ONAP CCSDK (Common Controller SDK)

Tracking is provided by using a combination of JIRA and git history. Every commit has an user and a Jira number attached to it. E.g. History for CCSDK repo "distribution" : https://gerrit.onap.org/r/gitweb?p=ccsdk/distribution.git;a=shortlog;h=refs/heads/master Jira for ONAP: https://jira.onap.org/secure/Dashboard.jspa

Gerrit provides a temporary branch for reviewing and providing comments. Once approved, the code will be merged and the temperate branch will be removed.

Git and Gerrit are used.

Release version is with format ${major}.${minor}.${patch} and will be updated accordingly for each release.

Each release is tagged within the Gerrit repository.

Release notes can be found at : https://onap.readthedocs.io/en/latest/submodules/ccsdk/distribution.git/docs/release-notes.html

Documented in release notes : https://onap.readthedocs.io/en/latest/submodules/ccsdk/distribution.git/docs/release-notes.html

The description of the process can be found in the following URL: https://wiki.onap.org/display/DW/Tracking+Issues+with+JIRA

Jira is used to track issues. https://wiki.onap.org/display/DW/Tracking+Issues+with+JIRA

The reported issues are being handled as soon as possible.

The reported issues are being handled as soon as possible.

This is provided by Jira : https://jira.onap.org

The process on how to report a vulnerability can be found in https://wiki.onap.org/display/DW/ONAP+Vulnerability+Management

Private vulnerability reports are not supported.

No vulnerabilities reported at this time

All artifacts are built using Jenkins. For example : https://jenkins.onap.org/view/ccsdk/job/ccsdk-distribution-amsterdam-docker-version-java-daily/

Maven is used for building software.

Maven is licensed under Apache 2.0

Project uses jUnit and mockito to run automated unit tests.

Tests can be run using standard maven command (mvn surefire:test)

Automated testing has ability to cover most code branches.

For each pull request, the project needs to be built successfully before the Merge option becomes activated. The test will be run automatically during the building process as well. Once build successfully and all tests has past, the Merge option will be activated.

When new code is added, the project's committers review submission to determine whether appropriate test cases have been added. As additional check, after code is merged, PTL reviews the updated code coverage metrics reported by Sonar to verify that coverage percentage did not drop. If it does, the PTL will ask the developer submitting that change to add appropriate test cases.

Evidence is maintained as git review comments in gerrit and can be viewed via standard git log commands.

This is documented on our wiki: Code Coverage and Static Code Analysis

As part of the project build process, the maven checkstyle plugin is used to perform an initial check. The project also uses SonarQube to perform a more detailed scan for code quality issues.

Items flagged in SonarQube are addressed and corrected.

Items flagged in SonarQube are addressed and corrected.

PTL and committers on our project are experienced developers with knowledge of designing secure software.

PTL and committers on our project are experienced developers with knowledge of designing secure software.

All generated certificates are generated with sha256, and furthermore only JWE approved ciphers are used.

https is supported in Beijing

https is supported in Beijing

There are currently no unpatched vulnerabilities in our active ONAP code.

Passwords are stored encrypted

Our project uses Nexus IQ Server

Nexus IQ Server identifies common vulnerabilities

Issues identified by Nexus IQ Server are tracked in our Jira as defects and addressed in timely manner.

Our project is written in memory-safe languages (Java and Python)

We are not currently performing dynamic analysis