary
MUST NOT, SHALL NOT, REQUIREDshall notis not allowed [permitted] [acceptable] [permissible], is required to be not, is required that … be not, is not to be, do not
SHOULD/RECOMMENDEDshouldit is recommended that, ought to
SHOULD NOT/NOT RECOMMENDEDshould notit is not recommended that, ought not to
MAY/OPTIONALmayis permitted, is allowed, is permissible
*may notit is not required that, no … is required
*canbe able to, there is a possibility of, it is possible to
*cannotbe unable to, there is no possibility of, it is not possible to

Entries with “*” indicate that no [IETF BCP14] equivalent is defined.


Appendix A. References

A.1 Keyword references

[IETF BCP14]

The two IETF RFCs [RFC2119] and [RFC8174]

[ISO/IEC Directives]

ISO/IEC Directives, Part 2 (Eighth edition) Principles and rules for the structure and drafting of ISO and IEC documents, International Organization for Standardization and International Electrotechnical Commission, 2018. https://www.iso.org/sites/directives/current/part2/index.xhtml.

[RFC2119]

Bradner, S., “Key words for use in RFCs to Indicate Requirement Levels”, BCP 14, RFC 2119, DOI 10.17487/RFC2119, March 1997, http://www.rfc-editor.org/info/rfc2119.

[RFC8174]

Leiba, B., “Ambiguity of Uppercase vs Lowercase in RFC 2119 Key Words”, BCP 14, RFC 8174, DOI 10.17487/RFC8174, May 2017, http://www.rfc-editor.org/info/rfc8174.

A.2 OASIS specifications cited

[EBMS-v3.0]

OASIS ebXML Messaging Services Version 3.0: Part 1, Core Features. 01 October 2007. OASIS Standard. http://docs.oasis-open.org/ebxml-msg/ebms/v3.0/core/os/ebms_core-3.0-spec-os.html.

[OData-Part1]

OData Version 4.0 Part 1: Protocol. Edited by Michael Pizzo, Ralf Handl, and Martin Zurmuehl. 24 February 2014. OASIS Standard. http://docs.oasis-open.org/odata/odata/v4.0/os/part1-protocol/odata-v4.0-os-part1-protocol.html.

[OpenDocument-v1.2]

Open Document Format for Office Applications (OpenDocument) Version 1.2. 29 September 2011. OASIS Standard. http://docs.oasis-open.org/office/v1.2/os/OpenDocument-v1.2-os.html.

[XACML-v3.0]

eXtensible Access Control Markup Language (XACML) Version 3.0. 22 January 2013. OASIS Standard. http://docs.oasis-open.org/xacml/3.0/xacml-3.0-core-spec-os-en.html.


Appendix B. Revision History

RevisionDateEditorChanges Made
Initial publication2014-03-21Patrick Durusau
Revision 22021-04-08Paul KnightRFC 2119 extended per BCP 14; Use of Eighth Edition of ISO/IEC Directives

Open Project Rules

This version of the OASIS Open Project (OP) Rules was approved by the OASIS Board of Directors on 14 June 2022 and became effective immediately. The change was announced to OASIS members on 01 July 2022 in https://lists.oasis-open.org/archives/members/202207/msg00000.html

Table of Contents

1. Purpose of Open Projects

An OASIS Open Project (or Project) is a program hosted by OASIS for the development of code, specifications and other artifacts under open source licenses, under one or more of the Applicable Licenses listed in Section 15, and selected by the Project as specified below. OASIS Open Projects are conducted according to the provisions of these Rules. The OASIS Committee Operations Process provides general provisions concerning the operation of all committees that may apply to the work of a Project Governing Board (PGB). Certain defined terms used in this document have the meaning provided in the OASIS Defined Terms.

Any person or entity, whether or not an OASIS member, may participate in or contribute to a Project, as provided by these rules. Contributions, and the acceptance or merger of contributions into the Project’s work, are managed primarily through one or more open source Project Repositories (as defined in Section 8).

Projects operate under the administrative and process rules described in this document, and are administered by the OASIS Open Project Administrator designated by OASIS.

2. Project Formation; Charter

2.1 OASIS Open Projects are initiated by one or more organizations committed to being Project Sponsors and (optionally) persons who intend to make technical contributions to the Project. Any group of at least one or more Project Sponsors whose aggregate project sponsorship dues equal or exceed the minimum threshold established by a resolution of the OASIS Board of Directors, plus one or more named Contributors, may initiate a Project by submitting to the Open Project Administrator a Charter prepared using the Open Project Charter Template maintained and made available by the Open Project Administrator. Additional membership requirements apply to some approval activities as noted below. The Charter shall be written in English and provided to OASIS in electronic form as plain text. The name proposed for the Project shall be subject to approval by the Open Project Administrator for purposes of confirming infringement and appropriate use issues. If the proposed name includes a reference to an OASIS Technical Committee (TC) or specification title, or the name of another Open Project, then the approval of any open OASIS TC or Open Project who uses that name or has authored that specification is required in advance. No information other than that requested in the template may be included in the proposal. Any documents referenced in the proposal shall be publicly available.

The Charter must include a brief statement of purpose and a scope of work for the Project. The scope of work serves as a limit on the approval of Project Standards Track Work Products. The statement of purpose is only informative, not normative. The Charter also must state the number of Project Repositories initially requested to support the Project, and the Applicable License to be applied to each requested repository.

2.2 The Open Project Administrator shall reply in writing with its approval or other disposition of the proposal described above. OASIS shall post a public notice of each approved Project to its announced public mailing list.

2.3 After formation, the Charter of an Open Project may be amended only as provided in Section 5.6.

3. Roles of Parties in the Project

The work of a Project and its administration are conducted by parties who voluntarily contribute in one or more of the following defined roles: Contributor, Maintainer, Project Governing Board (PGB), Technical Steering Committee (TSC), and Chair. A detailed and definitive description of those roles follows in Sections 4, 5, 6 ,and 7 below. A table summarizing those roles can be found in the OASIS Committee Operations Process.

4. Contributors

4.1 Any person (whether or not an OASIS member) may participate in a Project as a Contributor by providing comments or bug reports to a Project Repository, subject to the licensing rules in Sections 14, 15 and 16 below.

4.2 Any person (whether or not an OASIS member) may agree to a Contributor License Agreement (CLA), as provided in the licensing rules below, as a prerequisite for acceptance of their pull requests or other substantive contributions. If a person who signs and submits an individual CLA indicates that they represent an entity, then that individual CLA will only be deemed effective if that entity has signed and submitted an entity CLA. The Project Governing Board and Maintainers shall only act on pull requests or other substantive contributions made by project Contributors who are listed in the OASIS system as having agreed to the relevant CLA. The Project shall maintain a record of all Contributors who have made contributions to a Project.

5. Project Governing Board and Project Sponsors

5.1 Overall guidance for the Project is provided by its Project Governing Board (or PGB). The PGB is composed of one voting member from each Project Sponsor who elects to appoint a PGB member, and (a) if the PGB has one or more Technical Steering Committees, one voting expert representative from each TSC, elected or appointed by that TSC, or (b) otherwise, the PGB may appoint at least one and no more than two voting expert representatives from its community of contributors. The PGB may create additional non-voting PGB member seats for expert representatives to be elected by the TSC or appointed by the PGB. The PGB membership of all such members of any type is conditioned on satisfaction of the CLA requirement of Section 5.2. Voting status on the PGB may be affected by the provisions of Section 5.7.

A list of PGB members shall be maintained and posted at the general information web page or official published governance information designated by OASIS for the Project. Certain actions taken by the PGB require affirmative action by Project Approval Minimum Membership, as defined below.

5.2 PGB members must:

  • (a) have signed and submitted an individual CLA, and if appointed or employed by an entity, that entity must have signed and submitted an entity CLA naming that project; and
  • (b) either (i) represent an organization that has paid the appropriate Sponsorship dues for that Open Project or (ii) has been appointed or elected as an expert representative as provided above.

5.3 Project Approval Minimum Membership, where it explicitly is required for the PGB’s approval of an action under these rules, means at least two Project Sponsors seated on the PGB.

5.4 The PGB shall:

Decisions by the PGB shall be made in a manner consistent with the requirements of Section 10.

5.5 Status as a PGB member who represents an organization accrues to the organizational Project Sponsor, and is transferable by that Project Sponsor from person to person, as evidenced by a notice in writing from its Primary Representative to the OASIS Open Project Administrator. A Project Sponsor may resign from PGB membership at any time, by notifying the Open Project Administrator and the PGB Chair(s) in writing.

5.6 The PGB may amend the Charter after the Project’s formation in the following manner:

  • (a) An amendment to the binding scope of work may only be made for the purpose of removing ambiguity or for narrowing the scope of work, and requires a Special Majority Vote  of the PGB. Such an amendment may also at the PGB’s option update the statement of purpose, list of planned deliverables and/or list of repositories and licenses.
  • (b) Any amendment to other elements of the Charter may be made by a Full Majority Vote  of the PGB, so long as and any additions to the list of deliverables are within the scope of
    work.
  • (c) In any case, any amended Charter must comply with the requirements of Section 2.1, and shall not take effect until approved by the PGB and announced by the Open Project Administrator.

5.7 At its option, the PGB may adopt a Standing Rule to modify its quorum and voting rules provided by these Rules in the following manner (all of which modifications must be elected as a single package):

  • (a) Applying the rule of OASIS TC Process Section 1.4 to PGB voting, so that repeatedly absent members shall remain PGB Members, but shall lose their right to vote as PGB Voting Members, and their right to be counted in Quorum, until recovered in the manner described in that Section 1.4;
  • (b) Applying the rule of OASIS TC Process Section 1.4 to Persistent Nonvoting Members of the PGB, so that members shall remain Members but decline to be Voting Members, in the manner described in that Section 1.4; and
  • (c) Applying the rule of OASIS TC Process Section 1.6 to Leaves of Absence for Voting Members of the PGB, so that Members shall remain Members but remove themselves from Voting Member status for a fixed duration, in the manner described in that Section 1.6.

If a PGB Member appointed by a Project Sponsor or a TSC is replaced on the PGB by a different individual appointed by that Project Sponsor or a TSC, the new incumbent will start as a Voting Member, regardless of any impairment to the prior representative’s voting status.

6. Technical Steering Committees

The PGB shall form a Technical Steering Committee (or TSC) by a resolution of the PGB. A Project’s TSC members shall be composed of the persons, selected in the manner, and chaired by such person as is provided by that resolution. The PGB must create and publish process documentation for each TSC, outlining the requirements for joining and voting in that TSC, consistent with these Rules (including Section 10), and shall specify whether the Chair(s) of the TSC are selected by the PGB, or by that TSC’s members. The TSC shall have the duties to advise the PGB and such others as are specified by the PGB, so long as consistent with these Rules and OASIS policies. The following activities may not be delegated by the PGB, although it may consult with any TSC regarding them at the PGB’s option: election or termination of PGB Chairs, approval of any Releases, Group Releases, Project Specification Drafts, Project Specifications, and approval of Candidates for OASIS Standards or external submissions.

The PGB may form more than one TSC, in which case it must designate a name and a distinct scope of operation for each TSC.

TSC members must have signed and submitted an individual CLA, and if appointed by an entity, that entity must have signed and submitted an entity CLA. A list of TSC members shall be maintained and posted at the general information web page designated by OASIS for the Project. An individual may resign from TSC membership at any time, by notifying the Open Project Administrator and the Chair(s) in writing.

7. Project Chairs and Maintainers

7.1 The PGB shall select one or two of its members as Chairs by a Full Majority Vote, to coordinate and manage Project decision-making and logistics. The PGB may remove a Chair at any time by a Full Majority Vote. The Chair(s) of the Project shall:

  • (a) be responsible for the coordination and polling of any decisions of the PGB
  • (b) convene and make arrangements for any desired virtual or physical face-to-face meetings of the PGB and/or Contributors
  • (c) assist and support the Maintainer(s) as appropriate
  • (d) be responsible as the Project’s principal point of contact with OASIS staff and resources as needed
  • (e) manage or provide for the management of communications with Contributors, any liaisons and the public as may be desirable in support of the Project’s goals.

