feat(site): add /terms section (MSA, OpenCache terms, SLA, subprocessors, privacy)

.github/workflows/sign-terms.yml

@@ -0,0 +1,87 @@
+name: Sign terms
+
+# Signs the legal documents in terms/ with Sigstore (keyless, using this
+# workflow's GitHub OIDC identity) whenever they change on master, and
+# publishes the signed copy as a GitHub release. Anyone can then check that
+# a document matches what P Foundation published, without trusting a key.
+
+on:
+  push:
+    branches:
+      - master
+    paths:
+      - 'terms/**'
+  # Re-sign the current master manually, for example after a failed run.
+  workflow_dispatch:
+
+concurrency:
+  group: sign-terms
+  cancel-in-progress: false
+
+jobs:
+  sign:
+    name: Sign and publish terms
+    # Never sign from another branch, even when dispatched manually.
+    if: github.ref == 'refs/heads/master'
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write # create the tag and release
+      id-token: write # request the OIDC token Sigstore signs with
+
+    env:
+      IDENTITY: https://github.com/${{ github.repository }}/.github/workflows/sign-terms.yml@refs/heads/master
+      ISSUER: https://token.actions.githubusercontent.com
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v5
+        with:
+          persist-credentials: false
+
+      - name: Install Cosign
+        uses: sigstore/cosign-installer@v4.0.0
+
+      - name: Collect documents and checksums
+        run: |
+          mkdir dist
+          cp terms/*.md dist/
+          (cd dist && sha256sum *.md > SHA256SUMS)
+          cat dist/SHA256SUMS
+
+      - name: Sign checksums
+        run: cosign sign-blob dist/SHA256SUMS --bundle dist/SHA256SUMS.sigstore.json --yes
+
+      - name: Verify signature
+        run: |
+          cosign verify-blob dist/SHA256SUMS \
+            --bundle dist/SHA256SUMS.sigstore.json \
+            --certificate-identity "$IDENTITY" \
+            --certificate-oidc-issuer "$ISSUER"
+
+      - name: Publish release
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          tag="terms-$(date -u +%Y-%m-%d)-${GITHUB_SHA::7}"
+          cat > notes.md <<EOF
+          Signed copy of the P Foundation terms and policies at commit ${GITHUB_SHA}.
+
+          To verify, download \`SHA256SUMS\`, \`SHA256SUMS.sigstore.json\` and the documents, then run:
+
+          \`\`\`sh
+          cosign verify-blob SHA256SUMS \\
+            --bundle SHA256SUMS.sigstore.json \\
+            --certificate-identity ${IDENTITY} \\
+            --certificate-oidc-issuer ${ISSUER}
+          sha256sum -c SHA256SUMS
+          \`\`\`
+          EOF
+          if gh release view "$tag" > /dev/null 2>&1; then
+            gh release upload "$tag" dist/* --clobber
+          else
+            gh release create "$tag" dist/* \
+              --target "$GITHUB_SHA" \
+              --title "Terms ${tag#terms-}" \
+              --notes-file notes.md \
+              --latest=false
+          fi

docusaurus.config.js

@@ -229,6 +229,16 @@ const config = {
             from: '/aidubbing',
             to: '/dubbing',
           },
+          // Legal pages live under /terms.
+          {
+            from: '/privacy',
+            to: '/terms/privacy',
+          },
+          // The MSA template names the register /terms/processor.
+          {
+            from: '/terms/processor',
+            to: '/terms/subprocessors',
+          },
           // The ISP application became the Embedded OpenCache PoP page.
           {
             from: '/apply/opencache/isp',
@@ -281,6 +291,16 @@ const config = {
         sidebarCollapsible: true,
       },
     ],
+    // Legal pages (/terms/*) share one sidebar for moving between them.
+    [
+      '@docusaurus/plugin-content-docs',
+      {
+        id: 'terms',
+        path: 'terms',
+        routeBasePath: 'terms',
+        sidebarPath: require.resolve('./sidebarsTerms.js'),
+      },
+    ],
   ],
   presets: [
     [
@@ -387,7 +407,7 @@ const config = {
           },
           {
             label: 'Privacy Policy',
-            to: '/privacy',
+            to: '/terms/privacy',
           },
           {
             label: 'Code of Conduct',

