WireCloud

Repository on GitHub, which provides public git repositories with URLs.

Repository on GitHub, which uses git. git can track the changes, who made them, and when they were made.

Interim versions are put on git, not just final versions.

Repository on GitHub, which uses git. git is distributed.

The primary development team uses git commit records to identify releases. Regular umbrella releases aligned with the FIWARE Foundation.

Git tags are created for each of the releases.

CHANGELOG.md file is in top directory, see: https://github.com/Wirecloud/wirecloud/blob/develop/CHANGELOG.md. Changes are also provided as description in the release tag at GitHub.

Documented in our release notes.

Bug reports can be provided using the GitHub issue tracker: https://github.com/Wirecloud/wirecloud/issues

Issue reports can be tracked using the GitHub issue tracker: https://github.com/Wirecloud/wirecloud/issues

Yes. This is a requirement for membership of the FIWARE Foundation Catalogue

The project has been responding to most enhancement requests.

Yes, via GitHub issue tracker: https://github.com/Wirecloud/wirecloud/issues

https://github.com/Wirecloud/wirecloud/issues

https://github.com/Wirecloud/wirecloud/blob/develop/docs/CONTRIBUTING.md

No external reports so far, so this is vacuously true.

Software uses python as main programming language, so it is not require to be built. Anyway, you can ensure all the dependencies are meet by using the requirements.txt file. Docker images and wheel packages (to be used by pip and pypi) can be build using the provided scripts.

This project uses commons tools: Django tools, docker tools, ...

WireCloud only uses FLOSS tools

There is a ci_scripts provides scripts for running automated test suite, as also, the project provides documentation to manually passing all those tests if required.

WireCloud uses common tools for running tests.

Currently, tests are covering more than 83% of the code and we are increasing the coverage, including code branches.

WireCloud is currently using Travis CI.

Contributing guidelines (https://github.com/Wirecloud/wirecloud/blob/develop/docs/CONTRIBUTING.md) states tests should be provided. Also, PR are connected to Travis CI and Coveralls, so we always check that coverage remains at the same level or increases.

Releases notes provide this details.

Contributing guidelines (https://github.com/Wirecloud/wirecloud/blob/develop/docs/CONTRIBUTING.md) states tests should be provided.

This project uses common linter tools like eslint, flake8, ... for those tasks.

In general warnings are addressed. In some cases warnings are disabled for specific cases.

The settings for the warning tools are generally fairly strict.

Álvaro Arranz assumes overall responsibility for this along with the development team.

Álvaro Arranz assumes overall responsibility for this along with the development team. For a discussion of security requirements, common types of security vulnerabilities, and how this application counters those common kinds of vulnerabilities, see: https://github.com/Wirecloud/wirecloud/blob/develop/doc/security.md

WireCloud delegates authentication to other components such as KeyRock, Keycloak, WSO2 Identity server.... These security components use strong encryption protocols and algorithms to store salted hashed iterated passwords and for storing user information and https+standard crypto protocols to communicate with users.

WireCloud can also be used for authenticating users, in this case WireCloud uses Django's utils for storing passwords in a secure way. WireCloud also stores some sensitive data when configuring the access to third-party services. In this case WireCloud is using AES encryption to store it on hard disk. In any case, that sensitive information can only be used by the WireCloud's proxy service through secure channels and cannot be read back to the browser.

Communication with users takes place using https+standard crypto protocols when correctly deployed.

WireCloud is relaying on the already available cryptography tools and packages for managing data encryption.

All required functionality is implemented using FLOSS, including cryptography.

WireCloud is using AES-256 for sensitive data.

Exact key lengths for the other aspects depends on the used component, but Django, KeyRock, KeyCloak, ... are currently using enough key lengths.

WireCloud itself does not uses broken cryptographic algorithms. User can configure other services using broken protocols, WireCloud emphasize not to use them and to configure services using proper configurations.

WireCloud does not depend on any algorithms or mode with known serious weaknesses at the present time.

WireCloud itself is not using protocols requiring perfect forward secrecy, except for accessing HTTPS configured to do so. WireCloud HTTPS configuration should be configured to use perfect forward secrecy. WireCloud points to documentation explaining how to enable Perfect Forward Secrecy.

Using Django tools that follows those criteria. OAuth2 tokens are stored in plain as provided by the auth server (server can provide encrypted tokens), but are short lived.

Documentation states how to configure WireCloud to listen on https. Also, WireClouds connects to other services using https.

Does not make this mistake.

No such vulnerabilities at this time.

No such vulnerabilities at this time.

No valid private credentials are leaked. Usernames and Passwords may be entered using Docker secrets and ENVs

As noted in https://github.com/Wirecloud/wirecloud/blob/develop/docs/CONTRIBUTING.md, JavaScript client-side code is analyzed using ESLint. Python code is analysed using flake8. These analysis tools are used in local development, as well as the continuous integration server running on Travis CI

ESLint specifically looks for common vulnerabilities in JavaScript applications.

This is vacuously true, since we've had no reports of vulnerabilities that apply to a deployed system.

All commits to GitHub are run through Travis, which performs a number of static analysis checks (ESLint, flake8, ...).

WireCloud uses languages that are not affected by this.

WireCloud is not running dynamic code analysis and thus have not found any vulnerabilities in this way.