Security Tooling WG Archive Application

[GeauxJD]

This PR will require a TAC vote per the WG Lifecycle process.

The TAC will also need to advise on the following projects from this group, as they have not had representation in quarterly updates to the TAC since February 2026:

• bomctl
• Fuzz Introspector
• OpenBao
• Protobom
• SBOMit

Options include moving the projects to other working groups such as the proposed SBOM & Vex WG, Supply Chain Integrity WG, etc, or having the projects report directly to the TAC as SigStore does.

[karras]

Thanks @GeauxJD! On the OpenBao side, we'll use this opportunity to further discuss the matter in the upcoming August TSC call.

[gkunz]

I'd prefer finding new homes for the affected projects in new WGs instead of having them report directly to the TAC. The main benefit I see is that being part of a WG fosters intra-WG and cross-project conversations which in turn creates additional value and benefit to those projects. Of course this is subject to mutual agreement between the projects and WGs, i.e., not intending to force anything from the TAC's side (strongly suggesting maybe).

[steiza]

Thanks Jeff - I think there's a couple of things to sort out here:

1. Archiving the security tooling WG: this is pretty unambiguous to me, although I think we probably want a standalone security_tooling_wg_archived_stage.md instead of moving the security_tooling_wg_graduation_stage.md doc

2. As for where the projects reporting to the WG should go, I agree that we should work with them to find homes with other WGs. I think the TAC is stretched pretty thin at the moment to oversee additional projects.

[GeauxJD]

Thanks Jeff - I think there's a couple of things to sort out here:

1. Archiving the security tooling WG: this is pretty unambiguous to me, although I think we probably want a standalone security_tooling_wg_archived_stage.md instead of moving the security_tooling_wg_graduation_stage.md doc
2. As for where the projects reporting to the WG should go, I agree that we should work with them to find homes with other WGs. I think the TAC is stretched pretty thin at the moment to oversee additional projects.

Regarding moving the graduation doc, i was following the precedent from the Securing Critical Projects archiving which did the same: https://github.com/ossf/tac/pull/596/changes

[TracyRagan]

My suggestions:
Bomctl, SBOMit and Protobom could fit well into Supply Chain Integrity
Fuzz - possibly Best Practices
OpenBao maybe Orbit??? or TAC directly

[steiza]

LGTM - thanks!