fiware-draco

It uses git, URL is https://github.com/ging/fiware-draco

Uses git to track this. Repository on GitHub, which uses git. git can track the changes, who made them, and when they were made.

Repository on GitHub, which uses git. git can track the changes, who made them, and when they were made.

Interim versions are put on git, not just final versions.

Repository on GitHub, which uses git. git is distrUses git. Repository on GitHub, which uses git. git is distributed.

Repository on GitHub, which uses git. git is distributed.ibuted. Repository on GitHub, which uses git. git is distributed.

The primary development team uses git commit records to identify releases. Regular umbrella releases aligned with the FIWARE Foundation.

Full releases are tagged using"git tag"

https://github.com/ging/fiware-draco/releases

A vulnerabities badge appears in the Readme of the project pointing to a complete list of known vulnerabilities https://snyk.io/test/github/ging/fiware-draco?targetFile=nifi-ngsi-bundle/nifi-ngsi-processors/pom.xml

Github issue tracker https://github.com/ging/fiware-draco/issues

https://github.com/ging/fiware-draco/issues

No bug reports were submitted in the last year https://github.com/ging/fiware-draco/issues

https://github.com/ging/fiware-draco/pulls The PRs automatically generated by bots were not accepted but rather fixed manually

Yes, via GitHub issue tracker: https://github.com/ging/fiware-draco/issues

https://github.com/ging/fiware-draco/issues

No private vulnerability reports are supported

No external reports so far, so this is vacuously true.

The software can be bugs using docker through Dockerfile: https://github.com/ging/fiware-draco/tree/master/nifi-ngsi-resources/docker

Use Docker for building the software https://github.com/ging/fiware-draco/tree/master/nifi-ngsi-resources/docker

All the dependencies and tools needed are FLOSS:https://github.com/ging/fiware-draco/tree/master/nifi-ngsi-resources/docker https://github.com/ging/fiware-draco/blob/master/docs/installation_and_administration_guide/install_with_docker.md

Automated tests are run with each commit to the code repository using Github actions continuous integration. The instructions for running the tests can be found in: https://github.com/ging/fiware-draco#testing

The instructions for running the tests can be found in: https://github.com/ging/fiware-draco#testing

The code uses coverage and coveralls to track test coverage and shows the badge in the main page

Continuous integration is done with Github actions: https://github.com/ging/fiware-draco/actions

Yes. The CONTRIBUTING file at: https://github.com/ging/fiware-draco/blob/master/CONTRIBUTING.md says, "Please ensure that your contribution passes all tests". Also, the README shows the test coverage, which encourages adding tests as new functionality is added.

Tests are added as new functionality is added.

Yes. The CONTRIBUTING file at https://github.com/ging/fiware-draco/blob/master/CONTRIBUTING.md says, "Please ensure that your contribution passes all tests".

The set of tools used for examining code quality are listed in CONTRIBUTING.md. The markdown documentation is scanned with remark and textlint.

In general warnings are addressed. In some cases warnings are disabled for specific cases.

The settings for the warning tools are generally fairly strict.

@anmunoz assumes overall responsibility for this along with the development team.

@anmunoz assumes overall responsibility for this along with the development team.

This application is a microservice which delegates security to other components such as Keyrock or Keyrock. These security components use bcrypt to store salted hashed iterated passwords, and https+standard crypto protocols to communicate with users. The software uses bcrypt to store salted hashed iterated passwords, and https+standard crypto protocols to communicate with users.

This application is a microservice which delegates security to other components for cryptography. Uses bcrypt package for bcrypt, and https implementation built into its web server.

This application is a microservice which delegates security to other components for cryptography. FLOSS cryptography is available in compatible components such as Keyrock. All required functionality is implemented using FLOSS, including cryptography.

This application is a microservice which delegates security to other components for cryptography.

The only cryptographic algorithm directly used by the program is bcrypt, which is not broken.

This application is a microservice which delegates security to other components such as Keyrock. Keyrock uses bcrypt, which is not broken.

The only cryptography used directly by this application is bcrypt (used for storing passwords as salted iterated hashes). At the time of this writing, no serious breaks are known in bcrypt. The application also depends on the web server's https configuration, but that is out of scope for this code.

Nothing in the code inhibits or prevents the use of PFS; that is a property of the website's web server.

This application is a microservice which delegates security to other components such as Keyrock. Keyrock uses bcrypt for storing local passwords. Bcrypt used for storing local passwords.

This application is a microservice which delegates security to other components such as Keyrock or Keycloak. These security components are using randomized mechanisms. The nonce for the salt is created by the bcrypt package; its code shows that it uses OpenSSL to get cryptographically random data for the salt. Other nonces are part of the https implementation, which are implemented by the web server (not this application).

An HTTPS mode is available.

Does not make this mistake.

No vulnerabilities exist within the codebase controlled by Draco itself, but some vulnerabilities may remain within dependent libraries within the NIFI software on which the component is based. Draco is regularly updated to incorporate security bug fixes found in the main NIFI software itself.

No valid private credentials are leaked. Usernames and Passwords may be entered using Docker secrets and ENVs

https://app.codacy.com/manual/anmunoz/fiware-draco

Snyk is used for vulnerability search

This is vacuously true, since we have had no reports of vulnerabilities that apply to a deployed system.

All commits to GitHub are run through Github actions, which perform a number of static analysis checks.

Dynamic code analysis has been applied through unit testing

The language used is not memory unsafe

Instead of embedding run-time assertions, there are many external tests with assertions that are checked during automated testing.

No issues were found by dynamic analysis.