If a PGB does not have at least one Chair then all PGB activities, with the exception of the selection of a new Chair, are suspended. If a PGB does not have a Chair for 180 days, the Open Project Administrator may declare the PGB closed. After closure of the PGB, the Project may no longer take actions that require the approval of the PGB.

7.2 The PGB shall ensure that there are one or more Maintainers to serve as the principal editor(s) of the Project’s technical work managed within its Project Repositories. Maintainers shall exercise editorial responsibility over the contents of the Project’s repositories, including by:

  • (a) evaluating and responding to pull requests
  • (b) designating main or recommended branches of each repository
  • (c) designating deprecated branches or contributions.

Maintainers should act to carry out the technical consensus of the TSC, Contributors, and PGB, and may be removed by the PGB at any time, after notice to the Maintainer and the TSC, for failure to perform their functions as determined by the PGB. No contributed information or pull requests may be deleted from any Project Repository, due to the open nature of the Applicable Licenses and the Archival Permanence rules in Section 9.2. The appointment of a Maintainer survives the closure of the PGB, and thereafter the remaining Maintainer(s) or the Open Projects Administrator may appoint additional or replacement Maintainers.

8. Repositories and Project Tools

8.1 OASIS will support official repositories for each Project (Project Repositories) using tools selected by staff that are clearly marked as a distinct resource. The repositories listed in the Project’s Charter will be opened by OASIS staff in connection with the Project’s launch. Subject to the requirements of this Section 8, subsequent Project Repositories may be opened by (a) a decision of the PGB, or (b) if the PGB elects to adopt a Standing Rule that permits it, then a TSC or a designated maintainer may also do so. However, adding new Applicable Licenses requires PGB approval: any Project Repository that applies an Applicable License (as provided in Section 15.1) that is already not in use in other Repositories of that Project must first be approved by a Special Majority Vote of the PGB.

8.2 Each Project Repository will serve as a distinct open source project, including issue tracking, comment facilities, and such other facilities as are normally available by default.

8.3 The Project’s official Project Tools include the Project’s Repositories and these additional tools: A principal web page for each Project, which may be the home resource page of the Project’s first Project Repository, and at least one official list for administration of the Project. Subscription to such lists, which shall be subject to the OASIS Mailing List Guidelines, shall be open to anyone.

9. Visibility and Archival Permanence

9.1 Visibility. Contributions, comments, decisions, records of decisions and all other resources of the Project, including web pages, documents, mailing lists and any other records of discussions, must be located only on the Project Tools designated or authorized by OASIS. Projects may not conduct official business or technical discussions, store documents, or host web pages on servers or systems not designated by OASIS. All Project Tools shall be publicly visible, and all threaded and mail list discussions shall be publicly archived.

9.2 Archival Permanence. OASIS warrants that it will not inhibit open and free access to all of the material contributed to each Project Repository, as open and freely available resources. This warranty is perpetual and will not be revoked by OASIS or its successors or assigns; however, neither OASIS nor its assigns shall be obligated to:

  • (a) perpetually maintain its own existence, nor
  • (b) provide for the perpetual existence of a website or other public means of accessing such material, nor
  • (c) maintain any material which it is legally required to remove from publication.

Some contributed material may be treated as superseded or deprecated by Maintainers or by version control methods, as provided in these rules, but neither Maintainers nor any other party shall delete content. The original form of each contribution shall continue to be available for review, and use according to its licensure, through appropriate version control or document management methodologies.

9.3 Repository Lifecycle. Once a Project Repository has been created, it will remain open as a resource for public use and reference, and continuing repository contributions or comments, regardless of closure of the Project, under the Archival Permanence rule above, with such remaining Maintainers as may have been appointed.

9.4 Announcements. The Open Project Administrator shall create a publicly archived, subscribable list for announcements and public notices from OASIS regarding Open Projects. Every important change in Project status shall be posted to that list, including Project formation; opening of a new Project Repository; Releases; Group Releases; Draft Project Specifications; Project Specifications; Candidate OASIS Standards; and proposed external submissions.

10. Project Governance: Decisions and Meetings

10.1 Decisions by the PGB regarding the matters allocated to them by these rules normally should be made after reasonable notice to and consultation with the Project’s Contributors, and should be made by consensus except in cases where a specific majority vote is required by these rules. In other matters, PGBs and their subordinate bodies are otherwise encouraged to operate without formal motions, formal balloting, or other procedural devices described in Roberts Rules of Order Newly Revised; except that a PGB may elect to require routine use of such motions, balloting and devices by approving a Special Rule to that effect. The Chair(s) of the Project are responsible for conducting and administrating the decision processes of the PGB and the Project, consistent with these rules.

10.2 Meetings of the PGB and any TSC must be properly called by the Chair(s) and scheduled in advance using the OASIS collaborative communication Project Tools. Meetings may be conducted face-to-face or via telephone conference or other electronic media that allow participation of all PGB members. In order to enable the openness of proceedings, meetings also should be scheduled and conducted to permit the presence of as many Contributors as is logistically feasible. A note of each meeting’s outcomes must be posted to a publicly accessible location provided by OASIS. Meetings or decisions scheduled or conducted so as to exclude the participation of any PGB member or Contributor are subject to appeal to the Open Project Administrator.

10.3 Electronic ballots of the PGB, when required by these rules, must be conducted on facilities provided or approved by OASIS, and must remain open for a minimum period for seven days. The Chair(s) may specify a longer voting period for a particular electronic ballot. Eligible voters may change their vote up until the end of the voting period.

11. Progression of Project Work

11.1 In addition to making available the contributions provided by Contributors, via their Project Repositories, Projects may designate specific portions of their output as official Releases, Group Releases, Project Specification Drafts or Project Specifications, and nominate them for further advancement, on the terms set forth in Sections 11, 12, 13 and 14.

11.2 Where the PGB or a consensus among the Contributors indicates that a specific set of contributions should be formally considered as a Release, Group Release, Draft Project Specification or Project Specification, then in preparation for that consideration, the Maintainers shall arrange the relevant material in the relevant Project Repository or repositories so that the set can be accessed and referenced as a distinct branch (a Designated Branch).

12. Releases and Group Releases

12.1 Releases. The PGB may act to approve a Designated Branch as an official Release of the Project, after giving notice to all Contributors via the Project Tools at least fourteen days prior to initiating a PGB vote or consensus call. Such approval decisions are subject to the process, notice and transparency provisions of these rules. Any product of the Project that is composed from contributions to the Project Repositories, of any nature, is eligible for approval as a Release of the Project.

12.2 Group Releases. When desirable to aggregate outputs, the PGB may act to approve any set of the Project’s Releases or subsets of Releases as an official Group Release of the Project, after giving notice to all Contributors via the Project Tools at least fourteen days prior to initiating a PGB vote or consensus call. Such approval decisions are subject to the process, notice and transparency provisions of these rules. Group Releases may include multiple Releases that bear different Applicable Licenses. Aggregate contributions by Maintainers or others which are prepared as potential Project Specifications should instead be approved as Project Specification Drafts, as provided below.

12.3 Licensing. Releases and Group Releases bear only the license rights and covenants provided for each of the contributions included there, as evidenced by the relevant repositories’ Applicable License(s) and the CLAs.

13. Project Specifications

13.1 In order to progress a Release or Group Release by the Project as a Project Specification Draft (or PSD) or a Project Specification (or PS), the PGB and the contents of the release(s) must satisfy the additional criteria of this Section.

13.2 In order to be advanced through the approval process, a proposed Project Specification must conform to the Project Specification template provided by the Open Project Administrator, which includes methods for indicating the relevant Designated Branches and Applicable Licenses. Proposed Project Specification Drafts also should conform to that template, to the extent possible.

13.3 Project Specification Drafts. A PGB having at least Project Approval Minimum Membership may act to approve any set of contributions to the Project, including from its Releases or Group Releases, as an official Project Specification Draft, after giving notice to all Contributors via the Project Tools at least fourteen days prior to initiating a PGB vote or consensus call. Such approval decisions are subject to the process, notice and transparency provisions of these rules.

13.4 Project Specifications. A PGB having at least Project Approval Minimum Membership may act to approve any Project Specification Draft as a Project Specification, by satisfying each of the following requirements:

  • (a) Written notice of that nomination must be given by the PGB to all those involved with the Project and the Open Project Administrator at least fourteen days prior to initiating a ballot. The ballot must be conducted by a Special Majority Vote of the PGB. The approval decision is subject to the process, notice and transparency rules set forth in these rules and the content requirements noted below.
  • (b) Any machine-executable instructions in a specific computer language (code) that are included in the Project Specification must be composed only of one or more Releases or Group Releases bearing Implementer-Class Licenses.
  • (c) Any guidance, descriptions, processes, models for the behavior of a system or service, or other content that is not machine-executable, and is included in the Project Specification, must be composed only of contributions (which may include Releases or Group Releases) previously made to a Project Repository.
  • (d) The proposed Project Specification will be subject to review and confirmation of conformance by the Open Project Administrator before the approval ballot is opened.

13.5 Upon successful conclusion of the Special Majority Vote, the Open Project Administrator must give public written notice thereof, which constitutes approval, and thereafter will publish the Project Specification to the OASIS Library.

13.6 Licensing. Project Specifications bear the license rights and covenants provided for each contribution included there, as evidenced by the relevant repositories’ Applicable License(s) and the CLAs, as well as the Specification Non-Assertion Covenant. Project Specifications may bear more than one Applicable License, when composed from Releases or Group Releases from multiple Project Repositories that have different Applicable Licenses.

13.7 Implementations of all kinds are welcome (partial or complete; prototype, proof-of-concept, example, model, or reference implementations), provided that PGBs may not designate any single implementation of a Project Specification as exclusive or privileged.

14. OASIS Standard Approval and External Submissions

Project Specifications are eligible for and may be submitted for approval as OASIS Standards, under the following conditions:

  • (a) After three Statements of Use referencing the PS have been presented to the PGB, a PGB having at least Project Approval Minimum Membership may approve the PS as a candidate for OASIS Standard in the same manner, and subject to the same requirements, as apply to Committee Specifications as provided in Section 3.8 Approval of an OASIS Standard of the OASIS TC Process. Procedural requirements applicable to TCs in that rule apply to the PGB for this purpose, including the Special Majority Vote required to nominate a Project Specification for OASIS Standard. However, a candidate for OASIS Standard submitted by an Open Project shall be subject to the distinct licensing terms in these rules, and not the licensing terms in the OASIS IPR Policy for TCs.
  • (b) Upon a successful conclusion of that PGB vote and all other requirements, the OASIS TC Administrator shall proceed with public review and a call for consent as provided in Sections 3.8.2 and 3.8.3 of the OASIS TC Process. An OASIS Standard submitted by an Open Project and approved as provided above is eligible for further external submissions as provided in and subject to the requirements in the OASIS Liaison Policy. The PGB must have at least Project Approval Minimum Membership at the time of any such action or approval; the other procedural requirements applicable to TCs in that policy apply to the PGB for this purpose.

15. Repository and Specification Licenses

15.1 Applicable Licenses; Copyright Implementation Licenses. Each Project Repository will be subject to a declared Applicable License, selected from the list of licenses in this section. Each Contributor agrees in the CLA to grant the Applicable License designated for a repository to all contributions donated to that repository by posting it or requesting its inclusion in that repository, and to all Releases issued from that repository.

Anyone may offer comments to any Project Repository, on the terms of the foregoing licenses, as evidenced in the manner noted below. Anyone will be entitled to make use of the contents of a Project Repository, according to the terms of its Applicable License.

15.2 When requesting the creation of a Project Repository, the PGB must select that repository’s Applicable License from among the following list:

Other widely-used free and open source licenses may be added to this list after review and acceptance by OASIS and amendment of these rules.

