ngsi-timeseries-api

Repository on GitHub, which provides public git repositories with URLs.

Repository on GitHub, which uses git. git can track the changes, who made them, and when they were made.

Interim versions are put on git, not just final versions.

Repository on GitHub, which uses git. git is distributed.

The primary development team uses git commit records to identify releases. Regular umbrella releases aligned with the FIWARE Foundation.

Full releases are tagged using "git tag".

RELEASE_NOTES.md file is in top directory, see: https://github.com/smartsdk/ngsi-timeseries-api/blob/master/RELEASE_NOTES.md Changes are summarized in in release tag

there have been no publicly known vulnerabilities

Yes, we use GitHub's issue tracker. See also: https://github.com/orchestracities/ngsi-timeseries-api/tree/master/.github/ISSUE_TEMPLATE

Yes, GitHub issue tracker.

Yes. This is a requirement for membership of the FIWARE Foundation Catalogue.

The project has been responding to most enhancement requests.

Yes, via GitHub issue tracker: https://github.com/orchestracities/ngsi-timeseries-api/issues

https://github.com/orchestracities/ngsi-timeseries-api/issues

The project does not support private vulnerability reports.

No external reports so far, so this is vacuously true.

The software is written using Python and its implementation runs directly on the source code.

Note that Docker images are provided to enable others to quickly recreate a development environment. Additionally, shell scripts are available to set up a development environment on Linux and MacOS: https://github.com/orchestracities/ngsi-timeseries-api/blob/master/setup_dev_env.sh

The software is written using Python and its implementation runs directly on the source code.

Yes, it includes a test suite based on pytest, Docker images and shell scripts: https://github.com/orchestracities/ngsi-timeseries-api/blob/master/run_tests.sh

The test suite can either be started directly with pytest or using the provided shell scripts.

Met. Currently coverage of the codebase is well over 69%.

Code is frequently integrated back into GitHub; Travis and several other tools are then run on the result to determine if there's a problem. If a problem is found, the tools provide feedback via GitHub. For more information, see the BadgeApp's status on Travis.

Yes. The CONTRIBUTING file at https://github.com/orchestracities/ngsi-timeseries-api/blob/master/docs/manuals/user/contributing.md says:

"For all the new functionalities provide tests (see setup_dev_env.sh and run.sh in the root to understand how tests can be run locally) When done, verify that all tests are passing If so, create a pull request against our repository (we cannot review pull requests with failing tests)"

Also, the README shows the test coverage, which encourages adding tests as new functionality is added.

Tests are added as new functionality is added.

Yes. The CONTRIBUTING file at https://github.com/orchestracities/ngsi-timeseries-api/blob/master/docs/manuals/user/contributing.md says:

"For all the new functionalities provide tests (see setup_dev_env.sh and run.sh in the root to understand how tests can be run locally) When done, verify that all tests are passing If so, create a pull request against our repository (we cannot review pull requests with failing tests)"

The project uses PEP-8 and MD Linter for code quality.

In general warnings are addressed. In some cases warnings are disabled for specific cases.

The settings for the warning tools are generally fairly strict.

https://github.com/chicco785 assumes overall responsibility for this along with the development team.

https://github.com/chicco785 assumes overall responsibility for this along with the development team.

This application is a microservice which delegates security to other components such as Keycloak or Keyrock. These security components use bcrypt to store salted hashed iterated passwords, and https+standard crypto protocols to communicate with users. The software uses https+standard crypto protocols to communicate with users.

This application is a microservice which delegates security to other components for cryptography and uses https+standard crypto protocols to communicate with users.

This application is a microservice which delegates security to other components for cryptography and uses https+standard crypto protocols to communicate with users.

This application is a microservice which delegates security to other components for cryptography such as Keycloak or Keyrock which provide appropriate key lengths as well as the ability to disable small keys.

This application is a microservice which delegates security to other components such as Keyrock. Keyrock uses bcrypt, which is not broken.

This application is a microservice which delegates security to other components such as Keyrock. Keyrock uses bcrypt, which is not broken.

This application is a microservice which delegates security to other components such as Keyrock which provide that functionality.

This application is a microservice which delegates security to other components such as Keyrock which provide that functionality.

This application is a microservice which delegates security to other components such as Keyrock which use cryptographically secure random number generators.

An HTTPS mode is available.

Does not make this mistake.

No such vulnerabilities at this time.

No such vulnerabilities at this time.

No credentials are stored in public repositories.

The project leverages pep8 that controls that python code styling and formatting.

GitHub identifies vulnerabilities of libraries used and introduces fixes to update libraries. Accordingly we evaluate the merge of the automatically generated PRs.

The software is written in Python.

Instead of embedding run-time assertions, there are many external tests with assertions that are checked during automated testing.

No issues were found by dynamic analysis.