harbor

Repository on GitHub, which provides public git repositories with URLs.

Repository on GitHub, which uses git. git can track the changes, who made them, and when they were made.

https://github.com/goharbor/harbor/releases

Repository on GitHub, which uses git. git is distributed.

https://github.com/goharbor/harbor/releases

Harbor versions are expressed as x.y.z, where x is the major version, y is the minor version, and z is the patch version, following Semantic Versioning terminology. Please see https://github.com/goharbor/harbor/releases

human readable release notes are attached to the source codes on the release page

https://github.com/goharbor/harbor/blob/master/CHANGELOG.md

The project identifies publicly known vulnerabilities in release notes for officially filed CVEs which come with a CVSS score. Please see this for detailed process: https://github.com/goharbor/harbor/blob/master/SECURITY.md

https://github.com/goharbor/harbor/issues

https://github.com/goharbor/harbor/issues

The project's maintainers hold bi-weekly meetings to review and respond to all incoming enhancement requests from the community

all issues here (https://github.com/goharbor/harbor/issues) are tracked and triaged in bi-weekly meetings with 2-4weeks turnaround time.

https://github.com/goharbor/harbor/issues

vulnerability process is detailed here: https://github.com/goharbor/harbor/blob/master/SECURITY.md

reported vulnerabilities are reported to cncf-harbor-security@lists.cncf.io and kept private during embargo period, please see details here: https://github.com/goharbor/harbor/blob/master/SECURITY.md

Initial response to vulnerability by Harbor security team is 3 business days and report date to public disclosure date to be on the order of 14 business days. please see details here: https://github.com/goharbor/harbor/blob/master/SECURITY.md

The project uses Travis CI for build and detailed build process here: https://github.com/goharbor/harbor/blob/master/docs/compile_guide.md

Non-trivial build file can be also be found in repository: https://github.com/goharbor/harbor/blob/master/Makefile.

The project uses Travis CI for build and detailed build process here: https://github.com/goharbor/harbor/blob/master/docs/compile_guide.md

Non-trivial build file can be also be found in repository: https://github.com/goharbor/harbor/blob/master/Makefile.

The project is buildable using only FLOSS tools

The project uses Travis CI for all internal feature development as well as generate builds off PRs in the github repo.
https://travis-ci.org/goharbor/harbor

Project uses 'go test' to trigger UT tests

Travis CI uses coveralls to provide coverage

The project implements continuous integration through the use of Travis CI, which runs on every single commit to DEV and Master https://travis-ci.org/goharbor/harbor

All new features must go through the Harbor's Travids CI pipeline and pass human review as well as automated testing and coveralls requirements.

please also see: https://github.com/goharbor/harbor/blob/master/CONTRIBUTING.md#automated-testing

The project runs automatic Travis CI pipelines against pull requests which must pass before being merged. PRs also have to go through unit testing for backend services and UI tests.

This is outlined in the contribution process (https://github.com/goharbor/harbor/blob/master/CONTRIBUTING.md)

The project uses golint and govet for enable/disable compiler warnings which directly impacts CI pass/fail, managing coding style and correctness

The project uses golint and govet for managing compiler warnings, coding style, and correctness

The project can enable gating any pull request by certain warnings, but likely don't.

The core developers of Harbor are familiar with designing secure software and Harbor has undergone a 3rd party penetration test by cure53

The core developers of Harbor are familiar with designing secure software and Harbor has undergone a 3rd party penetration test by cure53

The project uses only cryptographic protocols and algorithms that are publicly published and reviewed by experts.

The project does not reimplement its own cryptographic functions.

all are implementable using FLOSS

The project's instances of symmetric encryption all use key lengths of 128 bit.

The project does not depend on broken cryptographic algorithms.

The project's default security mechanisms do not depend on weak algorithms or modes with serious weaknesses such as SHA-1

The project implements perfect forward secrecy for key agreement protocols so a session key derived from a set of long-term keys cannot be compromised if one of the long-term keys is compromised in the future.

The project does not store passwords for authentication of external users against Harbor

"The project uses cryptogrpahically secure random number generators (golang and python official rand library) tracking:https://github.com/goharbor/harbor/issues/9423"

The project supports HTTPS.

The default mode of https ensures no cryptographic hash of any kind is retrieved over http. This is detailed in the installation guide (https://github.com/goharbor/harbor/blob/master/docs/installation_guide.md)

There are currently no known vulnerabilities of high criticallity in the project that have not been already patched. Vulnerabilities reporting and disclosure process is here: https://github.com/goharbor/harbor/blob/master/SECURITY.md

There are currently no known vulnerabilities of high criticallity in the project that have not been already patched. Vulnerabilities reporting and disclosure process is here: https://github.com/goharbor/harbor/blob/master/SECURITY.md

The project does not keep any private credentials in any public repositories

The project uses golint and govet in our Travis CI to perform static code analysis on all releases, not just major production releases

The project uses golint / go vet to perform static analysis on all commits through its Travis CI pipeline. Project also uses gosec ( https://github.com/securego/gosec) for secure static analysis.

The project runs static analysis continuously and issues are triaged and fixed right away on the nightly build before merged to master

all pull requests and commits are run with golint.

The project uses golint, go race, and go vet to make sure code is readable, safe, and correct. All unit tests will be triggerd via go test against the pull request. Special attention is paid to the Travis CI result and the coverage report

The project does not produce any software written in a memory-unsafe language

This does not apply to golang

All medium and high severity vulnerabilities discovered through dynamic code analysis internally are triaged and fixed immediately before release