The coreboot project has used different methods of governance at different times. It was called a meritocracy at some times in the past, basically saying that the people who did the work got to make the decisions. At other times, it was led with a light touch by Stefan Reinauer who was considered the BDFL (Benevolent Dictator for Life). Stefan owns the coreboot trademark and the coreboot.org domain name. He has owned or paid for the main coreboot server for many years now.
Currently, the coreboot project leadership is bound to the agreement made with the Software Freedom Conservancy when the coreboot project joined the SFC. The leadership is made up of a minimum of three individuals, none of whom may work for the same company. The members of the current board may, by majority vote, remove current members and add new members.
The leadership board was created to make decisions about the direction, implementation, budget, and day-to-day management of the coreboot project. The general policy is to keep a light touch on the activities of the coreboot project. The belief is that the people of the coreboot project, many of whom have been involved for one or two decades, know how the project should be run.
As of 2023-10-18, the coreboot leadership board consists of Werner Zeh, David Hendricks, and Matt DeVillier.
Previous members were Stefan Reinauer and Marc Jones.
In addition to these three members of the leadership board, above, who are ultimately responsible for making decisions, there is a general advisory committee made up of any individuals who wish to help out and discuss their thoughts with the leadership board. This is done at bi-weekly meetings, which all members of the project are invited to attend and contribute.
Core attendees to the leadership meetings over the past several years include:
In addition to the leadership team, another group with a significant role in the coreboot project are the admin team who keep all of the infrastructure for coreboot running. Because coreboot started so long ago, before things like github, the coreboot infrastructure is all completely owned (or rented) and managed by the coreboot project.
The current coreboot infrastructure admin team is:
The arbitration team handles code-of-conduct violations and any other grievances of the coreboot community. There is no email alias for this group so that there's no question of who is included in emails when they are sent.
Our arbitration team consists of the following people:
The release team handles the packaging and announcements of the quarterly coreboot releases. This is a weeks-long process of testing, documenting significant changes, updating test images, and clean-up. Because a quarterly time frame is a reasonable schedule for ongoing maintenance of the project, many of those tasks have been taken over by this team as well.
This team consists of:
The security response team monitors and responds to issues on the coreboot security mailing list. They can then reach out to others based on the issue brought up on the list.
Current members are:
Three other very important groups are the project members who take the time to review everyone's code and those who do a final inspection before merging patches into the tree. These people are the body of the coreboot project and are vital to its success.
Maintainers are the individuals who have signed up to be responsible for certain sections of code or other responsibilities.
Core Developers are those people who have put a significant amount of time into the project. Those who have shown that they have a good understanding of coreboot internals, and are committed to help drive the project forward. These people are the ones who are trusted to actually merge everyone's patches to the coreboot main branch.
The Reviewers list is made up of people who have submitted a few patches to coreboot. These people have the right to look at other people's patches and decide whether they think the patch is good enough to submit. They cannot actually do the merge process themselves, but marking a patch as +2 is the first step to getting it submitted.
Note: The Core Developers and Reviewers links only work for registered coreboot gerrit users who are signed into their accounts.