search

eclipse-tractusx / sig-release

https://eclipse-tractusx.github.io/sig-release
Apache License 2.0
8 stars 8 forks source link

R24.03 Discovery Service (BPN Finder) - Release Checks #503

Closed kelaja closed 5 months ago

kelaja commented 7 months ago

Release Info

Please provide information on what you want to be included in the Eclipse Tractus-X release. If you are not owner of this issue, please provide the information as comment to the issue.

Version to be included in Eclipse Tractus-X release: Helm Chart Version: 0.1.18 App Version: 0.2.8

Leading product repository: https://github.com/eclipse-tractusx/sldt-bpn-discovery

Compliance Verifications

This issue tracks all compliance related checks, that need to be performed for a product release in Eclipse Tractus-X.

Documentation

Security Checks

General Checks

Test Results

Helpful Links

tunacicek commented 7 months ago

Gaia-X compliance: @kelaja : No changes since Release 23.12 -> Could you please tick this checkbox? Gaia-X compliance is not relevant for the Discovery Finder.

tunacicek commented 7 months ago

Release Mangement

GDPR compliance: No changes since Release 23.12 Catena-X.GDPR.Declaration.and.Requirements_V2024.03_BPN.Discovery.xlsx

tunacicek commented 7 months ago

Interoperability Check: Interoperability was ensured to Release 23.12. Since then no changes have been made. @kelaja : Could you please tick this checkbox?

tunacicek commented 7 months ago

Data Sovereignty Check: @vialkoje : Could you please tick this checkbox? No significant changes since Release 23.12.

tunacicek commented 7 months ago

Verification of foreseen CX Standards: @thomas-henn : Could you please confirm? See also previous task for R23.12: https://github.com/eclipse-tractusx/sig-release/issues/121

tunacicek commented 7 months ago

Documentation

@vialkoje : Could you please check and approve the checkboxes?

tunacicek commented 7 months ago

Security Checks- Thread Modelling Analysis: No changes since Release 23.12. See also Security Assessment diagram: https://github.com/eclipse-tractusx/sldt-bpn-discovery/blob/main/docs/documentation.md#:~:text=Security-,Assessment,-Data%20Flow%20Diagram

@guenterban : Could you please check and approve it?

tunacicek commented 7 months ago

User Journey : @thomas-henn : Could you please confirm? See also previous task for R23.12: https://github.com/eclipse-tractusx/sig-release/issues/124

tunacicek commented 7 months ago

Compliant with the Style Guide: N/A → no User Interface / no Frontend for this Service

@jjeroch : Could you please check and approve it?

thomas-henn commented 7 months ago

Verification of foreseen CX Standards: @thomas-henn : Could you please confirm? See also previous task for R23.12: #121

Yes, BPN Discovery Service is compliant with relevant published CX Standards.

thomas-henn commented 7 months ago

User Journey : @thomas-henn : Could you please confirm? See also previous task for R23.12: #124

Yes, user journey of BPN Discovery is aligned along with e.g. Digital Twin Registry, Discovery Finder and Semantic Hub.

tunacicek commented 7 months ago

Security Checks - Dynamic Application Security Testing (DAST): Invicti scan has been made - the results can be seen here: https://www.netsparkercloud.com/scans/report/87f6d8d3119b4e596344b111023574bc/

@PiotrStys : Could you please review and approved it?

PiotrStys commented 7 months ago

@tunacicek, results approved with a side note to validate the current DAST findings. Thank you.

tunacicek commented 6 months ago

Security Check- Secret scanning:

Secret Scanning (gitleaks) is activated and available: https://github.com/eclipse-tractusx/sldt-bpn-discovery/actions/workflows/gitleaks.yml

@DnlZF Could you please review and approved it?

tunacicek commented 6 months ago

Security Checks - Static Application Security Testing (SAST): Please see the results here: https://analysiscenter.veracode.com/auth/index.jsp#ReviewResultsAllFlaws:47240:1739413:32851550:32821208:32836858::5382788

@BANANAS1337 : Could you please review and approved it?

tunacicek commented 6 months ago

Security Checks - Software Composition Analysis (SCA): https://analysiscenter.veracode.com/auth/index.jsp#ReviewResultsSCA:47240:1739413:32851550:32821208:32836858:::::5382788: @BANANAS1337 : Could you please review and approved it?

tunacicek commented 6 months ago

Security Checks - nfrastructure as Code https://github.com/eclipse-tractusx/sldt-bpn-discovery/actions/workflows/kics.yml @RoKrish14 : Could you please review and approved it?

tunacicek commented 6 months ago

Test Results - E2E Integration Test Tests done: See result here: https://jira.catena-x.net/browse/CXSOLUTION-489

RoKrish14 commented 6 months ago

@tunacicek : As discussed-

SAST: Approved SCA: Approved IAC: Approved Secret Scanning: Approved

jjeroch commented 6 months ago

Compliant with the Style Guide: N/A → no User Interface / no Frontend for this Service

@jjeroch : Could you please check and approve it?

confirmed

vialkoje commented 6 months ago

Expert Approval granted for Documentation and data sovereignty.

DirkBTSI commented 6 months ago

INT test performed/documented. E2E test performed/documented. No high defect. TM approved @kelaja : please approve for "E2E Integration Test passed"

RolaH1t commented 6 months ago

Open: InterOP ThreatModeling & Container Scans TRG QG approval postponed until topics addressed / no follow-up mtg required.

RoKrish14 commented 6 months ago

Discussed with @tunacicek Container Scans: Approved

szymonkowalczykzf commented 6 months ago

Security Assessment Process (Threat Modeling Analysis) approved.

No significant changes detected since last release (23.12). No open critical & high finding remaining for this release.

Documentation of the assessment will be moved out to the GitHub repositories of the Products before the next release.

HiHenrik commented 6 months ago

According to team no interoperability relevant changes for this release, therefore expert approval granted for interoperability

FaGru3n commented 6 months ago

Hi all are these the proper information for the QG-Checks?

Product Owner: @bs-sili Dev SPOC: @tunacicek Helm Chart Version: 0.2.3 App Version: 0.2.8

Issue created https://github.com/eclipse-tractusx/sldt-bpn-discovery/issues/109

FaGru3n commented 6 months ago

QG checks done.

RolaH1t commented 6 months ago

QG4 approval granted. Congrats!