Proposed Updates to Release Templates (Dublin) - Security Questions

Practice Area

Checkpoint

Yes/No

Evidence - Comment

How to?

Security

Has the Release Security/Vulnerability table been filled out in the   protected Security Vulnerabilities wiki space?

Table in in the protected Security Vulnerabilities wiki space   corresponds to the latest NexusIQ scan

PTL reviews the NexusIQ scans for their project repos and fills out   the vulnerability review table

Have known vulnerabilities (critical and severe) to address/remove in   the release been identified with jira tickets?

Jira tickets exist for vulnerabilities or the project indicates that   there will be no vulnerable library replacement

Create Jira tickets

Has the project committed to the release CII badging level

Project plans that include

See https://www.coreinfrastructure.org/programs/badge-program/ and https://lf-onap.atlassian.net/wiki/display/DW/CII+Badging+Program

Has the project created their project CII questionnaire and completed the ONAP-level CII requirements?

URL of the questionnaire and all ONAP level CII requirements are answered

See https://lf-onap.atlassian.net/wiki/display/DW/CII+Badging+Program

If the project uses java, has the project integrated with the   oparent.pom?

Oparent.pom included in project

Practice Area