Clarify Process of Projects with Sub Projects

[jkjell]

In the recent conversations regarding Health of the Notary V2 Project it has been cited:

CNCF projects have a rich history with sub-projects. The TOC is not making changes in this area. Sub-projects should have their maturity clearly documented in relation to the primary project, and not be assumed to be at the same maturity level.

Given the contents of Archiving.md make no reference to subprojects and states:

Open source projects have a lifecycle and there are times that projects become inactive due to a variety of reasons. There are also cases where a project may no longer want to be supported by the TOC, or the TOC may no longer wish to recommend the use of a project.

Additionally:

• Notary has not had a release in almost 5 years, since April of 2018 - v0.6.1
• Harbor has deprecated support for Notary
• Harbor's support was noted as a reason not to archive Notary

A significant proportion of adoption is through other projects like Harbor, which should ease the transition for end users.

• And that Notation has explicitly listed backwards compatibility with Notary as a non-goal.

Given the facts above regarding the main Notary project and the TOCs decision not to archive the project, In what conditions should a CNCF Project with Subprojects be archived (if at all)?

A precedent appears to have been established by Flux v1 which was explicitly put into maintenance mode on October of 2020 and continued releasing security releases until its final release Aug 30, 2022. This appears less applicable to a project that is no longer supporting its v1 release.

[jkjell]

While the above example calls out the process of Archival, there are equivalent gaps around how to handle Incubation and Graduation. It may be possible to address this in this existing issue. If a project is willing to implement a sub-project maturity model, different levels of due diligence could apply to these broader processes. For instance, if a project is interested in moving to Incubation but, has an emerging sub project, it would not make sense to do a complete security audit of that emerging sub project.

[jkjell]

This should be covered by a combination of #1014 and #1018