Eclipse Steady

Repository on GitHub, which provides public git repositories with URLs.

Repository on GitHub, which uses git. git can track the changes, who made them, and when they were made.

https://github.com/eclipse/steady/releases

Repository on GitHub, which uses git. git is distributed.

Semver is used Releases are tagged on GitHub: https://github.com/eclipse/steady/releases Java artifacts are deployed on Maven: https://search.maven.org/search?q=com.sap.research.security.vulas

https://github.com/eclipse/steady/tags

https://github.com/eclipse/steady/releases includes descriptions of bug fixes, improvements, features and breaking changes.

No publicly known vulnerabilities

Read https://eclipse.github.io/steady/contributor/#report-bugs, then open an issue at https://github.com/SAP/vulnerability-assessment-tool/issues/new/choose or a StackOverflow question at https://stackoverflow.com/questions/tagged/vulas.

https://github.com/eclipse/steady/issues

All issues are acknowledged and tried to be fixed with major priority

All requests are and were answered

https://github.com/eclipse/steady/issues?utf8=%E2%9C%93&q=is%3Aissue+sort%3Aupdated-desc+

https://sap.github.io/vulnerability-assessment-tool/contributor/#report-bugs

An email is present opensource@sap.com.

Non-trivial build file in repository: https://github.com/eclipse/steady/blob/master/pom.xml Docs' build process: https://github.com/eclipse/steady/tree/master/docs Easy docker setup process: https://github.com/eclipse/steady/tree/master/docker and https://eclipse.github.io/steady/admin/

Non-trivial build file in repository: https://github.com/eclipse/steady/blob/master/pom.xml Maven is used to build the Java core components. Docker to build the test containers. Python to build the documentation.

Maven and Docker are FLOSS, see pom.xml and .travis.yml for information about other FLOSS tools used during the build.

JUnit tests and integration tests are part of every Maven module

JUnit tests and integration tests are invoked with the Maven Surefire and Failsafe plugins (mvn test).

Travis jobs are used to build and test the Java core application, to check code style and analyze the code using Spotbugs, to build the Javadoc and src artifacts (required for deployments on Maven Central), to check if the documentation is buildable and if there are dead links, and - finally - to build and test Docker containers.

Tests of new functionalities are informally asked for new tests to be added. Core contributors add tests.

New features are asked to be tested.

The requirements to add tests is documented at https://eclipse.github.io/steady/contributor/#contribution-content-guidelines.

The Maven compiler plugin has been configured to show compilation and depreciation warnings. Such warnings are reviewed and - where applicable - addressed by the core developers.

Warnings are reviewed and addressed by the core developers where applicable.

The core developers work for many years in security research and security testing departments.

Steady makes use of cryptographic hash functions to identify and distinguish application dependencies (e.g., Java archives). Here, it uses standard digest algorithms provided in the java.security package.

Steady itself does not implement any cryptographic functions, algorithms or protocols.

The core logic of the application does not encrypt anything on its own.

Steady makes use of SHA1, however, not in the context of a security mechanism (but to identify and differentiate application dependencies, e.g., archives, which are managed by dependency managers and kept in the file system).

See previous answer.

No passwords are stored, and no user management is present.

Users can protect all client-server communication with HTTPS by creating and installing certificates and configuring the respective endpoints.

See previous answer.

Spotbugs is run for every PR.

Spotbugs includes a number of security checks: https://spotbugs.readthedocs.io/en/latest/bugDescriptions.html#security-security

Spotbugs is run for every PR

The project is developed in Java and Python.