Attention Iron Bank Customers: On March 27, 2025, we are moving SBOM artifacts from the Anchore Scan job to the Build job to streamline the container hardening pipeline. If you currently download SBOMs from the Anchore Scan job, you can still get them from the Build job and from other sources, including IBFE and image attestations.
This is the process for adding an package into Big Bang
This is the process for adding a new package into Big Bang
## Incubation
## Out-of-Tree / 3rd Party Packages
To get into an incubation stage, an package needs the following:
### Submit New Big Bang Package Proposal to the BB Technical Oversite Committee
* Written support by **two** Big Bang Customers identifying capability gap in BigBang
* Nomination of **two** developers from different companies, who have contributed to other big bang packages, as Package Owners.
* Architecture Review approved by a majority of the present Big Bang Package Owners.
* Sign-off by Government
[BB TOC New Package Proposal](https://repo1.dso.mil/platform-one/p1toc/-/issues/new?issue%5Bassignee_id%5D=&issue%5Bmilestone_id%5D=)
## Full Membership
A shepherd will be assigned to the project to create a repo in the [BB sandbox](https://repo1.dso.mil/platform-one/big-bang/apps/sandbox)
Once the package adheres to all [Package Requirements](PackageRequirements.md), a final review of implementation details will be presented to the Big Bang Admins.
### Process
Out-of-Tree packages packages will follow the [BBTOC process](https://repo1.dso.mil/platform-one/bbtoc/-/tree/master/process) from Sandbox -> Incubating -> Graduated
## In-Tree / Big Bang Maintained Package Process
In order for a package to become an "In-Tree" package (supported by Platform One), it must meet all of the requirements of a BB TOC graduated package and have an [issue](https://repo1.dso.mil/groups/platform-one/big-bang/apps/third-party/-/issues) opened to 'Recommend Package for "In-Tree" Support'. The issue will be processed through the Platform One Jedi Order and Rebel Alliance councils for a governement decision to be added as officially supported / "in-tree" add-on.
@@ -24,34 +24,17 @@ Each package will work with any cluster under the following criteria.
## PR-X. Iron Bank Images
Every Big Bang Package shall be configured to use exclusively Iron Bank approved images. The images used __must__ be approved.
Every Big Bang Package shall be configured to use Iron Bank images. The images used from Iron Bank __must__ be _fully_ approved and _functional_ to be in compliance with the Big Bang baseline security posture.
In general, the following rules must be met:
Once this prerequisite is met, a package is eligible for inclusion within BigBang in accordance with [New Package Requests](NewPackageRequests.md).
* Images must be __approved__ in IronBank
* Unmodified IronBank image must be fully functional
### Out-of-Tree Packages
When the above are true, the package _may_ be considered for approval and inclusion within BigBang based off the requirements in [New Package Requests](NewPackageRequests.md).
[Out-of-Tree Packages](https://repo1.dso.mil/platform-one/big-bang/apps/third-party) are third party packages that adhere to all the BigBang package standards. These packages are predominantly community-maintained packages; however, some packages may be jointly maintained by BigBang and community as indicated by the codeowners.
Depending on the package, the customer need, and the approval process, packages may not comply with the above requirements to be integrated with BigBang, but still be heavily desired by customers. To account for these packages, BigBang Third Party Packages can be used.
### In-Tree Packages
### Third Party Packages
[Third Party Packages](https://repo1.dso.mil/platform-one/big-bang/apps/third-party) are packages that adhere by all the BigBang package standards _except_ the IronBank containers/approvals. These packages in many cases are still maintained by BigBang, but for security purposes are not included into the BigBang product.
[Third Party Packages](https://repo1.dso.mil/platform-one/big-bang/apps/third-party) are packages that adhere by all the BigBang package standards, but are missing key requirements (defined in [New Package Requests](NewPackageRequests.md)). The most common being approved IronBank containers.
There are two types of third party packages:
#### Big Bang Supported and Maintained
These are packages that are supported, updated, and maintained by team members of BigBang. This designation is usually reserved for packages that key customers require, but are missing approved IronBank containers, or blanket approval that allows them to be included with the BigBang product.
These products are labeled with the "BigBang Supported" badge on the repository's `README.md` page, which indicates active support. That being said, BigBang reserves the right to deprecate support for these packages.
#### Independent
These are packages that are not owned by team members of BigBang, but are still actively maintained independent of BigBang. There are no rules as to who/what is allowed to own these packages, only that they must be actively maintained and up to BigBang Package Requirements. Stale packages will be removed over time (exact timeline TBD) by members of BigBang.
[In-Tree Packages](https://repo1.dso.mil/platform-one/big-bang/apps) are Platform One developer-supported Big Bang Core & add-ons that adhere to all the BigBang package standards. These packages have been adopted as an official Big Bang offering for key customers. As such, they are supported, updated, and maintained by team members of BigBang and are labeled with the "BigBang Supported" badge on the repository's `README.md` page, which indicates active support. That being said, BigBang reserves the right to deprecate support for these packages.
