...
| Jira No | Summary | Description | Status | Solution | Last TSC meeting |
| ongoing | Last PTLs meeting | Finally executed, but SECCOM message remains:
| ongoing | to close tickets for projects not participating in Istanbul release - done. | Software BOMs, Hardware BOMs - Muddasar | |||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
We follow PoC idea - first we take a look at the CI/CD pipeline, collect the data and store it as we want it., who is the consumer in ONAP framework, we will have to select one of three formats discussed during the last session.
| ongoing | Seccom criteria for the integration tests to pass a release | ongoing | Security Risk Assessment and Acceptance – revisit Brian’s statement | To be discussed next week. | CII Badging update - Tony | Progress in the applications. Review results at 31 August meeting | M3 update | Java upgrades - good progress. Python good progress as well. Packages upgrades - very good progress - 16 tickets closed already - vulnerabilities removed: 679/776 (based on tickets). Still some pprojects that did some upgrades but no update on the restricted Wiki. New Sonatype function to filter direct vs. transitive dependencies. Weak cryptography and injection items - excellent progress. There are still few there open (projects no longer maintained - e.g. Portal). For Jakarta, few other items that SonarCloud highlights - Jira tickets to be written for those (blocking and critical). | ongoing | To be checked if we have waivers for all remaining ticktets. PTLs meeting shall address the gaps on the restricted Wiki. Projects with open status on their Jira tickets to be elaborated. Will Portal be excluded from ONAP future releases? - Byung to investigate. | ||||||
| Software BOMs | Documentation review - nexus account manager contacted. It is part of Nexus product lifecycle licence (cyclone DX format). APIs for info extraction to be checked. Access to Nexus-IQ server - what group shall be used for that - REST API calls are possible now - will be used for SW BOMs. | ongoing | |||||||||||||||
| Logging requirements | Almost 50% of the metadata fields defined - good progress. In some of the GitHub repos md (markdown) files with good description for logging - SO is a good example. | ongoing | |||||||||||||||
| Dependency confusion attacks vs. ONAP SW build process | No updates on the Wiki... Bob will work this week and trying to check filtering rules with Jess for this type of threat. | ongoing | Bob to contact Jess. | Logging requirement - update from Friday's meeting | Long Format overview by Robert Heinemann
| ongoing | Meetings held Friday at 4PM CET OOM feedback to be collected on K8s and Docker coexistance.. Byung to send an e-mail to Krzysztof and Sylvain. | Logs consumption | Context delivery for the logs by tagging. Currently we are focusing on logs generation and collection but later will will have to cover processing. APIs availability to bring the data back in to make an action. Lot o data collected in DCAE, decision can be taken outside of ONAP system. | ongoing | LFN Security Group – focus, outcomes, contributions | Kick-off meeting scheduled on 18th of August.
| ongoing | Default setting for software configuration to be reviewed i.e. TCP window x, autonegotiate network parameters by default.Bob had exchanges with Jess on filtering rules and dependencies management software. | on hold | To be further elaborated with Samuli. | |
| Security Risk Assessment and Acceptance | Excel table that was initially prepared 3 years ago to be shared and reviewed at the next SECCOM, frameworks to be reviewed as well (MIST and ISO). | ongoing | |||||||||||||||
| Feature request template | Alla leading ONAP Requirements Subcommittee to be contacted to provide details. | ongoing | Muddasar to be introduced to Alla by Pawel. | ||||||||||||||
| Last TSC meeting |
| ongoing | |||||||||||||||
| Code quality update | Status to be checked, there were some exchanges with Thierry and Jess. | ongoing | Slide to be presented to next PTLs meeting. | ||||||||||||||
| Last PTLs meeting | Meeting was cancelled (Labor day in US) | ongoing | slot to be booked for the next PTLs meeting. | ||||||||||||||
| CADI and AAF replacement | DCAE and DMaaP communication - new proposal to be presented today at the Architecture Subcommittee. | ongoing | Byung to present update for the next SECCOM | ||||||||||||||
| OUR NEXT SECCOM MEETING CALL WILL BE HELD ON 14th OF SEPTEMBER'21. | M3 update - waivers review Software BOMs Logging requirements update Security Risk Assessment and Acceptance – revisit Brian’s statementreview frameworks and old excel file Dependency confusion attacks vs. ONAP SW build process - synch with Samuli Code quality update CADI and AAF replacement |
Recording:
| View file | ||||
|---|---|---|---|---|
|
SECCOM presentation:
| View file | ||||
|---|---|---|---|---|
|