NNStreamer

Repository on GitHub, which provides public git repositories with URLs: https://github.com/nnstreamer/nnstreamer

Repository on GitHub, which uses git. git can track the changes, who made them, and when they were made: https://github.com/nnstreamer/nnstreamer Repository on GitHub, which uses git. git can track the changes, who made them, and when they were made.

Every commit should go through automated test & verification and review processes (at least 2 approvals without any rejections from committers): https://github.com/nnstreamer/nnstreamer/pulls

Repository on GitHub, which uses git. git is distributed.

Git Commit ID is available. For "official" release, we add git tags, too.

Each release is combined with a git tag, which is combined with a git commit: https://github.com/nnstreamer/nnstreamer/releases

https://github.com/nnstreamer/nnstreamer/blob/main/CHANGES is the release note in code.

We have no publicly known vulnerabilities (not received any CVE reports, yet)

https://github.com/nnstreamer/nnstreamer/issues

https://github.com/nnstreamer/nnstreamer/issues

https://github.com/nnstreamer/nnstreamer/issues?q=label%3Abug+is%3Aclosed

https://github.com/nnstreamer/nnstreamer/issues?q=feature

Unresponded enhancement requests are usually maintainer's notes for future feature plans (written by the maintainer).

https://github.com/nnstreamer/nnstreamer/issues?q=is%3Aissue+is%3Aclosed

https://github.com/nnstreamer/nnstreamer/issues

We have no distinction between general bug reports and security vulnerability reports.

We do not have private report channels.

The only vulnerability report was https://github.com/nnstreamer/nnstreamer/issues/1763 (1 year ago), which was resolved within one day.

Every PR is built and tested automatically: https://github.com/nnstreamer/nnstreamer/pulls (look inside PR's "All checks have passed" or "Some checks were not successful") Daily builds are at http://nnsuite.mooo.com/nnstreamer/ci/taos/daily-build/build_result/

Meson and Ninja https://github.com/nnstreamer/nnstreamer/blob/main/meson.build

MESON: Apache 2.0 NINJA: Apache 2.0

GTEST (BSD-3) and SSAT (Apache 2.0 / https://github.com/myungjoo/SSAT )

GTEST: C/C++ SSAT: Bash Scripts

As of today, LCOV shows that 80.9% of lines and 93.2% of functions are covered by GTEST and SSAT automated tests. http://nnsuite.mooo.com/nnstreamer/ci/gcov_html/index.html

Every PR goes through TAOS-CI ( https://github.com/nnstreamer/nnstreamer/pulls ), we do daily build. Launchpad PPA does daily build as well: https://launchpad.net/~nnstreamer/+archive/ubuntu/ppa Tizen's infra does automated build & tests as well: https://build.tizen.org/package/show/Tizen:Unified/nnstreamer

We require any feature to accompany with test cases (GTEST or SSAT). Without it, the maintainer generally does not accept the feature. We also try to keep the test coverage over 80% (lines) at any time.

Ubuntu/Debian: https://github.com/nnstreamer/nnstreamer/blob/main/debian/rules#L55 : It runs automated test suite mandatorily for PPA and Per-PR build. Tizen/OpenSUSE/Fedora: https://github.com/nnstreamer/nnstreamer/blob/main/packaging/nnstreamer.spec#L630 : It runs automated test suite (if user/system wants). In daily builds, it is mandatory for all architectures. In Per-PR checks, we check all test cases for x64 architectures and check a few of them for ARM architectures.

https://github.com/nnstreamer/nnstreamer/blob/main/Documentation/contributing.md#additional-requirements-for-codes

https://github.com/nnstreamer/nnstreamer/blob/main/.TAOS-CI/config/config-plugins-prebuild.sh configures static checkers of TAOS-CI. For every commit and PR, we check, "are Doxygen tags available?", "indentation and coding styles", "clang-format checks", "pylint", "newline at the end of file", "rpm spec statements", "file formats (no binaries!)", "cppcheck", "commit messages", "timestamps", "file attributes", "common misspells", "doxygen grammars", "the size of commits (fails if too big)", "prohibitted keywords", "commit sign-offs", "shell script checks", "flawfinder".

Any single fail from all the static checkers ==> No committers will review them ==> Cannot be merged.

We do not allow compiler warnings: https://github.com/nnstreamer/nnstreamer/blob/main/meson.build#L9

No warnings are allowed: https://github.com/nnstreamer/nnstreamer/blob/main/meson.build#L9

Project team uses a SDL software development approach https://www.microsoft.com/en-us/securityengineering/sdl/ and works closely with an independent security team in the company during the entire development cycle. https://github.com/jaeyun-jung is the security contact of the project.

Probably, the maintainer and top committers are.

Github uses https and ssh.

During the connection, the TLS 1.2 protocol is used which eliminates the use of weak algorithms for authentication.

We have been addressing such issues within a few days (no more than a week)

We have been addressing such issues within a few days (no more than a week)

We do not have any credentials in repositories.

For every commit or PR: cppcheck For every release: Coverity

I believe Coverity does it.

Every stable release should have ZERO issues from all static checkers

Cppcheck and all other static checker (not Coverity, though) are done for every PR (pull request).

In-house dynamic code analysis tool (TAOS-CI's "post-build" sessions, Apache 2.0) is used for every release and every pull request.

With Tizen's infrastructure (build.tizen.org), we do ASAN with every code submit to Tizen (roughly once or twice a week).

Hundreds of unit test cases (executed for every pull request) have a lot of assertions.

Any issues found by CI from a pull request (PR) are required to be fixed before merged. Any issues found by tests from daily or regular checks are usually addressed within a few days because the same code is used for products.