15.3 Special Covenants for Project Specifications. In addition to the Applicable License for each Project Repository, each Contributor also agrees in the CLA to provide the additional covenants in this Section 15.3, as non-assertion covenants in favor of certain Project Specifications (collectively the Specification NonAssertion Covenant):

Contributor Covenant for Specifications. As a Contributor, you irrevocably covenant that you will not assert any patent claims licensable by you that are necessarily infringed by an implementation of your contribution to the extent that contribution is included in a Project Specification approved by the Open Project to which you made the contribution, against OASIS or any other parties who the Applicable License benefits, for making, having made, using, marketing, importing, offering to sell, selling, and otherwise distributing works that Implement or Derive From your contribution.

PGB Covenant for Specifications. For any Project Repository whose Applicable License is an Implementer-Class License, if you (or your representative) are a member of that Open Project’s Governing Board, you irrevocably covenant that you will not assert any patent claims licensable by you that are necessarily infringed by an implementation of a Project Specification approved by that Open Project within the scope of work of its Charter in effect at the time such deliverable was approved, and any Maintenance Deliverable approved for it, against OASIS or any other parties who the Applicable License benefits, for making, having made, using, marketing, importing, offering to sell, selling, and otherwise distributing works that Implement or Derive From that Project Specification and are compliant with all normative portions thereof. If you withdraw from the PGB, then this obligation continues to apply, but only with respect to those Project Specification Drafts approved more than 7 calendar days prior to your withdrawal, and to any Maintenance Deliverables approved for those specifications thereafter.

Scope of Implementations Benefited. As used in this covenant, works that “Implement or Derive From” a contribution or specification include:

  • (a) specifications to the extent derived from code
  • (b) independent code implementations of a specification
  • (c) independent code implementations of a specification to the extent the specification is derived from code.

For purposes of this definition, “specifications” include documentation, data flows, data formats, application programming interfaces and process descriptions.

Withdrawal from Covenant. Your Specification NonAssertion Covenant may be suspended or revoked by you with respect to any person who alleges in writing or files a suit asserting that your Contribution, or the work to which you have contributed, constitutes direct or contributory patent infringement.

16. Trademarks

In order to incorporate a trademark or service mark into a Project, including its use in the name of an OASIS Open Project or any Release, or its inclusion in the body of such work, that mark must be:

  • (a) owned by OASIS; or
  • (b) otherwise as approved by the OASIS Board of Directors.

No person may use an OASIS trademark or service mark in connection with an Open Project, a Release or otherwise, except in compliance with the Applicable License for a Release or otherwise according to such license and usage guidelines as OASIS may from time to time require.

17. CLAs and License Notices

17.1 A Contributor License Agreement (or CLA) shall bind each donor of a repository contribution, issue or comment of any kind to the repository’s Applicable License. All Contributions to Project Repositories shall be subject to an Individual CLA, in the form of Appendix A-1 to these rules, by which all persons making those Contributions are bound. Where Contributions are made by or on behalf of an organization, the responsible individual will designate that organization in their Individual CLA, and that organization will be asked to provide an Entity CLA, in the form of Appendix A-2 to these rules. If that Entity CLA is not obtained, OASIS and the Project must decline contributions from that individual.

Project Sponsors who appoint a member to the PGB must provide an Entity CLA, and the persons appointed by them as PGB members must provide an Individual CLA in order to serve.

Members of OASIS who provide an Entity CLA must provide the signature (or assent) of their OASIS Primary Representative. Individuals who represent an organization also are required by the Individual CLA to obtain an Entity CLA for that organization.

17.2 While some nominal write-access privileges (such as adding issues and comments) may be granted automatically to the public by the Project Tools, only persons who have signed the CLA will be permitted to submit content other than comments or suggestions for Non-Material Changes.

17.3. Each person making a Project Repository contribution must be bound to the terms of the Individual CLA, by obtaining their signature (which may be an equivalent electronic assent) in a manner appropriate to the tools employed to implement that repository; and those signatures shall be recorded and maintained in an auditable manner. Organizational Entity CLA signatures must also be obtained, recorded and maintained in a similar manner.

17.4. Notices of the Applicable License applicable to each Project Repository shall be conspicuously visible both from each repository’s contribution channels (for potential submitters of material) and its home resource pages (for potential readers and users).

17.5 Each Repository and its contribution facility shall be conspicuously marked with the following Call for Patent Disclosure:

[OASIS requests that any party contact the OASIS Open Project Administrator if it is aware of a claim of ownership of any patent claims that would necessarily be infringed by implementations of an OASIS Project Specification; and that any such claimant provide an indication of its willingness to grant a Specification Non-Assertion Covenant with respect to such patent claims, or otherwise to negotiate patent licenses free of charge with other parties on a non-discriminatory basis on reasonable terms and conditions.]

[OASIS may include such claims on its website, but disclaims any obligation to do so. OASIS takes no position regarding the validity or scope of any intellectual property or other rights that might be claimed to pertain to the implementation or use of the technology described in an OASIS Project Specification, or the extent to which any license under such rights might or might not be available; neither does it represent that it has made any effort to identify any such rights.]

18. Appeals and Application of Rules

The appeals process provided in Section 3.2 of the OASIS TC Process also shall apply to the actions of the OASIS Open Project Administrator, which may be appealed as provided therein.

Changes to these rules shall apply to previously-established Open Projects upon their adoption. However, OASIS may not change the terms of any signed CLA once it has been delivered to OASIS; if a change is required a new CLA must be executed.


Appendix A-1: Individual CLA

OASIS Open Projects: Individual Contributor License Agreement (CLA)

The text and links to file i-CLAs for Open Projects are available at https://www.oasis-open.org/open-projects/cla/oasis-open-projects-individual-contributor-license-agreement-i-cla/ .


Appendix A-2: Entity CLA

OASIS Open Projects: Entity Contributor License Agreement (CLA)

The text and link to file an e-CLA for an Open Project is available at https://www.oasis-open.org/open-projects/cla/entity-cla-20210630/.

Open Project Rules (06 March 2020)

This version of the OASIS Open Project (OP) Rules was approved by the OASIS Board of Directors on 06 March 2020 and became effective immediately. The change was announced to OASIS members on 10 March 2020 in https://lists.oasis-open.org/archives/members/202003/msg00001.html.

Table of Contents

1. Purpose of Open Projects

An OASIS Open Project (or Project) is a program hosted by OASIS for the development of code, specifications and other artifacts under open source licenses, under one or more of the Applicable Licenses listed in Section 15, and selected by the Project as specified below. OASIS Open Projects are conducted according to the provisions of these Rules. The OASIS Committee Operations Process provides general provisions concerning the operation of all committees that may apply to the work of a Project Governing Board (PGB). Certain defined terms used in this document have the meaning provided in the OASIS Defined Terms.

Any person or entity, whether or not an OASIS member, may participate in or contribute to a Project, as provided by these rules. Contributions, and the acceptance or merger of contributions into the Project’s work, are managed primarily through one or more open source Project Repositories (as defined in Section 8).

Projects operate under the administrative and process rules described in this document, and are administered by the OASIS Open Project Administrator designated by OASIS.

2. Project Formation

2.1 OASIS Open Projects are initiated by one or more organizations committed to being Project Sponsors and (optionally) persons who intend to make technical contributions to the Project. Any group of at least one or more Project Sponsors whose aggregate project sponsorship dues equal or exceed the minimum threshold established by a resolution of the OASIS Board of Directors, plus one or more named Contributors, may initiate a Project by submitting to the Open Project Administrator a Charter prepared using the Open Project Charter Template maintained and made available by the Open Project Administrator. Additional membership requirements apply to some approval activities as noted below. The Charter shall be written in English and provided to OASIS in electronic form as plain text. The name proposed for the Project shall be subject to approval by the Open Project Administrator for purposes of confirming infringement and appropriate use issues. If the proposed name includes a reference to an OASIS Technical Committee (TC) or specification title, or the name of another Open Project, then the approval of any open OASIS TC or Open Project who uses that name or has authored that specification is required in advance. No information other than that requested in the template may be included in the proposal. Any documents referenced in the proposal shall be publicly available.

The Charter must include a brief statement of purpose for the Project. However, the Project’s statement of purpose does not serve as a binding scope or boundary for work created in the Project. The Charter also must state the number of initial Project Repositories requested to be opened to support the Project, and the Applicable License to be applied to each requested repository.

2.2 The Open Project Administrator shall reply in writing with its approval or other disposition of the proposal described above. OASIS shall post a public notice of each approved Project to its announced public mailing list.

3. Roles of Parties in the Project

The work of a Project and its administration are conducted by parties who voluntarily contribute in one or more of the following defined roles: Contributor, Maintainer, Project Governing Board (PGB), Technical Steering Committee (TSC), and Chair. A detailed and definitive description of those roles follows in Sections 4, 5, 6 ,and 7 below. A table summarizing those roles can be found in the OASIS Committee Operations Process.

4. Contributors

4.1 Any person (whether or not an OASIS member) may participate in a Project as a Contributor by providing comments or bug reports to a Project Repository, subject to the licensing rules in Sections 14, 15 and 16 below.

4.2 Any person (whether or not an OASIS member) may agree to a Contributor License Agreement (CLA), as provided in the licensing rules below, as a prerequisite for acceptance of their pull requests or other substantive contributions. If a person who signs and submits an individual CLA indicates that they represent an entity, then that individual CLA will only be deemed effective if that entity has signed and submitted an entity CLA. The Project Governing Board and Maintainers shall only act on pull requests or other substantive contributions made by project Contributors who are listed in the OASIS system as having agreed to the relevant CLA. The Project shall maintain a record of all Contributors who have made contributions to a Project.

5. Project Governing Board and Project Sponsors

5.1 Overall guidance for the Project is provided by its Project Governing Board (or PGB). The PGB is composed of one voting member from each Project Sponsor who elects to appoint a PGB member, and at least one voting at-large expert representative from the community of contributors, elected or appointed by the Technical Steering Committee (TSC). The PGB may create additional PGB member seats for expert representatives to be elected by the TSC or appointed by the PGB.

A list of PGB members shall be maintained and posted at the general information web page designated by OASIS for the Project. Certain actions taken by the PGB require affirmative action by Project Approval Minimum Membership, as defined below.

5.2 PGB members must:

  • (a) have signed and submitted an individual CLA, and if appointed by an entity, that entity must have signed and submitted an entity CLA naming that project; and
  • (b) either (i) represent an organization that has paid the appropriate Backer dues for that Open Project or (ii) has been appointed or elected as an expert representative as provided above.

5.3 Project Approval Minimum Membership, where it explicitly is required for the PGB’s approval of an action under these rules, means at least two Project Sponsors.

5.4 The PGB shall:

Decisions by the PGB shall be made in a manner consistent with the requirements of Section 10.

5.5 Status as a PGB member who represents an organization accrues to the organizational Project Sponsor, and is transferable by that Project Sponsor from person to person, as evidenced by a notice in writing from its Primary Representative to the OASIS Open Project Administrator. A Project Sponsor may resign from PGB membership at any time, by notifying the Open Project Administrator and the PGB Chair(s) in writing.

6. Technical Steering Committees

The PGB shall form a Technical Steering Committee (or TSC) by a resolution of the PGB. A Project’s TSC members shall be composed of the persons, selected in the manner, and chaired by such person as is provided by that resolution. The PGB must create and publish process documentation, outlining the requirements for joining and voting in the project’s TSC. The TSC shall have the duties to advise the PGB and such others as are specified by the PGB, so long as consistent with these Rules and OASIS policies. The following activities may not be delegated by the PGB, although it may consult with the TSC regarding them at the PGB’s option: election or termination of PGB Chairs, approval of any Releases, Group Releases, Project Specification Drafts, Project Specifications, and approval of Candidate OASIS Standards or external submissions. TSC members must have signed and submitted an individual CLA, and if appointed by an entity, that entity must have signed and submitted an entity CLA. A list of TSC members shall be maintained and posted at the general information web page designated by OASIS for the Project. An individual may resign from TSC membership at any time, by notifying the Open Project Administrator and the Chair(s) in writing.

