├── .github ├── ISSUE_TEMPLATE │ ├── bug_report.md │ ├── config.yml │ ├── docs_request.md │ ├── feature_request.md │ ├── repo_deprecation_request.md │ ├── repo_incubating_request.md │ ├── repo_promoting_to_stable.md │ └── repo_sandbox_request.md └── PULL_REQUEST_TEMPLATE.md ├── CODE_OF_CONDUCT.md ├── GOVERNANCE.md ├── LICENSE ├── MAINTAINERS.md ├── MAINTAINERS_GUIDELINES.md ├── Makefile ├── OWNERS ├── README.md ├── REPOSITORIES.md ├── deploy └── README.md ├── img └── pidgeotto.gif ├── maintainers.yaml ├── people └── affiliations.json ├── repos └── badges │ ├── README.md │ ├── falco-core-blue.svg │ ├── falco-ecosystem-blue.svg │ └── falco-infra-blue.svg ├── repositories.yaml └── utils ├── .gitignore ├── Makefile ├── cmd ├── maintainers.go ├── readme.go └── utils.go ├── go.mod ├── go.sum └── pkg └── utils ├── text.go └── types.go /.github/ISSUE_TEMPLATE/bug_report.md: -------------------------------------------------------------------------------- 1 | --- 2 | name: Bug report 3 | about: Create a bug report to help us improve 4 | title: '' 5 | labels: kind/bug 6 | assignees: '' 7 | 8 | --- 9 | 10 | 11 | 12 | **Describe the bug** 13 | 14 | 15 | 16 | **How to reproduce it** 17 | 18 | 19 | 20 | **Expected behaviour** 21 | 22 | 23 | 24 | **Screenshots** 25 | 26 | 27 | 28 | **Additional context** 29 | 30 | 31 | -------------------------------------------------------------------------------- /.github/ISSUE_TEMPLATE/config.yml: -------------------------------------------------------------------------------- 1 | blank_issues_enabled: true 2 | contact_links: 3 | - name: Support 4 | url: https://slack.k8s.io 5 | about: "Please ask and answer questions in the #falco channel on the Kubernetes Slack" 6 | -------------------------------------------------------------------------------- /.github/ISSUE_TEMPLATE/docs_request.md: -------------------------------------------------------------------------------- 1 | --- 2 | name: Documentation request 3 | about: Suggest to document a part of the project 4 | title: '' 5 | labels: kind/documentation 6 | assignees: '' 7 | 8 | --- 9 | 10 | **What to document** 11 | 12 | 16 | -------------------------------------------------------------------------------- /.github/ISSUE_TEMPLATE/feature_request.md: -------------------------------------------------------------------------------- 1 | --- 2 | name: Feature request 3 | about: Suggest an idea for evolution repository 4 | title: '' 5 | labels: kind/feature 6 | assignees: '' 7 | 8 | --- 9 | 10 | **Motivation** 11 | 12 | 17 | 18 | **Feature** 19 | 20 | 24 | 25 | **Alternatives** 26 | 27 | 31 | 32 | **Additional context** 33 | 34 | 35 | -------------------------------------------------------------------------------- /.github/ISSUE_TEMPLATE/repo_deprecation_request.md: -------------------------------------------------------------------------------- 1 | --- 2 | name: Deprecation request 3 | about: 'Request to transition a repository to "deprecated" status' 4 | title: '' 5 | labels: kind/deprecated 6 | assignees: '' 7 | --- 8 | 9 | **Repository**: 10 | 11 | **Motivation** 12 | 13 | -------------------------------------------------------------------------------- /.github/ISSUE_TEMPLATE/repo_incubating_request.md: -------------------------------------------------------------------------------- 1 | --- 2 | name: Incubation request 3 | about: 'Request adoption/promotion of a repository with/to the "incubating" status' 4 | title: '' 5 | labels: kind/incubating 6 | assignees: '' 7 | --- 8 | 9 | **Repository**: 10 | 11 | **Motivation** 12 | 13 | -------------------------------------------------------------------------------- /.github/ISSUE_TEMPLATE/repo_promoting_to_stable.md: -------------------------------------------------------------------------------- 1 | --- 2 | name: Promotion to stable 3 | about: 'Request promotion of a repository to the "stable" status' 4 | title: '' 5 | labels: kind/stable 6 | assignees: '' 7 | --- 8 | 9 | **Repository**: 10 | 11 | **Motivation** 12 | 13 | 16 | -------------------------------------------------------------------------------- /.github/ISSUE_TEMPLATE/repo_sandbox_request.md: -------------------------------------------------------------------------------- 1 | --- 2 | name: Sandbox request 3 | about: 'Request adoption of a repository with the "sandbox" status' 4 | title: '' 5 | labels: kind/sandbox 6 | assignees: '' 7 | --- 8 | 9 | 15 | 16 | **Repository**: 17 | 18 | **Motivation** 19 | 20 | 23 | -------------------------------------------------------------------------------- /.github/PULL_REQUEST_TEMPLATE.md: -------------------------------------------------------------------------------- 1 | 7 | 8 | **What type of PR is this?** 9 | 10 | > Uncomment one (or more) `/kind <>` lines: 11 | 12 | > /kind bug 13 | 14 | > /kind cleanup 15 | 16 | > /kind documentation 17 | 18 | > /kind feature 19 | 20 | > /kind stable 21 | 22 | > /kind incubating 23 | 24 | > /kind sandbox 25 | 26 | > /kind deprecated 27 | 28 | 29 | 32 | 33 | **Any specific area of the project related to this PR?** 34 | 35 | > Uncomment one (or more) `/area <>` lines: 36 | 37 | > /area governance 38 | 39 | > /area proposals 40 | 41 | > /area utils 42 | 43 | 44 | 47 | 48 | **What this PR does / why we need it**: 49 | 50 | **Which issue(s) this PR fixes**: 51 | 52 | 56 | 57 | Fixes # 58 | 59 | **Special notes for your reviewer**: -------------------------------------------------------------------------------- /CODE_OF_CONDUCT.md: -------------------------------------------------------------------------------- 1 | # Code of Conduct 2 | 3 | We follow the [CNCF Code of Conduct](https://github.com/cncf/foundation/blob/main/code-of-conduct.md). 4 | 5 | Please contact [cncf-falco-maintainers@lists.cncf.io](mailto:cncf-falco-maintainers@lists.cncf.io) 6 | or the Linux Foundation mediator, Mishi Choudhary [mishi@linux.com](mailto:mishi@linux.com) to report an issue. -------------------------------------------------------------------------------- /GOVERNANCE.md: -------------------------------------------------------------------------------- 1 | # The Falco Project Governance 2 | 3 | This document describes the fundamental principles **The Falco Project** adheres to. It defines the project governance, and regulates its extension and modification. 4 | 5 | **Table of Contents** 6 | 7 | - [Principles](#principles) 8 | - [Project Evolution](#project-evolution) 9 | - [Repositories](#repositories) 10 | - [Core repositories](#core-repositories) 11 | - [Repository ownership](#repository-ownership) 12 | - [Community](#community) 13 | - [Adopters](#adopters) 14 | - [Community Members](#community-members) 15 | - [Contributors](#contributors) 16 | - [Reviewers](#reviewers) 17 | - [Maintainers](#maintainers) 18 | - [Core Maintainers](#core-maintainers) 19 | - [Emeritus Maintainers](#emeritus-maintainers) 20 | - [Technical Advisory Groups](#technical-advisory-groups) 21 | - [Decision making](#decision-making) 22 | - [Governance changes](#governance-changes) 23 | - [Editorial changes](#editorial-changes) 24 | - [Maintainership](#maintainership) 25 | - [Sensitive decisions](#sensitive-decisions) 26 | - [Ordinary decisions](#ordinary-decisions) 27 | - [Voting](#voting) 28 | - [Consensus](#consensus) 29 | - [Majority vote](#majority-vote) 30 | - [Supermajority vote](#supermajority-vote) 31 | - [License](#license) 32 | 33 | **Resources** 34 | 35 | 36 | - [Governance](https://github.com/falcosecurity/evolution/blob/main/GOVERNANCE.md) 37 | - [Code Of Conduct](https://github.com/falcosecurity/evolution/blob/main/CODE_OF_CONDUCT.md) 38 | - [Maintainers Guidelines](https://github.com/falcosecurity/evolution/blob/main/MAINTAINERS_GUIDELINES.md) 39 | - [Maintainers List](https://github.com/falcosecurity/evolution/blob/main/MAINTAINERS.md) 40 | - [Repositories Guidelines](https://github.com/falcosecurity/evolution/blob/main/REPOSITORIES.md) 41 | - [Repositories List](https://github.com/falcosecurity/evolution/blob/main/README.md#repositories) 42 | - [Adopters List](https://github.com/falcosecurity/falco/blob/master/ADOPTERS.md) 43 | - [Contributing](https://github.com/falcosecurity/.github/blob/main/CONTRIBUTING.md) 44 | - [Security policy](https://github.com/falcosecurity/.github/blob/main/SECURITY.md) 45 | - [Join the Community](https://github.com/falcosecurity/community) 46 | 47 | 48 | ## Principles 49 | 50 | The Falco Project and its community adhere to the following principles: 51 | - **Open**: Falco is open source and open to contribution, accessible and welcoming for everyone. 52 | - **Respectful**: the community pledges to respect all people involved in the project. 53 | - **Diverse**: the project furthers the interest in the diversity of representation. 54 | - **Transparent**: discussions, collaboration, and decision-making are done in public. 55 | - **Vibrant**: evolution is better than stagnation. 56 | 57 | The Falco Project is part of the broader [CNCF](https://www.cncf.io/) community, and adheres to its values. 58 | 59 | ## Project Evolution 60 | 61 | The project source code and documentation live in various repositories under the [falcosecurity](https://github.com/falcosecurity) GitHub organization. Each repository represents a component or a subproject of The Falco Project. For transparency, project decisions are publicly made using GitHub issues and pull requests. 62 | 63 | The Falco Project documents its evolution in the [falcosecurity/evolution](https://github.com/falcosecurity/evolution) repository, which is also a place designed to: 64 | - make decisions that regard the whole project, and 65 | - define rules and structures which span beyond the extent of a single repository (i.e., organization-wide). 66 | 67 | ## Repositories 68 | 69 | The process of adding, removing, and managing repositories under the [falcosecurity](https://github.com/falcosecurity) GitHub organization is described in [REPOSITORIES.md](REPOSITORIES.md). The document assigns a [scope](https://github.com/falcosecurity/evolution/blob/main/REPOSITORIES.md#scope) and a [status](https://github.com/falcosecurity/evolution/blob/main/REPOSITORIES.md#status) to each repository. 70 | 71 | ### Core repositories 72 | 73 | In particular, repositories essential for building, installing, running, documenting, or using Falco are considered [core repositories](https://github.com/falcosecurity/evolution#core) and are given the [*core*](https://github.com/falcosecurity/evolution/blob/main/REPOSITORIES.md#core-scope) scope. 74 | 75 | ### Repository ownership 76 | 77 | [OWNERS](https://www.kubernetes.dev/docs/guide/owners/) files are used to designate responsibility over different parts of The Falco Project codebase, and serve as the implementation mechanism for the code review process. Each repository must have an `OWNERS` file in the root directory, and can optionally have other `OWNERS` files in subdirectories. The `OWNERS` file applies to everything within the directory, including the OWNERS file itself, sibling files, and child directories. 78 | 79 | ## Community 80 | 81 | The Falco Project is driven by its community. The [falcosecurity/community](https://github.com/falcosecurity/community) repository documents the official communication channels, community calls, and other initiatives. 82 | 83 | The below section outlines the different roles of community members within the project, along with the responsibilities and privileges that come with them. 84 | 85 | ### Adopters 86 | 87 | Adopters are any organizations publicly stating that they successfully leveraged The Falco Project, or repackaged it as a component of a service offering. See the [CNCF Adopters definition](https://github.com/cncf/toc/blob/main/FAQ.md#what-is-the-definition-of-an-adopter) for more details. 88 | 89 | Defined by: 90 | - The [ADOPTERS.md](https://github.com/falcosecurity/falco/blob/master/ADOPTERS.md) document. 91 | 92 | Responsibilities: 93 | - Publicly announcing they are adopters of The Falco Project. 94 | 95 | ### Community Members 96 | 97 | Community Members are all users who interact with the project. This could be through Slack, GitHub discussions, joining public project meetings, mailing lists, etc. 98 | 99 | Responsibilities: 100 | - Respect the [Code Of Conduct](CODE_OF_CONDUCT.md). 101 | 102 | ### Contributors 103 | 104 | Contributors are [Community Members](#community-members) who [contribute](https://opensource.guide/how-to-contribute/#what-it-means-to-contribute) directly to the project and add value to it. This can be through code, documentation, taking part in bug scrubs, opening issues, proposing a pull request, etc. 105 | 106 | Defined by: 107 | - Having valid contributions (as per [GitHub definition](https://docs.github.com/en/account-and-profile/setting-up-and-managing-your-github-profile/managing-contribution-settings-on-your-profile/viewing-contributions-on-your-profile#what-counts-as-a-contribution)) under the [falcosecurity](https://github.com/falcosecurity) GitHub organization. 108 | - Any non-GitHub contribution but considered relevant for the project, as documented in the [falcosecurity/evolution](https://github.com/falcosecurity/evolution) repository. 109 | 110 | Responsibilities: 111 | - Respect the [Contribution Guidelines](https://github.com/falcosecurity/.github/blob/main/CONTRIBUTING.md). 112 | - [Sign off](https://git-scm.com/docs/git-commit#Documentation/git-commit.txt---signoff) Git Commits to certify they adhere to the [Developer Certificate of Origin (DCO)](https://developercertificate.org/). 113 | 114 | ### Reviewers 115 | 116 | Reviewers are [Contributors](#contributors) who have technical experience in an area of the project, and are willing to help in reviewing pull requests. They are added or removed at the sole discretion of repository maintainers. They are also [members](https://github.com/orgs/falcosecurity/people) of the [falcosecurity](https://github.com/falcosecurity) GitHub organization. 117 | 118 | Defined by: 119 | - The OWNERS file `reviewers` entry. 120 | 121 | Responsibilities: 122 | - Review pull requests. 123 | - Follow the [Maintainers](#maintainers) guidelines. 124 | 125 | ### Maintainers 126 | 127 | Maintainers are [Contributors](#contributors) who have shown significant and sustained contribution. They are highly experienced reviewers and contributors to a specific area of the project. They are also [members](https://github.com/orgs/falcosecurity/people) of the [falcosecurity](https://github.com/falcosecurity) GitHub organization. 128 | 129 | Defined by: 130 | - The OWNERS file `approvers` entry. 131 | 132 | Requirements: 133 | - Active contribution and participation in one or more areas of the project. 134 | - Domain expertise and a good understanding of the code-base of those areas. 135 | - Comprehensive understanding of project governance. 136 | - Known to uphold the projects best interests. 137 | 138 | Measurement of these criteria are subject to the determination of the existing maintainers as attested by the sponsoring maintainer (the person working with the interested contributor to show them the ropes). 139 | 140 | Responsibilities: 141 | - Be active and proactive in communications, lead community calls, and help other community members. 142 | - Monitor [official communication channels](https://github.com/falcosecurity/community). Delayed responses are acceptable. 143 | - Triage GitHub issues and review pull requests (PRs). 144 | - Make sure that PRs are moving forward at the right pace, or closing them. 145 | - Participate when called upon in security releases. Although this should be a rare occurrence, if a serious vulnerability is found it may take up to several full days of work. 146 | - Mentoring, encouraging, and sponsoring new reviewers and maintainers. 147 | 148 | To become a maintainer, [Contributors](#contributors) must express interest to the existing maintainers. The full process is documented in the [MAINTAINERS_GUIDELINES.md](https://github.com/falcosecurity/evolution/blob/main/MAINTAINERS_GUIDELINES.md) file. 149 | 150 | The list of current [maintainers](./MAINTAINERS.md) is automatically updated by our infra (see the [falcosecurity/test-infra](https://github.com/falcosecurity/test-infra) repository). 151 | 152 | ### Core Maintainers 153 | 154 | Core Maintainers are [Maintainers](#maintainers) of at least one of the [core repositories](#core-repositories). 155 | The Core Maintainers form a team that drives the direction, values, and governance of the overall project. They also serve as an escalation point for the overall project, and anything not easily managed by the maintainers of each repository. 156 | 157 | Defined by: 158 | - The OWNERS file `approvers` entry of any [core repository](#core-repositories) (only the OWNERS file in the root directory must be considered). 159 | 160 | Requirements (same as for [Maintainers](#maintainers) plus): 161 | - Consistent engagement in the community for at least 6 months. 162 | - Regarded as a trustworthy curator of contributions. 163 | 164 | Responsibilities and privileges: 165 | - Overseeing the overall project health and growth. 166 | - Speaking on behalf of the project. 167 | - Maintaining the brand, mission, vision, values, and scope of the project. 168 | - Defining general guidelines for the project. 169 | - Administering the [falcosecurity](https://github.com/falcosecurity) GitHub organization. 170 | - Administering any assets or services owned or assigned to project. 171 | - Handle license and copyright issues. 172 | - Look out for issues or conflicts in any area of the project. 173 | - Serve as the last escalation point for an issue that can't be solved by other community roles. 174 | - Ability to create committees and delegate powers to them. 175 | 176 | The full process to become a Core Maintainer is documented in the [MAINTAINERS_GUIDELINES.md](https://github.com/falcosecurity/evolution/blob/main/MAINTAINERS_GUIDELINES.md) file. 177 | 178 | ### Emeritus Maintainers 179 | 180 | Emeritus Maintainers are former [Maintainers](#maintainers) of a specific project area (they can still be active maintainers of another project area). The only path to this role is to be previously listed in the `approvers` entry of an OWNERS file of that project area. 181 | 182 | Maintainers who are domain experts over certain areas of the codebase but can no longer dedicate the time needed to handle the responsibilities of reviewing and approving changes are encouraged to add themselves in the OWNERS file `emeritus_approvers` entry. 