R24.03 BPDM Golden Record / BPN Service - Release Checks

[kelaja]

Release Info

Please provide information on what you want to be included in the Eclipse Tractus-X release.
If you are not owner of this issue, please provide the information as comment to the issue.

Version to be included in Eclipse Tractus-X release: version placeholder

Leading product repository: repository link

Compliance Verifications

This issue tracks all compliance related checks, that need to be performed for a product release in Eclipse Tractus-X.

• Gaia-X compliance confirmed
• GDPR compliance confirmed (personal data, data protection + privacy DPP)
• Interoperability checks performed
• Data Sovereignty checks performed
• Compliant with relevant published CX Standards (see the Catena-X standard library)

Documentation

• Arc24 documentation up-to-date
• Administrators Guide up-to-date
• End-User manual up-to-date
• Interface documentation up-to-date

Security Checks

• Thread Modelling Analysis passed
• Static Application Security Testing (SAST) scans passed
• Dynamic Application Security Testing (DAST) tests passed
• Secret Scans passed
• Software Composition Analysis (SCA) passed
• Container Scans passed
• Infrastructure as Code (IaC) scans passed

General Checks

• Tractus-X Release Guidelines fulfilled QG checks (Release 24.03) bpdm#757
• Compliant with the Style Guide

Test Results

• E2E Integration Test passed
• User Journey approved

Helpful Links

• Eclipse Tractus-X openAPI specs on SwaggerHub
• Catena-X standard library

[nicoprow]

No Secrets in Github Scans:

No Github Code scanning alerts:

No Dependabot Alerts:

[nicoprow]

Veracode passed:

One medium composition vulnerability:

2 Triage Flaws, both mitigation proposed, one approved. (But flaws seem to be duplicates anyway):

[nicoprow]

Threat Modeling passed and assessment currently in the process of being merged:
eclipse-tractusx/bpdm#737
eclipse-tractusx/bpdm#740

[nicoprow]

Interface documentation up to date for current release version:
https://github.com/eclipse-tractusx/bpdm/tree/release/5.0.x/docs/api

[RoKrish14]

SAST: Approved
SCA: Approved
Trivy: Approved
KICKS: Approved

[nicoprow]

DAST no high or above issues:

Gate: https://www.netsparkercloud.com/websites/dashboard/9372f73eb7d24ca41db1b059018933cc/?scanGroupId=6b67c661-b788-44db-2f1f-b0c701e8f2f9
Pool: https://www.netsparkercloud.com/websites/dashboard/9372f73eb7d24ca41db1b059018933cc/?scanGroupId=48809087-5bb1-4773-3453-b0c2024239f4

[RoKrish14]

Secret Scanning: Approved
DAST: Approved

[rybtim]

No significant changes to last time related Gaia-X Compliance and GDPR @kelaja

[rybtim]

We herby confirm that we considered (as good as possible) all relevant CX-Standards as well as that we reviewed the content of upcoming STAN Request as good as possible @kelaja

[rybtim]

E2E Test passed
https://jira.catena-x.net/browse/TEST-1739
Overall Status
https://confluence.catena-x.net/x/sgA1Bw

[alexKeppler]

@kelaja User Journey approved

[ThomasObermeyer]

No major architecture changes in the current release - interoperability check approved.

@kelaja

[szymonkowalczykzf]

Security Assessment Process (Threat Modeling Analysis) approved.

Re-assessment was done on Wednesday 25th Jan 2024. No open critical & high findings remains.
Documentation of the assessment will be available under BPDM/docs/Security_Assessment.md

[FaGru3n]

Hi all,

think there are some infos not shared within this issue would suggest:

Version to be included in Eclipse Tractus-X release: version placeholder

Leading product repository: repository link

Leading repo: https://github.com/eclipse-tractusx/bpdm

Version: 5.0.0 Am i correct?

Created TRG Guideline Check Issue for bpdm repo: eclipse-tractusx/bpdm#757

Thanks in advance.

[vialkoje]

could you please add the links to the documentation documents to check ?

Arc24 documentation
Administrators Guide
End-User manual
Interface documentation -> I found that one already

[nicoprow]

Hi all,

think there are some infos not shared within this issue would suggest:

Version to be included in Eclipse Tractus-X release: version placeholder
Leading product repository: repository link

Leading repo: https://github.com/eclipse-tractusx/bpdm

Version: 5.0.0 Am i correct?

Created TRG Guideline Check Issue for bpdm repo: eclipse-tractusx/bpdm#757

Thanks in advance.

Yes that is correct. Chart version is 4.0.0

[nicoprow]

could you please add the links to the documentation documents to check ?

Arc24 documentation Administrators Guide End-User manual Interface documentation -> I found that one already

Arc24: https://github.com/eclipse-tractusx/bpdm/tree/release/5.0.x/docs/arc42
Admin Guide: https://github.com/eclipse-tractusx/bpdm/blob/release/5.0.x/docs/OPERATOR_VIEW.md
End-User Manual: We don't have an UI, so no End-User. There is a guide for integrating services however: https://github.com/eclipse-tractusx/bpdm/blob/release/5.0.x/docs/ADOPTION_VIEW.md
Interface Documentation: https://github.com/eclipse-tractusx/bpdm/tree/release/5.0.x/docs/api

[rybtim]

Hi security team,
can you please check our scans.
@BANANAS1337 @RoKrish14 @PiotrStys @DnlZF
Thanks

[DnlZF]

Secret Scans: Approved

[RoKrish14]

Hi security team, can you please check our scans. @BANANAS1337 @RoKrish14 @PiotrStys @DnlZF Thanks

Hi @rybtim
What has changed since last security checks?

1. R24.03 BPDM Golden Record / BPN Service - Release Checks #496 (comment)
2. R24.03 BPDM Golden Record / BPN Service - Release Checks #496 (comment)

[rybtim]

Hi security team, can you please check our scans. @BANANAS1337 @RoKrish14 @PiotrStys @DnlZF Thanks

Hi @rybtim What has changed since last security checks?

1. R24.03 BPDM Golden Record / BPN Service - Release Checks #496 (comment)
2. R24.03 BPDM Golden Record / BPN Service - Release Checks #496 (comment)

@RoKrish14 Sorry my fault, I have overlooked your release :) Thanks

[DirkBTSI]

INT test performed/documented.
E2E test performed/documented.
No high defect.
TM approved
@kelaja  : please approve for "E2E Integration Test passed"

[rybtim]

STYLE Guide: No changes to last release. No UI for Golden Record Service

[RolaH1t]

QG review as per plan 21-Feb:
pending topics are DataSov & Documentation, as well as TRGs
Approval postponed until topics addressed; no follow-up mtg required.

[vialkoje]

Documentation Existing and looking consistent. Sovereignty requirements fulfilled as tehre are no specific requirements for 24.03. Expert Approval granted

[RolaH1t]

all pre-conditions fulfilled and QG approval granted!
Congrats!

[RolaH1t]

Critical Update:
QG approval withdrawn until clarification of Postgresql DB issue => @HeyHardy @nicoprow @Siegfriedk
reference: violation of TRG 5.07

[RolaH1t]

final conclusion: TRG 5.07 still violated (postgresql DB version 14.x) but successfully tested.
this is covered in overall release note 24.03
QG closed with these conditions.