Administrative and Security Code Review

[jessemapel]

All software must have an administrative security review before it is made publicly available by any method. This type of review ensures personal, private, or otherwise sensitive information is not included in the repository. Types of sensitive information include:

• Personally identifiable information (PII)
• Absolute file system paths
• Internal server host names or IP addresses
• Usernames/passwords

Administrative security reviews may be performed by any trusted person; the reviewer does not necessarily need a strong scientific or programming background. When migrating an existing project into any non-private Git repository, it is important to remember that the entire project history needs to be reviewed if that history is to be maintained after migration.

[acpaquette]

• No PII other than an email in the code.json for a point of contact

• Absolute file paths found in the following:
  1. Examples/notebooks:
• bundle_adjust
• bundle_adjust_distributed
• cassini_isis_nac_cmp
• cassini_isis_wac_cmp
• data_snooping
• dawn_fc_isis_cmp
• footprint_cmp
• footprint_control
• kaguya_tc_isis_cmp
• lronac_isis_cmp
• mdis_extra_cmp
• messenger_mdisnac_isis_cmp
• mex_hrsc_isis_cmp
• mro_ctx_isis_cmp
• mro_hirise_isis_cmp

2. Examples/data/:
   • EN0213023991M.json

   • EN0213110924M.json

   • One potential server referenced in the gitlab-ci.yml is code.usgs.gov:5001/astrogeology/knoten/ubuntu:latest but code.usgs.gov is technically public facing so it may be acceptable?

   • No usernames or passwords for internal accounts

[jessemapel]

One potential server referenced in the gitlab-ci.yml is code.usgs.gov:5001/astrogeology/knoten/ubuntu:latest but code.usgs.gov is technically public facing so it may be acceptable?

This is acceptable.

[jessemapel]

The release is going to need to be re-done once the issues in the administrative review are resolved.

[jessemapel]

I will address these issues while I'm working on ALE's history too.

[jessemapel]

I've wiped the history for the files with paths, then re-added them with the internal paths removed or converted to relative paths. @acpaquette This should be ready for a re-review.

[acpaquette]

Everything looks to have been addressed. Knoten is ready for release!