search

eclipse-tractusx / sig-release

https://eclipse-tractusx.github.io/sig-release
Apache License 2.0
8 stars 10 forks source link

R24.03 Trace-X - Release Checks #506

Closed kelaja closed 7 months ago

kelaja commented 9 months ago

Release Info

Please provide information on what you want to be included in the Eclipse Tractus-X release. If you are not owner of this issue, please provide the information as comment to the issue.

Version to be included in Eclipse Tractus-X release:

Helm Chart Version: 1.3.28 App Version: 10.3.0

Leading product repository:

Compliance Verifications

This issue tracks all compliance related checks, that need to be performed for a product release in Eclipse Tractus-X.

Documentation

Security Checks

General Checks

Test Results

Helpful Links

mkanal commented 8 months ago

Hello @vialkoje

Documentation:

Docu Arc24 documentation Administrators Guide End-User manual Interface documentation

Thank you very much Martin

mkanal commented 8 months ago

@kelaja please update the status based on the following information:

mkanal commented 8 months ago

@wjost, kindly ask for your approval regarding Gaia-X compliance. There are no changes between 24.3 and already approved version 23.12. Thank you very much Martin

wjost commented 8 months ago

For Release R24.03 we do not support Targus-Release auf GXDCH. Hence „Gaia-X compliance“ is still on the level of R23.12. I confirm this release is GAIA-X compliant.

mkanal commented 8 months ago

Interoperability checks

Preparation for Business Hour 19.2.2024 17:30 - 18:15 Participants @jzbmw & @mkanal https://confluence.catena-x.net/display/PL/2024-02-12+InterOp+for+TraceX+and+IRS

mkanal commented 8 months ago

Threat Modeling Analysis passed

@pablosec @scherersebastian There are no relevant changes in either product compared to R23.12. For this reason, we would like to request the release of the QGC "Threat Modelling Analysis passed" based on the R23.12 release.

mkanal commented 8 months ago

Data Sovereignty checks performed

@vialkoje @cwBMW Data Sovereignty Guardrails for Release 24-03 referring to the QG or Q-Gate Criteria Release 23-12. As Trace-X has an approval of Data Sov Guardrails for R23.12 this approval might be valid for R24.3 as well. Trace-X team participates in Data Sov Weekly on Monday 19.2 to discuss the Data Sov of the product. Kindly ask for approval of Data Sovereignty

mkanal commented 8 months ago

Date: 14.2.2024

Static Application Security Testing (SAST) scans passed

@BANANAS1337 @RoKrish14

image

image

Dynamic Application Security Testing (DAST) tests passed

Backend

image

image

Secret Scans passed

@DnlZF

Software Composition Analysis (SCA) passed

VeraCode

@klaudiaZF @ZFLokesh @RoKrish14 @Tim.herres Dependencies must be scanned with Veracode tool in regard to vulnerability

image

Container Scans passed

@RoKrish14

jjeroch commented 8 months ago

Findings UI/UX

Functional Request Where can I find the details of the policies - I do not understand those policy details Image

ds-mmaul commented 8 months ago

Date: 14.2.2024

Static Application Security Testing (SAST) scans passed

  • [x] @ds-mmaul Please add mitigation comment for 3 medium findings in frontend

  • [x] code must be scanned weekly with Veracode tool

  • [x] medium risks require mitigation statement @ds-mmaul

  • [x] only medium findings

image

image

Dynamic Application Security Testing (DAST) tests passed

Backend

image

image

Secret Scans passed

Software Composition Analysis (SCA) passed

VeraCode

Dependencies must be scanned with Veracode tool in regard to vulnerability

  • [x] no high findings

image

Container Scans passed

Infrastructure as Code (IaC) scans passed

proposed mitigation for all three medium findings

ds-mmaul commented 8 months ago

Issues to address the UUX Feedback were created. You can find them with the "uux" label in our project

BANANAS1337 commented 8 months ago

SCA: Approved SAST: Approved

almadigabor commented 8 months ago

My first round of checks have been completed here. I've opened 2 small issues that needs fixing before I approve the QG.

