ONAP APPC (Application Controller)

Sparky's version controlled repository can be found in https://gerrit.onap.org/r/#/admin/projects/appc https://gerrit.onap.org/r/#/admin/projects/appc/cdt https://gerrit.onap.org/r/#/admin/projects/appc/deployment

Tracking is provided by using a combination of JIRA and git history. Every commit has an user and a Jira number attached to it. Git history for APPC's master branch:https://gerrit.onap.org/r/#/q/projects:+appc Jira for ONAP: https://jira.onap.org/secure/Dashboard.jspa

Gerrit provides an temperate branch for reviewing and providing comments. Once approved, the code will be merged and the temperate branch will be removed.

Git and Gerrit are used.

Release version is with format ${major}.${minor}.${patch} and will be updated accordingly for each release.

Each release is tagged within the Gerrit repository.

Release notes can be found in

http://onap.readthedocs.io/en/latest/submodules/aai/aai-common.git/docs/release-notes.html

Release notes with identified vulnerabilities can be found in http://onap.readthedocs.io/en/latest/submodules/appc.git/docs/release-notes.html

No vulnerabilities have yet been identified.

The description of the process can be found in the following URL: https://wiki.onap.org/display/DW/Tracking+Issues+with+JIRA

Jira is used to track issues. https://wiki.onap.org/display/DW/Tracking+Issues+with+JIRA

The reported issues are being handled as soon as possible.

The reported issues are being handled as soon as possible.

The report of issues are listed here: https://wiki.onap.org/display/DW/Issue+Reports

The process on how to report a vulnerability can be found in https://wiki.onap.org/display/DW/ONAP+Vulnerability+Management

Private vulnerability reports are not supported.

There's no vulnerabilities reported so far.

APPC uses Jenkins to automatically build the software. https://jenkins.onap.org/view/appc/job/appc-deployment-master-release-version-java-daily-no-sonar/

Maven is used to build the project

Maven is under Apache 2.0 license.

APPC uses JUNIT and mockito to run the unit tests

Tests can be run, by running the command "mvn test"

The combination of junit and mockito has the ability to cover all the branches and input fields

For each pull request, the project needs to be built successfully before the Merge option becomes activated. The test will be run automatically during the building process as well. Once build successfully and all tests has past, the Merge option will be activated.

The code coverage is evaluated by Sonar on daily bases. If the code coverage reduced, actions will be taken to add more test cases. All tests on for Clamp is trigger by Maven build and could be launched automatically by Jenkins.

The daily sonar report contains a link for recent overall coverage on the new code. Here is the link: https://sonar.onap.org/drilldown/measures?id=org.onap.appc%3Aappc&metric=new_overall_uncovered_lines&period=1&highlight=new_overall_coverage

This is documented on our wiki: https://wiki.onap.org/display/DW/Code+Coverage+and+Static+Code+Analysis

Sonar is used to examine the quality of the source code. Sonar uses different rules to verify the quality of the code and to address the vulnerability of the code.

A task is created in JIRA to remove such warnings in a continuous way. https://jira.onap.org/browse/APPC-254

Build systems run the compile with test flag enabled by default. So any failure in test cases will fail the ci and the merge request.

The APPC is using MD5 encryption algorithm

https://gerrit.onap.org/r/gitweb?p=appc.git;a=blob;f=appc-config/appc-config-adaptor/provider/src/main/java/org/onap/appc/ccadaptor/EncryptionTool.java;h=dd92f0a537511e5808705b58c9e75dedd6f15537;hb=refs/heads/master

APPC is using java.security.Provider, and javax.crypto.Cipher classes to implement cryptographic function.

APPC is using java.security.Provider, and javax.crypto.Cipher classes to implement cryptographic function. all those classes are using FLOSS.

APPC runs security scan software to uncover any security risks.

APPC runs security scan software to uncover any security risks.

Security scans are used to ensure this is not comprised.

In Beijing release, we are going to use AAF for user authentication and authorization. also Openstack credentials are used in the APPC encryption tool

cryptographic encrypted key is generated by java.security.Provider and javax.crypto.Cipher classed provided by Java.

The website to store the delivered software is: https://nexus3.onap.org/

APPC uses tool like Sonar to detect vulnerabilities and fix it as soon as possible when find any.

APPC uses a sample or test credential for testing in onap.org FQDN, which is in onap source code. User can read source code or follow the document, then change the credential for their own environment.

Sonar is used for static code analysis. https://sonar.onap.org

Sonar uses different rules for static code analysis. The list of rules used by APPC is: https://sonar.onap.org/coding_rules#qprofile=java-sonar-way-74911|activation=true

A task is created in JIRA to remove such warnings in a continuous way https://jira.onap.org/browse/APPC-254

it's triggered daily

Sonar is used as Dynamic code analysis tool.

APPC uses Java

After discovering the vulnerabilities, they will be fixed as soon as possible. A task is created in JIRA to remove such warnings in a continuous way. https://jira.onap.org/browse/APPC-254