2023-02-28 Security Subcommittee Meeting Notes

Wrapping up the unmaintained repo task force 

Amy presented actual status.

Recap of the new process to remove repos and artifacts from the release.

1. Identifying the candidate (no PTL), Jenkins script verifies for not updated artifact  for last 12 months

2. Investigating if it is still needed, migration path from getting supported to getting removed. Jira for ArchiCOM to be issued.

3. Removal - remove Jenkins job that generates images for the release. Jira tickets to be created for Doc and OOM projects.

Byung is working on updated architecture drawing for ONAP.

TSC to be informed on what are the components as part of the release. This could come from Docs project but earlier than at the moment of releasing.

Security Questionnaire for CPS

• https://lf-onap.atlassian.net/wiki/display/DW/CPS+-+ONAP+Security+Review+Questionnaire

• all SECCOM comments were reviewed with CPS team.

ARCHCOM LFN DTF presentation, https://wiki.lfnetworking.org/download/attachments/82904014/ONAP-ARCCOM-Update-London-2023-02-14-Final2.pptx?version=1&modificationDate=1676388390000&api=v2  - see page 6 for the security framework component

• Review SECCOM feedback on 28 February call

• Invite CPS to 7 March SECCOM call

PTL meeting (February 27th)

Continuation of Release Management tasks review

SECCOM MEETING CALL WILL BE HELD ON 7th March 2023. 

• CPS Security questionnaire review by SECCOM.

• IT-24999 Security Issue - Sensitive information leakage 

• Python PoC by Bob – Work in Progress – Fiachra still to be contacted

• Progress on package upgrades

• Progress on unmaintained repos