183 | 184 | When an emeritus maintainer returns to being more active, they may be promoted back at the discretion of the current [Maintainers](#maintainers) of the relevant area of the project. 185 | 186 | Defined by: 187 | - The OWNERS file `emeritus_approvers` entry. 188 | 189 | Responsibilities: 190 | - Lead by example. 191 | - May be consulted by [Maintainers](#maintainers). 192 | - May serve as sponsors, and commit to the long-term success of The Falco Project. 193 | 194 | ## Technical Advisory Groups 195 | 196 | Technical Advisory Groups (TAGs) are groups of [Community Members](#community-members) with considerable technical experience on a specific matter of The Falco Project. TAGs have the purpose of helping foster project maturity, casting recommendations, and advancing the project concerning a particular topic. 197 | 198 | Each TAG must have a charter specifying its name, interest topic, scope, mission, membership rules, and governance processes. TAGs must have at least one TAG chair at any given time. The TAG chairs are intended to be organizers and facilitators, responsible for the overall direction and governance of the TAG. 199 | 200 | TAGs must respect The Falco Project's [principles](#principles), communicate in the open using [communication channels](https://github.com/falcosecurity/community), and periodically share a high-level summary of their work with the [community](#community). 201 | 202 | Anyone can propose a new TAG. Proposals must first be submitted to the community. Once a sufficient discussion has occurred, the [Core Maintainers](#core-maintainers) consider the community feedback and will eventually approve using a majority vote. 203 | 204 | A [repository](#repositories) is assigned to each new accepted TAG. TAG's charter must define the requirements and responsibilities for the repository's [owners](#repository-ownership), who effectively are [Maintainers](#maintainers) of a repository and therefore are subject to the same rules. 205 | 206 | ## Decision making 207 | 208 | The Falco Project tries by default to find consensus. Using lazy consensus has to date never resulted in later disputes. However, sometimes voting is required to solve disputes, or for specific matters, as described in this section. 209 | 210 | Our [communication channels](https://github.com/falcosecurity/community) should be used to find agreement before deciding to call a vote. Discussions can happen on any official channel. Cross-posting is recommended to give more visibility to essential topics. 211 | 212 | ### Governance changes 213 | 214 | Material changes to this document must be discussed publicly on the [falcosecurity/evolution](https://github.com/falcosecurity/evolution) repository, via GitHub issues or pull requests. Any change requires a [supermajority vote](#supermajority-vote) of [Core Maintainers](#core-maintainers). 215 | 216 | The open nature of The Falco Project, its first [principle](#principles), will never be a matter of change. 217 | 218 | #### Editorial changes 219 | 220 | Editorial changes are changes that fix spelling or grammar, update links, or similar; they update the style, or keep the document up to date with obvious external changes. They do not change the intent or meaning of anything in this document. Such changes must be made via pull request, and are accepted by [lazy consensus](#consensus). 221 | 222 | ### Maintainership 223 | 224 | A [Maintainer](#maintainers) may resign by notifying their willing using a GitHub issue or pull request. In such a case, they can be moved to [Emeritus Maintainers](#emeritus-maintainers) using [lazy consensus](#consensus). 225 | 226 | [Maintainers](#maintainers) can be added (or moved to or from [Emeritus Maintainers](#emeritus-maintainers)) with a [majority vote](#majority-vote), if the criteria in this document and the [MAINTAINERS_GUIDELINES.md](https://github.com/falcosecurity/evolution/blob/main/MAINTAINERS_GUIDELINES.md) file are met. If inactivity is the criteria, at least the past six months must be considered. 227 | 228 | In all other cases, to remove [Maintainers](#maintainers) from their role, a [supermajority vote](#supermajority-vote) is required. 229 | 230 | If the decision regards a [Core Maintainer](#core-maintainers) appointment or removal, any [Core Maintainer](#core-maintainers) can request to escalate the decision to all [Core Maintainers](#core-maintainers). 231 | 232 | In any case, the persons in question are not eligible to vote, and do not count towards the quorum. 233 | 234 | ### Sensitive decisions 235 | 236 | Any sensitive matter that needs a decision to be taken privately, including but not limited to security disclosure or financial matters, may be discussed and voted on secretly if [Core Maintainers](#core-maintainers) are present and agree. 237 | 238 | In such situations, [Core Maintainers](#core-maintainers) must be notified promptly using the CNCF mailing list for Falco maintainers: [cncf-falco-maintainers@lists.cncf.io](mailto:cncf-falco-maintainers@lists.cncf.io). 239 | 240 | [Lazy consensus](#consensus) is allowed only in urgent situations that render a vote impractical. 241 | 242 | ### Ordinary decisions 243 | 244 | Technical decisions, and decisions about any other matter, are made informally by the [Maintainers](#maintainers), and [lazy consensus](#consensus) is assumed. 245 | 246 | A [majority vote](#majority-vote) is required only if: 247 | - an eligible voter proposes a vote, or 248 | - a guideline documented in the [falcosecurity/evolution](https://github.com/falcosecurity/evolution) repository requires a vote. 249 | 250 | ## Voting 251 | 252 | Different voting methods are used depending on the circumstance, as laid out [above](#decision-making). 253 | 254 | For all votes, voting must be open for **one week**. If reasonably justified, the voting period can be extended up to three weeks. The end date should be clearly stated in the call to vote. A vote may be called and closed early if enough votes have been cast, and further votes cannot change the outcome. 255 | 256 | Unless otherwise specified in this document, the voting process must be public, and the only allowed voting mechanism is using **comments on issues or pull requests** in the [falcosecurity](https://github.com/falcosecurity) GitHub organization. 257 | 258 | For public discussions, anyone interested is encouraged to participate and cast non-binding votes. 259 | 260 | Formal power to object or cast a binding vote is limited to **eligible voters**: 261 | 262 | | Scope | Eligible voters | 263 | | -------- | -------- | 264 | | Subdirectory | [Maintainers](#maintainers) of the directory, the parent directories, if any, and [Maintainers](#maintainers) of the whole repository | 265 | | One or more repositories | [Maintainers](#maintainers) of those repositories | 266 | | Any other | The [Core Maintainers](#core-maintainers) team | 267 | 268 | Notes: 269 | - If the matter regards multiple repositories, maintainers from those repositories can join and make a voting together. 270 | - Some decisions are reserved for [Core Maintainers](#core-maintainers), such as [changes in governance](#governance-changes). 271 | 272 | In case of vacation or prolonged absence, eligible voters may temporarily delegate their voting power to another [Maintainer](#maintainers) or [Emeritus Maintainer](#emeritus-maintainers) for up to three months. The appointed person, the initial and final dates of their assignment period must be publicly recorded. 273 | 274 | When a decision cannot be taken within its default scope, or there are less than two eligible voters, the decision must be escalated to the parent scope. 275 | 276 | No organization or company should be allowed more than 40% of eligible votes. If more than 40% of eligible votes are affiliated with an organization or company, they must decide who will cast votes. Affiliations must be publicly stated or acknowledged when a person is associated with or employed by an organization or company. If there are not enough organizations or companies to meet this rule, any [Maintainers](#maintainers) can request to escalate to the parent scope. 277 | 278 | ### Consensus 279 | 280 | The default decision making mechanism for The Falco Project is [lazy consensus](https://openoffice.apache.org/docs/governance/lazyConsensus.html). This means that any decision is considered supported by all concerned persons, as long as nobody objects. 281 | 282 | Silence on any consensus decision is an implicit agreement, and equivalent to an explicit agreement. Explicit agreement may be stated at will. Decisions may, but do not need to, be called out and put up for discussion on any [communication channels](https://github.com/falcosecurity/community) at any time and by anyone. 283 | 284 | Consensus decisions can never override or go against the spirit of an earlier explicit vote. 285 | 286 | If anybody raises objections, all the interested parties should work together towards a solution that all involved can accept. This solution is again subject to lazy consensus. 287 | 288 | In case no consensus can be found, but a decision one way or the other must be made, any potential eligible voters in the scope of the decision may call a formal [majority vote](#majority-vote). 289 | 290 | ### Majority vote 291 | 292 | Majority votes must be called explicitly. The subject must be prefixed with `vote:`. In the body, the call to vote must state the proposal being voted on. It should reference any discussion leading up to this point. 293 | 294 | Votes may take the form of a single proposal, with the option to vote yes or no, or the form of multiple alternatives. 295 | 296 | A vote on a single proposal is considered successful if more vote in favor than against. 297 | 298 | If there are multiple alternatives, members may vote for one or more alternatives, or vote “no” to object to all alternatives. It is not possible to cast an “abstain” vote. A vote on multiple alternatives is considered decided in favor of one alternative if it has received the most votes in favor, and a vote from more than half of those voting. Should no alternative reach this quorum, another vote on a reduced number of options may be called separately. 299 | 300 | ### Supermajority vote 301 | 302 | Supermajority votes must be called explicitly. The subject must be prefixed with `vote:`. In the body, the call to vote must state the proposal being voted on. It should reference any discussion leading up to this point. 303 | 304 | Votes may take the form of a single proposal, with the option to vote yes or no, or the form of multiple alternatives. 305 | 306 | A vote on a single proposal is considered successful if at least two thirds of those eligible vote in favor. 307 | 308 | If there are multiple alternatives, members may vote for one or more alternatives, or vote “no” to object to all alternatives. A vote on multiple alternatives is considered decided in favor of one alternative if it has received the most votes in favor, and a vote from at least two thirds of those eligible to vote. Should no alternative reach this quorum, another vote on a reduced number of options may be called separately. 309 | 310 | ## License 311 | 312 | Repository contents must be licensed under [Apache-2.0](https://www.apache.org/licenses/LICENSE-2.0) or adhere to the [Allowed Third-Party License Policy of the CNCF](https://github.com/cncf/foundation/blob/main/allowed-third-party-license-policy.md). 313 | 314 | Documentation is distributed under the [Creative Commons License version 4.0](https://creativecommons.org/licenses/by/4.0/legalcode). 315 | 316 | In each repository, copyright notices can either be included in each contributed file or stored in designated files. Copyright notices must contain the `Copyright (C) XXXX The Falco Authors` statement (see the [CNCF Copyright Notices](https://github.com/cncf/foundation/blob/main/copyright-notices.md#copyright-notices) document), where `XXXX` is the most recent year the file was updated. 317 | 318 | [Developer Certificate of Origin (DCO)](https://developercertificate.org/) commit sign-off is required for all new code contributions. 319 | -------------------------------------------------------------------------------- /LICENSE: -------------------------------------------------------------------------------- 1 | Apache License 2 | Version 2.0, January 2004 3 | http://www.apache.org/licenses/ 4 | 5 | TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION 6 | 7 | 1. Definitions. 8 | 9 | "License" shall mean the terms and conditions for use, reproduction, 10 | and distribution as defined by Sections 1 through 9 of this document. 11 | 12 | "Licensor" shall mean the copyright owner or entity authorized by 13 | the copyright owner that is granting the License. 14 | 15 | "Legal Entity" shall mean the union of the acting entity and all 16 | other entities that control, are controlled by, or are under common 17 | control with that entity. For the purposes of this definition, 18 | "control" means (i) the power, direct or indirect, to cause the 19 | direction or management of such entity, whether by contract or 20 | otherwise, or (ii) ownership of fifty percent (50%) or more of the 21 | outstanding shares, or (iii) beneficial ownership of such entity. 22 | 23 | "You" (or "Your") shall mean an individual or Legal Entity 24 | exercising permissions granted by this License. 25 | 26 | "Source" form shall mean the preferred form for making modifications, 27 | including but not limited to software source code, documentation 28 | source, and configuration files. 29 | 30 | "Object" form shall mean any form resulting from mechanical 31 | transformation or translation of a Source form, including but 32 | not limited to compiled object code, generated documentation, 33 | and conversions to other media types. 34 | 35 | "Work" shall mean the work of authorship, whether in Source or 36 | Object form, made available under the License, as indicated by a 37 | copyright notice that is included in or attached to the work 38 | (an example is provided in the Appendix below). 39 | 40 | "Derivative Works" shall mean any work, whether in Source or Object 41 | form, that is based on (or derived from) the Work and for which the 42 | editorial revisions, annotations, elaborations, or other modifications 43 | represent, as a whole, an original work of authorship. For the purposes 44 | of this License, Derivative Works shall not include works that remain 45 | separable from, or merely link (or bind by name) to the interfaces of, 46 | the Work and Derivative Works thereof. 47 | 48 | "Contribution" shall mean any work of authorship, including 49 | the original version of the Work and any modifications or additions 50 | to that Work or Derivative Works thereof, that is intentionally 51 | submitted to Licensor for inclusion in the Work by the copyright owner 52 | or by an individual or Legal Entity authorized to submit on behalf of 53 | the copyright owner. For the purposes of this definition, "submitted" 54 | means any form of electronic, verbal, or written communication sent 55 | to the Licensor or its representatives, including but not limited to 56 | communication on electronic mailing lists, source code control systems, 57 | and issue tracking systems that are managed by, or on behalf of, the 58 | Licensor for the purpose of discussing and improving the Work, but 59 | excluding communication that is conspicuously marked or otherwise 60 | designated in writing by the copyright owner as "Not a Contribution." 61 | 62 | "Contributor" shall mean Licensor and any individual or Legal Entity 63 | on behalf of whom a Contribution has been received by Licensor and 64 | subsequently incorporated within the Work. 65 | 66 | 2. Grant of Copyright License. Subject to the terms and conditions of 67 | this License, each Contributor hereby grants to You a perpetual, 68 | worldwide, non-exclusive, no-charge, royalty-free, irrevocable 69 | copyright license to reproduce, prepare Derivative Works of, 70 | publicly display, publicly perform, sublicense, and distribute the 71 | Work and such Derivative Works in Source or Object form. 72 | 73 | 3. Grant of Patent License. Subject to the terms and conditions of 74 | this License, each Contributor hereby grants to You a perpetual, 75 | worldwide, non-exclusive, no-charge, royalty-free, irrevocable 76 | (except as stated in this section) patent license to make, have made, 77 | use, offer to sell, sell, import, and otherwise transfer the Work, 78 | where such license applies only to those patent claims licensable 79 | by such Contributor that are necessarily infringed by their 80 | Contribution(s) alone or by combination of their Contribution(s) 81 | with the Work to which such Contribution(s) was submitted. If You 82 | institute patent litigation against any entity (including a 83 | cross-claim or counterclaim in a lawsuit) alleging that the Work 84 | or a Contribution incorporated within the Work constitutes direct 85 | or contributory patent infringement, then any patent licenses 86 | granted to You under this License for that Work shall terminate 87 | as of the date such litigation is filed. 88 | 89 | 4. Redistribution. You may reproduce and distribute copies of the 90 | Work or Derivative Works thereof in any medium, with or without 91 | modifications, and in Source or Object form, provided that You 92 | meet the following conditions: 93 | 94 | (a) You must give any other recipients of the Work or 95 | Derivative Works a copy of this License; and 96 | 97 | (b) You must cause any modified files to carry prominent notices 98 | stating that You changed the files; and 99 | 100 | (c) You must retain, in the Source form of any Derivative Works 101 | that You distribute, all copyright, patent, trademark, and 102 | attribution notices from the Source form of the Work, 103 | excluding those notices that do not pertain to any part of 104 | the Derivative Works; and 105 | 106 | (d) If the Work includes a "NOTICE" text file as part of its 107 | distribution, then any Derivative Works that You distribute must 108 | include a readable copy of the attribution notices contained 109 | within such NOTICE file, excluding those notices that do not 110 | pertain to any part of the Derivative Works, in at least one 111 | of the following places: within a NOTICE text file distributed 112 | as part of the Derivative Works; within the Source form or 113 | documentation, if provided along with the Derivative Works; or, 114 | within a display generated by the Derivative Works, if and 115 | wherever such third-party notices normally appear. The contents 116 | of the NOTICE file are for informational purposes only and 117 | do not modify the License. You may add Your own attribution 118 | notices within Derivative Works that You distribute, alongside 119 | or as an addendum to the NOTICE text from the Work, provided 120 | that such additional attribution notices cannot be construed 121 | as modifying the License. 