VF-C (Virtual Function Controller Project)

GIT and GERRIT is used as the version-controlled repository: URL for accessing the: project repository is https://gerrit.onap.org/r/#/admin/projects/?filter=vfc

All the changes made in the repository along with the current status and the committer name are clearly identifiable

https://gerrit.onap.org/r/#/q/vfc

Gerrit provides an temperate branch for reviewing and providing comments. Once approved, the code will be merged and the temperate branch will be removed.

Git and Gerrit are used

Release version is with format ${major}.${minor}.${patch} and will be updated accordingly for each release.

Each release is tagged within the Gerrit repository.

Release Notes can be found at http://onap.readthedocs.io/en/latest/submodules/vfc/nfvo/lcm.git/docs/release-notes.html?highlight=release

Release notes with identified vulnerabilities can be found at: http://onap.readthedocs.io/en/latest/submodules/vfc/nfvo/lcm.git/docs/release-notes.html?highlight=release

No vulnerabilities have been found yet.

The description of the process can be found in the following URL: https://wiki.onap.org/display/DW/Tracking+Issues+with+JIRA

Jira is used to track issues. https://wiki.onap.org/display/DW/Tracking+Issues+with+JIRA

The reported issues are being handled as soon as possible.

The enhancement request are being handled as soon as possible.

All the issues and enhancement desired along with the current status and reporter name is available publicly at below URL https://wiki.onap.org/display/DW/Issue+Reports

The Vulnerability could be reported either as a feature or a issue. In case the vulnerability involves large changes, e.g. framework change, it could be reported as a feature. In case the vulnerability is due to bugs in the code, it could be reported as a bug.

The reporting process is in the following URL: https://wiki.onap.org/display/DW/Tracking+Issues+with+JIRA

Private vulnerability reports are not supported

There's no vulnerabilities reported so far.

Jenkins is used to automatically build the VF-C project. The project URL is :

https://jenkins.onap.org/view/vfc/

Maven is used to build VF-C.

Maven is under Apache 2.0 license.

VF-C uses PyUnit+Django test framework for python and Junit for java

The test runs automatically during the building process.

Test suits covers most of the functionality .

The test will be run automatically during the building process . Once build successfully and all tests has past, the Merge option will be activated.

When new functionality is added we will add the corresponding unit test, when we merge the code, the test will be run automatically

In Amsterdam Release, we documented the test-case in wiki (https://wiki.onap.org/display/DW/VF-C+Function+Test+Cases), similar;y we will also provide one wiki about the test case for all future releases.

It uses ONAP defined policy https://wiki.onap.org/display/DW/Development+Procedures+and+Policies

Sonar is used to examine the quality of the source code. Sonar uses different rules to verify the quality of the code and to address the vulnerability of the code

A task is created in JIRA to remove such warnings in a continuous way

https://jira.onap.org/browse/VFC-689

Build systems run the compile with test flag enabled by default. So any failure in test cases will fail the ci and the merge request.

Currently VF-C didn't use any cryptographic protocols and algorithms

The website to store the delivered software is: https://nexus3.onap.org/

vfc uses tool like Sonar to detect vulnerabilities and fix it as soon as possible when find any.

Sonar is used for static code analysis.

Sonar uses different rules for static code analysis.

The List of rules to do static analysis on VF-C code is as per below URL https://sonar.onap.org/coding_rules#qprofile=java-sonar-way-74911|activation=true

A task is created in JIRA to remove such warnings in a continuous way :

https://jira.onap.org/browse/VFC-689

It is triggered daily

Sonar is used as Dynamic code analysis tool

VF-C uses Java, Javascript and Python