CII Badge

[ssteinbach]

We need to meet the conditions of the CII Badge:

https://github.com/coreinfrastructure/best-practices-badge/blob/master/doc/criteria.md

The first task is to break this list down into a concrete check list.

Checklist from best practices.coreinsfrastructure.org site:
https://bestpractices.coreinfrastructure.org/en/projects/2288

To-do Items:

• Finish migration to Apache 2.0 License (floss_license, floss_license_osi)
• OpenTimelineIO must be https (sites_https)
• Process for vulnerability reporting OpenEXR for reference (vulnerability_report_process, vulnerability_report_private, vulnerability_report_response)
• Break non-C++ and Python code into other repos (warnings)
• Talk to Linux Foundation rep about getting a developer up on secure development knowledge (know_secure_design)

[jminor]

I updated our entry on the CII system. We are currently at 61%

https://bestpractices.coreinfrastructure.org/en/projects/2288

[jminor]

I'm splitting this issue into separate issues for each actionable step to help us make progress here.
For example:

• Static code analysis #1405
• Dynamic code analysis #1406
• Security vulnerability process #1407
• Address build-time warnings #1408