122 | 123 | You may add Your own copyright statement to Your modifications and 124 | may provide additional or different license terms and conditions 125 | for use, reproduction, or distribution of Your modifications, or 126 | for any such Derivative Works as a whole, provided Your use, 127 | reproduction, and distribution of the Work otherwise complies with 128 | the conditions stated in this License. 129 | 130 | 5. Submission of Contributions. Unless You explicitly state otherwise, 131 | any Contribution intentionally submitted for inclusion in the Work 132 | by You to the Licensor shall be under the terms and conditions of 133 | this License, without any additional terms or conditions. 134 | Notwithstanding the above, nothing herein shall supersede or modify 135 | the terms of any separate license agreement you may have executed 136 | with Licensor regarding such Contributions. 137 | 138 | 6. Trademarks. This License does not grant permission to use the trade 139 | names, trademarks, service marks, or product names of the Licensor, 140 | except as required for reasonable and customary use in describing the 141 | origin of the Work and reproducing the content of the NOTICE file. 142 | 143 | 7. Disclaimer of Warranty. Unless required by applicable law or 144 | agreed to in writing, Licensor provides the Work (and each 145 | Contributor provides its Contributions) on an "AS IS" BASIS, 146 | WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or 147 | implied, including, without limitation, any warranties or conditions 148 | of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A 149 | PARTICULAR PURPOSE. You are solely responsible for determining the 150 | appropriateness of using or redistributing the Work and assume any 151 | risks associated with Your exercise of permissions under this License. 152 | 153 | 8. Limitation of Liability. In no event and under no legal theory, 154 | whether in tort (including negligence), contract, or otherwise, 155 | unless required by applicable law (such as deliberate and grossly 156 | negligent acts) or agreed to in writing, shall any Contributor be 157 | liable to You for damages, including any direct, indirect, special, 158 | incidental, or consequential damages of any character arising as a 159 | result of this License or out of the use or inability to use the 160 | Work (including but not limited to damages for loss of goodwill, 161 | work stoppage, computer failure or malfunction, or any and all 162 | other commercial damages or losses), even if such Contributor 163 | has been advised of the possibility of such damages. 164 | 165 | 9. Accepting Warranty or Additional Liability. While redistributing 166 | the Work or Derivative Works thereof, You may choose to offer, 167 | and charge a fee for, acceptance of support, warranty, indemnity, 168 | or other liability obligations and/or rights consistent with this 169 | License. However, in accepting such obligations, You may act only 170 | on Your own behalf and on Your sole responsibility, not on behalf 171 | of any other Contributor, and only if You agree to indemnify, 172 | defend, and hold each Contributor harmless for any liability 173 | incurred by, or claims asserted against, such Contributor by reason 174 | of your accepting any such warranty or additional liability. 175 | 176 | END OF TERMS AND CONDITIONS 177 | 178 | APPENDIX: How to apply the Apache License to your work. 179 | 180 | To apply the Apache License to your work, attach the following 181 | boilerplate notice, with the fields enclosed by brackets "[]" 182 | replaced with your own identifying information. (Don't include 183 | the brackets!) The text should be enclosed in the appropriate 184 | comment syntax for the file format. We also recommend that a 185 | file or class name and description of purpose be included on the 186 | same "printed page" as the copyright notice for easier 187 | identification within third-party archives. 188 | 189 | Copyright [yyyy] [name of copyright owner] 190 | 191 | Licensed under the Apache License, Version 2.0 (the "License"); 192 | you may not use this file except in compliance with the License. 193 | You may obtain a copy of the License at 194 | 195 | http://www.apache.org/licenses/LICENSE-2.0 196 | 197 | Unless required by applicable law or agreed to in writing, software 198 | distributed under the License is distributed on an "AS IS" BASIS, 199 | WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. 200 | See the License for the specific language governing permissions and 201 | limitations under the License. 202 | -------------------------------------------------------------------------------- /MAINTAINERS.md: -------------------------------------------------------------------------------- 1 | # Maintainers 2 | 3 | As per our [governance](./GOVERNANCE.md), the lists of current maintainers and core maintainers are automatically updated by our infra. 4 | 5 | These lists summarize the content of all [OWNERS](./GOVERNANCE.md#repository-ownership) files across all The Falco Project repositories. 6 | 7 | Last update: **2025-05-29T09:03:25Z** 8 | 9 | ## Core Maintainers 10 | 11 | 12 | - [Aldo Lacuku](https://github.com/alacuku), Sysdig 13 | - [Andrea Terzolo](https://github.com/andreagit97), SUSE 14 | - [Carlos Tadeu Panato Junior](https://github.com/cpanato), Chainguard 15 | - [Federico Di Pierro](https://github.com/fededp), Sysdig 16 | - [Grzegorz Nosek](https://github.com/gnosek), Sysdig 17 | - [Jason Dellaluce](https://github.com/jasondellaluce), Sysdig 18 | - [Leonardo Grasso](https://github.com/leogr), Sysdig 19 | - [Lorenzo Susini](https://github.com/loresuso), Sysdig 20 | - [Luca Guerra](https://github.com/lucaguerra), Sysdig 21 | - [Mark Stemm](https://github.com/mstemm), Sysdig 22 | - [Massimiliano Giovagnoli](https://github.com/maxgio92), Chainguard 23 | - [Mauro Ezequiel Moltrasio](https://github.com/molter73), RedHat 24 | - [Melissa Kilby](https://github.com/incertum), Apple 25 | - [Michele Zuccala](https://github.com/zuc), Sysdig 26 | - [Samuel Gaist](https://github.com/sgaist), Idiap Research Institute 27 | - [Thomas Labarussias](https://github.com/issif), Sysdig 28 | 29 | 30 | ## Maintainers 31 | 32 | 33 | - [Ahmed Amin](https://github.com/ahmedameenaim), Zartis 34 | - [Aldo Lacuku](https://github.com/alacuku), Sysdig 35 | - [Andrea Terzolo](https://github.com/andreagit97), SUSE 36 | - [Angelo Puglisi](https://github.com/deepskyblue86), Sysdig 37 | - [Aurélie Vache](https://github.com/scraly), OVHcloud 38 | - [Carlos Tadeu Panato Junior](https://github.com/cpanato), Chainguard 39 | - [David Windsor](https://github.com/dwindsor), Independent 40 | - [Edd Wilder-James](https://github.com/ewilderj), Independent 41 | - [Federico Di Pierro](https://github.com/fededp), Sysdig 42 | - [Frank Jogeleit](https://github.com/fjogeleit), LOVOO 43 | - [Fred Araujo](https://github.com/araujof), IBM 44 | - [Gianmatteo Palmieri](https://github.com/mrgian), Sysdig 45 | - [Grzegorz Nosek](https://github.com/gnosek), Sysdig 46 | - [Hendrik Brueckner](https://github.com/hbrueckner), IBM 47 | - [Igor Eulalio](https://github.com/igoreulalio), Sysdig 48 | - [Jason Dellaluce](https://github.com/jasondellaluce), Sysdig 49 | - [Jonah Jones](https://github.com/jonahjon), Amazon 50 | - [Leonardo Di Donato](https://github.com/leodido), Independent 51 | - [Leonardo Di Giovanna](https://github.com/ekoops), Sysdig 52 | - [Leonardo Grasso](https://github.com/leogr), Sysdig 53 | - [Logan Bond](https://github.com/exoner4ted), Secureworks 54 | - [Lorenzo Susini](https://github.com/loresuso), Sysdig 55 | - [Loris Degioianni](https://github.com/ldegio), Sysdig 56 | - [Luca Guerra](https://github.com/lucaguerra), Sysdig 57 | - [Lyonel Martinez](https://github.com/lowaiz), Numberly 58 | - [Mark Stemm](https://github.com/mstemm), Sysdig 59 | - [Massimiliano Giovagnoli](https://github.com/maxgio92), Chainguard 60 | - [Mauro Ezequiel Moltrasio](https://github.com/molter73), RedHat 61 | - [Melissa Kilby](https://github.com/incertum), Apple 62 | - [Michele Zuccala](https://github.com/zuc), Sysdig 63 | - [Nedim Sabic Sabic](https://github.com/rabbitstack), Sysdig 64 | - [Roberto Scolaro](https://github.com/therealbobo), Sysdig 65 | - [Rohith Raju](https://github.com/rohith-raju), Independent 66 | - [Samuel Gaist](https://github.com/sgaist), Idiap Research Institute 67 | - [Samuele Cappellin](https://github.com/cappellinsamuele), Ca' Foscari University of Venice 68 | - [Stefano Chierici](https://github.com/darryk10), Sysdig 69 | - [Sverre Boschman](https://github.com/sboschman), Topicus.Education 70 | - [Teryl Taylor](https://github.com/terylt), IBM 71 | - [Thomas Labarussias](https://github.com/issif), Sysdig 72 | - [Vicente Javier Jiménez Miras](https://github.com/vjjmiras), Independent 73 | 74 | -------------------------------------------------------------------------------- /MAINTAINERS_GUIDELINES.md: -------------------------------------------------------------------------------- 1 | # Maintainers Guidelines 2 | 3 | Maintainership-related decisions must be taken with respect to the rules established in our [governance](GOVERNANCE.md#maintainership). This document provides guidelines for the implementation of these decisions. 4 | 5 | [Reviewers](GOVERNANCE.md#reviewers) have no maintainers power, but behave similarly and therefore this document includes also guidelines for reviewers. 6 | 7 | Both [Maintainers](GOVERNANCE.md#maintainers) and [Reviewers](GOVERNANCE.md#reviewers) are defined by [OWNERS](REPOSITORIES.md#owners) files. Most of the processes described below involve making pull requests (PRs) to correctly make changes to those files. 8 | 9 | **Table of Contents** 10 | - [Organization membership](#organization-membership) 11 | - [Onboarding a Reviewer](#onboarding-a-reviewer) 12 | - [Onboarding a Maintainer](#onboarding-a-maintainer) 13 | - [Offboarding a Reviewer](#offboarding-a-reviewer) 14 | - [Offboarding a Maintainer](#offboarding-a-maintainer) 15 | - [Review maintainers activity](#review-maintainers-activity) 16 | * [How inactivity is measured](#how-inactivity-is-measured) 17 | - [Mentoring programs](#mentoring-programs) 18 | 19 | **Resources** 20 | 21 | - [Governance](https://github.com/falcosecurity/evolution/blob/main/GOVERNANCE.md) 22 | - [Code Of Conduct](https://github.com/falcosecurity/evolution/blob/main/CODE_OF_CONDUCT.md) 23 | - [Maintainers Guidelines](https://github.com/falcosecurity/evolution/blob/main/MAINTAINERS_GUIDELINES.md) 24 | - [Maintainers List](https://github.com/falcosecurity/evolution/blob/main/MAINTAINERS.md) 25 | - [Repositories Guidelines](https://github.com/falcosecurity/evolution/blob/main/REPOSITORIES.md) 26 | - [Repositories List](https://github.com/falcosecurity/evolution/blob/main/README.md#repositories) 27 | - [Adopters List](https://github.com/falcosecurity/falco/blob/master/ADOPTERS.md) 28 | - [Contributing](https://github.com/falcosecurity/.github/blob/main/CONTRIBUTING.md) 29 | - [Security policy](https://github.com/falcosecurity/.github/blob/main/SECURITY.md) 30 | - [Join the Community](https://github.com/falcosecurity/community) 31 | 32 | 33 | ## Organization membership 34 | 35 | [Maintainers](GOVERNANCE.md#maintainers) and [Reviewers](GOVERNANCE.md#reviewers) are also [organization members](https://github.com/orgs/falcosecurity/people). 36 | 37 | If they are not yet [organization members](https://github.com/orgs/falcosecurity/people), they should open a PR to add them to the `members` entry of [org.yaml](https://github.com/falcosecurity/test-infra/blob/master/config/org.yaml). 38 | 39 | [Maintainers](GOVERNANCE.md#maintainers) are usually not removed from [organization members](https://github.com/orgs/falcosecurity/people) because they become [Emeritus Maintainers](GOVERNANCE.md#emeritus-maintainers), unless they request so. 40 | 41 | Former [Reviewers](GOVERNANCE.md#reviewers) are removed from the [organization members](https://github.com/orgs/falcosecurity/people) if they are no longer listed in any [OWNERS](REPOSITORIES.md#owners) file. 42 | 43 | 44 | ## Onboarding a Reviewer 45 | 46 | If [Community Members](GOVERNANCE.md#community-members) believe they match the criteria to become [Reviewers](GOVERNANCE.md#reviewers) of a repository (or a subdirectory) they can propose themselves by opening a PR to add themselves to the `reviewers` entry of the [OWNERS](REPOSITORIES.md#owners) of the repository (or the subdirectory). The person in question must publicly express their interest and should discuss it with the other persons listed in the OWNERS file and the community before proposing themself. 47 | 48 | New reviewers can also be proposed and sponsored by existing [Maintainers](GOVERNANCE.md#maintainers) and [Reviewers](GOVERNANCE.md#reviewers). 49 | 50 | [Maintainers](GOVERNANCE.md#maintainers) will review the PR and decide. 51 | 52 | If the decision is to grant the reviewer status, then the person in question must become a member of the [falcosecurity](https://github.com/falcosecurity) Github organization (see the [Organization membership](#organization-membership) section). 53 | 54 | ## Onboarding a Maintainer 55 | 56 | If [Community Members](GOVERNANCE.md#community-members) believe they match the criteria to become [Maintainers](GOVERNANCE.md#maintainers) of a repository (or a subdirectory) they can propose themselves by opening a PR to add themselves to the `approvers` entry of the [OWNERS](REPOSITORIES.md#owners) of the repository (or the subdirectory). The person in question must publicly express their interest and should discuss it with the other persons listed in the OWNERS file and the community before proposing themself. 57 | 58 | New maintainers can also be proposed and sponsored by existing [Maintainers](GOVERNANCE.md#maintainers). 59 | 60 | [Maintainers](GOVERNANCE.md#maintainers) will review the PR and decide. Before taking the decision, existing maintainers may ask the person in question to shadow them or apply for a reviewer position for a period. 61 | 62 | If the decision is to grant the maintainer status, then the person in question must: 63 | - Update the [`people/affiliations.json`](people/affiliations.json) file by opening a PR to add their information. 64 | - If they aren't already, become a member of the [falcosecurity](https://github.com/falcosecurity) Github organization (see the [Organization membership](#organization-membership) section). 65 | - Join with `*-maintainers` [GitHub team](https://docs.github.com/en/organizations/organizing-members-into-teams/about-teams) relative to the repository they became maintainer of (i.e. the [`falco-maintainers`](https://github.com/orgs/falcosecurity/teams/falco-maintainers) team for [falcosecurity/falco](https://github.com/falcosecurity/falco)); One can do so by opening a PR to change the [org.yaml](https://github.com/falcosecurity/test-infra/blob/master/config/org.yaml) file. 66 | - Only for first-time core maintainers: 67 | - also join with [`core-maintainers`](https://github.com/orgs/falcosecurity/teams/core-maintainers) team; 68 | - go to https://maintainers.cncf.io/ and open a PR to be listed as a Falco maintainer; 69 | - ask the CNCF to be added to the `cncf-falco-maintainers@lists.cncf.io` mailing list. 70 | 71 | ## Offboarding a Reviewer 72 | 73 | Reviewers of a repository (or a directory) can lose their status by voluntarily stepping down for personal reasons, an extended period of inactivity, a period of failing to meet the requirements for the role, a violation of the [Code Of Conduct](CODE_OF_CONDUCT.md) and/or at the maintainers' discretion. 74 | 75 | In such a case, a PR is required to remove the person in question from the `reviewers` entry of the respective [OWNERS](REPOSITORIES.md#owners) file. [Maintainers](GOVERNANCE.md#maintainers) will review the PR and decide. 76 | 77 | Furthermore, former [Reviewers](GOVERNANCE.md#reviewers) are removed from the [organization members](https://github.com/orgs/falcosecurity/people) if they are no longer listed in any [OWNERS](REPOSITORIES.md#owners) file. 78 | 79 | 80 | ## Offboarding a Maintainer 81 | 82 | Maintainers of a repository (or a directory) can lose their status by voluntarily stepping down for personal reasons, or due to [inactivity](#review-maintainers-activity). 83 | 84 | In such a case: 85 | - A PR is required to move the person in question from the `approvers` entry to the `emeritus_approvers` entry of the respective [OWNERS](REPOSITORIES.md#owners) file. The person in question must be mentioned in the body of the PR. This acts as a final contact attempt so that they can provide their feedback. 86 | - Another PR is required to remove them from GitHub team defined by the [org.yaml](https://github.com/falcosecurity/test-infra/blob/master/config/org.yaml) file. 87 | - Only for core maintainers who are losing their status: 88 | - remove them from the [`core-maintainers`](https://github.com/orgs/falcosecurity/teams/core-maintainers) team; 89 | - go to https://maintainers.cncf.io/ and open a PR to remove them under Falco; 90 | - ask the CNCF to remove them from the `cncf-falco-maintainers@lists.cncf.io` mailing list. 91 | 92 | ## Review maintainers activity 93 | 94 | The [Maintainers](GOVERNANCE.md#maintainers)' activity is periodically reviewed. Any [Maintainer](GOVERNANCE.md#maintainers) that does not show significant [activity](#how-inactivity-is-measured) on the repository (or the subdirectory) they maintain can be removed from the `approvers` entry of the respective [OWNERS](REPOSITORIES.md#owners) of the repository (or the subdirectory), as described in the [Offboarding a Maintainer](#offboarding-a-maintainer) section. 95 | 96 | [Maintanership decisions](GOVERNANCE.md#maintainership) must be made on a per-OWNERS-file basis. So, a maintainer can be inactive in a project area but still involved elsewhere. 