7. Project Chairs and Maintainers

7.1 The PGB shall select one or two of its members as Chairs by a Full Majority Vote, to coordinate and manage Project decision-making and logistics. The PGB may remove a Chair at any time by a Full Majority Vote. The Chair(s) of the Project shall:

  • (a) be responsible for the coordination and polling of any decisions of the PGB
  • (b) convene and make arrangements for any desired virtual or physical face-to-face meetings of the PGB and/or Contributors
  • (c) assist and support the Maintainer(s) as appropriate
  • (d) be responsible as the Project’s principal point of contact with OASIS staff and resources as needed
  • (e) manage or provide for the management of communications with Contributors, any liaisons and the public as may be desirable in support of the Project’s goals.

If a PGB does not have at least one Chair then all PGB activities, with the exception of the selection of a new Chair, are suspended. If a PGB does not have a Chair for 180 days, the Open Project Administrator may declare the PGB closed. After closure of the PGB, the Project may no longer take actions that require the approval of the PGB.

7.2 The PGB shall ensure that there are one or more Maintainers to serve as the principal editor(s) of the Project’s technical work managed within its Project Repositories. Maintainers shall exercise editorial responsibility over the contents of the Project’s repositories, including by:

  • (a) evaluating and responding to pull requests
  • (b) designating main or recommended branches of each repository
  • (c) designating deprecated branches or contributions.

Maintainers should act to carry out the technical consensus of the TSC, Contributors, and PGB, and may be removed by the PGB at any time, after notice to the Maintainer and the TSC, for failure to perform their functions as determined by the PGB. No contributed information or pull requests may be deleted from any Project Repository, due to the open nature of the Applicable Licenses and the Archival Permanence rules in Section 9.2. The appointment of a Maintainer survives the closure of the PGB, and thereafter the remaining Maintainer(s) or the Open Projects Administrator may appoint additional or replacement Maintainers.

8. Repositories and Project Tools

8.1 OASIS will create and support official repositories for each Project (Project Repositories) using tools, selected and configured by staff that are clearly marked as a distinct resource. OASIS will initialize each Project Repository as a distinct open source project, including issue tracking, comment facilities, and such other facilities as are normally available by default.

8.2 The Project’s official Project Tools include the Project’s Repositories and these additional tools: A principal web page for each Project, which may be the home resource page of the Project’s first Project Repository, and optionally, one or more mailing lists for administration of the Project. Subscription to such lists, which shall be subject to the OASIS Mailing List Guidelines, shall be open to anyone.

9. Visibility and Archival Permanence

9.1 Visibility. Contributions, comments, decisions, records of decisions and all other resources of the Project, including web pages, documents, mailing lists and any other records of discussions, must be located only on the Project Tools designated or authorized by OASIS. Projects may not conduct official business or technical discussions, store documents, or host web pages on servers or systems not designated by OASIS. All Project Tools shall be publicly visible, and all threaded and mail list discussions shall be publicly archived.

9.2 Archival Permanence. OASIS warrants that it will not inhibit open and free access to all of the material contributed to each Project Repository, as open and freely available resources. This warranty is perpetual and will not be revoked by OASIS or its successors or assigns; however, neither OASIS nor its assigns shall be obligated to:

  • (a) perpetually maintain its own existence, nor
  • (b) provide for the perpetual existence of a website or other public means of accessing such material, nor
  • (c) maintain any material which it is legally required to remove from publication.

Some contributed material may be treated as superseded or deprecated by Maintainers or by version control methods, as provided in these rules, but neither Maintainers nor any other party shall delete content. The original form of each contribution shall continue to be available for review, and use according to its licensure, through appropriate version control or document management methodologies.

9.3 Repository Lifecycle. Once a Project Repository has been created, it will remain open as a resource for public use and reference, and continuing repository contributions or comments, regardless of closure of the Project, under the Archival Permanence rule above, with such remaining Maintainers as may have been appointed.

9.4 Announcements. The Open Project Administrator shall create a publicly archived, subscribable list for announcements and public notices from OASIS regarding Open Projects. Every important change in Project status shall be posted to that list, including Project formation; opening of a new Project Repository; Releases; Group Releases; Draft Project Specifications; Project Specifications; Candidate OASIS Standards; and proposed external submissions.

10. Project Governance: Decisions and Meetings

10.1 Decisions by the PGB regarding the matters allocated to them by these rules normally should be made after reasonable notice to and consultation with the Project’s Contributors, and should be made by consensus except in cases where a specific majority vote is required by these rules. The Chair(s) of the Project are responsible for conducting and administrating the decision processes of the PGB and the Project, consistent with these rules.

10.2 Meetings of the PGB and any TSC must be properly called by the Chair(s) and scheduled in advance using the OASIS collaborative communication Project Tools. Meetings may be conducted face-to-face or via telephone conference or other electronic media that allow participation of all PGB members. In order to enable the openness of proceedings, meetings also should be scheduled and conducted to permit the presence of as many Contributors as is logistically feasible. A note of each meeting’s outcomes must be posted to a publicly accessible location provided by OASIS. Meetings or decisions scheduled or conducted so as to exclude the participation of any PGB member or Contributor are subject to appeal to the Open Project Administrator.

10.3 Electronic ballots of the PGB, when required by these rules, must be conducted on facilities provided or approved by OASIS, and must remain open for a minimum period for seven days. The Chair(s) may specify a longer voting period for a particular electronic ballot. Eligible voters may change their vote up until the end of the voting period.

11. Progression of Project Work

11.1 In addition to making available the contributions provided by Contributors, via their Project Repositories, Projects may designate specific portions of their output as official Releases, Group Releases, Project Specification Drafts or Project Specifications, and nominate them for further advancement, on the terms set forth in Sections 11, 12, 13 and 14.

12.2 Where the PGB or a consensus among the Contributors indicates that a specific set of contributions should be formally considered as a Release, Group Release, Draft Project Specification or Project Specification, then in preparation for that consideration, the Maintainers shall arrange the relevant material in the relevant Project Repository or repositories so that the set can be accessed and referenced as a distinct branch (a Designated Branch).

12. Releases and Group Releases

12.1 Releases. The PGB may act to approve a Designated Branch as an official Release of the Project, after giving notice to all Contributors via the Project Tools at least fourteen days prior to initiating a PGB vote or consensus call. Such approval decisions are subject to the process, notice and transparency provisions of these rules. Any product of the Project that is composed from contributions to the Project Repositories, of any nature, is eligible for approval as a Release of the Project.

12.2 Group Releases. When desirable to aggregate outputs, the PGB may act to approve any set of the Project’s Releases or subsets of Releases as an official Group Release of the Project, after giving notice to all Contributors via the Project Tools at least fourteen days prior to initiating a PGB vote or consensus call. Such approval decisions are subject to the process, notice and transparency provisions of these rules. Group Releases may include multiple Releases that bear different Applicable Licenses. Aggregate contributions by Maintainers or others which are prepared as potential Project Specifications should instead be approved as Project Specification Drafts, as provided below.

12.3 Licensing. Releases and Group Releases bear only the license rights and covenants provided for each of the contributions included there, as evidenced by the relevant repositories’ Applicable License(s) and the CLAs.

13. Project Specifications

13.1 In order to progress a Release or Group Release by the Project as a Project Specification Draft (or PSD) or a Project Specification (or PS), the PGB and the contents of the release(s) must satisfy the additional criteria of this Section.

13.2 In order to be advanced through the approval process, a proposed Project Specification must conform to the Project Specification template provided by the Open Project Administrator, which includes methods for indicating the relevant Designated Branches and Applicable Licenses. Proposed Project Specification Drafts also should conform to that template, to the extent possible.

13.3 Project Specification Drafts. A PGB having at least Project Approval Minimum Membership may act to approve any set of contributions to the Project, including from its Releases or Group Releases, as an official Project Specification Draft, after giving notice to all Contributors via the Project Tools at least fourteen days prior to initiating a PGB vote or consensus call. Such approval decisions are subject to the process, notice and transparency provisions of these rules.

13.4 Project Specifications. A PGB having at least Project Approval Minimum Membership may act to approve any Project Specification Draft as a Project Specification, by satisfying each of the following requirements:

  • (a) Written notice of that nomination must be given by the PGB to all those involved with the Project and the Open Project Administrator at least fourteen days prior to initiating a ballot. The ballot must be conducted by a Special Majority Vote of the PGB. The approval decision is subject to the process, notice and transparency rules set forth in these rules and the content requirements noted below.
  • (b) Any machine-executable instructions in a specific computer language (code) that are included in the Project Specification must be composed only of one or more Releases or Group Releases bearing Implementer-Class Licenses.
  • (c) Any guidance, descriptions, processes, models for the behavior of a system or service, or other content that is not machine-executable, and is included in the Project Specification, must be composed only of contributions (which may include Releases or Group Releases) previously made to a Project Repository.
  • (d) The proposed Project Specification will be subject to review and confirmation of conformance by the Open Project Administrator before the approval ballot is opened.

13.5 Upon successful conclusion of the Special Majority Vote, the Open Project Administrator must give public written notice thereof, which constitutes approval, and thereafter will publish the Project Specification to the OASIS Library.

13.6 Licensing. Project Specifications bear the license rights and covenants provided for each contribution included there, as evidenced by the relevant repositories’ Applicable License(s) and the CLAs, as well as the Specification NonAssertion Covenant. Project Specifications may bear more than one Applicable License, when composed from Releases or Group Releases from multiple Project Repositories that have different Applicable Licenses.

13.7 Implementations of all kinds are welcome (partial or complete; prototype, proof-of-concept, example, model, or reference implementations), provided that PGBs may not designate any single implementation of a Project Specification as exclusive or privileged.

14. OASIS Standard Approval and External Submissions

Project Specifications are eligible for and may be submitted for approval as OASIS Standards, under the following conditions:

  • (a) After three Statements of Use referencing the PS have been presented to the PGB, a PGB having at least Project Approval Minimum Membership may approve the PS as a Candidate OASIS Standard in the same manner, and subject to the same requirements, as apply to Committee Specifications as provided in Section 3.8 Approval of an OASIS Standard of the OASIS TC Process. Procedural requirements applicable to TCs in that rule apply to the PGB for this purpose, including the Special Majority Vote required to nominate a Project Specification for OASIS Standard. However, a Candidate OASIS Standard submitted by an Open Project shall be subject to the distinct licensing terms in these rules, and not the licensing terms in the OASIS IPR Policy for TCs.
  • (b) Upon a successful conclusion of that PGB vote and all other requirements, the OASIS TC Administrator shall proceed with public review and a call for consent as provided in Sections 3.8.2 and 3.8.3 of the OASIS TC Process. An OASIS Standard submitted by an Open Project and approved as provided above is eligible for further external submissions as provided in and subject to the requirements in the OASIS Liaison Policy. The PGB must have at least Project Approval Minimum Membership at the time of any such action or approval; the other procedural requirements applicable to TCs in that policy apply to the PGB for this purpose.

15. Repository and Specification Licenses

15.1 Applicable Licenses; Copyright Implementation Licenses. Each Project Repository will be subject to a declared Applicable License, selected from the list of licenses in this section. Each Contributor agrees in the CLA to grant the Applicable License designated for a repository to all contributions donated to that repository by posting it or requesting its inclusion in that repository, and to all Releases issued from that repository. Anyone may offer comments to any Project Repository, on the terms of the foregoing licenses, as evidenced in the manner noted below. Anyone will be entitled to make use of the contents of a Project Repository, according to the terms of its Applicable License.

15.2 When requesting the creation of a Project Repository, the PGB must select that repository’s Applicable License from among the following list:

Other widely-used free and open source licenses may be added to this list after review and acceptance by OASIS and amendment of these rules.

