Page Comparison

Toine Siebelink new elected PTL - Configuration & Persistency Service R7

Action point from last PTL meeting - Determine what can be achieved regarding the approved best practices for the Honolulu release.

SECCOM runs (among other things):

• Software Composition Analysis with Nexus-IQ for vulnerabilities and re commended upgrades for direct dependencies.
• CII Badging (passing, silver and gold levels) - self reported. Majority of projects are at passing level.
• SonarCloud scans - used for an automated code coverage (80-90% of code). Use of various cryptography under exploration.
• Securing communication (https protocol) - tested at build time
• Removing secrets
• Not running as root

Jenkins jobs for CPS need to be revised (last time scan failed) - ticket to be opened to LFN for that.

Access to Nexus-IQ reports for Toine - ticket to be opened to LFN for that.

Under SonarCloud nearly 50% achieved so far by CPS.

Access to security vulnerability space Wiki to be organized for Toine - ticket to be opened to LFN for that.

Links for Toine:

https://jenkins.onap.org/view/CLM/job/cps-maven-clm-master/

/wiki/spaces/SV/overview

Feedback from the PTLs about the SECCOM plan on proposing that Python 2 -> 3 and Java 8 -> 11 become Honolulu Global requirements

Guilin Java upgrade results: onap-guilin-java-versions.xlsx

Guilin Python upgrade results: onap-guilin-python-versions.xlsx

Exception process is needed, PostgreSQL mentionned by Vijay. List of impacted projects requested by Seshu.

• LFN Developer & Testing Forum - Feb 1 - 4, 2021.
• Registration
• Proposals Page- Session proposals are due January 15th 

SECCOM does +1 or -1 and we need TSC to provide +1 or -1 before we put +2.

TSC shall approve exception.

#AGREED The TSC approves REQ-437 (Python 2 -> 3) and REQ-438 (Java 8 -> 11) as Global Requirements beginning with the Honolulu release.

-Exception process – TSC involvement (with +2 acceptance)

HELMv3

CII Badging

Packages upgrades

Last PTL session – was in fact a TSC session

Discussion on global requirements and best practices for Honolulu

LFN Developer & Testing Forum - Feb 1 - 4, 2021.

Please register (Registration)

SECCOM proposals:

• Global requirements and DCAE testimony on Java migration
• Packages upgrades – Focus on most commonly used packages
• CII Badging – 3 items: additional verification test for crypto weakness (integration team to be addressed), crypto credentials, secure design
• Service Mesh update (TBC with Krzysztof)?

Special guest star: Vijay joined us.

• DCAE jiras review:

Python: DCAEGEN2-2494, DCAEGEN2-2427

Java: DCAEGEN2-2428, DCAEGEN2-2381