97 | 98 | Inactive maintainers are proposed for review by any other [Maintainer](GOVERNANCE.md#maintainers) or, whenever possible, by the automation. The review is performed by opening a PR where other maintainers of the repository (or the subdirectory) can discuss and decide. If the persons under consideration voluntarily step down, the PR can be merged by [lazy consensus](GOVERNANCE.md#consensus); otherwise, a [majority vote](GOVERNANCE.md#majority-vote) is needed. 99 | 100 | ### How inactivity is measured 101 | 102 | [Maintainers](GOVERNANCE.md#maintainers) contributions can be measured by using the CNCF [DevStats](https://devstats.cncf.io/) project (see also [API reference](https://github.com/cncf/devstatscode/blob/master/API.md)). 103 | 104 | An inactive person is defined as someone with less than 10 recorded contributions within the past six months. 105 | 106 | Exceptions are allowed for vacation, sick leave, maternity and paternity leave, or planned absences. Moreover, since this method does not consider special situations and does not track all [Maintainers](GOVERNANCE.md#maintainers) duties, other exceptions can be made at the discretion of existing maintainers. In particular, the criteria can be loose and tightened as needed for [*Special*](REPOSITORIES.md#status) repositories and those with very little activity. 107 | 108 | ## Mentoring programs 109 | 110 | The community promotes initiatives to seek new maintainers to ensure that the project grows healthy and increases the maintainers' diversity. 111 | 112 | Existing maintainers regularly open mentoring programs for aspirant maintainers. Mentorship is the most practical way to share knowledge. The goal is to help aspirants understand the maintainer's activities and duties. 113 | 114 | Mentoring programs may be tailored to the needs of a particular repository or area of the project. However, they must at least include: 115 | - a mentoring period where one or more maintainers with enough experience guide the participants, who will learn the dynamics of being a maintainer by performing concrete activities; 116 | - an evaluation process that must consider the technical merit, the participation in the community, as well as the other requirements to become a maintainer. 117 | 118 | Whenever a new program starts, it must be announced to the community via the official [communication channels](https://github.com/falcosecurity/community). 119 | 120 | ### Core Maintainers duties 121 | 122 | [Core Maintainers](GOVERNANCE.md#core-maintainers) as a team are responsible for maintaining the [falcosecurity](https://github.com/falcosecurity) GitHub organization; thus, they can intervene in any situation concerning their responsibility. If needed, they can ask to [become maintainers of a repository](https://github.com/falcosecurity/evolution/blob/main/REPOSITORIES.md#core-maintainers-duties-and-privileges). 123 | 124 | [Core Maintainers](GOVERNANCE.md#core-maintainers) who volunteer to intervene must act with the spirit of serving the entire falcosecurity organization. 125 | -------------------------------------------------------------------------------- /Makefile: -------------------------------------------------------------------------------- 1 | # SPDX-License-Identifier: Apache-2.0 2 | # 3 | # Copyright (C) 2023 The Falco Authors. 4 | # 5 | # Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with 6 | # the License. You may obtain a copy of the License at 7 | # 8 | # http://www.apache.org/licenses/LICENSE-2.0 9 | # 10 | # Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an 11 | # "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the 12 | # specific language governing permissions and limitations under the License. 13 | # 14 | 15 | MAKE ?= make 16 | SHELL ?= /bin/bash 17 | 18 | README_PATH=./README.md 19 | MAINTAINERS_PATH=./MAINTAINERS.md 20 | MAINTAINERS_YAML_PATH=./maintainers.yaml 21 | REPOSITORIES_YAML_PATH=./repositories.yaml 22 | 23 | .PHONY: all 24 | all: gen-readme gen-maintainers 25 | 26 | .PHONY: clean 27 | clean: 28 | +@$(MAKE) -C utils clean 29 | 30 | .PHONY: gen-readme 31 | gen-readme: utils 32 | +./utils/bin/utils readme -o $(README_PATH) -r $(REPOSITORIES_YAML_PATH) 33 | 34 | .PHONY: gen-maintainers 35 | gen-maintainers: utils 36 | +./utils/bin/utils maintainers -o $(MAINTAINERS_PATH) -r $(REPOSITORIES_YAML_PATH) -m $(MAINTAINERS_YAML_PATH) 37 | 38 | .PHONY: utils 39 | utils: 40 | +@$(MAKE) -C utils 41 | -------------------------------------------------------------------------------- /OWNERS: -------------------------------------------------------------------------------- 1 | approvers: 2 | - leogr 3 | - maxgio92 4 | - jasondellaluce 5 | - LucaGuerra 6 | emeritus_approvers: 7 | - leodido 8 | - fntlnz 9 | - kris-nova 10 | -------------------------------------------------------------------------------- /README.md: -------------------------------------------------------------------------------- 1 | 2 |

3 |

4 | 5 | # Falco Project Evolution 6 | 7 | This repository aims to document the evolution process of The Falco Project. 8 | 9 | It provides a space for the community to work together, discuss ideas, and document processes. It is also a place to make decisions that regard the whole [falcosecurity](https://github.com/falcosecurity) organization and define rules and structures that span beyond the extent of a single repository. 10 | 11 | **Table of Contents** 12 | 13 | - [Governance](#governance) 14 | - [Code Of Conduct](#code-of-conduct) 15 | - [Maintainers](#maintainers) 16 | * [Maintainers Guidelines](./MAINTAINERS_GUIDELINES.md) 17 | * [Maintainers List](./MAINTAINERS.md) 18 | - [Repositories](#repositories) 19 | * [Repositories Guidelines](./REPOSITORIES.md) 20 | * [Core](#core) 21 | * [Ecosystem](#ecosystem) 22 | * [Infra](#infra) 23 | * [Special](#special) 24 | * [Archived](#archived) 25 | * [Retired](#retired) 26 | - [Contributing](#contributing) 27 | - [Security policy](#security-policy) 28 | - [Join the Community](#join-the-community) 29 | 30 | ## Governance 31 | 32 | The Falco Project governance model is documented in the [GOVERNANCE.md](./GOVERNANCE.md) file. 33 | 34 | ## Code Of Conduct 35 | 36 | We follow the [CNCF Code of Conduct](https://github.com/cncf/foundation/blob/main/code-of-conduct.md). 37 | 38 | Please contact [cncf-falco-maintainers@lists.cncf.io](mailto:cncf-falco-maintainers@lists.cncf.io) 39 | or the Linux Foundation mediator, Mishi Choudhary [mishi@linux.com](mailto:mishi@linux.com) to report an issue. 40 | 41 | ## Maintainers 42 | 43 | The process to become a maintainer is documented in the [MAINTAINERS_GUIDELINES.md](https://github.com/falcosecurity/evolution/blob/main/MAINTAINERS_GUIDELINES.md) file. 44 | 45 | You can find the list of current maintainers in the [MAINTAINERS.md](./MAINTAINERS.md) file. 46 | 47 | ## Repositories 48 | 49 | The Falco Project applies a straightforward **adoption model** for its repositories. Each repository is given a *[scope](./REPOSITORIES.md#scope)*, which outlines its purpose, and a *[status](./REPOSITORIES.md#status)* that indicates its maturity level. 50 | 51 | For more detailed information, please refer to the [REPOSITORIES.md](./REPOSITORIES.md) file. 52 | 53 | In the sections that follow, we present the repositories, grouped by their *scope*. 54 | 55 | ### Core 56 | 57 | Core repositories, as defined by Falco's [governance](https://github.com/falcosecurity/evolution/blob/main/GOVERNANCE.md#core-repositories), are critically important as they are essential for building, installing, running, documenting, and using Falco. 58 | 59 | For more information, click on the badge below. 60 | 61 | [![Falco Core Repository](./repos/badges/falco-core-blue.svg)](./REPOSITORIES.md#core-scope) 62 | 63 | 64 | | NAME | STATUS | DESCRIPTION | 65 | |---------------------------------------------------------------------------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| 66 | | [falcosecurity/charts](https://github.com/falcosecurity/charts) | [![Stable](https://img.shields.io/badge/status-stable-brightgreen?style=for-the-badge)](https://github.com/falcosecurity/evolution/blob/main/REPOSITORIES.md#stable) | Helm charts repository for Falco and its ecosystem. | 67 | | [falcosecurity/deploy-kubernetes](https://github.com/falcosecurity/deploy-kubernetes) | [![Stable](https://img.shields.io/badge/status-stable-brightgreen?style=for-the-badge)](https://github.com/falcosecurity/evolution/blob/main/REPOSITORIES.md#stable) | Kubernetes deployment resources for Falco and its ecosystem. | 68 | | [falcosecurity/falco](https://github.com/falcosecurity/falco) | [![Stable](https://img.shields.io/badge/status-stable-brightgreen?style=for-the-badge)](https://github.com/falcosecurity/evolution/blob/main/REPOSITORIES.md#stable) | Falco is a cloud native runtime security tool for Linux operating systems. It is designed to detect and alert on abnormal behavior and potential security threats in real-time. | 69 | | [falcosecurity/falco-website](https://github.com/falcosecurity/falco-website) | [![Stable](https://img.shields.io/badge/status-stable-brightgreen?style=for-the-badge)](https://github.com/falcosecurity/evolution/blob/main/REPOSITORIES.md#stable) | Falco website and documentation repository. | 70 | | [falcosecurity/falcoctl](https://github.com/falcosecurity/falcoctl) | [![Stable](https://img.shields.io/badge/status-stable-brightgreen?style=for-the-badge)](https://github.com/falcosecurity/evolution/blob/main/REPOSITORIES.md#stable) | The official CLI tool for working with Falco and its ecosystem components. | 71 | | [falcosecurity/libs](https://github.com/falcosecurity/libs) | [![Stable](https://img.shields.io/badge/status-stable-brightgreen?style=for-the-badge)](https://github.com/falcosecurity/evolution/blob/main/REPOSITORIES.md#stable) | Foundational libraries that constitute the core of Falco's functionality, offering essential features including kernel drivers and eBPF probes. | 72 | | [falcosecurity/plugin-sdk-go](https://github.com/falcosecurity/plugin-sdk-go) | [![Stable](https://img.shields.io/badge/status-stable-brightgreen?style=for-the-badge)](https://github.com/falcosecurity/evolution/blob/main/REPOSITORIES.md#stable) | Plugins SDK for Go that facilitates writing plugins for Falco or applications built on top of Falco's libs. | 73 | | [falcosecurity/plugins](https://github.com/falcosecurity/plugins) | [![Stable](https://img.shields.io/badge/status-stable-brightgreen?style=for-the-badge)](https://github.com/falcosecurity/evolution/blob/main/REPOSITORIES.md#stable) | Plugins serve as extensions for Falco and applications built on top of Falco's libraries. This repository contains the official registry for all Falco plugins and host plugins maintained by The Falco Project. | 74 | | [falcosecurity/rules](https://github.com/falcosecurity/rules) | [![Stable](https://img.shields.io/badge/status-stable-brightgreen?style=for-the-badge)](https://github.com/falcosecurity/evolution/blob/main/REPOSITORIES.md#stable) | Official rulesets for Falco provide pre-defined detection rules for various security threats and abnormal behaviors. | 75 | 76 | 77 | ### Ecosystem 78 | 79 | Ecosystem repositories extend the core project by providing optional components, including value-added features, integrations, utilities, and services that, while not essential for basic Falco functioning, enrich its utility for adopters. 80 | 81 | For more information, click on the badge below. 82 | 83 | [![Falco Ecosystem Repository](./repos/badges/falco-ecosystem-blue.svg)](./REPOSITORIES.md#ecosystem-scope) 84 | 85 | 86 | | NAME | STATUS | DESCRIPTION | 87 | |---------------------------------------------------------------------------------------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|-----------------------------------------------------------------------------------------------------------------------------------| 88 | | [falcosecurity/client-go](https://github.com/falcosecurity/client-go) | [![Incubating](https://img.shields.io/badge/status-incubating-orange?style=for-the-badge)](https://github.com/falcosecurity/evolution/blob/main/REPOSITORIES.md#incubating) | Go client and SDK for Falco. | 89 | | [falcosecurity/contrib](https://github.com/falcosecurity/contrib) | [![Sandbox](https://img.shields.io/badge/status-sandbox-red?style=for-the-badge)](https://github.com/falcosecurity/evolution/blob/main/REPOSITORIES.md#sandbox) | Sandbox repository to test-drive ideas/projects/code. | 90 | | [falcosecurity/driverkit](https://github.com/falcosecurity/driverkit) | [![Incubating](https://img.shields.io/badge/status-incubating-orange?style=for-the-badge)](https://github.com/falcosecurity/evolution/blob/main/REPOSITORIES.md#incubating) | Kit for building Falco drivers (kernel modules or eBPF probes). | 91 | | [falcosecurity/event-generator](https://github.com/falcosecurity/event-generator) | [![Incubating](https://img.shields.io/badge/status-incubating-orange?style=for-the-badge)](https://github.com/falcosecurity/evolution/blob/main/REPOSITORIES.md#incubating) | Testing tool to generate a variety of suspect actions that are detected by Falco rules. | 92 | | [falcosecurity/falco-exporter](https://github.com/falcosecurity/falco-exporter) | [![Deprecated](https://img.shields.io/badge/status-deprecated-inactive?style=for-the-badge)](https://github.com/falcosecurity/evolution/blob/main/REPOSITORIES.md#deprecated) | Prometheus Metrics Exporter for Falco output events. | 93 | | [falcosecurity/falco-aws-terraform](https://github.com/falcosecurity/falco-aws-terraform) | [![Incubating](https://img.shields.io/badge/status-incubating-orange?style=for-the-badge)](https://github.com/falcosecurity/evolution/blob/main/REPOSITORIES.md#incubating) | Terraform Module for Falco AWS Resources. | 94 | | [falcosecurity/falcosidekick](https://github.com/falcosecurity/falcosidekick) | [![Stable](https://img.shields.io/badge/status-stable-brightgreen?style=for-the-badge)](https://github.com/falcosecurity/evolution/blob/main/REPOSITORIES.md#stable) | Falcosidekick seamlessly integrates Falco with your ecosystem, enabling event forwarding to multiple outputs in a fan-out manner. | 95 | | [falcosecurity/falcosidekick-ui](https://github.com/falcosecurity/falcosidekick-ui) | [![Incubating](https://img.shields.io/badge/status-incubating-orange?style=for-the-badge)](https://github.com/falcosecurity/evolution/blob/main/REPOSITORIES.md#incubating) | A simple WebUI with latest events from Falco. | 96 | | [falcosecurity/flycheck-falco-rules](https://github.com/falcosecurity/flycheck-falco-rules) | [![Incubating](https://img.shields.io/badge/status-incubating-orange?style=for-the-badge)](https://github.com/falcosecurity/evolution/blob/main/REPOSITORIES.md#incubating) | A custom checker for Falco rules files that can be loaded using the Flycheck syntax checker for GNU Emacs. | 97 | | [falcosecurity/libs-sdk-go](https://github.com/falcosecurity/libs-sdk-go) | [![Sandbox](https://img.shields.io/badge/status-sandbox-red?style=for-the-badge)](https://github.com/falcosecurity/evolution/blob/main/REPOSITORIES.md#sandbox) | Go SDK for Falco libs. | 98 | | [falcosecurity/plugin-sdk-cpp](https://github.com/falcosecurity/plugin-sdk-cpp) | [![Incubating](https://img.shields.io/badge/status-incubating-orange?style=for-the-badge)](https://github.com/falcosecurity/evolution/blob/main/REPOSITORIES.md#incubating) | Falco plugins SDK for C++. | 99 | | [falcosecurity/k8s-metacollector](https://github.com/falcosecurity/k8s-metacollector) | [![Incubating](https://img.shields.io/badge/status-incubating-orange?style=for-the-badge)](https://github.com/falcosecurity/evolution/blob/main/REPOSITORIES.md#incubating) | Fetches the metadata from kubernetes API server and dispatches them to Falco instances. | 100 | | [falcosecurity/falco-talon](https://github.com/falcosecurity/falco-talon) | [![Incubating](https://img.shields.io/badge/status-incubating-orange?style=for-the-badge)](https://github.com/falcosecurity/evolution/blob/main/REPOSITORIES.md#incubating) | Response Engine for managing threats in your Kubernetes. | 101 | | [falcosecurity/plugin-sdk-rs](https://github.com/falcosecurity/plugin-sdk-rs) | [![Incubating](https://img.shields.io/badge/status-incubating-orange?style=for-the-badge)](https://github.com/falcosecurity/evolution/blob/main/REPOSITORIES.md#incubating) | Falco plugins SDK for Rust. | 102 | | [falcosecurity/falco-actions](https://github.com/falcosecurity/falco-actions) | [![Sandbox](https://img.shields.io/badge/status-sandbox-red?style=for-the-badge)](https://github.com/falcosecurity/evolution/blob/main/REPOSITORIES.md#sandbox) | Run Falco in a GitHub Actions to detect suspicious behavior in your CI/CD. | 103 | | [falcosecurity/falco-rustlings](https://github.com/falcosecurity/falco-rustlings) | [![Sandbox](https://img.shields.io/badge/status-sandbox-red?style=for-the-badge)](https://github.com/falcosecurity/evolution/blob/main/REPOSITORIES.md#sandbox) | Small exercises to get you used to writing Falco plugins in Rust. | 104 | | [falcosecurity/falco-operator](https://github.com/falcosecurity/falco-operator) | [![Incubating](https://img.shields.io/badge/status-incubating-orange?style=for-the-badge)](https://github.com/falcosecurity/evolution/blob/main/REPOSITORIES.md#incubating) | Kubernetes Operator for Falco. | 105 | 106 | 107 | ### Infra 108 | 109 | Infra repositories, such as the prominent [test-infra](https://github.com/falcosecurity/test-infra), underpin The Falco Project's infrastructure, serving the project's functioning, management, and maintenance. 110 | 111 | For more information, click on the badge below. 