vialkoje commented 8 months ago

Expert Approval granted - documents existing and looking consistent

DirkBTSI commented 8 months ago

INT test performed/documented. E2E test performed/documented. No high defect. TM approved @kelaja : please approve for "E2E Integration Test passed"

mkanal commented 8 months ago

image

jzbmw commented 8 months ago

As the PO i assure that in this minor release there have not been changes regarding interoperability to a earlier version

RolaH1t commented 8 months ago

Secret scans pending 2 minor findings wrt TRGs StyleGuide findings must be rated (critical?) QG approval postponed until those topics are addressed

mkanal commented 8 months ago

Hello @DnlZF could you please approve the secrets scanning for product Trace-X. Thank you very much, Martin

DnlZF commented 8 months ago

Secret scans: approved

jzbmw commented 8 months ago

Findings UI/UX

  • update icon used for "Queued & Requested" Quality Investigations. Suggested Icon (Material UI): Image

  • QUALITY INVESTIGATIONS table

    • missing frame on right and left side
    • button "view all" is unclear - I can see no-where how many records are even available - please add somewhere the information of record numbers
    • button "view all" is also displayed if the table has "0" records; in this case I suggest to disable the button/option
  • same as the bullet points above also applies for QUALITY ALERTS
  • used colors unclear - please recheck Image Image
  • Navigation: please use checkboxes for such navigations where multiple selects are possible. Current used element is a single select element Image
  • Overlay implementation does not follow the guidelines of cx Image
  • User Infos: "createAlert" tooltip info unclear Image
  • User direction - why does clicking "closed" on the right hand side results into such an overlay of investigation closure? Unclear Image

Functional Request Where can I find the details of the policies - I do not understand those policy details Image

The Frontend findings will be refactored with the Release 24.05. With the major release we plan to implement further bigger frontend changes.

almadigabor commented 8 months ago

I'm done with the QG checks, all issues have been fixed, I approve it.

mkanal commented 8 months ago

Findings UI/UX

  • update icon used for "Queued & Requested" Quality Investigations. Suggested Icon (Material UI): Image

  • QUALITY INVESTIGATIONS table

    • missing frame on right and left side
    • button "view all" is unclear - I can see no-where how many records are even available - please add somewhere the information of record numbers
    • button "view all" is also displayed if the table has "0" records; in this case I suggest to disable the button/option
  • same as the bullet points above also applies for QUALITY ALERTS
  • used colors unclear - please recheck Image Image
  • Navigation: please use checkboxes for such navigations where multiple selects are possible. Current used element is a single select element Image
  • Overlay implementation does not follow the guidelines of cx Image
  • User Infos: "createAlert" tooltip info unclear Image
  • User direction - why does clicking "closed" on the right hand side results into such an overlay of investigation closure? Unclear Image

Functional Request Where can I find the details of the policies - I do not understand those policy details Image

Hello @jjeroch , complete feedback is covered in pbis: https://github.com/orgs/eclipse-tractusx/projects/45/views/1?filterQuery=label%3Auux Thank you very much Martin

szymonkowalczykzf commented 8 months ago

Security Assessment Process (Threat Modeling Analysis) approved.

No significant changes detected since last release. No open critical & high finding remaining for this release.

Documentation of the assessment will be moved out to the GitHub repositories of the Products before the next release.

RoKrish14 commented 8 months ago

DAST: Approved

For below approval, based on discussion with @ds-mmaul and @ds-mwesener - Container Scans: Approved IAC: Approved

RolaH1t commented 8 months ago

@mkanal , @jzbmw , @jjeroch what is your conclusion on StyleGuide pls? All other Q-criteria are passed.

jjeroch commented 8 months ago

@mkanal , @jzbmw , @jjeroch what is your conclusion on StyleGuide pls? All other Q-criteria are passed.

Based on Johannes comment above, provisional approval was granted. In release 24.05. the review MUST get scheduled earlier and findings must get fixed in time

RolaH1t commented 8 months ago

pre-conditions all fulfilled; QG approval granted! Congrats!