sidebarsTerms.js

@@ -0,0 +1,19 @@
+/** @type {import('@docusaurus/plugin-content-docs').SidebarsConfig} */
+const sidebars = {
+  termsSidebar: [
+    { type: 'doc', id: 'index', label: 'Overview' },
+    {
+      type: 'category',
+      label: 'Service Agreements',
+      collapsible: false,
+      items: ['msa', 'opencache', 'sla'],
+    },
+    {
+      type: 'category',
+      label: 'Privacy',
+      collapsible: false,
+      items: ['privacy', 'subprocessors'],
+    },
+  ],
+};
+module.exports = sidebars;

src/components/newsletter/Newsletter.tsx

@@ -148,7 +148,7 @@ export const Newsletter: FunctionComponent = () => {
                 <p className={styles.consent}>
                   By subscribing you agree to receive email updates about P
                   Foundation&apos;s work. Read our{' '}
-                  <Link className={styles.consentLink} to="/privacy">
+                  <Link className={styles.consentLink} to="/terms/privacy">
                     privacy policy
                   </Link>
                   .

terms/index.md

@@ -0,0 +1,49 @@
+---
+slug: /
+sidebar_label: 'Overview'
+title: 'P Foundation Terms and Policies'
+description: 'The agreements, service terms, and policies that govern P Foundation services and websites.'
+---
+
+# P Foundation Terms and Policies
+
+This page lists the agreements, service terms, and policies that apply to P Foundation services and websites. Use the menu to move between documents.
+
+## Service Agreements
+
+Our services are provided under our standard Master Services Agreement. Each service adds its own Service Appendix and any service level agreement. These terms apply to a customer only once that customer and P Foundation sign a Service Order, which records the customer's details, the services ordered, and any agreed variations. A signed Service Order is governed by the version of these terms in force on the date it is signed. To discuss a service, please [contact us](https://p.foundation/contact).
+
+| Document                                               | Applies to                | Summary                                                                                                                     |
+| ------------------------------------------------------ | ------------------------- | --------------------------------------------------------------------------------------------------------------------------- |
+| [Master Services Agreement](./msa.md)                  | All P Foundation services | General terms for every service: structure, data protection, confidentiality, liability, and term and termination.          |
+| [Appendix 1: OpenCache Service Terms](./opencache.md)  | OpenCache                 | Service-specific terms for OpenCache: delivery path, capacity, neutrality, content handling, data handling, and transition. |
+| [Annex A: OpenCache Service Level Agreement](./sla.md) | OpenCache                 | Availability commitments, incident response, maintenance, remedies, reporting, and escalation for OpenCache.                |
+
+## Privacy and Data Protection
+
+| Document                            | Applies to                               | Summary                                                                                               |
+| ----------------------------------- | ---------------------------------------- | ----------------------------------------------------------------------------------------------------- |
+| [Privacy Policy](./privacy.md)      | Our websites, apps, programs, and donors | How we collect, use, store, and share personal information, and the rights you have over it.          |
+| [Subprocessors](./subprocessors.md) | All services                             | The third-party providers that process personal information on our behalf, with purpose and location. |
+
+## Changes and Verification
+
+Each document shows the date it was last updated, with a **Changelog** link to its full edit history on GitHub.
+
+Every published version of these documents is signed with [Sigstore](https://www.sigstore.dev) and released on GitHub as a [signed terms release](https://github.com/pfoundation/p.foundation/releases?q=terms-). Each release contains the documents, their SHA-256 checksums, and a signature bundle recorded in Sigstore's public transparency log. The signature is made by our publishing workflow on the master branch, without a private key that could be lost or copied. To confirm that a copy you hold matches what we published, download the release files and run:
+
+```sh
+cosign verify-blob SHA256SUMS \
+  --bundle SHA256SUMS.sigstore.json \
+  --certificate-identity https://github.com/pfoundation/p.foundation/.github/workflows/sign-terms.yml@refs/heads/master \
+  --certificate-oidc-issuer https://token.actions.githubusercontent.com
+sha256sum -c SHA256SUMS
+```
+
+## Contact Us
+
+For questions about these documents, please contact us:
+
+- **Email:** privacy@p.foundation
+- **Postal Mail:** P Foundation  
+  700 12th St NW, Ste 700, Washington, DC 20005, United States