112 | 113 | [![Falco Infra Repository](./repos/badges/falco-infra-blue.svg)](./REPOSITORIES.md#infra-scope) 114 | 115 | | NAME | STATUS | DESCRIPTION | 116 | |-------------------------------------------------------------------------------------------------------|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------|-------------------------------------------------------------------------------------------------| 117 | | [falcosecurity/cncf-green-review-testing](https://github.com/falcosecurity/cncf-green-review-testing) | [![Sandbox](https://img.shields.io/badge/status-sandbox-red?style=for-the-badge)](https://github.com/falcosecurity/evolution/blob/main/REPOSITORIES.md#sandbox) | Falco configurations intended for testing with the CNCF Green Reviews Working Group. | 118 | | [falcosecurity/dbg-go](https://github.com/falcosecurity/dbg-go) | [![Incubating](https://img.shields.io/badge/status-incubating-orange?style=for-the-badge)](https://github.com/falcosecurity/evolution/blob/main/REPOSITORIES.md#incubating) | A go tool to work with falcosecurity drivers build grid. | 119 | | [falcosecurity/kernel-crawler](https://github.com/falcosecurity/kernel-crawler) | [![Incubating](https://img.shields.io/badge/status-incubating-orange?style=for-the-badge)](https://github.com/falcosecurity/evolution/blob/main/REPOSITORIES.md#incubating) | A tool to crawl Linux kernel versions. | 120 | | [falcosecurity/pigeon](https://github.com/falcosecurity/pigeon) | [![Incubating](https://img.shields.io/badge/status-incubating-orange?style=for-the-badge)](https://github.com/falcosecurity/evolution/blob/main/REPOSITORIES.md#incubating) | Secrets and config manager for Falco's infrastructure. | 121 | | [falcosecurity/test-infra](https://github.com/falcosecurity/test-infra) | [![Stable](https://img.shields.io/badge/status-stable-brightgreen?style=for-the-badge)](https://github.com/falcosecurity/evolution/blob/main/REPOSITORIES.md#stable) | Test infrastructure and automation workflows for The Falco Project. | 122 | | [falcosecurity/testing](https://github.com/falcosecurity/testing) | [![Incubating](https://img.shields.io/badge/status-incubating-orange?style=for-the-badge)](https://github.com/falcosecurity/evolution/blob/main/REPOSITORIES.md#incubating) | All-purpose test suite for Falco and its ecosystem. | 123 | | [falcosecurity/syscalls-bumper](https://github.com/falcosecurity/syscalls-bumper) | [![Incubating](https://img.shields.io/badge/status-incubating-orange?style=for-the-badge)](https://github.com/falcosecurity/evolution/blob/main/REPOSITORIES.md#incubating) | A tool to automatically update supported syscalls in libs. | 124 | | [falcosecurity/kernel-testing](https://github.com/falcosecurity/kernel-testing) | [![Incubating](https://img.shields.io/badge/status-incubating-orange?style=for-the-badge)](https://github.com/falcosecurity/evolution/blob/main/REPOSITORIES.md#incubating) | Ansible playbooks to provision firecracker VMs and run Falco kernel tests. | 125 | | [falcosecurity/falco-playground](https://github.com/falcosecurity/falco-playground) | [![Sandbox](https://img.shields.io/badge/status-sandbox-red?style=for-the-badge)](https://github.com/falcosecurity/evolution/blob/main/REPOSITORIES.md#sandbox) | falco-playground is a web application used to validate Falco rules and test against scap files. | 126 | 127 | 128 | ### Special 129 | 130 | Finally, some repositories have a special meaning and do not fit the above scopes. They serve a particular purpose or function in the [falcosecurity](https://github.com/falcosecurity) organization and are curated by [core maintainers](./GOVERNANCE.md#core-maintainers). 131 | 132 | See [REPOSITORIES.md#special-scope](./REPOSITORIES.md#special-scope) for more information. 133 | 134 | 135 | | NAME | STATUS | DESCRIPTION | 136 | |-----------------------------------------------------------------------------|--------|-------------------------------------------------------------------------------------------------------------------| 137 | | [falcosecurity/.github](https://github.com/falcosecurity/.github) | *n/a* | Default files for all repos in the Falcosecurity GitHub org. | 138 | | [falcosecurity/community](https://github.com/falcosecurity/community) | *n/a* | Falco community content and resources. | 139 | | [falcosecurity/elftoolchain](https://github.com/falcosecurity/elftoolchain) | *n/a* | Local version of https://sourceforge.net/projects/elftoolchain/ | 140 | | [falcosecurity/evolution](https://github.com/falcosecurity/evolution) | *n/a* | A space for the community to work together, discuss ideas, define processes, and document the evolution of Falco. | 141 | 142 | 143 | ### Archived 144 | 145 | In general, a repository can be archived at the discretion of The Falco Project community. Usually, maintainers can decide to archive a project that has not been maintained for a long time or does not fit the guidelines for the projects under the [falcosecurity](https://github.com/falcosecurity) GitHub's organization anymore. In other cases, a repository is archived to reserve its name for future use. 146 | 147 | The list of archived repositories can be found [here](https://github.com/falcosecurity?q=&type=archived&language=&sort=name). 148 | 149 | ### Retired 150 | 151 | Repositories that are no longer maintained or relevant to The Falco Project will be retired definitively. Periodically, the maintainers clean up the [falcosecurity](https://github.com/falcosecurity) and move these projects to the [Falco Projects Retirement Home](https://github.com/falcosecurity-retire) GitHub's organization. 152 | 153 | ## Contributing 154 | 155 | See the [contributing guide](https://github.com/falcosecurity/.github/blob/main/CONTRIBUTING.md) and the [code of conduct](./CODE_OF_CONDUCT.md). 156 | 157 | ## Security policy 158 | 159 | To report a security vulnerability, please follow our [security policy](https://github.com/falcosecurity/.github/blob/main/SECURITY.md). 160 | 161 | ## Join the Community 162 | 163 | To get involved with The Falco Project, please visit [the community repository](https://github.com/falcosecurity/community) to find more. 164 | -------------------------------------------------------------------------------- /REPOSITORIES.md: -------------------------------------------------------------------------------- 1 | # Repositories 2 | 3 | This document describes the lifecycle of repositories under the [falcosecurity](https://github.com/falcosecurity) along with their criteria, structure, scope, and status. 4 | 5 | **Table of Contents** 6 | 7 | - [Criteria](#criteria) 8 | - [Owners](#owners) 9 | - [License](#license) 10 | - [Scope](#scope) 11 | * [Core Scope](#core-scope) 12 | * [Ecosystem Scope](#ecosystem-scope) 13 | * [Infra Scope](#infra-scope) 14 | * [Special Scope](#special-scope) 15 | - [Status](#status) 16 | * [Stable](#stable) 17 | * [Incubating](#incubating) 18 | * [Sandbox](#sandbox) 19 | * [Deprecated](#deprecated) 20 | - [Lifecycle](#lifecycle) 21 | * [Addition](#addition) 22 | * [Change of Status or Scope](#change-of-status-or-scope) 23 | * [Archiviation](#archiviation) 24 | * [Unarchiviation](#unarchiviation) 25 | * [Removal](#removal) 26 | * [Core Maintainers duties and privileges](#core-maintainers-duties-and-privileges) 27 | 28 | **Resources** 29 | 30 | - [Governance](https://github.com/falcosecurity/evolution/blob/main/GOVERNANCE.md) 31 | - [Code Of Conduct](https://github.com/falcosecurity/evolution/blob/main/CODE_OF_CONDUCT.md) 32 | - [Maintainers Guidelines](https://github.com/falcosecurity/evolution/blob/main/MAINTAINERS_GUIDELINES.md) 33 | - [Maintainers List](https://github.com/falcosecurity/evolution/blob/main/MAINTAINERS.md) 34 | - [Repositories Guidelines](https://github.com/falcosecurity/evolution/blob/main/REPOSITORIES.md) 35 | - [Repositories List](https://github.com/falcosecurity/evolution/blob/main/README.md#repositories) 36 | - [Adopters List](https://github.com/falcosecurity/falco/blob/master/ADOPTERS.md) 37 | - [Contributing](https://github.com/falcosecurity/.github/blob/main/CONTRIBUTING.md) 38 | - [Security policy](https://github.com/falcosecurity/.github/blob/main/SECURITY.md) 39 | - [Join the Community](https://github.com/falcosecurity/community) 40 | 41 | 42 | ## Criteria 43 | 44 | Repositories host specific parts of The Falco Project such as core codebase components, documentation, tools, libraries, or subprojects. The [falcosecurity](https://github.com/falcosecurity) GitHub organization owns repositories exclusively related to The Falco Project or its ecosystem. 45 | 46 | ## Owners 47 | 48 | Repositories must contain [OWNERS](https://www.kubernetes.dev/docs/guide/owners/) files following the Kubernetes specification. OWNERS files are used to designate responsibility over different parts of the repository codebase and serve as the implementation mechanism for the two-phase code review process used by each project. 49 | 50 | Each repository must have an `OWNERS` file in the root directory. Each sub-directory that contains a unit of independent code or content may also contain an OWNERS file. This file applies to everything within its directory, including the OWNERS file itself, sibling files, and child directories. There must be only one OWNERS file per directory. 51 | 52 | As for the [Kubernetes specification](https://www.kubernetes.dev/docs/guide/owners/), OWNERS files are in YAML format and support a given set of keys, of which The Falco Project observes the following: 53 | 54 | - `approvers`: Users that can `/approve` or `/lgtm` PRs. See [GOVERNANCE.md](GOVERNANCE.md#maintainers) for more details. 55 | - `reviewers`: Users that are good candidates to `/lgtm` PRs. See [GOVERNANCE.md](GOVERNANCE.md#reviewers) for more details. 56 | - `emeritus_approvers`: Users that used to be in `approvers` but can no longer dedicate the time needed to handle the responsibilities of reviewing and approving changes. See [GOVERNANCE.md](GOVERNANCE.md#emeritus-maintainers) for more details. 57 | 58 | In OWNERS files, users are referenced by their GitHub usernames or aliases. In a given OWNERS file, a given user can't be listed in more than one of `approvers`, `reviewers`, and `emeritus_approvers`. 59 | 60 | ## License 61 | 62 | Refer to [GOVERNANCE.md](GOVERNANCE.md#license). 63 | 64 | ## Scope 65 | 66 | *Scopes* are defined by [Core Maintainers](GOVERNANCE.md#core-maintainers) following the standard [decision-making process](GOVERNANCE.md#decision-making). Every repository within the [falcosecurity](https://github.com/falcosecurity) GitHub organization must have an assigned scope, which characterizes its **role and responsibilities**. The scope of a repository is determined by maintainers and might be subject to change over time. However, only [Core Maintainers](https://github.com/falcosecurity/evolution/blob/main/GOVERNANCE.md#core-maintainers) can decide whether a specific repository should be given the [*core*](#core-scope) scope. See the [Lifecycle](#lifecycle) section for more details. 67 | 68 | Please note that the assigned scope pertains to the repository and might not necessarily reflect all the hosted components or the artifacts it provides. For example, a mono repo that contains different components may still be scoped as *core* if its function or some hosted components align with the *core* definition. Notable examples include the [charts](https://github.com/falcosecurity/charts) and the [plugins](https://github.com/falcosecurity/plugins) repositories. 69 | 70 | The *scope* of each repository is tracked by the [repository.yaml](https://github.com/falcosecurity/evolution/blob/main/repositories.yaml) file, and you can find an overview of that in the [README.md](README.md) of this repository. 71 | 72 | The descriptions for the currently defined scopes are provided in the below sub-sections. 73 | 74 | ### Core Scope 75 | 76 | [![Falco Core Repository](./repos/badges/falco-core-blue.svg)](#core-scope) 77 | 78 | Core repositories form the heart of Falco and are critically important. Our [governance](https://github.com/falcosecurity/evolution/blob/main/GOVERNANCE.md#core-repositories) precisely defines them as: 79 | 80 | > repositories essential for building, installing, running, documenting, or using Falco 81 | 82 | They provide foundational code, primary libraries, crucial APIs, deployment tools, documentation, and more. They are the most important repositories in the project and are the most likely to be used (directly or indirectly) by adopters. 83 | 84 | You can find the list of core repositories, along with their *status*, [here](https://github.com/falcosecurity/evolution#core). 85 | 86 | ### Ecosystem Scope 87 | 88 | [![Falco Ecosystem Repository](./repos/badges/falco-ecosystem-blue.svg)](#ecosystem-scope) 89 | 90 | Repositories under the ecosystem scope are extensions of the core project. They provide optional components that may be useful to Falco and its adopters. While they may not be necessary for the basic functioning of Falco, ecosystem repositories often offer value-added features, integrations, utilities, and services that help adopters make the most out of Falco. 91 | 92 | You can find the list of ecosystem repositories, along with their *status*, [here](https://github.com/falcosecurity/evolution#ecosystem). 93 | 94 | ### Infra Scope 95 | 96 | [![Falco Infra Repository](./repos/badges/falco-infra-blue.svg)](#infra-scope) 97 | 98 | Repositories under the infra scope are dedicated to supporting the infrastructure of The Falco Project. They are not intended to be consumed by adopters but serve as the backbone for the functioning, management, and maintenance of the project and [falcosecurity](https://github.com/falcosecurity) GitHub organization. The most notable repository in this scope is [test-infra](https://github.com/falcosecurity/test-infra). 99 | 100 | You can find the list of infra repositories, along with their *status*, [here](https://github.com/falcosecurity/evolution#infra). 101 | 102 | ### Special Scope 103 | 104 | *No badge is required for special repositories* 105 | 106 | Any other repository not matching a specific scope is included in this category. This includes repositories with a unique function or a particular purpose for The Falco Project as a whole or the [falcosecurity](https://github.com/falcosecurity) GitHub organization, including (but not limited to) the [evolution](https://github.com/falcosecurity/evolution) repository, the [community](https://github.com/falcosecurity/community) repository, the [.github](https://github.com/falcosecurity/.github) repository, forks, mirrors, and other particular ones like the [template repositories](https://docs.github.com/en/repositories/creating-and-managing-repositories/creating-a-template-repository). These repositories are curated by [Core Maintainers](GOVERNANCE.md#core-maintainers). 107 | 108 | It's worth noting that *special* repositories usually do not have a designated status. This is because they are not intended to be used by adopters and may not be subject to the same lifecycle as other repositories. You can find the list of special repositories [here](https://github.com/falcosecurity/evolution#infra). 109 | 110 | ## Status 111 | 112 | *Statuses* are defined by [Core Maintainers](GOVERNANCE.md#core-maintainers) following the standard [decision-making process](GOVERNANCE.md#decision-making). Every repository within [falcosecurity](https://github.com/falcosecurity) GitHub organization must have an assigned status, which characterizes its **maturity level**. The status of a repository is determined by maintainers and might be subject to change over time. See the [Lifecycle](#lifecycle) section for more details. 113 | 114 | Please keep in mind that the status designation refers strictly to the repository itself and might not necessarily reflect the hosted components or the artifacts it provides. This is especially true for mono repos. In such cases, the status of a component or an artifact should be denoted in the corresponding subfolder or documentation. 115 | 116 | The *status* of each repository is tracked by the [repository.yaml](https://github.com/falcosecurity/evolution/blob/main/repositories.yaml) file, and you can find an overview of that in the [README.md](README.md) of this repository. 117 | 118 | The definitions for each status are outlined in the below sub-sections. 119 | 120 | ### Stable 121 | 122 | [![Stable](https://img.shields.io/badge/status-stable-brightgreen?style=for-the-badge)](https://github.com/falcosecurity/evolution/blob/main/REPOSITORIES.md#stable) 123 | 124 | Repositories with the status *stable* have reached a high degree of maturity and reliability and are actively curated by maintainers. The components provided by those repositories are intended to be used in production by adopters and are officially supported by The Falco Project. Significant changes or updates are typically less frequent. 125 | 126 | Criteria to achieve the *stable* status include: 127 | 128 | - Actively supported by maintainers and the community. 129 | - Provided components are regularly updated and released. 130 | - Documentation is provided and kept up-to-date. 131 | - Automated testing via unit, functional, and integration test suites on multiple platforms (when applicable). 132 | - Pre-built artifacts are published by an automated system for multiple platforms (when applicable). 133 | - Documented release process (when applicable). 134 | 135 | You can find the list of all repositories, along with their current status, [here](https://github.com/falcosecurity/evolution#repositories). 136 | 137 | ### Incubating 138 | 139 | [![Incubating](https://img.shields.io/badge/status-incubating-orange?style=for-the-badge)](https://github.com/falcosecurity/evolution/blob/main/REPOSITORIES.md#incubating) 140 | 141 | Repositories with the status *incubating* are in an intermediate stage of maturity. These repositories may still be subject to significant changes as feedback is gathered and improvements are made. The components provided by those repositories might be used in production by adopters, but it's not recommended. Generally, those projects are not safe for mission-critical purposes. The level of support for those projects may vary case by case. 142 | 143 | Criteria to achieve the *incubating* status include: 144 | 145 | - Supported on a best-effort basis by at least two maintainers. 146 | - Basic documentation is provided. 147 | - Releases may not occur regularly. 148 | - Minimal CI/CD pipelines are implemented (when applicable). 149 | 150 | You can find the list of all repositories, along with their current status, [here](https://github.com/falcosecurity/evolution#repositories). 151 | 152 | ### Sandbox 153 | 154 | [![Sandbox](https://img.shields.io/badge/status-sandbox-red?style=for-the-badge)](https://github.com/falcosecurity/evolution/blob/main/REPOSITORIES.md#sandbox) 155 | 156 | Repositories with the status *sandbox* are in the earliest stage of development. The componentes provided by these repositories are not recommended for production use but are intended for users interested in experimenting with cutting-edge features, contributing to early-stage development, or providing feedback. Usually, no support is provided for these projects. 