R24.03 - Eclipse Data Space Connector (EDC) Release Checks

[kelaja]

Release Info

Please provide information on what you want to be included in the Eclipse Tractus-X release. If you are not owner of this issue, please provide the information as comment to the issue.

Version to be included in Eclipse Tractus-X release: 0.5.x

Leading product repository: repository link

Compliance Verifications

This issue tracks all compliance related checks, that need to be performed for a product release in Eclipse Tractus-X.

• [x] Gaia-X compliance confirmed
• [x] GDPR compliance confirmed (personal data, data protection + privacy DPP)
• [x] Interoperability checks performed
• [x] Data Sovereignty checks performed
• [x] Compliant with relevant published CX Standards (see the Catena-X standard library)

Documentation

• [x] Arc24 documentation up-to-date
• [x] Administrators Guide up-to-date
• [x] End-User manual up-to-date
• [x] Interface documentation up-to-date

Security Checks

• [x] Thread Modelling Analysis passed
• [x] Static Application Security Testing (SAST) scans passed
• [x] Dynamic Application Security Testing (DAST) tests passed
• [x] Secret Scans passed
• [x] Software Composition Analysis (SCA) passed
• [x] Container Scans passed
• [x] Infrastructure as Code (IaC) scans passed

General Checks

• [x] Tractus-X Release Guidelines fulfilled
• [x] Compliant with the Style Guide

Test Results

• [x] E2E Integration Test passed
• [x] User Journey approved

Helpful Links

• Eclipse Tractus-X openAPI specs on SwaggerHub
• Catena-X standard library

[stefan-ettl]

SAST Scan done - no findings:

[stefan-ettl]

SCA Scan done - no findings:

[stefan-ettl]

Container Scan with Trivy - passed: https://github.com/eclipse-tractusx/tractusx-edc/actions/runs/7931952515

[stefan-ettl]

Since there was only a Patch regarding Bugfixes, no change in regards to compliance.

Gaia-X compliance confirmed GDPR compliance confirmed (personal data, data protection + privacy DPP) Interoperability checks performed Data Sovereignty checks performed Compliant with relevant published CX Standards (see the Catena-X standard library)

[stefan-ettl]

Since there was only a Patch regarding Bugfixes, no change in regards to Documentation: @vialkoje could you please confirm? Arc24 documentation up-to-date Administrators Guide up-to-date End-User manual up-to-date Interface documentation up-to-date

[stefan-ettl]

Secret Scans of 0.5.4 - no findings.

[stefan-ettl]

Thread Modelling Analysis passed - no change in regards to the last release. @pablosec can you confirm?

[wolf4ood]

Latest tests Run with IaC tests

https://github.com/eclipse-tractusx/tractusx-edc/actions/runs/7958280287

[vialkoje]

as there was no change, documentation is sufficient. Expert approval granted

[FaGru3n]

@vialkoje

as there was no change, documentation is sufficient. Expert approval granted

Documentation

• [ ] Arc24 documentation up-to-date
• [ ] Administrators Guide up-to-date
• [ ] End-User manual up-to-date
• [ ] Interface documentation up-to-date

all of them?

[stefan-ettl]

TRGs completed in 23.12 - no code change since then. https://github.com/eclipse-tractusx/tractusx-edc/issues/885

[stefan-ettl]

Style Guide is n.a. because the EDC has no frontend.

[stefan-ettl]

User Journey approved by PO because there is no BO for the EDC.

[RoKrish14]

Quality Gate check performed with @wolf4ood:

SAST: Approved SCA: Approved DAST: Approved Secret Scans: Approved IAC: Approved Container scans: Approved

[DirkBTSI]

INT test not performed/not documented. E2E test not performed/not documented. EDC is directly "co-tested" by some systems during the execution of the E2E test. No high defect. TM approved @kelaja : please approve for "E2E Integration Test passed"

[stefan-ettl]

Interoperability checks performed Data Sovereignty checks performed no change compared to 0.5.x Gate Review in December - therefore valid for 24.03 as well.

[RolaH1t]

QG review performed in question => TRG / will be confirmed with System team, as EDC version 0.5.x was already part of R24.03

[szymonkowalczykzf]

Security Assessment Process (Threat Modeling Analysis) approved.

No significant changes detected since last release. No open critical & high finding remaining for this release.

Documentation of the assessment will be moved out to the GitHub repositories of the Products before the next release.

[FaGru3n]

Question to TRG if this is still needed https://github.com/eclipse-tractusx/tractusx-edc/issues/885 while TRG updates?

[RolaH1t]

QG4 approval granted. Congrats!