15.3 Special Covenants for Project Specifications. In addition to the Applicable License for each Project Repository, each Contributor also agrees in the CLA to provide the additional covenants in this Section 15.3, as non-assertion covenants in favor of certain Project Specifications (collectively the Specification NonAssertion Covenant):

Contributor Covenant for Specifications. As a Contributor, you irrevocably covenant that you will not assert any patent claims licensable by you that are necessarily infringed by an implementation of your contribution to the extent that contribution is included in a Project Specification approved by the Open Project to which you made the contribution, against OASIS or any other parties who the Applicable License benefits, for making, having made, using, marketing, importing, offering to sell, selling, and otherwise distributing works that Implement or Derive From your contribution.

PGB Covenant for Specifications. For any Project Repository whose Applicable License is an Implementer-Class License, if you (or your representative) are a member of that Open Project’s Governing Board, you irrevocably covenant that you will not assert any patent claims licensable by you that are necessarily infringed by an implementation of a Project Specification approved by that Open Project, and any Maintenance Deliverable approved for it, against OASIS or any other parties who the Applicable License benefits, for making, having made, using, marketing, importing, offering to sell, selling, and otherwise distributing works that Implement or Derive From that Project Specification and are compliant with all normative portions thereof. If you withdraw from the PGB, then this obligation continues to apply, but only with respect to those Project Specification Drafts approved more than 7 calendar days prior to your withdrawal, and to any Maintenance Deliverables approved for those specifications thereafter.

Scope of Implementations Benefited. As used in this covenant, works that “Implement or Derive From” a contribution or specification include:

  • (a) specifications to the extent derived from code
  • (b) independent code implementations of a specification
  • (c) independent code implementations of a specification to the extent the specification is derived from code.

For purposes of this definition, “specifications” include documentation, data flows, data formats, application programming interfaces and process descriptions.

Withdrawal from Covenant. Your Specification NonAssertion Covenant may be suspended or revoked by you with respect to any person who alleges in writing or files a suit asserting that your Contribution, or the work to which you have contributed, constitutes direct or contributory patent infringement.

16. Trademarks

In order to incorporate a trademark or service mark into a Project, including its use in the name of an OASIS Open Project or any Release, or its inclusion in the body of such work, that mark must be:

  • (a) owned by OASIS; or
  • (b) licensed by the owner of the mark to OASIS (i) under a perpetual, irrevocable, non-exclusive, royalty-free, worldwide license, with the rights to directly and indirectly sublicense, to copy, publish, distribute and incorporate the mark, and to prepare derivative works that use or incorporate the mark, all for the purposes of publishing, developing, maintaining and promoting any of the Project’s Contributions, Releases, Group Releases, Project Specifications or OASIS Standards, and enabling the use, re-use and implementation of any of the foregoing by coders, implementers, and end-users as sublicensees or beneficiaries; (ii) on published written license terms satisfactory to the Open Project Administrator, and (iii) on license terms that the Open Project Administration is satisfied are consistent with the Applicable License designated for the repositories in or with which such marks are used; or
  • (c) otherwise as approved by the OASIS Board of Directors.

No person may use an OASIS trademark or service mark in connection with an Open Project, a Release or otherwise, except in compliance with the Applicable License for a Release or otherwise according to such license and usage guidelines as OASIS may from time to time require.

17. CLAs and License Notices

17.1 A Contributor License Agreement (or CLA) shall bind each donor of a repository contribution, issue or comment of any kind to the repository’s Applicable License. All Contributions to Project Repositories shall be subject to an Individual CLA, in the form of Appendix A-1 to these rules, by which all persons making those Contributions are bound. Where Contributions are made by or on behalf of an organization, the responsible individual will designate that organization in their Individual CLA, and that organization will be asked to provide an Entity CLA, in the form of Appendix A-2 to these rules. If that Entity CLA is not obtained, OASIS and the Project must decline contributions from that individual. Project Sponsors who appoint a member to the PGB must provide an Entity CLA, and the persons appointed by them as PGB members must provide an Individual CLA in order to serve. Members of OASIS who provide an Entity CLA must provide the signature (or assent) of their OASIS Primary Representative. Individuals who represent an organization also are required by the Individual CLA to obtain an Entity CLA for that organization.

17.2 While some nominal write-access privileges (such as adding issues and comments) may be granted automatically to the public by the Project Tools, only persons who have signed the CLA will be permitted to submit content other than comments or suggestions for Non-Material Changes.

17.3. Each person making a Project Repository contribution must be bound to the terms of the Individual CLA, by obtaining their signature (which may be an equivalent electronic assent) in a manner appropriate to the tools employed to implement that repository; and those signatures shall be recorded and maintained in an auditable manner. Organizational Entity CLA signatures must also be obtained, recorded and maintained in a similar manner.

17.4. Notices of the Applicable License applicable to each Project Repository shall be conspicuously visible both from each repository’s contribution channels (for potential submitters of material) and its home resource pages (for potential readers and users).

17.5 Each Repository and its contribution facility shall be conspicuously marked with the following Call for Patent Disclosure:

[OASIS requests that any party contact the OASIS Open Project Administrator if it is aware of a claim of ownership of any patent claims that would necessarily be infringed by implementations of an OASIS Project Specification; and that any such claimant provide an indication of its willingness to grant a Specification Non-Assertion Covenant with respect to such patent claims, or otherwise to negotiate patent licenses free of charge with other parties on a non-discriminatory basis on reasonable terms and conditions.]

[OASIS may include such claims on its website, but disclaims any obligation to do so. OASIS takes no position regarding the validity or scope of any intellectual property or other rights that might be claimed to pertain to the implementation or use of the technology described in an OASIS Project Specification, or the extent to which any license under such rights might or might not be available; neither does it represent that it has made any effort to identify any such rights.]

18. Appeals and Application of Rules

The appeals process provided in Section 4.2 of the OASIS TC Process also shall apply to the actions of the OASIS Open Project Administrator, which may be appealed as provided therein.

Changes to these rules shall apply to previously-established Open Projects upon their adoption. However, OASIS may not change the terms of any signed CLA once it has been delivered to OASIS; if a change is required a new CLA must be executed.


Appendix A-1: Individual CLA

OASIS Open Projects: Individual Contributor License Agreement (CLA)

[This is a verbatim display exhibit of the Web form, supplemented by several hyperlinks]

In order to contribute intellectual property into an OASIS Open Project, you must agree to be bound by the terms of this Agreement (“CLA”), so that it is clear what terms apply to your intellectual property contributions. This is a license by you as an individual, for your protection as a contributor as well as for the protection of OASIS Open and all who use the donated material. You are required to agree to this CLA before you contribute to any repository maintained by an OASIS Open Project. You can do so by completing the online form below.

Contributor information

Your personal name: *
Your email address: *
Your GitHub Username: *
Your physical mailing address, including country: *

Employer or affiliation information, if relevant

For a corporation, organization or other entity that has assigned employees or contractors to contribute to an OASIS Open Project, an Entity CLA also should be used for contributing any intellectual property owned by that entity. Signing of an Entity CLA does not remove the need for every developer or contributor to sign their own CLA as an individual, to cover any contributions not owned by the entity signing the Entity CLA.

Please provide your employer’s or organization’s name, if you are contributing material as part of your employment or engagement with them:

Employer or organization’s primary representative email address:

Agreement to License

This CLA applies to all material (“Contributions”), including any original work of authorship and any modifications or additions to an existing work, that you send, post or otherwise explicitly submit for inclusion in any OASIS Open Project, now and in the future. OASIS Open Projects are governed by the OASIS Open Project Rules, which may also affect the application of this CLA.

You agree to license all of your rights in each of your Contributions, under the terms of the specific “Applicable License” designated on the home page of the repository into which it is submitted, for the benefit of both OASIS and all later parties who that Applicable License benefits. Subject to the terms of this CLA, and without limiting the terms of the Applicable License, you also hereby grant to OASIS a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license (with the right to directly and indirectly sublicense) to prepare derivative works of, publicly display, publicly perform, and distribute each of your Contributions and such derivative works that Implement Or Derive From those Contributions (as defined in the Open Project Rules), and enable the implementation of the same by other parties.

You additionally agree to the terms of the Specification Non-Assertion Covenant set forth in the Open Project Rules, with respect to any claims licensable by you that are described in that covenant, on the terms and conditions set forth there, which apply in some cases to all contributors and in other cases only to Project Governing Board members. That covenant may be withdrawn or terminated by you as provided by those terms.

This is a license and non-assertion agreement only; it does not transfer ownership, and does not change your rights to use your own Contributions for any other purpose. You understand that OASIS, its members and the users of its Open Projects are not required to make any use of your Contributions. You represent that you have the all of the legal rights necessary to license each of your Contributions under the terms of the Applicable License and this CLA. If you are employed or are contributing your work-for-hire supplied to another party, you also represent that you have received any necessary permissions from your employer or that party to submit your Contributions and grant those licenses. Please note that you are responsible for assuring that your employer or that Party has executed an Entity CLA with OASIS, if their rights are contributed, and that an Open Project may choose to decline your contributions if those arrangements are not in place. If any part of your Contribution incorporates the original work of another party, you also represent that you have received all necessary rights and permissions from them to make the Contribution under the terms of the Applicable License.

Information and Disclosure

You agree that all OASIS Open Projects and their repositories are public, and that a record of your Contributions, including your identifying information and notices provided with them and in this CLA, may be permanently maintained and freely redistributed. OASIS guidelines and procedures for its Open Projects can be found at: https://www.oasis-open.org/policies-guidelines/open-projects-process-2018-05-22.

OASIS also calls your attention to the requests in the Call for Patent Disclosure contained in the Open Project Rules.

You agree to promptly notify OASIS by email to open-projects-cla@oasis-open.org if you become aware of any facts, changes or circumstances that would make your commitments and statements in this Entity CLA inaccurate in any way, or if you wish to withdraw from this CLA.

Processing this CLA

You may submit this CLA request by clicking the “Accept” button below. You should then receive an email message from open-projects-cla@oasis-open.org with the subject line “OASIS Open Projects: CLA Confirmation”. Please reply to that email message to confirm that the information submitted in the CLA form is correct and that you submitted the request. Approval of the CLA requires that you reply to the email message from open-projects-cla@oasis-open.org. Questions may also be submitted directly to OASIS Open Project Administration Staff at any time: send general questions to open-projects-admin@oasis-open.org and CLA-related questions to open-projects-cla@oasis-open.org.


Appendix A-2: Entity CLA

OASIS Open Projects: Entity Contributor License Agreement (CLA)

[This is a verbatim display exhibit of the Web form, supplemented by several hyperlinks]

In order to contribute intellectual property into an OASIS Open Project, individuals are required to be bound by the terms of our Contributor License Agreement, to agree to and make clear the terms that apply to their intellectual property contributions. In cases where that individual is participating and making contributions as your representative, using intellectual property that is owned by your company or organization, your company or organization (“you”) also should execute and return to OASIS this Entity Contributor License Agreement (“Entity CLA”). OASIS reserves the right to reject any contributions made by individuals who state that their contributions are owned by you, unless you provide an Entity CLA. You can do so by completing the online form below. Only a person who is authorized to commit the entity to a license agreement should submit this form.

This Entity CLA is a license by the company or organization listed below, for its protection as a contributor as well as for the protection of OASIS Open and all who use the contributed material. Signing this Entity CLA does not remove the need for every developer or contributor to sign their own CLA as an individual, to cover any contributions not owned by the entity signing the Entity CLA.

Entity information

Organization’s full legal name: *
Name of organization’s primary representative (person to be used for communications between OASIS and the organization regarding this Entity CLA): *
Representative’s email address: *
Representative’s physical mailing address, including country: *

Contributor information

Initial list of name, email, and GitHub Username of the designated employees or representatives whose contributions are subject to this Entity CLA:

CONTRIBUTORS
Name: *
Email: *
GitHub Username: *
[ ] Delete
[ ] Add another contributor

Agreement to License

This CLA applies to all material (“Contributions”), including any original work of authorship and any modifications or additions to an existing work, that your employees or other representatives designated by you send, post or otherwise explicitly submit for inclusion in any OASIS Open Project, now and in the future. OASIS Open Projects are governed by the OASIS Open Project Rules, which may also affect the application of this CLA.

