ONAP VNFSDK

Projects that follow the best practices below can voluntarily self-certify and show that they've achieved an Open Source Security Foundation (OpenSSF) best practices badge.

If this is your project, please show your badge status on your project page! The badge status looks like this:

Here is how to embed it:

You can show your badge status by embedding this in your markdown file:

[![OpenSSF Best Practices](https://www.bestpractices.dev/projects/1588/badge)](https://www.bestpractices.dev/projects/1588)

or by embedding this in your HTML:
<a href="https://www.bestpractices.dev/projects/1588"><img src="https://www.bestpractices.dev/projects/1588/badge"></a>

These are the

level criteria. You can also view the

level criteria.

Basics 3/5 ●

Identification

What is the human-readable name of the project?
Note that other projects may use the same name.
What is a brief description of the project?
ONAP VNFSDK's mission is to simplify the process of developing and onboarding VNFs and expanding ONAP's VNF ecosystem. For Service Providers, VNFSDK will reduce the time and level of testing required to identify, select, and onboard a VNF. For vendors, VNFSDK will reduce integration efforts by defining a standard for VNF packaging with widespread operator acceptance. VNFSDK can be used in a validation/conformance testing program in the future.

VNFSDK delivers automation tools for VNF product specification, packaging, publication and ingestion. This project will also deliver a tool for:
```
package validation,
lifecycle test (framework)
functional test (framework)
Reference Repository for VNFs to enable CI/CD without dependency on service provider ingestion
```
What is the URL for the project (as a whole)?
https://wiki.onap.org/display/DW/VNF+SDK+Project

What is the URL for the version control repository (it may be the same as the project URL)?
https://gerrit.onap.org/r/admin/repos/q/filter:vnfsdk
Prerequisites

Criterion [achieve_silver]
Met

Unmet

The project MUST achieve a silver level badge. ^{[achieve_silver]}
Project oversight

Criterion [bus_factor]
Met

Unmet

?

Mradi LAZIMA uwe na "bus factor" ya 2 au zaidi. (URL required) ^[bus_factor]
A "bus factor" (aka "truck factor") is the minimum number of project members that have to suddenly disappear from a project ("hit by a bus") before the project stalls due to lack of knowledgeable or competent personnel. The truck-factor tool can estimate this for projects on GitHub. For more information, see Assessing the Bus Factor of Git Repositories by Cosentino et al.

[29-09-2020] https://jira.onap.org/browse/VNFSDK-664

Criterion [contributors_unassociated]
Met

Unmet

?

Mradi LAZIMA uwe na angalau wachangiaji wawili wasiohusika. (URL required) ^{[contributors_unassociated]}
Contributors are associated if they are paid to work by the same organization (as an employee or contractor) and the organization stands to benefit from the project's results. Financial grants do not count as being from the same organization if they pass through other organizations (e.g., science grants paid to different organizations from a common government or NGO source do not cause contributors to be associated). Someone is a significant contributor if they have made non-trivial contributions to the project in the past year. Examples of good indicators of a significant contributor are: written at least 1,000 lines of code, contributed 50 commits, or contributed at least 20 pages of documentation.

Currently, in the project we have two contributors: Huawei and Nokia https://gerrit.onap.org/r/q/project:vnfsdk/refrepo+status:merged https://gerrit.onap.org/r/q/project:vnfsdk/validation+status:merged
Other

Criterion [copyright_per_file]
Met

Unmet

?

The project MUST include a copyright statement in each source file, identifying the copyright holder (e.g., the [project name] contributors). ^{[copyright_per_file]}
This MAY be done by including the following inside a comment near the beginning of each file: "Copyright the [project name] contributors.". See "Copyright Notices in Open Source Software Projects" by Steve Winslow.

In pom.xml file there is a plugin which check do all file have a header with copyright.

Criterion [license_per_file]
Met

Unmet

?

The project MUST include a license statement in each source file. This MAY be done by including the following inside a comment near the beginning of each file: SPDX-License-Identifier: [SPDX license expression for project]. ^{[license_per_file]}
This MAY also be done by including a statement in natural language identifying the license. The project MAY also include a stable URL pointing to the license text, or the full license text. Note that the criterion license_location requires the project license be in a standard location. See this SPDX tutorial for more information about SPDX license expressions. Note the relationship with copyright_per_file, whose content would typically precede the license information.

In pom.xml file there is a plugin which check do all file have a header with copyright.

Analysis 1/2 ●

Dynamic code analysis

Criterion [dynamic_analysis]
Met

Unmet

N/A

?

The project MUST apply at least one dynamic analysis tool to any proposed major production release of the software produced by the project before its release. ^{[dynamic_analysis]}
A dynamic analysis tool examines the software by executing it with specific inputs. For example, the project MAY use a fuzzing tool (e.g., American Fuzzy Lop) or a web application scanner (e.g., OWASP ZAP or w3af). In some cases the OSS-Fuzz project may be willing to apply fuzz testing to your project. For purposes of this criterion the dynamic analysis tool needs to vary the inputs in some way to look for various kinds of problems or be an automated test suite with at least 80% branch coverage. The Wikipedia page on dynamic analysis and the OWASP page on fuzzing identify some dynamic analysis tools. The analysis tool(s) MAY be focused on looking for security vulnerabilities, but this is not required.

We are evaluating dynamic analyzers, but have not selected one yet.

Criterion [dynamic_analysis_enable_assertions]
Met

Unmet

N/A

?

The project SHOULD include many run-time assertions in the software it produces and check those assertions during dynamic analysis. ^{[dynamic_analysis_enable_assertions]}
This criterion does not suggest enabling assertions during production; that is entirely up to the project and its users to decide. This criterion's focus is instead to improve fault detection during dynamic analysis before deployment. Enabling assertions in production use is completely different from enabling assertions during dynamic analysis (such as testing). In some cases enabling assertions in production use is extremely unwise (especially in high-integrity components). There are many arguments against enabling assertions in production, e.g., libraries should not crash callers, their presence may cause rejection by app stores, and/or activating an assertion in production may expose private data such as private keys. Beware that in many Linux distributions NDEBUG is not defined, so C/C++ assert() will by default be enabled for production in those environments. It may be important to use a different assertion mechanism or defining NDEBUG for production in those environments.

We are exploring this for a future version.

This data is available under the Creative Commons Attribution version 3.0 or later license (CC-BY-3.0+). All are free to share and adapt the data, but must give appropriate credit. Please credit mrsjackson76 and the OpenSSF Best Practices badge contributors.

ONAP VNFSDK

Basics 3/5 ●

Identification

Prerequisites

Project oversight

Other

Change Control 3/4 ●

Public version-controlled source repository

Quality 2/7 ●

Coding standards

Working build system

Automated test suite

Security 0/5 ●

Use basic good cryptographic practices

Secured delivery against man-in-the-middle (MITM) attacks

Other security issues

Analysis 1/2 ●

Dynamic code analysis