harbor

Every Harbor release is tested for upgrades from older releases and the uprade process is detailed in the upgradetest.md (https://github.com/goharbor/harbor/blob/master/docs/upgradetest.md)

https://github.com/goharbor/harbor/issues

Vulnerability information including detailed reporter information are all disclosed on the CVE created through on the CVSS( https://www.first.org/cvss/specification-document) Please see security process: https://github.com/goharbor/harbor/blob/master/SECURITY.md

vulnerability reporting, response, and disclosure are all carefully documented here: https://github.com/goharbor/harbor/blob/master/SECURITY.md

The project uses golint to enforce coding styles. Please see (https://github.com/goharbor/harbor/blob/master/CONTRIBUTING.md#develop-build-and-test)

The project uses golint to enforce coding styles

This is done, Please see (https://github.com/goharbor/harbor/pull/9649)

Harbor is written in Go and standard build can be configured to preserve all debugging information with relevant flags.

The project does not recursively build subdirectories and there are no cross-dependencies in the subdirectories. Go's compiler ensure's the dependency of packages are handled correctly.

This requirement has been satisfied by https://github.com/goharbor/harbor/pull/9828

This is detailed in the installation_guide.md (https://github.com/goharbor/harbor/blob/master/docs/installation_guide.md)

There is no standard convention applicable since project is packaged and delievered in docker container format as opposed to on a standard POSIX system. Users are advised to follow Docker recommended practice in this regard.

This is detailed in the installation_guide.md (https://github.com/goharbor/harbor/blob/master/docs/installation_guide.md)

The project lists all its external dependencies in the installation guide (https://github.com/goharbor/harbor/blob/master/docs/installation_guide.md)

We carefully scan for vulnerabilities of ALL computer-processeable dependencies in our software using AppCheck (https://appcheck-ng.com) on a weekly basis. Upon discovery of vulnerabilities, we triage and disclose them using Harbor's security reporting and disclosure process (SECURITY.md)

The project uses Go modules for dependency versioning and dependency management.

The project avoids using deprecated or obsolete functions

Travis CI is configured to run automated tests for all incoming change requests on all repos and builds. Each test must pass before change request is pushed through to merge request.

Regression tests are run for at least 50% of all bugs fixed within the last six months

The project uses Travis CI and coveralls

Automated testing is detailed in the CONTRIBUTION.md (https://github.com/goharbor/harbor/blob/master/CONTRIBUTING.md#automated-testing)

This is outlined in the contribution process (https://github.com/goharbor/harbor/blob/master/CONTRIBUTING.md)

The project can enable gating any pull request by certain warnings, but likely don't.

The project uses the strongest secure design principles where applicable including prolific use of HTTP/S, TLS, Certificates, secrets

The project's default security mechanisms do not depend on weak algorithms or modes with serious weaknesses such as SHA-1

The project supports multiple cryptophic algorithms throughout including SHA-256.

The project supports secure cold storage of private cryptographic keys and dynamic tokens.

The projects supports TLS in all of its network transmissions, some of which is detailed in the installation and deployment guide here: https://github.com/goharbor/harbor/blob/master/docs/installation_guide.md

In addtion, HTTPS and certificates configuration is detailed in separate document here: https://github.com/goharbor/harbor/blob/master/docs/configure_https.md

The project is written in Go which has native support for TLS version 1.2 and beyond

The project performs TLS certificate verification by default

The project performs TLS certificate verification by default

all releases published on GitHub come with signature

all releases published on GitHub come with signature

The project results checks all inputs from potentially untrusted sources (docker login, web console login, cve whitelist, docker push etc) to ensure they are valid

Project performs static and dynamic code analysis through Travis CI. Every release also pays attention to latest list of CVEs that may impact Harbor components as well as supported distros and OS which if pertinent will be patched on the next patch (minor) release.

Please see (https://github.com/goharbor/harbor/blob/master/SECURITY.md)

The project uses golint / go vet to perform static analysis on all commits through its Travis CI pipeline. Project also uses gosec ( https://github.com/securego/gosec) for secure static analysis.

The project does not produce any software written in a memory-unsafe language