Fabric Gateway client API

The project maintains only the most current release version but version-to-version compatibility is maintained. Semantic versioning is used to communicate this compatibility.

The project uses GitHub issues to track bugs and associated pull requests that resolve them.

No vulnerabilities reported. https://github.com/hyperledger/fabric-gateway/security/advisories

https://github.com/hyperledger/fabric-gateway/security/policy

Guidance on coding style is provided in the contributing guide: https://github.com/hyperledger/fabric-gateway/blob/main/CONTRIBUTING.md. Coding style is also codified in linting rules.

Rigorous linting and static analysis enforces a comprehensive set of code style rules at build time. These checks can be easily run locally by contributors, and are required to pass for all code changes.

The project delivers libraries to be used by consuming applications. No native binaries are produced.

The project delivers libraries for use by consuming applications.

The project delivers libraries for use by consuming applications.

Compilation of TypeScript to JavaScript, and Java to bytecode is carried out by a repeatable, automated build system. The versions and flags used are encoded in the project source and maintained in source control. This is a repeatable process.

The project delivers libraries for use by consuming applications. Go, Node.js and Java provide standard tools and mechanisms for adding or removing dependencies in consuming applications.

The project delivers libraries for use by consuming applications.

The project content is entirely contained within the source repository. The README file describes prerequisite tools and their versions. Additionally, the project provides a Dev Container definition that allows the entire development environment and all prerequisite tools to be created within a Docker container.

Standard Go module, Node.js (NPM) and Java (Maven) project definitions describe all dependencies. https://github.com/hyperledger/fabric-gateway/blob/main/go.mod https://github.com/hyperledger/fabric-gateway/blob/main/node/package.json https://github.com/hyperledger/fabric-gateway/blob/main/java/pom.xml

Daily scheduled vulnerability scans are run. Multiple vulnerability scanning tools are employed, including OSV-Scanner, Govulncheck, Sonatype Nancy, NPM audit and OWASP Dependency-Check.

Project dependencies (and their versions) are codified using language-specific mechanisms for Go, Node.js (NPM) and Java (Maven).

Project dependencies and language versions are actively updated to stay current. Linting and strict compiler flags highlight any usage of deprecated functions.

Extensive automated testing is required to pass on every code change.

All code changes must be accompanied by appropriate automated tests.

Code coverage is collected for Go, Node (Jest) and Java (Jacoco) unit test suites. All are above 80%.

The contributing guide states that code changes should include accompanying tests (and documentation): https://github.com/hyperledger/fabric-gateway/blob/main/CONTRIBUTING.md

The CONTRIBUTING guide documents the requirement for all code submissions to have appropriate accompanying unit and scenario tests: https://github.com/hyperledger/fabric-gateway/blob/main/CONTRIBUTING.md

Compilers are set with strict options and linters are used aggressively, requiring an explicit documented exception in the code to allow any failing check.

The project intentionally avoids direct access to cryptographic credentials, accessing cryptographic operations through pluggable APIs. Security is required and enforced by downstream APIs with which this project interacts. In addition to code review with security in mind, static analysis tooling (such as gosec) is used within the build process to aid identification of potential issues.

The default signing implementation uses ECDSA signatures with NIST-approved P-256 curve and SHA-256 hash.

The cryptographic implementation used is pluggable and specified by the consuming application. Several out-of-the-box implementations are provided for use, including P-256, P384 and Ed25519 for signing, and SHA-2 (SHA-256, SHA-384) and SHA3 (SHA3-256, SHA3-384) for hashing.

The project uses a signing implementation function provided by the consuming application. The project code does not make use of private keys directly. The consuming application has responsibility for how authentication credentials are stored.

The project makes use of gRPC connections with TLS authentication supplied by the consuming application. It is the responsibility of the consuming application to configure appropriate authentication settings on the connection.

TLS version support is provided by gRPC: https://grpc.io/docs/guides/auth/

TLS certificate verification is carried out by gRPC and is out of scope of the project itself.

TLS certificate verification is carried out by gRPC as part of the initial establishment of a connection and is out of scope of the project itself.

Release artifacts are published to the public NPM registry and Maven Central repository. Both of these include their own signing mechanisms.

https://github.com/hyperledger/fabric-gateway/tags

Inputs are used to build API requests. The content is validated at the server end of the API request.

Strict compiler options and linting are used to enforce safe data access.

https://hyperledger-fabric.readthedocs.io/en/latest/security_model.html

gosec, CodeQL

Go, TypeScript and Java.