- On-boarded
Coverity scans (and fixing issues found) has been ongoing since 2016
Security Response Process in place since 2016
Integrated CycloneDX into CI
Deemed inapplicable for spec sub-projects.
Cedric Ollivier : self declarative checks don't bring any value to the code project compared to patchset and deliverables verifications
See all *-grype and *-trivy views in build.opnfv.org
ex: Xtesting
A few code projects are running the well known both Python and Docker security tools (bandit, trivy, etc.). They are even running as verification jobs in Functest.
tox.ini - functest - Test suites and cases to verify OPNFV Platform functionality
Cedric Ollivier: is it only for master? a few LFN projects fail in checking the stable branches.
Security analysis (August 2021, Srinivasa Addepalli) - Securing EMCO