search

eclipse-tractusx / sig-release

https://eclipse-tractusx.github.io/sig-release
Apache License 2.0
8 stars 8 forks source link

R24.03 Discovery Finder - Release Checks #502

Closed kelaja closed 5 months ago

kelaja commented 7 months ago

Release Info

Please provide information on what you want to be included in the Eclipse Tractus-X release. If you are not owner of this issue, please provide the information as comment to the issue.

Version to be included in Eclipse Tractus-X release: helm: discoveryfinder-0.1.18 Image version: 0.2.7

Leading product repository: https://github.com/eclipse-tractusx/sldt-discovery-finder

Compliance Verifications

This issue tracks all compliance related checks, that need to be performed for a product release in Eclipse Tractus-X.

Documentation

Security Checks

General Checks

Test Results

Helpful Links

tunacicek commented 7 months ago

Gaia-X compliance: @kelaja : No changes since Release 23.12 -> Could you please tick this checkbox? Gaia-X compliance is not relevant for the Discovery Finder.

tunacicek commented 7 months ago

@kelaja : GDPR Compliance: No changes since Release 23.12 Catena-X.GDPR.Declaration.and.Requirements_V2024.03_Discovery.Finder.xlsx

tunacicek commented 7 months ago

Interoperability Check: Interoperability was ensured to Release 23.12. Since then no changes have been made. @kelaja : Could you please tick this checkbox?

tunacicek commented 7 months ago

Data Sovereignty Check: @vialkoje : Could you please tick this checkbox? No significant changes since Release 23.12.

tunacicek commented 7 months ago

Verification of foreseen CX Standards: @thomas-henn : Could you please confirm? See also previous task for R23.12: https://github.com/eclipse-tractusx/sig-release/issues/117

tunacicek commented 7 months ago

Documentation

@vialkoje : Could you please check and approve the checkboxes?

tunacicek commented 7 months ago

Security Checks- Thread Modelling Analysis: No changes since Release 23.12. See also Security Assessment diagram: https://github.com/eclipse-tractusx/sldt-discovery-finder/blob/main/docs/documentation.md#:~:text=INSTALL.md.-,Security,-Assessment

@guenterban : Could you please check and approve it?

tunacicek commented 7 months ago

User Journey : @thomas-henn : Could you please confirm? See also previous task for R23.12: https://github.com/eclipse-tractusx/sig-release/issues/120

tunacicek commented 7 months ago

Compliant with the Style Guide: N/A → no User Interface / no Frontend for this Service

@jjeroch : Could you please check and approve it?

thomas-henn commented 7 months ago

Verification of foreseen CX Standards: @thomas-henn : Could you please confirm? See also previous task for R23.12: #117

Yes, Discovery Finder is compliant with relevant published CX Standards.

thomas-henn commented 7 months ago

User Journey : @thomas-henn : Could you please confirm? See also previous task for R23.12: #120

Yes, user journey of Discovery Finder is aligned along with e.g. Digital Twin Registry, BPN Discovery and Semantic Hub.

tunacicek commented 7 months ago

Security Checks - Dynamic Application Security Testing (DAST): Invicti scan has been made - the results can be seen here: https://www.netsparkercloud.com/scans/report/b49918c6505a46783ef3b11101e9d7e0/

@PiotrStys : Could you please review and approved it?

PiotrStys commented 6 months ago

Hi @tunacicek, DAST approved.

tunacicek commented 6 months ago

Security Check- Secret scanning:

Secret Scanning (gitleaks) is activated and available: https://github.com/eclipse-tractusx/sldt-discovery-finder/actions/workflows/gitleaks.yml

@DnlZF Could you please review and approved it?

tunacicek commented 6 months ago

Security Checks - Static Application Security Testing (SAST): See the results here: https://analysiscenter.veracode.com/auth/index.jsp#ReviewResultsAllFlaws:47240:1739409:32851565:32821223:32836873::5382776

@BANANAS1337 : Could you please review and approved it?

tunacicek commented 6 months ago

Security Checks - Software Composition Analysis (SCA): https://analysiscenter.veracode.com/auth/index.jsp#ReviewResultsSCA:47240:1739409:32851565:32821223:32836873:::::5382776: @BANANAS1337 : Could you please review and approved it?

tunacicek commented 6 months ago

Security Checks - nfrastructure as Code https://github.com/eclipse-tractusx/sldt-discovery-finder/actions/workflows/kics.yml @RoKrish14 : Could you please review and approved it?

tunacicek commented 6 months ago

Test Results - E2E Integration Test Tests done: See result here: https://jira.catena-x.net/browse/CXSOLUTION-489

RoKrish14 commented 6 months ago

@tunacicek : As discussed-

SAST: Approved SCA: Approved IAC: Approved Secret Scanning: Approved

jjeroch commented 6 months ago

Compliant with the Style Guide: N/A → no User Interface / no Frontend for this Service

@jjeroch : Could you please check and approve it?

confirmed

vialkoje commented 6 months ago

Expert Approval granted for Documentation and data sovereignty.

DirkBTSI commented 6 months ago

INT test performed/documented. E2E test performed/documented. No high defect. TM approved @kelaja : please approve for "E2E Integration Test passed"

RolaH1t commented 6 months ago

Open: InterOP ThreatModeling & Container Scans TRG QG approval postponed until topics addressed / no follow-up mtg required.

RoKrish14 commented 6 months ago

Discussed with @tunacicek Container Scans: Approved

szymonkowalczykzf commented 6 months ago

Security Assessment Process (Threat Modeling Analysis) approved.

No significant changes detected since last release (23.12). No open critical & high finding remaining for this release.

Documentation of the assessment will be moved out to the GitHub repositories of the Products before the next release.

HiHenrik commented 6 months ago

According to team no interoperability relevant changes for this release, therefore expert approval granted for interoperability

tomaszbarwicki commented 6 months ago

QG checks completed: https://github.com/eclipse-tractusx/sldt-discovery-finder/issues/110

RolaH1t commented 6 months ago

QG approval granted! Congrats, Roland