CLAMP (Closed Loop Automation Management Platform)

Git and Gerrit is used in Clamp: https://gerrit.onap.org/r/gitweb?p=clamp.git;a=summary

The commits related information are tracked by Gerrit: https://gerrit.onap.org/r/gitweb?p=clamp.git;a=summary

It provides an temperate branch for reviewing and providing comments. Once approved, the code will be merged and the temperate branch will be removed.

Git and Gerrit are used.

Release version is with format ${major}.${minor}.${patch} and will be updated accordingly for each release.

git tags are used for the CLAMP releases (amsterdam, beijing, casablanca, dublin, etc...).

The draft version of the release note is shown below: https://wiki.onap.org/display/DW/Release+Notes+1.0.0+draft

This will be indicated in the release note, optionally with the Nexus IQ report.

The description of the process could be found in the following URL: https://wiki.onap.org/display/DW/Tracking+Issues+with+JIRA

Jira is used to track issues. https://wiki.onap.org/display/DW/Tracking+Issues+with+JIRA

The reported issues are being handled as soon as possible. At this moment, all issues older than a month are closed.

The reported issues are being handled as soon as possible. At this moment, all issues older than a month are closed.

The report of issues are listed here: https://wiki.onap.org/display/DW/Issue+Reports

The Vulnerability could be reported either as a feature or a issue. In case the vulnerability involves large changes, e.g. framework change, it could be reported as a feature. In case the vulnerability is due to bugs in the code, it could be reported as a bug.

The reporting process is in the following URL: https://wiki.onap.org/display/DW/Tracking+Issues+with+JIRA

Private vulnerability reports are not supported.

Response time are currently less than 14 days.

Clamp use Jenkins to automatically build the software. https://jenkins.onap.org/view/clamp/

Clamp use Maven to build the software.

Maven is under Apache 2.0 liscense.

Tools used by Clamp for automated test are: Junit (Eclipse Public License 1.0), Mockito (MIT)

The test is launched by default while building the software, this is integrated in the maven build. This is explained in the development guide for CLAMP : https://wiki.onap.org/display/DW/CLAMP+Development+Guide

For each pull request, the project needs to be built successfully before the Merge option becomes activated. The test will be run automatically during the building process as well. Once build successfully and all tests has past, the Merge option will be activated. see https://jenkins.onap.org

The code coverage is evaluated by Sonar on daily bases. If the code coverage reduced, actions will be taken to add more test cases. All tests on for Clamp is trigger by Maven build and could be launched automatically by Jenkins.

On the assumption that the only test_policy that ONAP has is about reaching 50% coverage through automated tests.

The code coverage requirement is listed as a developer best practice here: https://wiki.onap.org/display/DW/Code+Coverage+and+Static+Code+Analysis

Sonar is used to examine the quality of the source code. Sonar uses different rules to verify the quality of the code and to address the vulnerability of the code.

A task is created in JIRA to remove such warnings in a continuous way. https://jira.onap.org/browse/CLAMP-43

Perfection is not the target but the project is being improved on each release to reach the best practical warning settings, where technically feasible.

Bcrypt is used as the default cryptographic hashing algorithm for Clamp.

Bcrypt is used for the cryptographic hashing.

Bcrypt is used for the cryptographic hashing, which is under MIT license.

Based on the feature the software, end user do not create their own login and password. Instead, the login and password are created manually and provided to the end user.

md5 is only used with other components in the context of non critical object hash/signature.

CLAMP strives to implement secure design principles. We encrypt data where possible, and run security scans on the code and its dependencies.

Previous mechanics now replaced by bcrypt (which is proposed).

bcrypt security mechanism is using java.security.SecureRandom (listed as secure random generator).

The website to store the delivered software is: https://nexus3.onap.org/

Since we use docker/nexus as a delivery mechanism, both being protected by proper digitally signed certificates from publicly known authorities, the clients using docker/nexus as a deliverable source would be warned if the certificate has been tampered with, and as such the hashes cannot be tampered with or modified.

Publicly known vulnerabilities could be reported by individual user or tracked by the project team in JIRA. It will be fixed as soon as possible (typically in the current release and in the previous supported release through a maintenance release).

Clamp uses tool like Sonar to detect vulnerabilities and fix it as soon as possible when find any.

Password stored in the Clamp properties file are "sample" credentials.

Sonar is used for static code analysis.

Sonar uses different rules for static code analysis. The list of rules used by CLAMP are: https://sonar.onap.org/coding_rules#qprofile=java-sonar-way-74911|activation=true https://sonar.onap.org/coding_rules#qprofile=js-sonar-way-57190|activation=true

A "task"/"user story" is created in JIRA to remove such warnings in a continuous way. https://jira.onap.org/secure/RapidBoard.jspa?rapidView=13&projectKey=CLAMP&view=planning&issueLimit=100

It is triggered daily.

Clamp uses Java and JavaScript.

After discovering the vulnerabilities, they will be fixed as soon as possible. A task is created in JIRA to remove such warnings in a continuous way. https://jira.onap.org/browse/CLAMP-43