157 | 158 | Generally, the criteria for adopting a project or a component with the status of *sandbox* are flexible and may be tightened as needed at the discretion of the community. Ideas, projects, or codes intended for the *sandbox* should generally be adopted under [falcosecurity/contrib](https://github.com/falcosecurity/contrib). A dedicated repository may only be requested for justified technical reasons. 159 | 160 | You can find the list of all repositories, along with their current status, [here](https://github.com/falcosecurity/evolution#repositories). 161 | 162 | ### Deprecated 163 | 164 | [![Deprecated](https://img.shields.io/badge/status-deprecated-inactive?style=for-the-badge)](https://github.com/falcosecurity/evolution/blob/main/REPOSITORIES.md#deprecated) 165 | 166 | Repositories with the status *deprecated* are no longer maintained or updated and are only kept for historical purposes. They are not recommended for any use, and contributions are not accepted. 167 | 168 | Deprecated respositories are usually [archived](#archiviation) and read-only. 169 | 170 | You can find the list of all repositories, along with their current status, [here](https://github.com/falcosecurity/evolution#repositories). 171 | 172 | ## Lifecycle 173 | 174 | This section describes the lifecycle of the repositories hosted under the [falcosecurity](https://github.com/falcosecurity) GitHub organization. 175 | 176 | Anyone can submit proposals regarding repositories' lifecycle by opening a GitHub issue in the 177 | [falcosecurity/evolution](https://github.com/falcosecurity/evolution) repository (see below sections). The [Core Maintainers](GOVERNANCE.md#core-maintainers) will take into account the community feedback and decide on the proposal. 178 | 179 | ### Addition 180 | 181 | New projects can be contributed to the falcosecurity organization by opening a GitHub issue in the 182 | [falcosecurity/evolution](https://github.com/falcosecurity/evolution) repository. 183 | 184 | If the decision is to add the proposed project, then one of the falcosecurity GitHub organization admins will assist the issue opener in transferring the repository to the falcosecurity organization and configuring it in [falcosecurity/test-infra](https://github.com/falcosecurity/test-infra). Upon addition, the repository must be reviewed to make sure it respects the [criteria](#criteria), [owners](#owners), and [license](#license) points of this document. In particular, when a repository is added, the proposed owners are reviewed as described by the [MAINTAINERS_GUIDELINES.md](MAINTAINERS_GUIDELINES.md) and eventually accepted. 185 | 186 | When a repository is first contributed to the [falcosecurity](https://github.com/falcosecurity) GitHub organization, it is assigned a [scope](#scope) and a [status](#status). 187 | 188 | Once the repository is added to the falcosecurity GitHub organization, it and its content will be owned and licensed by The Falco Project and will be subject to its [governance](GOVERNANCE.md). 189 | 190 | ### Change of Status or Scope 191 | 192 | Actively maintaining a repository might cause the evolution of its maturity, scope, and involvement, in The Falco Project. In those cases, the [Maintainers](GOVERNANCE.md#maintainers) of a given repository can propose changing its status by opening a GitHub issue in the [falcosecurity/evolution](https://github.com/falcosecurity/evolution) repository. The [Core Maintainers](GOVERNANCE.md#core-maintainers) will take into account the community feedback and decide on the proposal. 193 | 194 | For instance, this is the path by which projects can be promoted from *incubating* to *stable* status or demoted from *incubating* to *sandbox*. 195 | 196 | #### Archiviation 197 | 198 | Repositories showing little to no activity during the time span of a year can be proposed for [deprecation](#deprecated) by opening a GitHub [issue](https://github.com/falcosecurity/evolution/issues/new?labels=kind%2Fdeprecation&template=repo_deprecation_request.md). Once the proposal has been accepted, they can be archived. [Archived repositories](https://docs.github.com/en/repositories/archiving-a-github-repository/archiving-repositories) will remain inside the falcosecurity GitHub organization but will be read-only and will not be maintained. As such, OWNERS files contained in archived repositories are not valid. 199 | 200 | In some cases, a repository is archived to reserve its name for future use. 201 | 202 | #### Unarchiviation 203 | 204 | Archived repositories can be proposed for unarchiviation by opening a GitHub issue in the [falcosecurity/evolution](https://github.com/falcosecurity/evolution) repository. If the decision is to unarchive the repository, then it must be reviewed to make sure it respects the [criteria](#criteria), [owners](#owners), and [license](#license) points of this document. In general, the same rules as for new repositories apply. The new proposed owners are reviewed as described by the [MAINTAINERS_GUIDELINES.md](MAINTAINERS_GUIDELINES.md) and eventually accepted. 205 | 206 | ### Removal 207 | 208 | Repositories that show little relevance, are not maintained, or no longer have a purpose inside The Falco Project, can be proposed for removal by opening a GitHub issue in the [falcosecurity/evolution](https://github.com/falcosecurity/evolution) repository. Removed repositories will stop being maintained and will no longer be part of the falcosecurity GitHub organization. In such a case, one of the falcosecurity GitHub organization admins will assist the issue opener in transferring the repository to the [Falco Projects Retirement Home](https://github.com/falcosecurity-retire) GitHub organization and removing its configuration from [falcosecurity/test-infra](https://github.com/falcosecurity/test-infra). 209 | 210 | ### Core Maintainers duties and privileges 211 | 212 | Since [Core Maintainers](GOVERNANCE.md#core-maintainers) as a team are responsible for the maintenance of the falcosecurity GitHub organization, they consequently have the following reserved powers: 213 | - decide on assigning or removing the *core* status of a repository; 214 | - become maintainer of *special* repositories; 215 | - become maintainer (or take control over) non-functioning or abandoned repositories (i.e., repositories with less than two active maintainers or disputed ones); 216 | - be the last escalation point for repositories disputes. 217 | 218 | In all the above cases, [Core Maintainers](GOVERNANCE.md#core-maintainers) who volunteer to intervene must act with the spirit of serving the entire falcosecurity organization. 219 | -------------------------------------------------------------------------------- /deploy/README.md: -------------------------------------------------------------------------------- 1 | # Kubernetes Deployment Files for Falco 2 | 3 | ## Notice 4 | 5 | The content of this folder has been transferred to the [falcosecurity/deploy-kubernetes](https://github.com/falcosecurity/deploy-kubernetes) repository. -------------------------------------------------------------------------------- /img/pidgeotto.gif: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/falcosecurity/evolution/f13f3ff552310c354a71f3e96c9584835d30fbed/img/pidgeotto.gif -------------------------------------------------------------------------------- /maintainers.yaml: -------------------------------------------------------------------------------- 1 | # Do not edit this file manually. 2 | # Made using github.com/leodido/maintainers-generator on 2025-05-29T09:03:08 3 | - name: Ahmed Amin 4 | github: https://github.com/ahmedameenaim 5 | company: Zartis 6 | projects: 7 | - https://github.com/falcosecurity/plugins/tree/main/plugins/gcpaudit 8 | - name: Aldo Lacuku 9 | github: https://github.com/alacuku 10 | company: Sysdig 11 | projects: 12 | - https://github.com/falcosecurity/charts 13 | - https://github.com/falcosecurity/event-generator 14 | - https://github.com/falcosecurity/falco-operator 15 | - https://github.com/falcosecurity/falcoctl 16 | - https://github.com/falcosecurity/k8s-metacollector 17 | - https://github.com/falcosecurity/kernel-testing 18 | - https://github.com/falcosecurity/test-infra 19 | - name: Andrea Terzolo 20 | github: https://github.com/andreagit97 21 | company: SUSE 22 | projects: 23 | - https://github.com/falcosecurity/community 24 | - https://github.com/falcosecurity/elftoolchain 25 | - https://github.com/falcosecurity/falco 26 | - https://github.com/falcosecurity/k8s-metacollector 27 | - https://github.com/falcosecurity/kernel-testing 28 | - https://github.com/falcosecurity/libs 29 | - https://github.com/falcosecurity/libs-sdk-go 30 | - https://github.com/falcosecurity/plugin-sdk-rs 31 | - https://github.com/falcosecurity/rules 32 | - https://github.com/falcosecurity/syscalls-bumper 33 | - https://github.com/falcosecurity/testing 34 | - name: Angelo Puglisi 35 | github: https://github.com/deepskyblue86 36 | company: Sysdig 37 | projects: 38 | - https://github.com/falcosecurity/falco-rustlings 39 | - name: Aurélie Vache 40 | github: https://github.com/scraly 41 | company: OVHcloud 42 | projects: 43 | - https://github.com/falcosecurity/plugins/tree/main/plugins/k8saudit-ovh 44 | - name: Carlos Tadeu Panato Junior 45 | github: https://github.com/cpanato 46 | company: Chainguard 47 | projects: 48 | - https://github.com/falcosecurity/charts 49 | - https://github.com/falcosecurity/falco-actions 50 | - https://github.com/falcosecurity/falco-talon 51 | - https://github.com/falcosecurity/falcoctl 52 | - https://github.com/falcosecurity/falcosidekick 53 | - https://github.com/falcosecurity/falcosidekick-ui 54 | - name: David Windsor 55 | github: https://github.com/dwindsor 56 | company: Independent 57 | projects: 58 | - https://github.com/falcosecurity/driverkit 59 | - name: Edd Wilder-James 60 | github: https://github.com/ewilderj 61 | company: Independent 62 | projects: 63 | - https://github.com/falcosecurity/flycheck-falco-rules 64 | - name: Federico Di Pierro 65 | github: https://github.com/fededp 66 | company: Sysdig 67 | projects: 68 | - https://github.com/falcosecurity/dbg-go 69 | - https://github.com/falcosecurity/driverkit 70 | - https://github.com/falcosecurity/elftoolchain 71 | - https://github.com/falcosecurity/event-generator 72 | - https://github.com/falcosecurity/falco 73 | - https://github.com/falcosecurity/falco-operator 74 | - https://github.com/falcosecurity/falcoctl 75 | - https://github.com/falcosecurity/kernel-crawler 76 | - https://github.com/falcosecurity/kernel-testing 77 | - https://github.com/falcosecurity/libs 78 | - https://github.com/falcosecurity/peribolos-syncer 79 | - https://github.com/falcosecurity/pigeon 80 | - https://github.com/falcosecurity/plugin-sdk-cpp 81 | - https://github.com/falcosecurity/rules 82 | - https://github.com/falcosecurity/syscalls-bumper 83 | - https://github.com/falcosecurity/test-infra 84 | - name: Frank Jogeleit 85 | github: https://github.com/fjogeleit 86 | company: LOVOO 87 | projects: 88 | - https://github.com/falcosecurity/falcosidekick 89 | - https://github.com/falcosecurity/falcosidekick-ui 90 | - name: Fred Araujo 91 | github: https://github.com/araujof 92 | company: IBM 93 | projects: 94 | - https://github.com/falcosecurity/community 95 | - https://github.com/falcosecurity/libs-sdk-go 96 | - name: Gianmatteo Palmieri 97 | github: https://github.com/mrgian 98 | company: Sysdig 99 | projects: 100 | - https://github.com/falcosecurity/plugin-sdk-rs 101 | - name: Grzegorz Nosek 102 | github: https://github.com/gnosek 103 | company: Sysdig 104 | projects: 105 | - https://github.com/falcosecurity/elftoolchain 106 | - https://github.com/falcosecurity/falco-rustlings 107 | - https://github.com/falcosecurity/libs 108 | - https://github.com/falcosecurity/plugin-sdk-rs 109 | - name: Hendrik Brueckner 110 | github: https://github.com/hbrueckner 111 | company: IBM 112 | projects: 113 | - https://github.com/falcosecurity/libs/tree/master/driver 114 | - name: Igor Eulalio 115 | github: https://github.com/igoreulalio 116 | company: Sysdig 117 | projects: 118 | - https://github.com/falcosecurity/falco-talon 119 | - https://github.com/falcosecurity/plugins/tree/main/plugins/k8saudit-aks 120 | - name: Jason Dellaluce 121 | github: https://github.com/jasondellaluce 122 | company: Sysdig 123 | projects: 124 | - https://github.com/falcosecurity/.github 125 | - https://github.com/falcosecurity/contrib 126 | - https://github.com/falcosecurity/deploy-kubernetes 127 | - https://github.com/falcosecurity/elftoolchain 128 | - https://github.com/falcosecurity/evolution 129 | - https://github.com/falcosecurity/falco 130 | - https://github.com/falcosecurity/falco-aws-terraform 131 | - https://github.com/falcosecurity/falco-exporter 132 | - https://github.com/falcosecurity/falco-playground 133 | - https://github.com/falcosecurity/falco-website 134 | - https://github.com/falcosecurity/libs 135 | - https://github.com/falcosecurity/libs-sdk-go 136 | - https://github.com/falcosecurity/pigeon 137 | - https://github.com/falcosecurity/plugin-sdk-go 138 | - https://github.com/falcosecurity/plugins 139 | - https://github.com/falcosecurity/rules 140 | - https://github.com/falcosecurity/testing 141 | - name: Jonah Jones 142 | github: https://github.com/jonahjon 143 | company: Amazon 144 | projects: 145 | - https://github.com/falcosecurity/test-infra 146 | - name: Leonardo Di Donato 147 | github: https://github.com/leodido 148 | company: Independent 149 | projects: 150 | - https://github.com/falcosecurity/client-go 151 | - https://github.com/falcosecurity/driverkit 152 | - https://github.com/falcosecurity/plugin-sdk-cpp 153 | - name: Leonardo Di Giovanna 154 | github: https://github.com/ekoops 155 | company: Sysdig 156 | projects: 157 | - https://github.com/falcosecurity/event-generator 158 | - https://github.com/falcosecurity/plugin-sdk-rs 159 | - https://github.com/falcosecurity/plugins/tree/main/plugins/krsi 160 | - name: Leonardo Grasso 161 | github: https://github.com/leogr 162 | company: Sysdig 163 | projects: 164 | - https://github.com/falcosecurity/.github 165 | - https://github.com/falcosecurity/charts 166 | - https://github.com/falcosecurity/client-go 167 | - https://github.com/falcosecurity/cncf-green-review-testing 168 | - https://github.com/falcosecurity/community 169 | - https://github.com/falcosecurity/contrib 170 | - https://github.com/falcosecurity/dbg-go 171 | - https://github.com/falcosecurity/deploy-kubernetes 172 | - https://github.com/falcosecurity/elftoolchain 173 | - https://github.com/falcosecurity/event-generator 174 | - https://github.com/falcosecurity/evolution 175 | - https://github.com/falcosecurity/falco 176 | - https://github.com/falcosecurity/falco-actions 177 | - https://github.com/falcosecurity/falco-aws-terraform 178 | - https://github.com/falcosecurity/falco-exporter 179 | - https://github.com/falcosecurity/falco-operator 180 | - https://github.com/falcosecurity/falco-playground 181 | - https://github.com/falcosecurity/falco-talon 182 | - https://github.com/falcosecurity/falco-website 183 | - https://github.com/falcosecurity/falcoctl 184 | - https://github.com/falcosecurity/falcosidekick 185 | - https://github.com/falcosecurity/k8s-metacollector 186 | - https://github.com/falcosecurity/kernel-crawler 187 | - https://github.com/falcosecurity/libs 188 | - https://github.com/falcosecurity/libs-sdk-go 189 | - https://github.com/falcosecurity/peribolos-syncer 190 | - https://github.com/falcosecurity/plugin-sdk-cpp 191 | - https://github.com/falcosecurity/plugin-sdk-go 192 | - https://github.com/falcosecurity/plugins 193 | - https://github.com/falcosecurity/rules 194 | - https://github.com/falcosecurity/syscalls-bumper 195 | - https://github.com/falcosecurity/test-infra 196 | - https://github.com/falcosecurity/testing 197 | - name: Logan Bond 198 | github: https://github.com/exoner4ted 199 | company: Secureworks 200 | projects: 201 | - https://github.com/falcosecurity/driverkit 202 | - https://github.com/falcosecurity/kernel-crawler 203 | - name: Lorenzo Susini 204 | github: https://github.com/loresuso 205 | company: Sysdig 206 | projects: 207 | - https://github.com/falcosecurity/falco-actions 208 | - https://github.com/falcosecurity/falcoctl 209 | - https://github.com/falcosecurity/rules/tree/main/rules 210 | - name: Loris Degioianni 211 | github: https://github.com/ldegio 212 | company: Sysdig 213 | projects: 214 | - https://github.com/falcosecurity/falco-aws-terraform 215 | - https://github.com/falcosecurity/plugin-sdk-cpp 216 | - name: Luca Guerra 217 | github: https://github.com/lucaguerra 218 | company: Sysdig 219 | projects: 220 | - https://github.com/falcosecurity/.github 221 | - https://github.com/falcosecurity/cncf-green-review-testing 222 | - https://github.com/falcosecurity/driverkit 223 | - https://github.com/falcosecurity/elftoolchain 224 | - https://github.com/falcosecurity/evolution 225 | - https://github.com/falcosecurity/falco 226 | - https://github.com/falcosecurity/falco-rustlings 227 | - https://github.com/falcosecurity/falco-website 228 | - https://github.com/falcosecurity/libs 229 | - https://github.com/falcosecurity/plugins 230 | - https://github.com/falcosecurity/rules 231 | - https://github.com/falcosecurity/test-infra 232 | - https://github.com/falcosecurity/testing 233 | - name: Lyonel Martinez 234 | github: https://github.com/lowaiz 235 | company: Numberly 236 | projects: 237 | - https://github.com/falcosecurity/driverkit 238 | - name: Mark Stemm 239 | github: https://github.com/mstemm 240 | company: Sysdig 241 | projects: 242 | - https://github.com/falcosecurity/elftoolchain 243 | - https://github.com/falcosecurity/falco 244 | - https://github.com/falcosecurity/falco-aws-terraform 245 | - https://github.com/falcosecurity/flycheck-falco-rules 246 | - https://github.com/falcosecurity/libs 247 | - https://github.com/falcosecurity/plugin-sdk-cpp 248 | - https://github.com/falcosecurity/plugins 249 | - https://github.com/falcosecurity/rules 250 | - name: Massimiliano Giovagnoli 251 | github: https://github.com/maxgio92 252 | company: Chainguard 253 | projects: 254 | - https://github.com/falcosecurity/.github 255 | - https://github.com/falcosecurity/cncf-green-review-testing 256 | - https://github.com/falcosecurity/community 257 | - https://github.com/falcosecurity/contrib 258 | - https://github.com/falcosecurity/dbg-go 259 | - https://github.com/falcosecurity/deploy-kubernetes 