You agree to license all of your rights in each of those Contributions, under the terms of the specific “Applicable License” designated on the home page of the repository into which it is submitted, for the benefit of both OASIS and all later parties who that Applicable License benefits. Subject to the terms of this Entity CLA, and without limiting the terms of the Applicable License, you also hereby grant to OASIS a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license (with the right to directly and indirectly sublicense) to reproduce, prepare derivative works of, publicly display, publicly perform, and distribute each of those Contributions and such derivative works that Implement Or Derive From those Contributions (as defined in the Open Project Rules), and enable the implementation of the same by other parties.

You additionally agree to the terms of the Specification Non-Assertion Covenant set forth in the Open Project Rules, with respect to any claims licensable by you that are described in that covenant, on the terms set forth there, which apply in some cases to all contributors and in other cases only if your employee or other representative is a member of the Project Governing Board. That covenant may be withdrawn or terminated by you as provided by those terms.

This is a license and non-assertion agreement only; it does not transfer ownership, and does not change your rights to use your Contributions for any other purpose. You understand that OASIS, its members and the users of its Open Projects are not required to make any use of your Contributions.

You represent that you have the all of the legal rights necessary to license each of your Contributions under the terms of the Applicable License and this Entity CLA. If any part of your Contribution incorporates the original work of another party, you also represent that you have received all necessary rights and permissions from them to make the Contribution under the terms of the Applicable License.

Information and Disclosure

You agree that all OASIS Open Projects and their repositories are public, and that a record of your Contributions, including your identifying information and notices provided with them and in this Entity CLA, may be permanently maintained and freely redistributed. OASIS guidelines and procedures for its Open Projects can be found at: https://www.oasis-open.org/policies-guidelines/open-projects-process-2018-05-22.

OASIS also calls your attention to the requests in the Call for Patent Disclosure contained in the Open Project Rules.

You agree to promptly notify OASIS by email to open-projects-cla@oasis-open.org if you become aware of any facts, changes or circumstances that would make your commitments and statements in this Entity CLA inaccurate in any way, or if you wish to withdraw from this CLA. Among other things, you may modify the list of your designated employees or representatives whose contributions are subject to this Entity CLA by sending such a notice.

Processing this CLA

You may submit this CLA request by clicking the “Accept” button below. You should then receive an email message from open-projects-cla@oasis-open.org with the subject line “OASIS Open Projects: CLA Confirmation”. Please reply to that email message to confirm that the information submitted in the CLA form is correct and that you submitted the request. Approval of the CLA requires that you reply to the email message from open-projects-cla@oasis-open.org. Questions may also be submitted directly to OASIS Open Project Administration Staff at any time: send general questions to open-projects-admin@oasis-open.org and CLA-related questions to open-projects-cla@oasis-open.org.

Open Project Rules (29 June 2021)

This version of the OASIS Open Project (OP) Rules was approved by the OASIS Board of Directors on 29 June 2021 and became effective immediately. The change was announced to OASIS members on 09 July 2021 in https://lists.oasis-open.org/archives/members/202107/msg00002.html

Table of Contents

1. Purpose of Open Projects

An OASIS Open Project (or Project) is a program hosted by OASIS for the development of code, specifications and other artifacts under open source licenses, under one or more of the Applicable Licenses listed in Section 15, and selected by the Project as specified below. OASIS Open Projects are conducted according to the provisions of these Rules. The OASIS Committee Operations Process provides general provisions concerning the operation of all committees that may apply to the work of a Project Governing Board (PGB). Certain defined terms used in this document have the meaning provided in the OASIS Defined Terms.

Any person or entity, whether or not an OASIS member, may participate in or contribute to a Project, as provided by these rules. Contributions, and the acceptance or merger of contributions into the Project’s work, are managed primarily through one or more open source Project Repositories (as defined in Section 8).

Projects operate under the administrative and process rules described in this document, and are administered by the OASIS Open Project Administrator designated by OASIS.

2. Project Formation

2.1 OASIS Open Projects are initiated by one or more organizations committed to being Project Sponsors and (optionally) persons who intend to make technical contributions to the Project. Any group of at least one or more Project Sponsors whose aggregate project sponsorship dues equal or exceed the minimum threshold established by a resolution of the OASIS Board of Directors, plus one or more named Contributors, may initiate a Project by submitting to the Open Project Administrator a Charter prepared using the Open Project Charter Template maintained and made available by the Open Project Administrator. Additional membership requirements apply to some approval activities as noted below. The Charter shall be written in English and provided to OASIS in electronic form as plain text. The name proposed for the Project shall be subject to approval by the Open Project Administrator for purposes of confirming infringement and appropriate use issues. If the proposed name includes a reference to an OASIS Technical Committee (TC) or specification title, or the name of another Open Project, then the approval of any open OASIS TC or Open Project who uses that name or has authored that specification is required in advance. No information other than that requested in the template may be included in the proposal. Any documents referenced in the proposal shall be publicly available.

The Charter must include a brief statement of purpose and a scope of work for the Project. The scope of work serves as a limit on the approval of Project Standards Track Work Products. The statement of purpose is only informative, not normative. The Charter also must state the number of Project Repositories initially requested to support the Project, and the Applicable License to be applied to each requested repository.

2.2 The Open Project Administrator shall reply in writing with its approval or other disposition of the proposal described above. OASIS shall post a public notice of each approved Project to its announced public mailing list.

2.3 After formation, the Charter of an Open Project may be amended only as provided in Section 5.6.

3. Roles of Parties in the Project

The work of a Project and its administration are conducted by parties who voluntarily contribute in one or more of the following defined roles: Contributor, Maintainer, Project Governing Board (PGB), Technical Steering Committee (TSC), and Chair. A detailed and definitive description of those roles follows in Sections 4, 5, 6 ,and 7 below. A table summarizing those roles can be found in the OASIS Committee Operations Process.

4. Contributors

4.1 Any person (whether or not an OASIS member) may participate in a Project as a Contributor by providing comments or bug reports to a Project Repository, subject to the licensing rules in Sections 14, 15 and 16 below.

4.2 Any person (whether or not an OASIS member) may agree to a Contributor License Agreement (CLA), as provided in the licensing rules below, as a prerequisite for acceptance of their pull requests or other substantive contributions. If a person who signs and submits an individual CLA indicates that they represent an entity, then that individual CLA will only be deemed effective if that entity has signed and submitted an entity CLA. The Project Governing Board and Maintainers shall only act on pull requests or other substantive contributions made by project Contributors who are listed in the OASIS system as having agreed to the relevant CLA. The Project shall maintain a record of all Contributors who have made contributions to a Project.

5. Project Governing Board and Project Sponsors

5.1 Overall guidance for the Project is provided by its Project Governing Board (or PGB). The PGB is composed of one voting member from each Project Sponsor who elects to appoint a PGB member, and at least one voting at-large expert representative from the community of contributors, elected or appointed by the Technical Steering Committee (TSC). The PGB may create additional PGB member seats for expert representatives to be elected by the TSC or appointed by the PGB.

A list of PGB members shall be maintained and posted at the general information web page designated by OASIS for the Project. Certain actions taken by the PGB require affirmative action by Project Approval Minimum Membership, as defined below.

5.2 PGB members must:

  • (a) have signed and submitted an individual CLA, and if appointed by an entity, that entity must have signed and submitted an entity CLA naming that project; and
  • (b) either (i) represent an organization that has paid the appropriate Backer dues for that Open Project or (ii) has been appointed or elected as an expert representative as provided above.

5.3 Project Approval Minimum Membership, where it explicitly is required for the PGB’s approval of an action under these rules, means at least two Project Sponsors seated on the PGB.

5.4 The PGB shall:

Decisions by the PGB shall be made in a manner consistent with the requirements of Section 10.

5.5 Status as a PGB member who represents an organization accrues to the organizational Project Sponsor, and is transferable by that Project Sponsor from person to person, as evidenced by a notice in writing from its Primary Representative to the OASIS Open Project Administrator. A Project Sponsor may resign from PGB membership at any time, by notifying the Open Project Administrator and the PGB Chair(s) in writing.

5.6 The PGB may amend the Charter after the Project’s formation in the following manner:

(a) An amendment to the binding scope of work may only be made for the purpose of removing ambiguity or for narrowing the scope of work, and requires a Special Majority Vote  of the PGB. Such an amendment may also at the PGB’s option update the statement of purpose, list of planned deliverables and/or list of repositories and licenses.
(b) Any amendment to other elements of the Charter may be made by a Full Majority Vote  of the PGB, so long as and any additions to the list of deliverables are within the scope of
work.
(c) In any case, any amended Charter must comply with the requirements of Section 2.1, and shall not take effect until approved by the PGB and announced by the Open Project Administrator.

6. Technical Steering Committees

The PGB shall form a Technical Steering Committee (or TSC) by a resolution of the PGB. A Project’s TSC members shall be composed of the persons, selected in the manner, and chaired by such person as is provided by that resolution. The PGB must create and publish process documentation, outlining the requirements for joining and voting in the project’s TSC. The TSC shall have the duties to advise the PGB and such others as are specified by the PGB, so long as consistent with these Rules and OASIS policies. The following activities may not be delegated by the PGB, although it may consult with the TSC regarding them at the PGB’s option: election or termination of PGB Chairs, approval of any Releases, Group Releases, Project Specification Drafts, Project Specifications, and approval of candidates for OASIS Standards or external submissions.

TSC members must have signed and submitted an individual CLA, and if appointed by an entity, that entity must have signed and submitted an entity CLA. A list of TSC members shall be maintained and posted at the general information web page designated by OASIS for the Project. An individual may resign from TSC membership at any time, by notifying the Open Project Administrator and the Chair(s) in writing.

7. Project Chairs and Maintainers

7.1 The PGB shall select one or two of its members as Chairs by a Full Majority Vote, to coordinate and manage Project decision-making and logistics. The PGB may remove a Chair at any time by a Full Majority Vote. The Chair(s) of the Project shall:

  • (a) be responsible for the coordination and polling of any decisions of the PGB
  • (b) convene and make arrangements for any desired virtual or physical face-to-face meetings of the PGB and/or Contributors
  • (c) assist and support the Maintainer(s) as appropriate
  • (d) be responsible as the Project’s principal point of contact with OASIS staff and resources as needed
  • (e) manage or provide for the management of communications with Contributors, any liaisons and the public as may be desirable in support of the Project’s goals.

If a PGB does not have at least one Chair then all PGB activities, with the exception of the selection of a new Chair, are suspended. If a PGB does not have a Chair for 180 days, the Open Project Administrator may declare the PGB closed. After closure of the PGB, the Project may no longer take actions that require the approval of the PGB.

7.2 The PGB shall ensure that there are one or more Maintainers to serve as the principal editor(s) of the Project’s technical work managed within its Project Repositories. Maintainers shall exercise editorial responsibility over the contents of the Project’s repositories, including by:

  • (a) evaluating and responding to pull requests
  • (b) designating main or recommended branches of each repository
  • (c) designating deprecated branches or contributions.

Maintainers should act to carry out the technical consensus of the TSC, Contributors, and PGB, and may be removed by the PGB at any time, after notice to the Maintainer and the TSC, for failure to perform their functions as determined by the PGB. No contributed information or pull requests may be deleted from any Project Repository, due to the open nature of the Applicable Licenses and the Archival Permanence rules in Section 9.2. The appointment of a Maintainer survives the closure of the PGB, and thereafter the remaining Maintainer(s) or the Open Projects Administrator may appoint additional or replacement Maintainers.

8. Repositories and Project Tools

8.1 OASIS will create and support official repositories for each Project (Project Repositories) using tools, selected and configured by staff that are clearly marked as a distinct resource. OASIS will initialize each Project Repository as a distinct open source project, including issue tracking, comment facilities, and such other facilities as are normally available by default.

