After viewing the presentations and chatting with the Pyrsia team, I am more convinced than before that this is absolutely the direction CDF needs to explore. Delivery doesn't matter if what you are delivering is dangerous.

Thank you for this thorough proposal.
The project seems to me to be aligned to the CDF charter as a component that enables best practices for continues delivery.
From the CDF charter:

a) The purpose of the Foundation is to raise, budget and spend funds in support of various continuous delivery open source and standards projects, including infrastructure and support initiatives related thereto (each such project, a "Technical Project"). The governance of each Technical Project is as set forth in the applicable charter for each Technical Project.

As decided by the TOC meeting yesterday, we would like to start public voting for adding Project Pyrsia to the Continuous Delivery Foundation. If accepted, the project would join the CDF as an incubating project. All votes and comments will be welcome! Please cast your vote by July 29th, 10PM UTC. Vote in the pull request or here: https://lists.cd.foundation/g/cdf-toc/message/832

Pyrsia is a Decentralized Package Network. Pyrsia aims to secure the software supply chain of open-source dependencies by creating a system that secures open-source builds and distribution. As concluded by the TOC, the project fits the scope of the CDF which targets providing solutions and best practices for all aspects of software delivery.

References:

• Website: https://pyrsia.io/
• GitHub: https://github.com/pyrsia
• Project proposal: Project Pyrsia proposal to CDF #149. Text version
• Presentation at the Software Supply Chain SIG: https://www.youtube.com/watch?v=5SNKO8Fysbc . There was also a presentation at the TOC meeting, but unfortunately it was not recorded
• TOC Sponsors: Steve Taylor, Melissa McKay
• Individual committers: listed here
• Company contributors: JFrog, Docker, DeployHub, Huawei, Oracle
• Twitter: https://twitter.com/PyrsiaOSS

For more information about the CDF project lifecycle and membership requirements, see this page. Thanks a lot to Steve and Melissa for driving this proposal in the TOC!

+1 nb

Interesting to see CDF considering conventions for artifact and package management, that's an area ripe for rationalization. Relatedly there was a PackagingCon in November sponsored by NumFOCUS which brought together lots of players in the package management ecosystem, that may provide some momentum.