Grid eXchange Fabric (GXF): formerly known as the Open Smart Grid Platform

We use forward-only releases and create release versions only for hotfix deployments. We use gitflow branching strategy to support this methodology.

More information on this can be found here: https://documentation.opensmartgridplatform.org/Opensourcecommunity/Communication-and-contact.html

There has no vulnerabilities reported by external contributors.

The project has process in place for reporting security issues. For more details see: https://documentation.gxf.lfenergy.org/opensourcecommunity/communication-and-contact.html

The project has code guideslines in place. For more details see: https://documentation.gxf.lfenergy.org/opensourcecommunity/contributing-to-the-code.html

Yes, the project uses a plugin in the Maven build to enfore the coding style.

The project only has JVM binaries.

This is a standard part of the JVM bytecode.

This project uses Maven as build system where we explicit define what needs to be built.

As long as the build enviroment stays the same, the build system that consists of Maven will produce the same result.

The developer guidelines are described in the gitbook on how to easily install the software. This should be sufficient to get started on the project.

In the near future we will improve this by providing helm charts and/or a docker images as a way to easily install the GXF project based on containers.

There is no installation system.

There is a virtual box available for potential developers.

The dependencies are defined in project’s manifest files: https://github.com/OSGP/open-smart-grid-platform/network/dependencies

The projects uses DependaBot and OWASP Dependency-Check.

The project uses Maven and Maven clearly states all the dependencies (including versioning information).

Due to SonarCloud scans and security scans within our CI/CD environment depricated code is identified very easlity. And are being resolved as a result.

The project uses Unit Tests and Cucumber. The results are reported during the build proces.

This is part of the way of working of the project.

Automated test suite is available and in use, but the requirement of 80% coverage is not met. Additional end-to-end tests (Cucumber) are in place where the code coverage is part of the business cases (FlexOVL, SMHE, DA) we build on top of GXF. The complete amount of tests lead to a very healty coverage for each business case.

80% coverage is therefor not a realistic goal for GXF to achieve!

These goals are part of the Gitbook documentation, see https://grid-exchange-fabric.gitbook.io/gxf/opensourcecommunity/contributing-to-the-code#guidelines.

Documentation on code tests can be found here: https://documentation.opensmartgridplatform.org/Opensourcecommunity/ToolsguidelinesCI.html

The project doesn't supress any warning on the java compiler and warning are visable in SonarCloud.

The project has a core principle: Secure-by-design.

The network connections are TLS secure and enscryption is used for sensative information.

The cryptographic hash algorithm that is used is configurable.

The project stores the authentication credentials and keys in separate and they can be updated wihout code recomplilation.

The project uses TLS1.2 or later.

The project uses TLS1.2 or later.

The project uses TLS certificate verification by default.

This depends on HTTPD by Apache.

Release are not published publically. User can download the source code and build the release by following the instructions on gitbook (https://grid-exchange-fabric.gitbook.io/gxf/)

The interfaces require the existence of a server side certificate and all input is validated for the correct data format and that they don't contain any scripting.

Vulnerability checks are part of the build process to validate vulnerabilities in used libraries. Code is being validated by SonarCloud. The used container images are also validated for all kinds of vulnerabilities. As we don't deploy VM's

This is part of the scan executed by SonarCloud. Additionally there are several security related scan being executed, by LF Energy (https://security.lfx.linuxfoundation.org/#/a092M00001JWs7KQAT/overview) and our internal SIG measurements en SonalCloud scans (https://sonarcloud.io/project/overview?id=OSGP_open-smart-grid-platform)

Documentation on used static code analysis: https://documentation.opensmartgridplatform.org/Architecture/Technical-overview/Technologystack.html

Dynamic code analysis is not implemented.