260 | - https://github.com/falcosecurity/evolution 261 | - https://github.com/falcosecurity/falcoctl 262 | - https://github.com/falcosecurity/kernel-crawler 263 | - https://github.com/falcosecurity/peribolos-syncer 264 | - https://github.com/falcosecurity/test-infra 265 | - name: Mauro Ezequiel Moltrasio 266 | github: https://github.com/molter73 267 | company: RedHat 268 | projects: 269 | - https://github.com/falcosecurity/elftoolchain 270 | - https://github.com/falcosecurity/libs 271 | - name: Melissa Kilby 272 | github: https://github.com/incertum 273 | company: Apple 274 | projects: 275 | - https://github.com/falcosecurity/cncf-green-review-testing 276 | - https://github.com/falcosecurity/elftoolchain 277 | - https://github.com/falcosecurity/falco 278 | - https://github.com/falcosecurity/libs 279 | - https://github.com/falcosecurity/rules 280 | - name: Michele Zuccala 281 | github: https://github.com/zuc 282 | company: Sysdig 283 | projects: 284 | - https://github.com/falcosecurity/deploy-kubernetes 285 | - https://github.com/falcosecurity/falco-aws-terraform 286 | - https://github.com/falcosecurity/falcoctl 287 | - https://github.com/falcosecurity/kernel-crawler 288 | - https://github.com/falcosecurity/test-infra 289 | - name: Nedim Sabic Sabic 290 | github: https://github.com/rabbitstack 291 | company: Sysdig 292 | projects: 293 | - https://github.com/falcosecurity/falco-rustlings 294 | - name: Roberto Scolaro 295 | github: https://github.com/therealbobo 296 | company: Sysdig 297 | projects: 298 | - https://github.com/falcosecurity/kernel-testing 299 | - name: Rohith Raju 300 | github: https://github.com/rohith-raju 301 | company: Independent 302 | projects: 303 | - https://github.com/falcosecurity/falco-playground 304 | - name: Samuel Gaist 305 | github: https://github.com/sgaist 306 | company: Idiap Research Institute 307 | projects: 308 | - https://github.com/falcosecurity/falco 309 | - name: Samuele Cappellin 310 | github: https://github.com/cappellinsamuele 311 | company: Ca' Foscari University of Venice 312 | projects: 313 | - https://github.com/falcosecurity/pigeon 314 | - name: Stefano Chierici 315 | github: https://github.com/darryk10 316 | company: Sysdig 317 | projects: 318 | - https://github.com/falcosecurity/falco-actions 319 | - https://github.com/falcosecurity/rules/tree/main/rules 320 | - name: Sverre Boschman 321 | github: https://github.com/sboschman 322 | company: Topicus.Education 323 | projects: 324 | - https://github.com/falcosecurity/plugins/tree/main/plugins/k8saudit-gke 325 | - name: Teryl Taylor 326 | github: https://github.com/terylt 327 | company: IBM 328 | projects: 329 | - https://github.com/falcosecurity/community 330 | - https://github.com/falcosecurity/libs-sdk-go 331 | - name: Thomas Labarussias 332 | github: https://github.com/issif 333 | company: Sysdig 334 | projects: 335 | - https://github.com/falcosecurity/charts 336 | - https://github.com/falcosecurity/community 337 | - https://github.com/falcosecurity/falco-talon 338 | - https://github.com/falcosecurity/falco-website 339 | - https://github.com/falcosecurity/falcosidekick 340 | - https://github.com/falcosecurity/falcosidekick-ui 341 | - https://github.com/falcosecurity/k8s-metacollector 342 | - https://github.com/falcosecurity/plugins/tree/main/plugins/k8saudit-aks 343 | - https://github.com/falcosecurity/plugins/tree/main/plugins/k8saudit-eks 344 | - https://github.com/falcosecurity/plugins/tree/main/plugins/k8saudit-ovh 345 | - https://github.com/falcosecurity/plugins/tree/main/plugins/okta 346 | - name: Vicente Javier Jiménez Miras 347 | github: https://github.com/vjjmiras 348 | company: Independent 349 | projects: 350 | - https://github.com/falcosecurity/falco-website/tree/master/content 351 | - https://github.com/falcosecurity/falco-website/tree/master/layouts 352 | -------------------------------------------------------------------------------- /people/affiliations.json: -------------------------------------------------------------------------------- 1 | { 2 | "leodido": { 3 | "name": "Leonardo Di Donato", 4 | "company": "Independent" 5 | }, 6 | "fntlnz": { 7 | "name": "Lorenzo Fontana", 8 | "company": "Independent" 9 | }, 10 | "leogr": { 11 | "name": "Leonardo Grasso", 12 | "company": "Sysdig" 13 | }, 14 | "issif": { 15 | "name": "Thomas Labarussias", 16 | "company": "Sysdig" 17 | }, 18 | "cpanato": { 19 | "name": "Carlos Tadeu Panato Junior", 20 | "company": "Chainguard" 21 | }, 22 | "nibalizer": { 23 | "name": "Spencer Krum", 24 | "company": "OctoML" 25 | }, 26 | "ldegio": { 27 | "name": "Loris Degioianni", 28 | "company": "Sysdig" 29 | }, 30 | "jonahjon": { 31 | "name": "Jonah Jones", 32 | "company": "Amazon" 33 | }, 34 | "admiral0": { 35 | "name": "Radu Andries", 36 | "company": "Independent" 37 | }, 38 | "airadier": { 39 | "name": "Álvaro Iradier", 40 | "company": "Sysdig" 41 | }, 42 | "bencer": { 43 | "name": "Jorge Salamero Sanz", 44 | "company": "Sysdig" 45 | }, 46 | "gnosek": { 47 | "name": "Grzegorz Nosek", 48 | "company": "Sysdig" 49 | }, 50 | "kaizhe": { 51 | "name": "Kaizhe Huang", 52 | "company": "Aurora" 53 | }, 54 | "kris-nova": { 55 | "name": "Kris Nóva", 56 | "company": "Independent" 57 | }, 58 | "lucperkins": { 59 | "name": "Luc Perkins", 60 | "company": "Timber" 61 | }, 62 | "markyjackson-taulia": { 63 | "name": "Marky Jackson", 64 | "company": "Packet" 65 | }, 66 | "mumoshu": { 67 | "name": "Yusuke Kuoka", 68 | "company": "Z Lab" 69 | }, 70 | "maxgio92": { 71 | "name": "Massimiliano Giovagnoli", 72 | "company": "Chainguard" 73 | }, 74 | "mmat11": { 75 | "name": "Mattia Meleleo", 76 | "company": "Elastic" 77 | }, 78 | "mstemm": { 79 | "name": "Mark Stemm", 80 | "company": "Sysdig" 81 | }, 82 | "radhikapc": { 83 | "name": "Radhika Puthiyetath", 84 | "company": "Sysdig" 85 | }, 86 | "rajakavitha1": { 87 | "name": "Rajakavitha", 88 | "company": "Independent" 89 | }, 90 | "tembleking": { 91 | "name": "Fede Barcelona", 92 | "company": "Sysdig" 93 | }, 94 | "keisukeyamashita": { 95 | "name": "Keisuke Yamashita", 96 | "company": "Mercari" 97 | }, 98 | "mfdii": { 99 | "name": "Michael Ducy", 100 | "company": "RedHat" 101 | }, 102 | "fjogeleit": { 103 | "name": "Frank Jogeleit", 104 | "company": "LOVOO" 105 | }, 106 | "sreedaum": { 107 | "name": "Sreeda U M", 108 | "company": "Independent" 109 | }, 110 | "pabloopez": { 111 | "name": "Pablo Zaldivar", 112 | "company": "Sysdig" 113 | }, 114 | "jasondellaluce": { 115 | "name": "Jason Dellaluce", 116 | "company": "Sysdig" 117 | }, 118 | "fededp": { 119 | "name": "Federico Di Pierro", 120 | "company": "Sysdig" 121 | }, 122 | "andreagit97": { 123 | "name": "Andrea Terzolo", 124 | "company": "SUSE" 125 | }, 126 | "araujof": { 127 | "name": "Fred Araujo", 128 | "company": "IBM" 129 | }, 130 | "dwindsor": { 131 | "name": "David Windsor", 132 | "company": "Independent" 133 | }, 134 | "terylt": { 135 | "name": "Teryl Taylor", 136 | "company": "IBM" 137 | }, 138 | "zuc": { 139 | "name": "Michele Zuccala", 140 | "company": "Sysdig" 141 | }, 142 | "molter73": { 143 | "name": "Mauro Ezequiel Moltrasio", 144 | "company": "RedHat" 145 | }, 146 | "lucaguerra": { 147 | "name": "Luca Guerra", 148 | "company": "Sysdig" 149 | }, 150 | "exoner4ted": { 151 | "name": "Logan Bond", 152 | "company": "Secureworks" 153 | }, 154 | "hbrueckner": { 155 | "name": "Hendrik Brueckner", 156 | "company": "IBM" 157 | }, 158 | "vjjmiras": { 159 | "name": "Vicente Javier Jiménez Miras", 160 | "company": "Independent" 161 | }, 162 | "incertum": { 163 | "name": "Melissa Kilby", 164 | "company": "Apple" 165 | }, 166 | "ewilderj": { 167 | "name": "Edd Wilder-James", 168 | "company": "Independent" 169 | }, 170 | "cappellinsamuele": { 171 | "name": "Samuele Cappellin", 172 | "company": "Ca' Foscari University of Venice" 173 | }, 174 | "lowaiz": { 175 | "name": "Lyonel Martinez", 176 | "company": "Numberly" 177 | }, 178 | "ahmedameenaim": { 179 | "name": "Ahmed Amin", 180 | "company": "Zartis" 181 | }, 182 | "alacuku": { 183 | "name": "Aldo Lacuku", 184 | "company": "Sysdig" 185 | }, 186 | "rohith-raju": { 187 | "name": "Rohith Raju", 188 | "company": "Independent" 189 | }, 190 | "therealbobo": { 191 | "name": "Roberto Scolaro", 192 | "company": "Sysdig" 193 | }, 194 | "sboschman": { 195 | "name": "Sverre Boschman", 196 | "company": "Topicus.Education" 197 | }, 198 | "darryk10": { 199 | "name": "Stefano Chierici", 200 | "company": "Sysdig" 201 | }, 202 | "loresuso": { 203 | "name": "Lorenzo Susini", 204 | "company": "Sysdig" 205 | }, 206 | "sgaist": { 207 | "name": "Samuel Gaist", 208 | "company": "Idiap Research Institute" 209 | }, 210 | "mrgian": { 211 | "name": "Gianmatteo Palmieri", 212 | "company": "Sysdig" 213 | }, 214 | "igoreulalio": { 215 | "name": "Igor Eulalio", 216 | "company": "Sysdig" 217 | }, 218 | "scraly": { 219 | "name": "Aurélie Vache", 220 | "company": "OVHcloud" 221 | }, 222 | "deepskyblue86": { 223 | "name": "Angelo Puglisi", 224 | "company": "Sysdig" 225 | }, 226 | "rabbitstack": { 227 | "name": "Nedim Sabic Sabic", 228 | "company": "Sysdig" 229 | }, 230 | "ekoops": { 231 | "name": "Leonardo Di Giovanna", 232 | "company": "Sysdig" 233 | } 234 | } 235 | -------------------------------------------------------------------------------- /repos/badges/README.md: -------------------------------------------------------------------------------- 1 | # Badges for repositories 2 | 3 | See [REPOSITORY.md](../../REPOSITORIES.md) for more information. 4 | 5 | ## Scope 6 | 7 | 17 | 18 | 19 | | Scopes | 20 | | --- | 21 | | [![Falco Core Repository](https://github.com/falcosecurity/evolution/blob/main/repos/badges/falco-core-blue.svg)](https://github.com/falcosecurity/evolution/blob/main/REPOSITORIES.md#core-scope) | 22 | | [![Falco Ecosystem Repository](https://github.com/falcosecurity/evolution/blob/main/repos/badges/falco-ecosystem-blue.svg)](https://github.com/falcosecurity/evolution/blob/main/REPOSITORIES.md#ecosystem-scope) | 23 | | [![Falco Infra Repository](https://github.com/falcosecurity/evolution/blob/main/repos/badges/falco-infra-blue.svg)](https://github.com/falcosecurity/evolution/blob/main/REPOSITORIES.md#infra-scope) | 24 | 25 | 26 | ## Status 27 | 28 | | Statuses | 29 | | --- | 30 | | [![Stable](https://img.shields.io/badge/status-stable-brightgreen?style=for-the-badge)](https://github.com/falcosecurity/evolution/blob/main/REPOSITORIES.md#stable) | 31 | | [![Incubating](https://img.shields.io/badge/status-incubating-orange?style=for-the-badge)](https://github.com/falcosecurity/evolution/blob/main/REPOSITORIES.md#incubating) | 32 | | [![Sandbox](https://img.shields.io/badge/status-sandbox-red?style=for-the-badge)](https://github.com/falcosecurity/evolution/blob/main/REPOSITORIES.md#sandbox) | 33 | | [![Deprecated](https://img.shields.io/badge/status-deprecated-inactive?style=for-the-badge)](https://github.com/falcosecurity/evolution/blob/main/REPOSITORIES.md#deprecated) | 34 | -------------------------------------------------------------------------------- /repos/badges/falco-core-blue.svg: -------------------------------------------------------------------------------- 1 | 2 | 3 | FALCO: CORE 4 | 5 | 6 | 7 | 8 | 9 | 10 | 11 | 12 | FALCO 13 | 14 | 15 | CORE 16 | 17 | 18 | 19 | -------------------------------------------------------------------------------- /repos/badges/falco-ecosystem-blue.svg: -------------------------------------------------------------------------------- 1 | 2 | 3 | FALCO: ECOSYSTEM 4 | 5 | 6 | 7 | 8 | 9 | 10 | 11 | 12 | FALCO 13 | 14 | 15 | ECOSYSTEM 16 | 17 | 18 | 19 | -------------------------------------------------------------------------------- /repos/badges/falco-infra-blue.svg: -------------------------------------------------------------------------------- 1 | 2 | 3 | FALCO: INFRA 4 | 5 | 6 | 7 | 8 | 9 | 10 | 11 | 12 | FALCO 13 | 14 | 15 | INFRA 16 | 17 | 18 | 19 | -------------------------------------------------------------------------------- /repositories.yaml: -------------------------------------------------------------------------------- 1 | - name: .github 2 | scope: Special 3 | description: Default files for all repos in the Falcosecurity GitHub org. 4 | - name: charts 5 | scope: Core 6 | status: Stable 7 | description: Helm charts repository for Falco and its ecosystem. 8 | - name: client-go 9 | scope: Ecosystem 10 | status: Incubating 11 | description: Go client and SDK for Falco. 12 | - name: cncf-green-review-testing 13 | scope: Infra 14 | status: Sandbox 15 | description: Falco configurations intended for testing with the CNCF Green Reviews Working Group. 16 | - name: community 17 | scope: Special 18 | description: Falco community content and resources. 19 | - name: contrib 20 | scope: Ecosystem 21 | status: Sandbox 22 | description: Sandbox repository to test-drive ideas/projects/code. 23 | - name: dbg-go 24 | scope: Infra 25 | status: Incubating 26 | description: "A go tool to work with falcosecurity drivers build grid." 27 | - name: deploy-kubernetes 28 | scope: Core 29 | status: Stable 30 | description: Kubernetes deployment resources for Falco and its ecosystem. 31 | - name: driverkit 32 | scope: Ecosystem 33 | status: Incubating 34 | description: "Kit for building Falco drivers (kernel modules or eBPF probes)." 35 | - name: elftoolchain 36 | scope: Special 37 | description: "Local version of https://sourceforge.net/projects/elftoolchain/" 38 | - name: event-generator 39 | scope: Ecosystem 40 | status: Incubating 41 | description: Testing tool to generate a variety of suspect actions that are detected by Falco rules. 42 | - name: evolution 43 | scope: Special 44 | description: A space for the community to work together, discuss ideas, define processes, and document the evolution of Falco. 45 | - name: falco 46 | scope: Core 47 | status: Stable 48 | description: Falco is a cloud native runtime security tool for Linux operating systems. It is designed to detect and alert on abnormal behavior and potential security threats in real-time. 49 | - name: falco-exporter 50 | scope: Ecosystem 51 | status: Deprecated 52 | description: Prometheus Metrics Exporter for Falco output events. 53 | - name: falco-aws-terraform 54 | scope: Ecosystem 55 | status: Incubating 56 | description: Terraform Module for Falco AWS Resources. 57 | - name: falco-website 58 | scope: Core 59 | status: Stable 60 | description: Falco website and documentation repository. 61 | - name: falcoctl 62 | scope: Core 63 | status: Stable 64 | description: The official CLI tool for working with Falco and its ecosystem components. 65 | - name: falcosidekick 66 | scope: Ecosystem 67 | status: Stable 68 | description: Falcosidekick seamlessly integrates Falco with your ecosystem, enabling event forwarding to multiple outputs in a fan-out manner. 69 | - name: falcosidekick-ui 70 | scope: Ecosystem 71 | status: Incubating 72 | description: A simple WebUI with latest events from Falco. 73 | - name: flycheck-falco-rules 74 | scope: Ecosystem 75 | status: Incubating 76 | description: A custom checker for Falco rules files that can be loaded using the Flycheck syntax checker for GNU Emacs. 77 | - name: kernel-crawler 78 | scope: Infra 79 | status: Incubating 80 | description: A tool to crawl Linux kernel versions. 81 | - name: libs 82 | scope: Core 83 | status: Stable 84 | description: Foundational libraries that constitute the core of Falco's functionality, offering essential features including kernel drivers and eBPF probes. 85 | - name: libs-sdk-go 86 | scope: Ecosystem 87 | status: Sandbox 88 | description: Go SDK for Falco libs. 89 | - name: pigeon 90 | scope: Infra 91 | status: Incubating 92 | description: Secrets and config manager for Falco's infrastructure. 93 | - name: plugin-sdk-cpp 94 | scope: Ecosystem 95 | status: Incubating 96 | description: Falco plugins SDK for C++. 97 | - name: plugin-sdk-go 98 | scope: Core 99 | status: Stable 100 | description: Plugins SDK for Go that facilitates writing plugins for Falco or applications built on top of Falco's libs. 101 | - name: plugins 102 | scope: Core 103 | status: Stable 104 | description: Plugins serve as extensions for Falco and applications built on top of Falco's libraries. This repository contains the official registry for all Falco plugins and host plugins maintained by The Falco Project. 105 | - name: rules 106 | scope: Core 107 | status: Stable 108 | description: Official rulesets for Falco provide pre-defined detection rules for various security threats and abnormal behaviors. 109 | - name: test-infra 110 | scope: Infra 111 | status: Stable 112 | description: Test infrastructure and automation workflows for The Falco Project. 113 | - name: testing 114 | scope: Infra 115 | status: Incubating 116 | description: All-purpose test suite for Falco and its ecosystem. 117 | - name: syscalls-bumper 118 | scope: Infra 119 | status: Incubating 120 | description: A tool to automatically update supported syscalls in libs. 121 | - name: kernel-testing 122 | scope: Infra 123 | status: Incubating 124 | description: Ansible playbooks to provision firecracker VMs and run Falco kernel tests. 125 | - name: falco-playground 126 | scope: Infra 127 | status: Sandbox 128 | description: falco-playground is a web application used to validate Falco rules and test against scap files. 129 | - name: k8s-metacollector 130 | scope: Ecosystem 131 | status: Incubating 132 | description: Fetches the metadata from kubernetes API server and dispatches them to Falco instances. 133 | - name: falco-talon 134 | scope: Ecosystem 135 | status: Incubating 136 | description: Response Engine for managing threats in your Kubernetes. 137 | - name: plugin-sdk-rs 138 | scope: Ecosystem 139 | status: Incubating 140 | description: Falco plugins SDK for Rust. 141 | - name: falco-actions 142 | scope: Ecosystem 143 | status: Sandbox 144 | description: Run Falco in a GitHub Actions to detect suspicious behavior in your CI/CD. 145 | - name: falco-rustlings 146 | scope: Ecosystem 147 | status: Sandbox 148 | description: Small exercises to get you used to writing Falco plugins in Rust. 149 | - name: falco-operator 150 | scope: Ecosystem 151 | status: Incubating 152 | description: Kubernetes Operator for Falco. 153 | -------------------------------------------------------------------------------- /utils/.gitignore: -------------------------------------------------------------------------------- 1 | bin -------------------------------------------------------------------------------- /utils/Makefile: -------------------------------------------------------------------------------- 1 | # SPDX-License-Identifier: Apache-2.0 2 | # 3 | # Copyright (C) 2023 The Falco Authors. 