Substra

Several version of Susbtra can be in production use. We maintain every version in production thanks to patch release done when needed (see https://github.com/Substra/substrafl/releases/tag/0.30.2 as an example). To facilitate the upgrade path when some difficulties can be encountered, we keep up to date a dedicated page in the documentation that gathered all upgrades notes on the different versions. See https://docs.substra.org/en/latest/operations/upgrade_notes.html

Yes, GitHub issue tracker.

There have been no external vulnerabilities resolved by external contributors

https://docs.substra.org/en/latest/contributing/contributing-guide.html

https://docs.substra.org/en/latest/contributing/contributing-guide.html document the coding standards of the project and how to respect them. More specifically, it specifies "Most of project repositories have a .pre-commit-config.yaml file. Run pre-commit install to automatically match some of the style rules of the project when committing your changes."

All repositories of the project runs lint on every contribution before allowing any modification. We use flake8 for Python, Prettier for ReactJS and golangci-lint for Go.

Every dependencies are listed in each repository. Installable Python repositories all have a setup.py (cf https://github.com/Substra/substra/blob/main/setup.py for instance). Installable using pip. ReactJS repository have a package.json (cf https://github.com/Substra/substra-frontend/blob/main/package.json). Backend repositories have a skaffold.yaml file (cf https://github.com/Substra/substra-backend/blob/main/skaffold.yaml for instance)

We use https://github.com/dependabot to check dependencies update.

Substra uses docker (https://www.docker.com/) and kubernetes (https://kubernetes.io/) to facilitate the updates of components.

We avoid depending on deprecated/obsolete functions.

Each repository of the Substra project have their own CI , running unit tests on each PR and for every merge of new code. e2e tests are also run every night, with a report send to a private Slack channel. These e2e tests can also be ran on every PR using the /e2e command as a comment on the PR.

When regressions occur, we add tests for them.

For pip instsallable repository we currently have: substra: 85% coverage substrafl: 96% coverage substra-tools: 94% coverage

For the all project (including backend and orchestrator), complete e2e tests and benchmarks are run every night, on tests gathered in a dedicated repository (cf https://github.com/Substra/substra-tests) and ensure the coverage of the project code base.

Our contributing guide specify: "When adding or changing functionality, please include new tests for them as part of your contribution." Cf: https://docs.substra.org/en/latest/contributing/contributing-guide.html

Our contributing guide specify: "When adding or changing functionality, please include new tests for them as part of your contribution." Cf: https://docs.substra.org/en/latest/contributing/contributing-guide.html

The settings for the warning tools are generally strict.

The only cryptography used directly by this application is PBKDF2 (used for storing passwords as salted iterated hashes). At the time of this writing, no serious breaks are known in PBKDF2.

Substra provide a documentation on how to activate TLS on the orchestrator to secure communication protocols between the different instances https://docs.substra.org/en/stable/operations/howto/orchestrator-deployment.html?highlight=TLS#setup-tls

The minimal version of TLS used is 1.2 (cf https://github.com/Substra/orchestrator/blob/main/server/common/tls.go#L37)

Bandit specifically looks for common vulnerabilities in Python code.

Application written using Python, Go and Typescript, not C/C++.