8.2 The Project’s official Project Tools include the Project’s Repositories and these additional tools: A principal web page for each Project, which may be the home resource page of the Project’s first Project Repository, and optionally, one or more mailing lists for administration of the Project. Subscription to such lists, which shall be subject to the OASIS Mailing List Guidelines, shall be open to anyone.

9. Visibility and Archival Permanence

9.1 Visibility. Contributions, comments, decisions, records of decisions and all other resources of the Project, including web pages, documents, mailing lists and any other records of discussions, must be located only on the Project Tools designated or authorized by OASIS. Projects may not conduct official business or technical discussions, store documents, or host web pages on servers or systems not designated by OASIS. All Project Tools shall be publicly visible, and all threaded and mail list discussions shall be publicly archived.

9.2 Archival Permanence. OASIS warrants that it will not inhibit open and free access to all of the material contributed to each Project Repository, as open and freely available resources. This warranty is perpetual and will not be revoked by OASIS or its successors or assigns; however, neither OASIS nor its assigns shall be obligated to:

  • (a) perpetually maintain its own existence, nor
  • (b) provide for the perpetual existence of a website or other public means of accessing such material, nor
  • (c) maintain any material which it is legally required to remove from publication.

Some contributed material may be treated as superseded or deprecated by Maintainers or by version control methods, as provided in these rules, but neither Maintainers nor any other party shall delete content. The original form of each contribution shall continue to be available for review, and use according to its licensure, through appropriate version control or document management methodologies.

9.3 Repository Lifecycle. Once a Project Repository has been created, it will remain open as a resource for public use and reference, and continuing repository contributions or comments, regardless of closure of the Project, under the Archival Permanence rule above, with such remaining Maintainers as may have been appointed.

9.4 Announcements. The Open Project Administrator shall create a publicly archived, subscribable list for announcements and public notices from OASIS regarding Open Projects. Every important change in Project status shall be posted to that list, including Project formation; opening of a new Project Repository; Releases; Group Releases; Draft Project Specifications; Project Specifications; Candidate OASIS Standards; and proposed external submissions.

10. Project Governance: Decisions and Meetings

10.1 Decisions by the PGB regarding the matters allocated to them by these rules normally should be made after reasonable notice to and consultation with the Project’s Contributors, and should be made by consensus except in cases where a specific majority vote is required by these rules. The Chair(s) of the Project are responsible for conducting and administrating the decision processes of the PGB and the Project, consistent with these rules.

10.2 Meetings of the PGB and any TSC must be properly called by the Chair(s) and scheduled in advance using the OASIS collaborative communication Project Tools. Meetings may be conducted face-to-face or via telephone conference or other electronic media that allow participation of all PGB members. In order to enable the openness of proceedings, meetings also should be scheduled and conducted to permit the presence of as many Contributors as is logistically feasible. A note of each meeting’s outcomes must be posted to a publicly accessible location provided by OASIS. Meetings or decisions scheduled or conducted so as to exclude the participation of any PGB member or Contributor are subject to appeal to the Open Project Administrator.

10.3 Electronic ballots of the PGB, when required by these rules, must be conducted on facilities provided or approved by OASIS, and must remain open for a minimum period for seven days. The Chair(s) may specify a longer voting period for a particular electronic ballot. Eligible voters may change their vote up until the end of the voting period.

11. Progression of Project Work

11.1 In addition to making available the contributions provided by Contributors, via their Project Repositories, Projects may designate specific portions of their output as official Releases, Group Releases, Project Specification Drafts or Project Specifications, and nominate them for further advancement, on the terms set forth in Sections 11, 12, 13 and 14.

12.2 Where the PGB or a consensus among the Contributors indicates that a specific set of contributions should be formally considered as a Release, Group Release, Draft Project Specification or Project Specification, then in preparation for that consideration, the Maintainers shall arrange the relevant material in the relevant Project Repository or repositories so that the set can be accessed and referenced as a distinct branch (a Designated Branch).

12. Releases and Group Releases

12.1 Releases. The PGB may act to approve a Designated Branch as an official Release of the Project, after giving notice to all Contributors via the Project Tools at least fourteen days prior to initiating a PGB vote or consensus call. Such approval decisions are subject to the process, notice and transparency provisions of these rules. Any product of the Project that is composed from contributions to the Project Repositories, of any nature, is eligible for approval as a Release of the Project.

12.2 Group Releases. When desirable to aggregate outputs, the PGB may act to approve any set of the Project’s Releases or subsets of Releases as an official Group Release of the Project, after giving notice to all Contributors via the Project Tools at least fourteen days prior to initiating a PGB vote or consensus call. Such approval decisions are subject to the process, notice and transparency provisions of these rules. Group Releases may include multiple Releases that bear different Applicable Licenses. Aggregate contributions by Maintainers or others which are prepared as potential Project Specifications should instead be approved as Project Specification Drafts, as provided below.

12.3 Licensing. Releases and Group Releases bear only the license rights and covenants provided for each of the contributions included there, as evidenced by the relevant repositories’ Applicable License(s) and the CLAs.

13. Project Specifications

13.1 In order to progress a Release or Group Release by the Project as a Project Specification Draft (or PSD) or a Project Specification (or PS), the PGB and the contents of the release(s) must satisfy the additional criteria of this Section.

13.2 In order to be advanced through the approval process, a proposed Project Specification must conform to the Project Specification template provided by the Open Project Administrator, which includes methods for indicating the relevant Designated Branches and Applicable Licenses. Proposed Project Specification Drafts also should conform to that template, to the extent possible.

13.3 Project Specification Drafts. A PGB having at least Project Approval Minimum Membership may act to approve any set of contributions to the Project, including from its Releases or Group Releases, as an official Project Specification Draft, after giving notice to all Contributors via the Project Tools at least fourteen days prior to initiating a PGB vote or consensus call. Such approval decisions are subject to the process, notice and transparency provisions of these rules.

13.4 Project Specifications. A PGB having at least Project Approval Minimum Membership may act to approve any Project Specification Draft as a Project Specification, by satisfying each of the following requirements:

  • (a) Written notice of that nomination must be given by the PGB to all those involved with the Project and the Open Project Administrator at least fourteen days prior to initiating a ballot. The ballot must be conducted by a Special Majority Vote of the PGB. The approval decision is subject to the process, notice and transparency rules set forth in these rules and the content requirements noted below.
  • (b) Any machine-executable instructions in a specific computer language (code) that are included in the Project Specification must be composed only of one or more Releases or Group Releases bearing Implementer-Class Licenses.
  • (c) Any guidance, descriptions, processes, models for the behavior of a system or service, or other content that is not machine-executable, and is included in the Project Specification, must be composed only of contributions (which may include Releases or Group Releases) previously made to a Project Repository.
  • (d) The proposed Project Specification will be subject to review and confirmation of conformance by the Open Project Administrator before the approval ballot is opened.

13.5 Upon successful conclusion of the Special Majority Vote, the Open Project Administrator must give public written notice thereof, which constitutes approval, and thereafter will publish the Project Specification to the OASIS Library.

13.6 Licensing. Project Specifications bear the license rights and covenants provided for each contribution included there, as evidenced by the relevant repositories’ Applicable License(s) and the CLAs, as well as the Specification NonAssertion Covenant. Project Specifications may bear more than one Applicable License, when composed from Releases or Group Releases from multiple Project Repositories that have different Applicable Licenses.

13.7 Implementations of all kinds are welcome (partial or complete; prototype, proof-of-concept, example, model, or reference implementations), provided that PGBs may not designate any single implementation of a Project Specification as exclusive or privileged.

14. OASIS Standard Approval and External Submissions

Project Specifications are eligible for and may be submitted for approval as OASIS Standards, under the following conditions:

  • (a) After three Statements of Use referencing the PS have been presented to the PGB, a PGB having at least Project Approval Minimum Membership may approve the PS as a candidate for OASIS Standard in the same manner, and subject to the same requirements, as apply to Committee Specifications as provided in Section 3.8 Approval of an OASIS Standard of the OASIS TC Process. Procedural requirements applicable to TCs in that rule apply to the PGB for this purpose, including the Special Majority Vote required to nominate a Project Specification for OASIS Standard. However, a candidate for OASIS Standard submitted by an Open Project shall be subject to the distinct licensing terms in these rules, and not the licensing terms in the OASIS IPR Policy for TCs.
  • (b) Upon a successful conclusion of that PGB vote and all other requirements, the OASIS TC Administrator shall proceed with public review and a call for consent as provided in Sections 3.8.2 and 3.8.3 of the OASIS TC Process. An OASIS Standard submitted by an Open Project and approved as provided above is eligible for further external submissions as provided in and subject to the requirements in the OASIS Liaison Policy. The PGB must have at least Project Approval Minimum Membership at the time of any such action or approval; the other procedural requirements applicable to TCs in that policy apply to the PGB for this purpose.

15. Repository and Specification Licenses

15.1 Applicable Licenses; Copyright Implementation Licenses. Each Project Repository will be subject to a declared Applicable License, selected from the list of licenses in this section. Each Contributor agrees in the CLA to grant the Applicable License designated for a repository to all contributions donated to that repository by posting it or requesting its inclusion in that repository, and to all Releases issued from that repository.

Anyone may offer comments to any Project Repository, on the terms of the foregoing licenses, as evidenced in the manner noted below. Anyone will be entitled to make use of the contents of a Project Repository, according to the terms of its Applicable License.

15.2 When requesting the creation of a Project Repository, the PGB must select that repository’s Applicable License from among the following list:

Other widely-used free and open source licenses may be added to this list after review and acceptance by OASIS and amendment of these rules.

15.3 Special Covenants for Project Specifications. In addition to the Applicable License for each Project Repository, each Contributor also agrees in the CLA to provide the additional covenants in this Section 15.3, as non-assertion covenants in favor of certain Project Specifications (collectively the Specification NonAssertion Covenant):

Contributor Covenant for Specifications. As a Contributor, you irrevocably covenant that you will not assert any patent claims licensable by you that are necessarily infringed by an implementation of your contribution to the extent that contribution is included in a Project Specification approved by the Open Project to which you made the contribution, against OASIS or any other parties who the Applicable License benefits, for making, having made, using, marketing, importing, offering to sell, selling, and otherwise distributing works that Implement or Derive From your contribution.

PGB Covenant for Specifications. For any Project Repository whose Applicable License is an Implementer-Class License, if you (or your representative) are a member of that Open Project’s Governing Board, you irrevocably covenant that you will not assert any patent claims licensable by you that are necessarily infringed by an implementation of a Project Specification approved by that Open Project within the scope of work of its Charter in effect at the time such deliverable was approved, and any Maintenance Deliverable approved for it, against OASIS or any other parties who the Applicable License benefits, for making, having made, using, marketing, importing, offering to sell, selling, and otherwise distributing works that Implement or Derive From that Project Specification and are compliant with all normative portions thereof. If you withdraw from the PGB, then this obligation continues to apply, but only with respect to those Project Specification Drafts approved more than 7 calendar days prior to your withdrawal, and to any Maintenance Deliverables approved for those specifications thereafter.

Scope of Implementations Benefited. As used in this covenant, works that “Implement or Derive From” a contribution or specification include:

  • (a) specifications to the extent derived from code
  • (b) independent code implementations of a specification
  • (c) independent code implementations of a specification to the extent the specification is derived from code.

For purposes of this definition, “specifications” include documentation, data flows, data formats, application programming interfaces and process descriptions.

Withdrawal from Covenant. Your Specification NonAssertion Covenant may be suspended or revoked by you with respect to any person who alleges in writing or files a suit asserting that your Contribution, or the work to which you have contributed, constitutes direct or contributory patent infringement.

16. Trademarks

In order to incorporate a trademark or service mark into a Project, including its use in the name of an OASIS Open Project or any Release, or its inclusion in the body of such work, that mark must be:

  • (a) owned by OASIS; or
  • (b) otherwise as approved by the OASIS Board of Directors.

