databend

Repository on GitHub, which provides public git repositories with URLs. https://github.com/datafuselabs/databend

Repository on GitHub, which uses git. git can track the changes, who made them, and when they were made.

Databend always keeps commit records for review.

Repository on GitHub, which uses git. git is distributed.

Databend currently follows a nightly release model and assigns a unique version number to each release (usually an incremental patch version)

Databend uses tags to identify the version. https://github.com/datafuselabs/databend/tags

Databend uses the Pull Request header, which conforms to the commit specification, as a summary of changes for the user to determine if updates are needed.

Similarly, on the website, Databend maintains a release section for user reference. https://databend.rs/doc/releases

Fixes for bugs and vulnerabilities will be listed in the changelog and can be viewed and confirmed by anyone.

Databend's issue submission is consistent with other projects hosted on GitHub. Visit https://github.com/datafuselabs/databend/issues/new/choose to submit an issue.

Databend uses GitHub Issues as an issue tracker. See https://github.com/datafuselabs/databend/issues

Databend's team will respond quickly to bug reports and fix them according to priority, usually within a few weeks.

Enhancement requests will go into the roadmap and will be scheduled according to priority. They will usually get a preview version in a few weeks for the nightly release and be officially released with the minor release update.

Roadmap: https://github.com/datafuselabs/databend/issues/3706

Databend uses GitHub Issues as an issue tracker, so you can filter and find the history of any report. https://github.com/datafuselabs/databend/issues

In addition, we also support general discussions via GitHub Discussions, again with search support. https://github.com/datafuselabs/databend/discussions

For security vulnerabilities, we would normally recommend reporting via email. https://github.com/datafuselabs/databend/security/policy

Typically, we disclose vulnerability reports that we receive.

We recommend that users report high-risk vulnerabilities by encrypting emails via OpenPGP.

Non-trivial build file in repository: https://github.com/datafuselabs/databend/blob/main/Makefile.

Non-trivial build file in repository: https://github.com/datafuselabs/databend/blob/main/Makefile.

Scripts such as Makefile, Dockerfile and tools such as Cargo and LLVM for building are all FLOSS compliant.

Databend contains unit tests, integration tests and functional tests, all of which are FLOSS compliant. They can be found in the corresponding tests directory.

For unit and integration tests, cargo test can be used to execute them.

The functional tests are scripted in python and again provide the usual call methods.

To simplify test execution, this can be done with a pre-wrapped make command.

Databend mainly uses rust-clippy for static analysis. https://github.com/rust-lang/rust-clippy

Databend will apply rust-clippy to analyze the code and use cargo-audit to audit upstream dependencies. We perform regular evaluations to ensure we are not vulnerable to common vulnerabilities.

Typically, Databend will fix vulnerabilities after confirming that a viable fix exists.

Databend performs a static analysis of each commit.

Databend use grammar fuzzer to build the first fuzz tools, using random engine to generate table with datas and execute generated queries without panic.

https://github.com/datafuselabs/databend/blob/main/.github/actions/test_fuzz_standalone_linux/action.yml

Rust ensures memory safety at compile time using its innovative ownership mechanism and the borrow checker built into the compiler.

Databend will run a basic fuzz on each commit. In addition, Databend includes a fuzz tool for parser.

Databend currently has no known high-risk exploitable vulnerabilities