[policy] Add php-tuf/php-tuf to core governance — for experimental Automatic Updates & Project Browser modules

This should either be turned into a policy issue, or closed.

php-tuf/php-tuf has no purpose in core by itself; its only use is as a dependency of 📌 Add php-tuf/composer-integration to core dependencies and governance — for experimental Automatic Updates & Project Browser modules Needs work . It should be kept as an indirect dependency, rather than added directly to core. However, I would recommend keeping it as a direct dependency drupal/core-recommended.

I wonder if we should just merge this into 📌 Add php-tuf/composer-stager to core dependencies and governance — for experimental Automatic Updates & Project Browser modules Needs work since likely we'll want to do the same thing. I have the same general concerns as in #3331078-55: Add php-tuf/composer-stager to core dependencies and governance — for experimental Automatic Updates & Project Browser modules → here too.

In support of closing this and/or merging this, how about we close this and discuss the governance for the three aspects of php-tuf in one governance issue 📌 Governance for projects on Github Active ?

That sounds good to me - just mark as duplicate then?

OK. I am closing this as a duplicate of the issue in the Governance project, 📌 Governance for projects on Github Active . Let's continue the discussion over there.