No person may use an OASIS trademark or service mark in connection with an Open Project, a Release or otherwise, except in compliance with the Applicable License for a Release or otherwise according to such license and usage guidelines as OASIS may from time to time require.

17. CLAs and License Notices

17.1 A Contributor License Agreement (or CLA) shall bind each donor of a repository contribution, issue or comment of any kind to the repository’s Applicable License. All Contributions to Project Repositories shall be subject to an Individual CLA, in the form of Appendix A-1 to these rules, by which all persons making those Contributions are bound. Where Contributions are made by or on behalf of an organization, the responsible individual will designate that organization in their Individual CLA, and that organization will be asked to provide an Entity CLA, in the form of Appendix A-2 to these rules. If that Entity CLA is not obtained, OASIS and the Project must decline contributions from that individual.

Project Sponsors who appoint a member to the PGB must provide an Entity CLA, and the persons appointed by them as PGB members must provide an Individual CLA in order to serve.

Members of OASIS who provide an Entity CLA must provide the signature (or assent) of their OASIS Primary Representative. Individuals who represent an organization also are required by the Individual CLA to obtain an Entity CLA for that organization.

17.2 While some nominal write-access privileges (such as adding issues and comments) may be granted automatically to the public by the Project Tools, only persons who have signed the CLA will be permitted to submit content other than comments or suggestions for Non-Material Changes.

17.3. Each person making a Project Repository contribution must be bound to the terms of the Individual CLA, by obtaining their signature (which may be an equivalent electronic assent) in a manner appropriate to the tools employed to implement that repository; and those signatures shall be recorded and maintained in an auditable manner. Organizational Entity CLA signatures must also be obtained, recorded and maintained in a similar manner.

17.4. Notices of the Applicable License applicable to each Project Repository shall be conspicuously visible both from each repository’s contribution channels (for potential submitters of material) and its home resource pages (for potential readers and users).

17.5 Each Repository and its contribution facility shall be conspicuously marked with the following Call for Patent Disclosure:

[OASIS requests that any party contact the OASIS Open Project Administrator if it is aware of a claim of ownership of any patent claims that would necessarily be infringed by implementations of an OASIS Project Specification; and that any such claimant provide an indication of its willingness to grant a Specification Non-Assertion Covenant with respect to such patent claims, or otherwise to negotiate patent licenses free of charge with other parties on a non-discriminatory basis on reasonable terms and conditions.]

[OASIS may include such claims on its website, but disclaims any obligation to do so. OASIS takes no position regarding the validity or scope of any intellectual property or other rights that might be claimed to pertain to the implementation or use of the technology described in an OASIS Project Specification, or the extent to which any license under such rights might or might not be available; neither does it represent that it has made any effort to identify any such rights.]

18. Appeals and Application of Rules

The appeals process provided in Section 4.2 of the OASIS TC Process also shall apply to the actions of the OASIS Open Project Administrator, which may be appealed as provided therein.

Changes to these rules shall apply to previously-established Open Projects upon their adoption. However, OASIS may not change the terms of any signed CLA once it has been delivered to OASIS; if a change is required a new CLA must be executed.


Appendix A-1: Individual CLA

OASIS Open Projects: Individual Contributor License Agreement (CLA)

[This is a verbatim display exhibit of the Web form, supplemented by several hyperlinks]

In order to contribute intellectual property into an OASIS Open Project, you must agree to be bound by the terms of this Agreement (“CLA”), so that it is clear what terms apply to your intellectual property contributions. This is a license by you as an individual, for your protection as a contributor as well as for the protection of OASIS Open and all who use the donated material. You are required to agree to this CLA before you contribute to any repository maintained by an OASIS Open Project. You can do so by completing the online form below.

Contributor information

Your personal name: *
Your email address: *
Your GitHub Username: *
Your physical mailing address, including country: *

Employer or affiliation information, if relevant

For a corporation, organization or other entity that has assigned employees or contractors to contribute to an OASIS Open Project, an Entity CLA also should be used for contributing any intellectual property owned by that entity. Signing of an Entity CLA does not remove the need for every developer or contributor to sign their own CLA as an individual, to cover any contributions not owned by the entity signing the Entity CLA.

Please provide your employer’s or organization’s name, if you are contributing material as part of your employment or engagement with them:

Employer or organization’s primary representative email address:

Agreement to License

This CLA applies to all material (“Contributions”), including any original work of authorship and any modifications or additions to an existing work, that you send, post or otherwise explicitly submit for inclusion in any OASIS Open Project, now and in the future. OASIS Open Projects are governed by the OASIS Open Project Rules, which may also affect the application of this CLA.

You agree to license all of your rights in each of your Contributions, under the terms of the specific “Applicable License” designated on the home page of the repository into which it is submitted, for the benefit of both OASIS and all later parties who that Applicable License benefits. Subject to the terms of this CLA, and without limiting the terms of the Applicable License, you also hereby grant to OASIS a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license (with the right to directly and indirectly sublicense) to prepare derivative works of, publicly display, publicly perform, and distribute each of your Contributions and such derivative works that Implement Or Derive From those Contributions (as defined in the Open Project Rules), and enable the implementation of the same by other parties.

You additionally agree to the terms of the Specification Non-Assertion Covenant set forth in the Open Project Rules, with respect to any claims licensable by you that are described in that covenant, on the terms and conditions set forth there, which apply in some cases to all contributors and in other cases only to Project Governing Board members. That covenant may be withdrawn or terminated by you as provided by those terms.

This is a license and non-assertion agreement only; it does not transfer ownership, and does not change your rights to use your own Contributions for any other purpose. You understand that OASIS, its members and the users of its Open Projects are not required to make any use of your Contributions. You represent that you have the all of the legal rights necessary to license each of your Contributions under the terms of the Applicable License and this CLA. If you are employed or are contributing your work-for-hire supplied to another party, you also represent that you have received any necessary permissions from your employer or that party to submit your Contributions and grant those licenses. Please note that you are responsible for assuring that your employer or that Party has executed an Entity CLA with OASIS, if their rights are contributed, and that an Open Project may choose to decline your contributions if those arrangements are not in place. If any part of your Contribution incorporates the original work of another party, you also represent that you have received all necessary rights and permissions from them to make the Contribution under the terms of the Applicable License.

Information and Disclosure

You agree that all OASIS Open Projects and their repositories are public, and that a record of your Contributions, including your identifying information and notices provided with them and in this CLA, may be permanently maintained and freely redistributed. OASIS guidelines and procedures for its Open Projects can be found at: https://www.oasis-open.org/policies-guidelines/open-projects-process-2018-05-22.

OASIS also calls your attention to the requests in the Call for Patent Disclosure contained in the Open Project Rules.

You agree to promptly notify OASIS by email to open-projects-cla@oasis-open.org if you become aware of any facts, changes or circumstances that would make your commitments and statements in this Entity CLA inaccurate in any way, or if you wish to withdraw from this CLA.

Processing this CLA

You may submit this CLA request by clicking the “Accept” button below. You should then receive an email message from open-projects-cla@oasis-open.org with the subject line “OASIS Open Projects: CLA Confirmation”. Please reply to that email message to confirm that the information submitted in the CLA form is correct and that you submitted the request. Approval of the CLA requires that you reply to the email message from open-projects-cla@oasis-open.org. Questions may also be submitted directly to OASIS Open Project Administration Staff at any time: send general questions to open-projects-admin@oasis-open.org and CLA-related questions to open-projects-cla@oasis-open.org.


Appendix A-2: Entity CLA

OASIS Open Projects: Entity Contributor License Agreement (CLA)

[This is a verbatim display exhibit of the Web form, supplemented by several hyperlinks]

In order to contribute intellectual property into an OASIS Open Project, individuals are required to be bound by the terms of our Contributor License Agreement, to agree to and make clear the terms that apply to their intellectual property contributions. In cases where that individual is participating and making contributions as your representative, using intellectual property that is owned by your company or organization, your company or organization (“you”) also should execute and return to OASIS this Entity Contributor License Agreement (“Entity CLA”). OASIS reserves the right to reject any contributions made by individuals who state that their contributions are owned by you, unless you provide an Entity CLA. You can do so by completing the online form below. Only a person who is authorized to commit the entity to a license agreement should submit this form.

This Entity CLA is a license by the company or organization listed below, for its protection as a contributor as well as for the protection of OASIS Open and all who use the contributed material. Signing this Entity CLA does not remove the need for every developer or contributor to sign their own CLA as an individual, to cover any contributions not owned by the entity signing the Entity CLA.

Entity information

Organization’s full legal name: *
Name of organization’s primary representative (person to be used for communications between OASIS and the organization regarding this Entity CLA): *
Representative’s email address: *
Representative’s physical mailing address, including country: *

Contributor information

Initial list of name, email, and GitHub Username of the designated employees or representatives whose contributions are subject to this Entity CLA:

CONTRIBUTORS
Name: *
Email: *
GitHub Username: *
[ ] Delete
[ ] Add another contributor

Agreement to License

This CLA applies to all material (“Contributions”), including any original work of authorship and any modifications or additions to an existing work, that your employees or other representatives designated by you send, post or otherwise explicitly submit for inclusion in any OASIS Open Project, now and in the future. OASIS Open Projects are governed by the OASIS Open Project Rules, which may also affect the application of this CLA.

You agree to license all of your rights in each of those Contributions, under the terms of the specific “Applicable License” designated on the home page of the repository into which it is submitted, for the benefit of both OASIS and all later parties who that Applicable License benefits. Subject to the terms of this Entity CLA, and without limiting the terms of the Applicable License, you also hereby grant to OASIS a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license (with the right to directly and indirectly sublicense) to reproduce, prepare derivative works of, publicly display, publicly perform, and distribute each of those Contributions and such derivative works that Implement Or Derive From those Contributions (as defined in the Open Project Rules), and enable the implementation of the same by other parties.

You additionally agree to the terms of the Specification Non-Assertion Covenant set forth in the Open Project Rules, with respect to any claims licensable by you that are described in that covenant, on the terms set forth there, which apply in some cases to all contributors and in other cases only if your employee or other representative is a member of the Project Governing Board. That covenant may be withdrawn or terminated by you as provided by those terms.

This is a license and non-assertion agreement only; it does not transfer ownership, and does not change your rights to use your Contributions for any other purpose. You understand that OASIS, its members and the users of its Open Projects are not required to make any use of your Contributions.

You represent that you have the all of the legal rights necessary to license each of your Contributions under the terms of the Applicable License and this Entity CLA. If any part of your Contribution incorporates the original work of another party, you also represent that you have received all necessary rights and permissions from them to make the Contribution under the terms of the Applicable License.

Information and Disclosure

You agree that all OASIS Open Projects and their repositories are public, and that a record of your Contributions, including your identifying information and notices provided with them and in this Entity CLA, may be permanently maintained and freely redistributed. OASIS guidelines and procedures for its Open Projects can be found at: https://www.oasis-open.org/policies-guidelines/open-projects-process-2018-05-22.

OASIS also calls your attention to the requests in the Call for Patent Disclosure contained in the Open Project Rules.

You agree to promptly notify OASIS by email to open-projects-cla@oasis-open.org if you become aware of any facts, changes or circumstances that would make your commitments and statements in this Entity CLA inaccurate in any way, or if you wish to withdraw from this CLA. Among other things, you may modify the list of your designated employees or representatives whose contributions are subject to this Entity CLA by sending such a notice.

Processing this CLA

You may submit this CLA request by clicking the “Accept” button below. You should then receive an email message from open-projects-cla@oasis-open.org with the subject line “OASIS Open Projects: CLA Confirmation”. Please reply to that email message to confirm that the information submitted in the CLA form is correct and that you submitted the request. Approval of the CLA requires that you reply to the email message from open-projects-cla@oasis-open.org. Questions may also be submitted directly to OASIS Open Project Administration Staff at any time: send general questions to open-projects-admin@oasis-open.org and CLA-related questions to open-projects-cla@oasis-open.org.

No results with the selected filters