FIWARE IoT Agent Sigfox

It uses git, URL is https://github.com/telefonicaid/sigfox-iotagent

Uses git to track this. Repository on GitHub, which uses git. git can track the changes, who made them, and when they were made.

All versions are put on git, not just final versions.

Uses git. Repository on GitHub, which uses git. git is distributed.

The primary development team uses git commit tags to identify releases. Regular umbrella releases aligned with the FIWARE Foundation.

Full releases are tagged using 'git tag'.

Release notes are included as part of the release in github (for example: https://github.com/telefonicaid/sigfox-iotagent/releases/tag/1.5.0). In addition, a CHANGES_NEXT_RELEASE file is hold in top directory in master branch (https://github.com/telefonicaid/sigfox-iotagent/blob/master/CHANGES_NEXT_RELEASE) with the delta of changes for the next release.

There have been no publicly known vulnerabilities

Yes, GitHub issue tracker. The process is described on the following link: https://github.com/telefonicaid/sigfox-iotagent/blob/master/docs/contribution.md

Yes, GitHub issue tracker. https://github.com/telefonicaid/sigfox-iotagent/issues

Yes. This is a requirement for membership of the FIWARE Foundation Catalogue https://www.fiware.org/developers/catalogue/

The project has been responding to most enhancement requests.

https://github.com/telefonicaid/sigfox-iotagent/issues

https://github.com/telefonicaid/sigfox-iotagent/blob/master/docs/contribution.md

https://github.com/telefonicaid/sigfox-iotagent/blob/master/docs/contribution.md

No external reports so far, so this is vacuously true

The software is written using JavaScript and their implementations run directly on the source code.

Note that an npm package is provided to enable others to quickly recreate a development environment.

No building tools needed

Yes, it includes a test suite based on Mocha https://github.com/telefonicaid/sigfox-iotagent/blob/master/docs/usermanual.md#testing

Yes. "npm test" invokes the automated test suite. This is documented in https://github.com/telefonicaid/sigfox-iotagent/blob/master/docs/usermanual.md#testing

Met. Currently coverage of the codebase is well over 80%. More info here: https://coveralls.io/github/telefonicaid/sigfox-iotagent?branch=master

Code implements continuous integration based in GitActions. Each time a new pull request is created, the continuous integration system runs the test on it and it is ready to merge only when all tests pass ok. If a problem is found, feedback is provided via GitHub. In addition, several badges on top of the master README.md of the project provide information about the build status in the master branch.

Yes. The contribution policies at https://github.com/telefonicaid/sigfox-iotagent/blob/master/docs/contribution.md says, "For any new feature added, unit tests must be provided, following the example of the ones already created."

Tests are added as new functionality is added. This is verified during the pull request code review, ensuring that proper tests are included in the pull request before merging it.

Yes, at the contribution policies at https://github.com/telefonicaid/sigfox-iotagent/blob/master/docs/contribution.md#branching-model “Remember to check both the linters and the tests before creating the Pull Request”

The set of tools used for examining code quality are listed in contribution.md The project uses eslint is used to look for problems in Javascript. The markdown documentation is scanned with remark and textlint. Docker files are scanned with Hadolint.

In general warnings are addressed. In some cases warnings are disabled for specific cases.

The FIWARE IoT Agent SigFox development team has developers who know how to design secure software

The FIWARE IoT Agent SigFox development team has developers who know how to design secure software

This application is a microservice which delegates security to other components such as Keyrock or Keyrock. These security components use bcrypt to store salted hashed iterated passwords, and https+standard crypto protocols to communicate with users.

Also, this software use the standard nodeJS libraries (express as a web server and requests as a client) to implement https functionalities.

This software relies on well-known libraries implementing cryptographic.

The aforementioned libraries use a FLOSS license. https://github.com/expressjs/express/blob/master/LICENSE https://github.com/request/request/blob/master/LICENSE

Cryptographic libraries used by this application and/or the other microservices to which it interacts (Keyrock or Keystone) allow the usage of such minimum key lengths.

FIWARE IoT Agent SigFox doesn’t use any broken cryptographic algorithm.

FIWARE IoT Agent SigFox doesn’t depend on cryptographic algorithms with known vulnerabilities.

Nothing in the code inhibits or prevents the use of PFS; that is a property of the website's web server.

Cryptographic libraries used by FIWARE IoT Agent SigFox and/or the other microservices to which it interacts (Keyrock or Keystone) use randomized mechanisms.

An HTTPS mode is available.

FIWARE IoT Agent JSON does not cryptographic hashes in any HTTP unsecure endpoint.

No such vulnerabilities at this time.

No such vulnerabilities at this time.

No valid private credentials appears in public repositories. When some usernames and/or passwords needs to be used, it is never included in repositories and proper mechanism (e.g. Docker secrets) are used at software building and deployment time.

The project uses eslint (https://eslint.org/) for this purpose. This analysis tool is used as part of the default test process used in local development, as well as the continuous integration server

eslint specifically looks for common vulnerabilities in JavaScript applications.

This is vacuously true, since we've had no reports of vulnerabilities that apply to a deployed system.

All commits to GitHub are run through Github Actions, which performs a number of static analysis checks

Not applicable, software written using Javascript

Instead of embedding run-time assertions, there are many external tests with assertions that are checked during automated testing.

No issues were found by dynamic analysis.