ONAP POLICY

Git and Gerrit is used in POLICY: https://gerrit.onap.org/r/gitweb?p=policy%2Fapi.git;a=shortlog;h=refs%2Fheads%2Fmaster Besides "api", there are several other policy repositories, all following the above URL format, with "api" replaced by the name of the relevant repository.

Tracking is provided by using a combination of JIRA and git history. Every commit has an user and a Jira number attached to it. The commits related information are tracked by Gerrit: https://gerrit.onap.org/r/gitweb?p=policy%2Fapi.git;a=shortlog;h=refs%2Fheads%2Fmaster

Gerrit provides a temporary branch for reviewing and providing comments. Once approved, the code will be merged and the temporary branch will be removed.

Git and Gerrit are used.

Release version is with format ${major}.${minor}.${patch} and will be updated accordingly for each release.

Each release is tagged within the Gerrit repository.

Release notes can be found in: https://docs.onap.org/projects/onap-policy-parent/en/latest/index.html#master-index

Release notes with identified vulnerabilities can be found in: https://docs.onap.org/projects/onap-policy-parent/en/latest/index.html#master-index No vulnerabilities have yet been identified.

The description of the process can be found in the following URL: https://wiki.onap.org/display/DW/Tracking+Issues+with+JIRA

Jira is used to track issues. https://wiki.onap.org/display/DW/Tracking+Issues+with+JIRA

The reported issues are being handled as soon as possible.

The reported issues are being handled as soon as possible.

The report of issues are listed here: https://wiki.onap.org/display/DW/Issue+Reports

The process on how to report a vulnerability can be found in ONAP Vulnerability Management https://wiki.onap.org/display/DW/ONAP+Vulnerability+Management.

The process on how to report a vulnerability can be found in ONAP Vulnerability Management https://wiki.onap.org/display/DW/ONAP+Vulnerability+Management.

By default all vulnerability reports are private unless modified by the reporter.

No vulnerabilities have been reported so far.

POLICY uses Jenkins to automatically build the software. https://jenkins.onap.org/view/policy/

Maven is used to build the software

Maven is under Apache 2.0 license.

Tools used by POLICY for automated test are: Junit (Eclipse Public License 1.0), Mockito (MIT)

Tests can be run, by running the command "mvn test". Our documentation for developers is described here: https://docs.onap.org/projects/onap-policy-parent/en/latest/development/devtools/devtools.html#building-onap-policy-framework-components Robot Framework tests are invoked by standard Robot methodology, also triggered by Jenkins build jobs. https://lf-onap.atlassian.net/wiki/spaces/DW/pages/16230125/Continuous+Integration

All POLICY repositories meet a minimum of 80% code coverage.

For each pull request, the project needs to be built successfully before the Merge option becomes activated. The test will be run automatically during the building process as well. Once build successfully and all tests has passed, the Merge option will be activated. Code inspection must also be passed by reviewers. The Policy Builds are located here: https://jenkins.onap.org/view/policy/

The code coverage is evaluated by Sonar on daily bases. Code reviewers enforce that junits are added for new code submissions. All tests for Policy are triggered by the Maven build and could be launched automatically by Jenkins.

Sonar Metrics are checked and JUnits are required in code reviews.

This is documented on our wiki: Code Coverage and Static Code Analysis

Sonar is used to examine the quality of the source code. Sonar uses different rules to verify the quality of the code and to address the vulnerability of the code.

Sonar results are evaluated and JIRA tasks are created as needed.

Build systems run the compile with test flag enabled by default. So any failure in test cases will fail the ci and the merge request.

Well known third party software (eg. apache http client library) is used for cryptographic needs.

Well known third party software (eg. apache http client library) is used for cryptographic needs.

Policy meets the requirement of symmetric key greater than 112. The restriction of shorter keys does not apply.

POLICY runs security scan software to uncover any security risks. Sonar scans are run daily; unsecure algorithms are reported.

All certificates are generated via kubernetes.

Security scans are used to ensure this is not comprised.

Access to the POLICY GUI is available via the ONAP Portal for external users.

Handled by third party software

HTTPS, using certificates generated by kubernetes.

Not used

Security issues have been cleared.

Critical vulnerabilities are fixed as soon as feasible.

Passwords are configurable at installation time.

Sonar is used for static code analysis.

https://sonarcloud.io/organizations/onap/projects

Vulnerabilities are fixed as soon as feasible.

Done daily via Jenkins

The project runs sonar against the code on every code reviews. Jmeter is also used for analyzing the performance and application behavior on load conditions. Observability is available with prometheus metrics in the runtime applications.

Ex: https://jenkins.onap.org/job/policy-api-sonar-verify/ Jmeter analysis: https://docs.onap.org/projects/onap-policy-parent/en/latest/development/devtools/testing/s3p/api-s3p.html

JAVA and JavaScript are used, which perform memory management.

The project validates prometheus metrics on the integration tests as runtime assertions. https://jenkins.onap.org/job/policy-api-master-project-csit-api/1829/robot/Api-Test%20&%20Api-Slas/Api-Slas/