Please find below the Minutes of Meetings and recording for the SECCOM meeting that was held on 15th of March 2022.
| Jira No | Summary | Description | Status | Solution |
|---|---|---|---|---|
Out of band planning for issues and topics, technical debt | Target of 10-20% of development capacity on technical debt. This should be discussed at the planning meetings. El-Alto release was focussed on technical debt. Now we have Global Requirements implemented and reviewed compliance every release. We first focussed on Java and Python upgrades, but also to take all of the interfaces to support HTTPs, upgrade direct dependencies, or Sonarcloud findings that are security related that are critical to be fixed. Other activity is code quality improvement. ODL allignement is managed by Dan who does the upgrade based on what is available on ODL side. Mainly requirement coming from security point of view are the recurring ones (every 6 months cycle), except for code quality improvement requirement. Log4j was a good example of out of band planning, extraordinary event that we responded. | started | ||
| Code quality gate | Meeting with Seshu planned by due to calendar issue it will be moved to next week. How to turn-on/off Jenkins job example: Enabling Jenkins job sonar-verify CPS blocks the code if did not pass quality gate. | |||
| Synch with ONAP documentation - Thomas | Release Notes organization: Log4j vulnerabilities in direct dependencies were removed from A&AI, DMAAP, SDNC and VNFSDK. Log4j vulnerabilities introduced by transitive dependencies are still in A&AI, CCSDK, DCAE, DMAAP, MULTICLOUD, SDNC, SO, VNFSDK. https://docs.onap.org/en/latest/release/index.html#istanbul-maintenance-release-9-0-1
Projects/functional repos with transitive dependencies for log4j:
| ongoing | Tickets to be open by Pawel for remaining transitive dependencies on per relevant project basis: | |
| Security Logging Presentation to Akraino TSC - Bob | Logging today at 1500 UTC. Here is the meeting info if you would like to join. https://wiki.akraino.org/display/AK/TSC+2022-03-08+%28Tuesday%29+7%3A00+am+Pacific | ongoing | ||
ONAP Security Review Questionnaire template first cut – Tony | https://wiki.onap.org/display/DW/ONAP+Security+Reviews We want to start simple and small. Time it takes to document vulnerabilities and time it takes to resolve it. Assurance section might be expanded. | ongoing | SECCOM members to review proposed draft and further discuss next week. | |
| Packages upgrades for Jakarta | As of today the project teams have upgraded 103 of 299 identified vulnerable direct dependencies for the release (~34%). | Ask TSC to have focus on security by sending an e-mail to TSC and discuss this issue on Thursday. | ||
| Time shift in US on 13th March and in EU on 27th March. | Please check if the meeting invitations are displayed accordingly. | |||
| Quality gates | No update. Meeting with Seshu to be done. | |||
| Issue with Wiki creation by Tony | Ticket to be created to solve the issue | Ticket to be created to solve the issue | ||
SECCOM MEETING CALL WILL BE HELD ON 22nd OF MARCH'22. | 5Y review criteria. SonarCloud fixing with new code focus. Quality gates for code quality improvements - continuation of the discussion. |
Recording:
SECCOM presentation: