Jaeger Project Security Self-Assessment - Security Pals #1198

cp-57 · 2023-12-07T04:29:31Z

Jaeger Tracing Project Self-Assessment

Jia Lin Weng
Cristian Panaro
Sameer Gori
Sarah Moughal

Signed-off-by: cp-57 <[email protected]>

netlify · 2023-12-07T04:29:36Z

✅ Deploy Preview for tag-security canceled.

Name	Link
🔨 Latest commit	`e9f6a02`
🔍 Latest deploy log	https://app.netlify.com/sites/tag-security/deploys/65a8037bda95d20008237a43

eddie-knight · 2023-12-08T13:45:50Z

Hi! I'm just starting to take a look at this, and the first thing I noticed is that a "backup" file was committed which was most likely intended for local development only.

assessments/projects/jaeger/self-assessment.md

ragashreeshekar

Thanks for the PR @cp-57 and team, appreciate the efforts.
I have completed first pass of review and left several comments on section that needs your attention. Please feel free to reach out here or on slack for any questions and clarifications.

Along with addressing the comments, kindly update the PR branch with the latest content in the repo as this branch is out-of-date with the base branch.

ragashreeshekar · 2023-12-13T06:52:36Z

assessments/projects/jaeger/self-assessment.md

+
+ I. OpenTelemetry SDK
+
+ II. Deprecated [Jaeger agent](https://github.com/jaegertracing/jaeger/issues/4739) (NOT REQUIRED)


Deprecated actors are not necessary. Please keep the ones that are currently relevant.

ragashreeshekar · 2023-12-13T06:58:35Z

assessments/projects/jaeger/self-assessment.md

+
+## Self-assessment use
+
+This self-assessment is created by the Jaeger team to perform an internal analysis of the


Can you please specify at the top which member of the maintainer team acted as an author on this? (Or otherwise rephrase)

ragashreeshekar · 2023-12-13T06:59:27Z

assessments/projects/jaeger/self-assessment.md

+
+## Project compliance
+
+* Compliance.  List any security standards or sub-sections the project is


Please remove any template content such as this one from the self-assessment.

ragashreeshekar · 2023-12-13T07:04:11Z

assessments/projects/jaeger/self-assessment.md

+  * Title not end with a period
+  * A description of the problem it’s solving or a reference to the corresponding issue
+  * Summary of what changes were made
+* The pull request will then be reviewed and merged by the maintainer


Please elaborate on the process that happens henceforth.

Is review and subsequent approval mandated for every PR?

What does the CI pipeline look like? what are the security checks performed in this pipeline (SAST, SCA, secret scan, container image scan etc.)

ragashreeshekar · 2023-12-13T07:05:03Z

assessments/projects/jaeger/self-assessment.md

+* Inbound Users can contact the Jaeger team via email at [email protected], open an issue on GitHub or send a message to the [#jaeger channel on the CNCF Slack](https://cloud-native.slack.com/archives/CGG7NFUJ3).
+
+#### Outbound
+* Outbound the Jaeger team communicates with their users on their [website](https://www.jaegertracing.io/) and the [#jaeger channel on the CNCF Slack](https://cloud-native.slack.com/archives/CGG7NFUJ3).


Please include if there is a mail list.

No mail list, but we also have :

https://github.com/orgs/jaegertracing/discussions
https://stackoverflow.com/questions/tagged/jaeger

For questions.

ragashreeshekar · 2023-12-13T07:05:18Z

assessments/projects/jaeger/self-assessment.md

+### Communication Channels. 
+
+#### Internal
+* Jaeger maintainers and contributors have a monthly [zoom meeting](https://calendar.google.com/calendar/u/0/[email protected]) every 3rd thursday at 11am EST.


Please include if there is a slack channel

We can add #jaeger-maintainers channel is for maintainers.

assessments/projects/jaeger/self-assessment.md

ragashreeshekar · 2023-12-13T07:12:42Z

assessments/projects/jaeger/self-assessment.md

+
+**ZipKin** was an earlier open source distributed tracing system which is used to help users monitor and troubleshoot microservice-based architectures. Both Zipkin and Jaeger aim to provide visibility into the flow of requests and responses across various services in a distributed system. While Zipkin has been around longer, Jaeger is known for its scalability to handle tracing in large and complex microservices and displaying those traces on the Web UI. Jaeger also has backward compatibility with Zipkin to help users transition from Zipkin to Jaeger. While Zipkin has been around longer than Jaeger, Jaeger has the benefit of being a part of Cloud Native Computing Foundation(CNCF), supporting containers, kubernetes and OpenTracing. To conclude, the decision between the two comes down to preference, supported languages and whatever is compatible with your existing tech stack.
+
+### Action Items.


Please move the action items to another file within same folder, and link it in the appendix.

cp-57 · 2023-12-14T04:51:42Z

Thanks for the PR @cp-57 and team, appreciate the efforts. I have completed first pass of review and left several comments on section that needs your attention. Please feel free to reach out here or on slack for any questions and clarifications.

Along with addressing the comments, kindly update the PR branch with the latest content in the repo as this branch is out-of-date with the base branch.

Thank you very much for the help @ragashreeshekar. The team and I have gone over the document and made the suggested changes. Please let me know if there is anything else that may need another look.

cp-57 · 2023-12-14T04:52:14Z

Hi! I'm just starting to take a look at this, and the first thing I noticed is that a "backup" file was committed which was most likely intended for local development only.

Thank you for the help @eddie-knight. I have removed the backup file.

eddie-knight · 2023-12-14T04:54:27Z

@cp-57 Were you also able to include feedback you received from the Jaeger maintainers?

cp-57 · 2023-12-14T05:34:34Z

@cp-57 Were you also able to include feedback you received from the Jaeger maintainers?

Hi Eddie, we had a couple suggestions/edits from the maintainers that we have incorporated.

jkowall · 2023-12-14T15:30:20Z

assessments/projects/jaeger/self-assessment.md

+### Communication Channels. 
+
+#### Internal
+* Jaeger maintainers and contributors have a monthly [zoom meeting](https://calendar.google.com/calendar/u/0/[email protected]) every 3rd thursday at 11am EST.


We can add #jaeger-maintainers channel is for maintainers.

jkowall · 2023-12-14T16:29:58Z

assessments/projects/jaeger/self-assessment.md

+* Inbound Users can contact the Jaeger team via email at [email protected], open an issue on GitHub or send a message to the [#jaeger channel on the CNCF Slack](https://cloud-native.slack.com/archives/CGG7NFUJ3).
+
+#### Outbound
+* Outbound the Jaeger team communicates with their users on their [website](https://www.jaegertracing.io/) and the [#jaeger channel on the CNCF Slack](https://cloud-native.slack.com/archives/CGG7NFUJ3).


No mail list, but we also have :

https://github.com/orgs/jaegertracing/discussions
https://stackoverflow.com/questions/tagged/jaeger

For questions.

cp-57 · 2023-12-14T19:52:36Z

Thank you @jkowall. I've added the suggested edits. Please let me know if there is anything else that needs some attention.

Signed-off-by: cp-57 <[email protected]> Update self-assessment.md Signed-off-by: cp-57 <[email protected]> Update self-assessment.md Signed-off-by: cp-57 <[email protected]> Update self-assessment.md Signed-off-by: cp-57 <[email protected]> Update self-assessment.md Signed-off-by: cp-57 <[email protected]> Update self-assessment.md Signed-off-by: cp-57 <[email protected]> Update self-assessment.md Signed-off-by: cp-57 <[email protected]> Update self-assessment.md Signed-off-by: cp-57 <[email protected]> Update self-assessment.md Signed-off-by: cp-57 <[email protected]> Update self-assessment.md Signed-off-by: cp-57 <[email protected]> Update self-assessment.md Signed-off-by: cp-57 <[email protected]> Update self-assessment.md Signed-off-by: cp-57 <[email protected]> Update self-assessment.md Signed-off-by: cp-57 <[email protected]> Update self-assessment.md Signed-off-by: cp-57 <[email protected]> Update self-assessment.md Signed-off-by: cp-57 <[email protected]> Add Jaeger SPDX-format SBOM Signed-off-by: cp-57 <[email protected]> Delete assessments/projects/jaeger/jaeger-SBOM.spdx Signed-off-by: cp-57 <[email protected]> Update self-assessment.md Signed-off-by: cp-57 <[email protected]> Update self-assessment.md Signed-off-by: cp-57 <[email protected]> Create self_assessment_backup Signed-off-by: cp-57 <[email protected]> Update self-assessment.md Signed-off-by: cp-57 <[email protected]> Update assessments/projects/jaeger/self-assessment.md Co-authored-by: Eddie Knight <[email protected]> Signed-off-by: cp-57 <[email protected]> Update assessments/projects/jaeger/self-assessment.md Co-authored-by: Eddie Knight <[email protected]> Signed-off-by: cp-57 <[email protected]> Delete assessments/projects/jaeger/self_assessment_backup Signed-off-by: cp-57 <[email protected]>

Signed-off-by: cp-57 <[email protected]> Fix link (261) Signed-off-by: cp-57 <[email protected]> Update self-assessment.md (maintainer-suggested edits) Signed-off-by: cp-57 <[email protected]> Fixed development pipeline Signed-off-by: cp-57 <[email protected]> Add actions.md link Signed-off-by: cp-57 <[email protected]> Update self-assessment.md (TAG-security suggested changes) Signed-off-by: cp-57 <[email protected]>

assessments/projects/jaeger/self-assessment.md

jkowall · 2024-01-16T20:57:13Z

Thank you @jkowall. I've added the suggested edits. Please let me know if there is anything else that needs some attention.

Sorry missed this one, but it looks good. We should merge it and then I can either copy it to our repo or you can open a PR.

Co-authored-by: torinvdb <[email protected]> Signed-off-by: Raga <[email protected]>

assessments/projects/jaeger/self-assessment.md

Signed-off-by: Raga <[email protected]>

Co-authored-by: torinvdb <[email protected]> Signed-off-by: Raga <[email protected]>

JustinCappos

The separation of such a small list action items is a little odd, but I understand the rationale.

This is ready to merge.

jkowall · 2024-01-22T15:22:55Z

Sorry to ask, do you want us to create the PR or does the author want to do that? Thanks, @JustinCappos .

eddie-knight · 2024-01-23T16:18:16Z

Hey Jonah! Justin asked me to take over from here, so I'll connect with you via slack regarding the next steps to get everything harmonized

## Description of the changes Big thank you to the security pals team on the self-assessment work they did with the help of the NYU students. The discussion happened in cncf/tag-security#1198 ## How was this change tested? No need to test, just updating URL. ## Checklist - [X] I have read https://github.com/jaegertracing/jaeger/blob/master/CONTRIBUTING_GUIDELINES.md - [X] I have signed all commits --------- Signed-off-by: Jonah Kowall <[email protected]>

Create self-assessment.md

5ea7728

Signed-off-by: cp-57 <[email protected]>

github-actions bot requested review from JustinCappos, mnm678 and pragashj December 7, 2023 04:29

eddie-knight reviewed Dec 8, 2023

View reviewed changes

assessments/projects/jaeger/self-assessment.md Outdated Show resolved Hide resolved

eddie-knight reviewed Dec 8, 2023

View reviewed changes

assessments/projects/jaeger/self-assessment.md Outdated Show resolved Hide resolved

eddie-knight reviewed Dec 12, 2023

View reviewed changes

assessments/projects/jaeger/self-assessment.md Show resolved Hide resolved

ragashreeshekar suggested changes Dec 13, 2023

View reviewed changes

jkowall approved these changes Dec 14, 2023

View reviewed changes

cp-57 force-pushed the main branch 2 times, most recently from f2d01b4 to 835548a Compare December 14, 2023 22:45

cp-57 force-pushed the main branch from 835548a to 5f1b3f5 Compare December 14, 2023 23:14

cp-57 force-pushed the main branch from 5f1b3f5 to e3ea538 Compare December 14, 2023 23:29

Merge branch 'main' into main

b5c2664

torinvdb reviewed Jan 16, 2024

View reviewed changes

assessments/projects/jaeger/self-assessment.md Outdated Show resolved Hide resolved

torinvdb reviewed Jan 16, 2024

View reviewed changes

assessments/projects/jaeger/self-assessment.md Outdated Show resolved Hide resolved

Update assessments/projects/jaeger/self-assessment.md

6d21458

Co-authored-by: torinvdb <[email protected]> Signed-off-by: Raga <[email protected]>

ragashreeshekar reviewed Jan 17, 2024

View reviewed changes

assessments/projects/jaeger/self-assessment.md Outdated Show resolved Hide resolved

ragashreeshekar and others added 2 commits January 16, 2024 20:29

Update assessments/projects/jaeger/self-assessment.md

7a7590e

Signed-off-by: Raga <[email protected]>

Update assessments/projects/jaeger/self-assessment.md

5f1838b

Co-authored-by: torinvdb <[email protected]> Signed-off-by: Raga <[email protected]>

ragashreeshekar approved these changes Jan 17, 2024

View reviewed changes

Merge branch 'main' into main

113efee

JustinCappos approved these changes Jan 17, 2024

View reviewed changes

Merge branch 'main' into main

e9f6a02

JustinCappos merged commit 57fd398 into cncf:main Jan 17, 2024
10 checks passed

jkowall mentioned this pull request Jan 24, 2024

Replace security self-assesment with one from cncf/tag-security jaegertracing/jaeger#5142

Merged

2 tasks

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Jaeger Project Security Self-Assessment - Security Pals #1198

Jaeger Project Security Self-Assessment - Security Pals #1198

cp-57 commented Dec 7, 2023

netlify bot commented Dec 7, 2023 •

edited

Loading

eddie-knight commented Dec 8, 2023

ragashreeshekar left a comment

ragashreeshekar Dec 13, 2023

ragashreeshekar Dec 13, 2023

ragashreeshekar Dec 13, 2023

ragashreeshekar Dec 13, 2023

ragashreeshekar Dec 13, 2023

jkowall Dec 14, 2023

ragashreeshekar Dec 13, 2023

jkowall Dec 14, 2023

ragashreeshekar Dec 13, 2023

cp-57 commented Dec 14, 2023

cp-57 commented Dec 14, 2023

eddie-knight commented Dec 14, 2023

cp-57 commented Dec 14, 2023

jkowall Dec 14, 2023

jkowall Dec 14, 2023

cp-57 commented Dec 14, 2023

jkowall commented Jan 16, 2024

JustinCappos left a comment

jkowall commented Jan 22, 2024

eddie-knight commented Jan 23, 2024


		I. OpenTelemetry SDK

		II. Deprecated [Jaeger agent](https://github.com/jaegertracing/jaeger/issues/4739) (NOT REQUIRED)


		## Self-assessment use

		This self-assessment is created by the Jaeger team to perform an internal analysis of the


		## Project compliance

		* Compliance. List any security standards or sub-sections the project is


		ZipKin was an earlier open source distributed tracing system which is used to help users monitor and troubleshoot microservice-based architectures. Both Zipkin and Jaeger aim to provide visibility into the flow of requests and responses across various services in a distributed system. While Zipkin has been around longer, Jaeger is known for its scalability to handle tracing in large and complex microservices and displaying those traces on the Web UI. Jaeger also has backward compatibility with Zipkin to help users transition from Zipkin to Jaeger. While Zipkin has been around longer than Jaeger, Jaeger has the benefit of being a part of Cloud Native Computing Foundation(CNCF), supporting containers, kubernetes and OpenTracing. To conclude, the decision between the two comes down to preference, supported languages and whatever is compatible with your existing tech stack.

		### Action Items.

Jaeger Project Security Self-Assessment - Security Pals #1198

Jaeger Project Security Self-Assessment - Security Pals #1198

Conversation

cp-57 commented Dec 7, 2023

netlify bot commented Dec 7, 2023 • edited Loading

✅ Deploy Preview for tag-security canceled.

eddie-knight commented Dec 8, 2023

ragashreeshekar left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

cp-57 commented Dec 14, 2023

cp-57 commented Dec 14, 2023

eddie-knight commented Dec 14, 2023

cp-57 commented Dec 14, 2023

Choose a reason for hiding this comment

Choose a reason for hiding this comment

cp-57 commented Dec 14, 2023

jkowall commented Jan 16, 2024

JustinCappos left a comment

Choose a reason for hiding this comment

jkowall commented Jan 22, 2024

eddie-knight commented Jan 23, 2024

netlify bot commented Dec 7, 2023 •

edited

Loading