Add criterion for support statements - NEW - OSPS-DO-13

[SecurityCRob]

new proposed criteria around support statements

[funnelfiasco]

This is pretty good overall, but there are a few changes I'd like to see before merging.

[funnelfiasco]

Approved, with a couple of nice-to-have comments.

[david-a-wheeler]

I support the need to document "level of support" in some way, I proposed changes to the implementation text.

I do worry about the word "support". When you're paying for software there's some implied level of support (not always achieved). Many may bristle at the term "support" at all when they're not being paid to do it. I can't think of a clearer word though. Suggestions welcome.

[funnelfiasco]

Many may bristle at the term "support" at all when they're not being paid to do it. I can't think of a clearer word though. Suggestions welcome.

"Maintenance" maybe? But I think "support" is well enough understood (and even used) by projects that don't offer paid support agreements that we can use the word. The people who bristle at the word "support" will probably have a similar reaction to this baseline anyway.

[david-a-wheeler]

Note: I'm told OASIS has a specification, but I doubt we want to mandate it.

Is there a widely-used convention for recording this?

[david-a-wheeler]

It might be interesting to look at https://endoflife.date e.g., https://endoflife.date/rails . I don't know anything about this group, but they seem potentially relevant.

[blkt]

This is breaking CI

Suggested change

	criteria: |
	criterion: |