4 | # 5 | # Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with 6 | # the License. You may obtain a copy of the License at 7 | # 8 | # http://www.apache.org/licenses/LICENSE-2.0 9 | # 10 | # Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an 11 | # "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the 12 | # specific language governing permissions and limitations under the License. 13 | # 14 | 15 | SHELL=/bin/bash -o pipefail 16 | 17 | GO ?= go 18 | 19 | all: bin/utils 20 | 21 | clean: 22 | @rm -fr bin 23 | 24 | bin/utils: 25 | @mkdir -p bin 26 | @$(GO) build -o bin/utils ./cmd/... 27 | -------------------------------------------------------------------------------- /utils/cmd/maintainers.go: -------------------------------------------------------------------------------- 1 | // SPDX-License-Identifier: Apache-2.0 2 | /* 3 | Copyright (C) 2023 The Falco Authors. 4 | 5 | Licensed under the Apache License, Version 2.0 (the "License"); 6 | you may not use this file except in compliance with the License. 7 | You may obtain a copy of the License at 8 | 9 | http://www.apache.org/licenses/LICENSE-2.0 10 | 11 | Unless required by applicable law or agreed to in writing, software 12 | distributed under the License is distributed on an "AS IS" BASIS, 13 | WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. 14 | See the License for the specific language governing permissions and 15 | limitations under the License. 16 | */ 17 | 18 | package main 19 | 20 | import ( 21 | "fmt" 22 | "strings" 23 | 24 | "github.com/falcosecurity/evolution/utils/pkg/utils" 25 | "github.com/spf13/cobra" 26 | ) 27 | 28 | var ( 29 | maintainersReposFilePath string 30 | maintainersInFilePath string 31 | maintainersOutFilePath string 32 | maintainersTextStartTag = "\n" 33 | maintainersTextEndTag = "\n" 34 | maintainersTextCoreStartTag = "\n" 35 | maintainersTextCoreEndTag = "\n" 36 | ) 37 | 38 | func maintainersTextEditor(s string, core bool) (string, error) { 39 | startTag := maintainersTextStartTag 40 | endTag := maintainersTextEndTag 41 | if core { 42 | startTag = maintainersTextCoreStartTag 43 | endTag = maintainersTextCoreEndTag 44 | } 45 | if len(s) == 0 { 46 | s = startTag + endTag 47 | } 48 | 49 | maintainers, err := utils.ReadMaintainersFromFile(maintainersInFilePath) 50 | if err != nil { 51 | return "", err 52 | } 53 | repositories, err := utils.ReadRepositoriesFromFile(maintainersReposFilePath) 54 | if err != nil { 55 | return "", err 56 | } 57 | 58 | var list utils.Maintainers 59 | for _, m := range maintainers { 60 | added := false 61 | for _, r := range repositories { 62 | for _, url := range m.Projects { 63 | isCoreRepo := r.Scope == utils.RepositoryScopeCore 64 | isRepoMaintainer := url == r.URL() 65 | isSubDirMaintainer := strings.HasPrefix(url, r.URL()+"/") 66 | if isRepoMaintainer || isSubDirMaintainer { 67 | if !added && (!core || isCoreRepo && !isSubDirMaintainer) { 68 | list = append(list, m) 69 | added = true 70 | } 71 | } 72 | } 73 | } 74 | } 75 | 76 | var res strings.Builder 77 | for _, m := range list { 78 | res.WriteString(fmt.Sprintf("- [%s](%s), %s\n", m.Name, m.Github, m.Company)) 79 | } 80 | return utils.ReplaceTextTags(s, startTag, endTag, res.String()) 81 | } 82 | 83 | func maintainersTextEditorAll(s string) (string, error) { 84 | return maintainersTextEditor(s, false) 85 | } 86 | 87 | func maintainersTextEditorCore(s string) (string, error) { 88 | return maintainersTextEditor(s, true) 89 | } 90 | 91 | var maintainersCmd = &cobra.Command{ 92 | Use: "maintainers", 93 | Short: "Generate MAINTAINERS.md for falcosecurity/evolution", 94 | RunE: func(cmd *cobra.Command, args []string) error { 95 | if len(maintainersReposFilePath) == 0 { 96 | return fmt.Errorf("must specify a path to repositories.yaml") 97 | } 98 | if len(maintainersInFilePath) == 0 { 99 | return fmt.Errorf("must specify a path to maintainers.yaml") 100 | } 101 | if len(maintainersOutFilePath) == 0 { 102 | return fmt.Errorf("must specify an output markdown file") 103 | } 104 | return utils.EditCreateTextFile( 105 | maintainersOutFilePath, 106 | latestUpdateTextEditor, 107 | maintainersTextEditorCore, 108 | maintainersTextEditorAll, 109 | ) 110 | }, 111 | } 112 | 113 | func init() { 114 | maintainersCmd.Flags().StringVarP(&maintainersReposFilePath, "repositories", "r", "", "Path to a repositories.yaml file") 115 | maintainersCmd.Flags().StringVarP(&maintainersInFilePath, "maintainers", "m", "", "Path to a maintainers.yaml file") 116 | maintainersCmd.Flags().StringVarP(&maintainersOutFilePath, "output", "o", "", "Path to an output markdown file") 117 | } 118 | -------------------------------------------------------------------------------- /utils/cmd/readme.go: -------------------------------------------------------------------------------- 1 | // SPDX-License-Identifier: Apache-2.0 2 | /* 3 | Copyright (C) 2023 The Falco Authors. 4 | 5 | Licensed under the Apache License, Version 2.0 (the "License"); 6 | you may not use this file except in compliance with the License. 7 | You may obtain a copy of the License at 8 | 9 | http://www.apache.org/licenses/LICENSE-2.0 10 | 11 | Unless required by applicable law or agreed to in writing, software 12 | distributed under the License is distributed on an "AS IS" BASIS, 13 | WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. 14 | See the License for the specific language governing permissions and 15 | limitations under the License. 16 | */ 17 | 18 | package main 19 | 20 | import ( 21 | "bytes" 22 | "fmt" 23 | "strings" 24 | 25 | "github.com/falcosecurity/evolution/utils/pkg/utils" 26 | "github.com/olekukonko/tablewriter" 27 | "github.com/spf13/cobra" 28 | ) 29 | 30 | var ( 31 | readmeRepoFilePath string 32 | readmeOutFilePath string 33 | readmeTextStartTagFmt = "\n" 34 | readmeTextEndTagFmt = "\n" 35 | readmeStatusBadgeTpl = "[![%s](https://img.shields.io/badge/status-%s-%s?style=for-the-badge)](https://github.com/falcosecurity/evolution/blob/main/REPOSITORIES.md#%s)" 36 | readmeStatusBadgeColorMap = map[utils.RepositoryStatus]string{ 37 | utils.RepositoryStatusStable: "brightgreen", 38 | utils.RepositoryStatusIncubating: "orange", 39 | utils.RepositoryStatusSandbox: "red", 40 | utils.RepositoryStatusDeprecated: "inactive", 41 | } 42 | ) 43 | 44 | func readmeTextEditor(s string, status utils.RepositoryScope) (string, error) { 45 | startTag := fmt.Sprintf(readmeTextStartTagFmt, strings.ToUpper(status.String())) 46 | endTag := fmt.Sprintf(readmeTextEndTagFmt, strings.ToUpper(status.String())) 47 | if len(s) == 0 { 48 | s = startTag + endTag 49 | } 50 | repos, err := utils.ReadRepositoriesFromFile(readmeRepoFilePath) 51 | if err != nil { 52 | return "", err 53 | } 54 | 55 | var buf bytes.Buffer 56 | empty := true 57 | table := tablewriter.NewWriter(&buf) 58 | table.SetHeader([]string{"Name", "Status", "Description"}) 59 | table.SetBorders(tablewriter.Border{Left: true, Top: false, Right: true, Bottom: false}) 60 | table.SetCenterSeparator("|") 61 | table.SetRowSeparator("-") 62 | table.SetAutoWrapText(false) 63 | for _, r := range repos { 64 | if r.Scope == status { 65 | row := []string{} 66 | row = append(row, fmt.Sprintf("[falcosecurity/%s](https://github.com/falcosecurity/%s)", r.Name, r.Name)) 67 | row = append(row, readmePrintStatusBadge(r.Status)) 68 | row = append(row, r.Description) 69 | table.Append(row) 70 | empty = false 71 | } 72 | } 73 | if !empty { 74 | table.Render() 75 | } 76 | return utils.ReplaceTextTags(s, startTag, endTag, buf.String()) 77 | } 78 | 79 | func readmeTextEditorCore(s string) (string, error) { 80 | return readmeTextEditor(s, utils.RepositoryScopeCore) 81 | } 82 | 83 | func readmeTextEditorEcosystem(s string) (string, error) { 84 | return readmeTextEditor(s, utils.RepositoryScopeEcosystem) 85 | } 86 | 87 | func readmeTextEditorInfra(s string) (string, error) { 88 | return readmeTextEditor(s, utils.RepositoryScopeInfra) 89 | } 90 | 91 | func readmeTextEditorSpecial(s string) (string, error) { 92 | return readmeTextEditor(s, utils.RepositoryScopeSpecial) 93 | } 94 | 95 | func readmePrintStatusBadge(status utils.RepositoryStatus) string { 96 | s := status.String() 97 | 98 | if s == "" { 99 | return "*n/a*" 100 | } 101 | 102 | ls := strings.ToLower(s) 103 | 104 | return fmt.Sprintf(readmeStatusBadgeTpl, s, ls, readmeStatusBadgeColorMap[status], ls) 105 | } 106 | 107 | var readmeCmd = &cobra.Command{ 108 | Use: "readme", 109 | Short: "Generate README.md for falcosecurity/evolution", 110 | RunE: func(cmd *cobra.Command, args []string) error { 111 | if len(readmeRepoFilePath) == 0 { 112 | return fmt.Errorf("must specify a path to repositories.yaml") 113 | } 114 | if len(readmeOutFilePath) == 0 { 115 | return fmt.Errorf("must specify an output markdown file") 116 | } 117 | return utils.EditCreateTextFile( 118 | readmeOutFilePath, 119 | readmeTextEditorCore, 120 | readmeTextEditorEcosystem, 121 | readmeTextEditorInfra, 122 | readmeTextEditorSpecial, 123 | ) 124 | }, 125 | } 126 | 127 | func init() { 128 | readmeCmd.Flags().StringVarP(&readmeRepoFilePath, "repositories", "r", "", "Path to a repositories.yaml file") 129 | readmeCmd.Flags().StringVarP(&readmeOutFilePath, "output", "o", "", "Path to an output markdown file") 130 | } 131 | -------------------------------------------------------------------------------- /utils/cmd/utils.go: -------------------------------------------------------------------------------- 1 | // SPDX-License-Identifier: Apache-2.0 2 | /* 3 | Copyright (C) 2023 The Falco Authors. 4 | 5 | Licensed under the Apache License, Version 2.0 (the "License"); 6 | you may not use this file except in compliance with the License. 7 | You may obtain a copy of the License at 8 | 9 | http://www.apache.org/licenses/LICENSE-2.0 10 | 11 | Unless required by applicable law or agreed to in writing, software 12 | distributed under the License is distributed on an "AS IS" BASIS, 13 | WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. 14 | See the License for the specific language governing permissions and 15 | limitations under the License. 16 | */ 17 | 18 | package main 19 | 20 | import ( 21 | "fmt" 22 | "os" 23 | "time" 24 | 25 | "github.com/falcosecurity/evolution/utils/pkg/utils" 26 | "github.com/spf13/cobra" 27 | ) 28 | 29 | var ( 30 | latestUpdateTextStartTag = "" 31 | latestUpdateTextEndTag = "" 32 | ) 33 | 34 | var rootCmd = &cobra.Command{ 35 | Use: "utils", 36 | Short: "utils - CLI tool for managing falcosecurity/evolution", 37 | Run: func(c *cobra.Command, args []string) { 38 | c.Help() 39 | }, 40 | } 41 | 42 | func latestUpdateTextEditor(s string) (string, error) { 43 | if len(s) == 0 { 44 | s = latestUpdateTextStartTag + latestUpdateTextEndTag 45 | } 46 | 47 | str := time.Now().UTC().Format(time.RFC3339) 48 | return utils.ReplaceTextTags(s, latestUpdateTextStartTag, latestUpdateTextEndTag, str) 49 | } 50 | 51 | func main() { 52 | rootCmd.AddCommand(readmeCmd) 53 | rootCmd.AddCommand(maintainersCmd) 54 | if err := rootCmd.Execute(); err != nil { 55 | fmt.Fprintf(os.Stderr, "CLI error: %s\n", err) 56 | os.Exit(1) 57 | } 58 | } 59 | -------------------------------------------------------------------------------- /utils/go.mod: -------------------------------------------------------------------------------- 1 | module github.com/falcosecurity/evolution/utils 2 | 3 | go 1.13 4 | 5 | require ( 6 | github.com/olekukonko/tablewriter v0.0.5 7 | github.com/spf13/cobra v1.5.0 8 | gopkg.in/yaml.v2 v2.4.0 9 | ) 10 | -------------------------------------------------------------------------------- /utils/go.sum: -------------------------------------------------------------------------------- 1 | github.com/cpuguy83/go-md2man/v2 v2.0.2/go.mod h1:tgQtvFlXSQOSOSIRvRPT7W67SCa46tRHOmNcaadrF8o= 2 | github.com/falcosecurity/plugin-sdk-go v0.5.0 h1:BPHdVyzJGx0mILvHUJ13lO2H02ZgISlZ5luWwIWpG98= 3 | github.com/inconshreveable/mousetrap v1.0.0 h1:Z8tu5sraLXCXIcARxBp/8cbvlwVa7Z1NHg9XEKhtSvM= 4 | github.com/inconshreveable/mousetrap v1.0.0/go.mod h1:PxqpIevigyE2G7u3NXJIT2ANytuPF1OarO4DADm73n8= 5 | github.com/mattn/go-runewidth v0.0.9 h1:Lm995f3rfxdpd6TSmuVCHVb/QhupuXlYr8sCI/QdE+0= 6 | github.com/mattn/go-runewidth v0.0.9/go.mod h1:H031xJmbD/WCDINGzjvQ9THkh0rPKHF+m2gUSrubnMI= 7 | github.com/olekukonko/tablewriter v0.0.5 h1:P2Ga83D34wi1o9J6Wh1mRuqd4mF/x/lgBS7N7AbDhec= 8 | github.com/olekukonko/tablewriter v0.0.5/go.mod h1:hPp6KlRPjbx+hW8ykQs1w3UBbZlj6HuIJcUGPhkA7kY= 9 | github.com/russross/blackfriday/v2 v2.1.0/go.mod h1:+Rmxgy9KzJVeS9/2gXHxylqXiyQDYRxCVz55jmeOWTM= 10 | github.com/spf13/cobra v1.5.0 h1:X+jTBEBqF0bHN+9cSMgmfuvv2VHJ9ezmFNf9Y/XstYU= 11 | github.com/spf13/cobra v1.5.0/go.mod h1:dWXEIy2H428czQCjInthrTRUg7yKbok+2Qi/yBIJoUM= 12 | github.com/spf13/pflag v1.0.5 h1:iy+VFUOCP1a+8yFto/drg2CJ5u0yRoB7fZw3DKv/JXA= 13 | github.com/spf13/pflag v1.0.5/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg= 14 | gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0= 15 | gopkg.in/yaml.v2 v2.4.0 h1:D8xgwECY7CYvx+Y2n4sBz93Jn9JRvxdiyyo8CTfuKaY= 16 | gopkg.in/yaml.v2 v2.4.0/go.mod h1:RDklbk79AGWmwhnvt/jBztapEOGDOx6ZbXqjP6csGnQ= 17 | -------------------------------------------------------------------------------- /utils/pkg/utils/text.go: -------------------------------------------------------------------------------- 1 | // SPDX-License-Identifier: Apache-2.0 2 | /* 3 | Copyright (C) 2023 The Falco Authors. 4 | 5 | Licensed under the Apache License, Version 2.0 (the "License"); 6 | you may not use this file except in compliance with the License. 7 | You may obtain a copy of the License at 8 | 9 | http://www.apache.org/licenses/LICENSE-2.0 10 | 11 | Unless required by applicable law or agreed to in writing, software 12 | distributed under the License is distributed on an "AS IS" BASIS, 13 | WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. 14 | See the License for the specific language governing permissions and 15 | limitations under the License. 16 | */ 17 | 18 | package utils 19 | 20 | import ( 21 | "fmt" 22 | "io/ioutil" 23 | "os" 24 | "strings" 25 | ) 26 | 27 | type TextEditFunc func(string) (string, error) 28 | 29 | func ReplaceTextTags(text, startTag, endTag, replace string) (string, error) { 30 | start := 0 31 | for { 32 | start = strings.Index(text[start:], startTag) 33 | if start < 0 { 34 | return text, nil 35 | } 36 | start += len(startTag) 37 | end := strings.Index(text[start:], endTag) 38 | if end < 0 { 39 | return "", fmt.Errorf("can't find end tag: " + endTag) 40 | } 41 | end += start 42 | text = text[:start] + replace + text[end:] 43 | start += len(replace) + len(endTag) 44 | } 45 | } 46 | 47 | func EditTextFile(path string, editors ...TextEditFunc) error { 48 | bytes, err := ioutil.ReadFile(path) 49 | if err != nil { 50 | return err 51 | } 52 | edited := string(bytes) 53 | for _, e := range editors { 54 | edited, err = e(edited) 55 | if err != nil { 56 | return err 57 | } 58 | } 59 | return ioutil.WriteFile(path, ([]byte)(edited), 0) 60 | } 61 | 62 | func EditCreateTextFile(path string, editors ...TextEditFunc) error { 63 | err := EditTextFile(path, editors...) 64 | if err != nil && os.IsNotExist(err) { 65 | var f *os.File 66 | f, err = os.Create(path) 67 | if err == nil { 68 | err = f.Close() 69 | if err == nil { 70 | err = EditTextFile(path, editors...) 71 | } 72 | } 73 | } 74 | return err 75 | } 76 | -------------------------------------------------------------------------------- /utils/pkg/utils/types.go: -------------------------------------------------------------------------------- 1 | // SPDX-License-Identifier: Apache-2.0 2 | /* 3 | Copyright (C) 2023 The Falco Authors. 4 | 5 | Licensed under the Apache License, Version 2.0 (the "License"); 6 | you may not use this file except in compliance with the License. 7 | You may obtain a copy of the License at 8 | 9 | http://www.apache.org/licenses/LICENSE-2.0 10 | 11 | Unless required by applicable law or agreed to in writing, software 12 | distributed under the License is distributed on an "AS IS" BASIS, 13 | WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. 14 | See the License for the specific language governing permissions and 15 | limitations under the License. 16 | */ 17 | 18 | package utils 19 | 20 | import ( 21 | "fmt" 22 | "io/ioutil" 23 | 24 | "gopkg.in/yaml.v2" 25 | ) 26 | 27 | type Maintainer struct { 28 | Name string `yaml:"name"` 29 | Github string `yaml:"github"` 30 | Company string `yaml:"company"` 31 | Projects []string `yaml:"projects"` 32 | } 33 | 34 | type Maintainers []Maintainer 35 | 36 | type RepositoryScope string 37 | 38 | type RepositoryStatus string 39 | 40 | type Repository struct { 41 | Name string `yaml:"name"` 42 | Description string `yaml:"description,omitempty"` 43 | Scope RepositoryScope `yaml:"scope"` 44 | Status RepositoryStatus `yaml:"status,omitempty"` 45 | } 46 | 47 | type Repositories []Repository 48 | 49 | const ( 50 | RepositoryStatusStable RepositoryStatus = "Stable" 51 | RepositoryStatusIncubating RepositoryStatus = "Incubating" 52 | RepositoryStatusSandbox RepositoryStatus = "Sandbox" 53 | RepositoryStatusDeprecated RepositoryStatus = "Deprecated" 54 | ) 55 | 56 | const ( 57 | RepositoryScopeCore RepositoryScope = "Core" 58 | RepositoryScopeEcosystem RepositoryScope = "Ecosystem" 59 | RepositoryScopeInfra RepositoryScope = "Infra" 60 | RepositoryScopeSpecial RepositoryScope = "Special" 61 | ) 62 | 63 | func (r RepositoryStatus) String() string { 64 | return string(r) 65 | } 66 | 67 | func (r RepositoryScope) String() string { 68 | return string(r) 69 | } 70 | 71 | func (r *Repository) URL() string { 72 | return fmt.Sprintf("https://github.com/falcosecurity/%s", r.Name) 73 | } 74 | 75 | func readFromFile(path string, out interface{}) error { 76 | data, err := ioutil.ReadFile(path) 77 | if err != nil { 78 | return err 79 | } 80 | return yaml.Unmarshal(data, out) 81 | } 82 | 83 | func ReadRepositoriesFromFile(path string) (Repositories, error) { 84 | var res Repositories 85 | if err := readFromFile(path, &res); err != nil { 86 | return nil, err 87 | } 88 | return res, nil 89 | } 90 | 91 | func ReadMaintainersFromFile(path string) (Maintainers, error) { 92 | var res Maintainers 93 | if err := readFromFile(path, &res); err != nil { 94 | return nil, err 95 | } 96 | return res, nil 97 | } 98 | --------------------------------------------------------------------------------