Tag-security: Security Assessment for Project Harbor's Graduation Bid

[michmike]

Project Name: Harbor
Github URL: https://github.com/goharbor
Website: https://goharbor.io
Security Provider: yes

• [x] Identify team
  
  
  
  • [x] Project security lead: Michael Michael (michmike), Daniel Jiang (reasonerjt)
  
  
  • [x] Lead Security Reviewer: Andres Vega (anvega)
  
  
  • [x] 1 or more additional reviewer(s): Justin Cappos (justincappos), Cameron Seader (cseader), Chase Pettet (chasemp), Vinay Venkataraghavan (vinayvenkat), observer:Payam Tarverdyan Chychi (pchychi-blox), Martin Vrachev (MVrachev)
  
  
  • [x] Declaration of reading of security reviewer guidelines and declaration of conflits (by each reviewer)
  
  
  • [x] Sign off by 2 chairs on reviewer conflicts
  
  
• [x] Create slack channel: #sec-assess-harbor
• [x] Project lead provides draft document - see outline
• [x] "Clarifying question phase" Lead Security Reviewer asks clarifying questions
• [x] Initial review
• [x] Presentation & discussion on 4/22/2020
• [x] Share draft findings with project
• [x] Assessment summary and doc checked into /assessments/projects/project-name - /assessments/projects/harbor
• [x] CNCF TOC presentation (Harbor did a TOC presentation on 11/05/2019. Slides)

Document for the CNCF SIG-Security review is located at https://docs.google.com/document/d/1OiBGl2D2kBUjLEippHUPgpZgSDTFIeCwpA6RxzQJpoc/edit?usp=sharing

[michmike]

Xref: https://github.com/cncf/toc/pull/311

[anvega]

I'm happy to participate as a reviewer. I've read the guideline and have no conflict.

Hard conflicts:

Reviewer is a maintainer of the project - NO
Reviewer is a direct report of/to a maintainer of the project - NO
Reviewer is paid to work on the project - NO
Reviewer has significant financial interest directly tied to success of the project - NO

Soft conflicts:

Reviewer belongs to the same company/organization of the project, but does not work on the project - NO
Reviewer uses the project in his/her work - NO
Reviewer has contributed to the project. - NO
Reviewer has a personal stake in the project (personal relationships, etc.) - NO

[cseader]

Happy to be an assessment reviewer :+1:

[chasemp]

I cannot seem to edit the top line item. But if someone can add me as an additional reviewer that would be swell.

[pchychi-blox]

Happy to be added as an security review observer

[vinayvenkat]

I'd like to participate in the security review for Harbor.

[saravanant23]

Like participate in the security review for Harbor. Thanks

[raravena80]

For Harbor, there is a combined document created by SIG-Runtime to gather reviews and concerns from all the different SIGs: http://bit.ly/harbor-graduation-dd. Can you please update the doc once you have completed the review? Thanks!

[JustinCappos]

Here is my conflict statement:

Hard conflicts:

Reviewer is a maintainer of the project - NO
Reviewer is a direct report of/to a maintainer of the project - NO
Reviewer is paid to work on the project - NO
Reviewer has significant financial interest directly tied to success of the project - NO

Soft conflicts:

Reviewer belongs to the same company/organization of the project, but does not work on the project - NO
Reviewer uses the project in his/her work - NO
Reviewer has contributed to the project. - NO (except to Notary via TUF)
Reviewer has a personal stake in the project (personal relationships, etc.) - NO

[chasemp]

Here is my conflict statement:

Hard conflicts:

Reviewer is a maintainer of the project - NO
Reviewer is a direct report of/to a maintainer of the project - NO
Reviewer is paid to work on the project - NO
Reviewer has significant financial interest directly tied to success of the project - NO

Soft conflicts:

Reviewer belongs to the same company/organization of the project, but does not work on the project - NO
Reviewer uses the project in his/her work - NO
Reviewer has contributed to the project. - NO
Reviewer has a personal stake in the project (personal relationships, etc.) - NO

[vinayvenkat]

Here is my conflict statement:

Hard conflicts:

Reviewer is a maintainer of the project - NO
Reviewer is a direct report of/to a maintainer of the project - NO
Reviewer is paid to work on the project - NO
Reviewer has significant financial interest directly tied to success of the project - NO

Soft conflicts:

Reviewer belongs to the same company/organization of the project, but does not work on the project - NO
Reviewer uses the project in his/her work - NO
Reviewer has contributed to the project. - NO
Reviewer has a personal stake in the project (personal relationships, etc.) - NO

[JustinCappos]

@cseader @anvega @pchychi-blox Would you please add your conflict statements?

[anvega]

I'd like to propose the following schedule:

March 30 - April 3 - Dumb questions phase (Only project team and lead security reviewer involved)
April 6 - 10 : Security review phase - Security reviewers add comments on the doc and conversation around edits to the doc continues
April 15 - Present assessment to SIG-Security (At least 1 representative from project team and security reviewers)
By April 17: Address all remaining comments, and finalize assessment summary

How does this work for everyone else?

@JustinCappos I edited my prior comment to include conflict statements.

[pchychi-blox]

Here is my conflict statement:

Hard conflicts:

Reviewer is a maintainer of the project - NO
Reviewer is a direct report of/to a maintainer of the project - NO
Reviewer is paid to work on the project - NO
Reviewer has significant financial interest directly tied to success of the project - NO

Soft conflicts:

Reviewer belongs to the same company/organization of the project, but does not work on the project - NO
Reviewer uses the project in his/her work - NO
Reviewer has contributed to the project. - NO
Reviewer has a personal stake in the project (personal relationships, etc.) - NO

[JustinCappos]

Reviewer has contributed to the project. - NO (except to Notary via TUF)

I didn't know you are a TUF contributor. Was this a typo?

[JustinCappos]

@anvega Since we haven't heard from @cseader , should we move on without them? I can remove them from the list.

[anvega]

@JustinCappos I pinged @cseader to see if he can respond today, while I get going on the dumb questions phase. If we don't hear back from him by tomorrow we can remove him from the list.

[cseader]

Here is my conflict statement:
Hard conflicts:

Reviewer is a maintainer of the project - NO
Reviewer is a direct report of/to a maintainer of the project - NO
Reviewer is paid to work on the project - NO
Reviewer has significant financial interest directly tied to success of the project - NO

Soft conflicts:

Reviewer belongs to the same company/organization of the project, but does not work on the project - NO
Reviewer uses the project in his/her work - NO
Reviewer has contributed to the project. - NO
Reviewer has a personal stake in the project (personal relationships, etc.) - NO

[JustinCappos]

@ultrasaurus @pragashj @dshaw Ready for sign-off from chairs about conflicts...

[JustinCappos]

I'm signing off on the conflict statements.

[dshaw]

Co-chair sign-off confirming conflict statement reviews for @anvega @justincappos @cseader @chasemp @vinayvenkat @pchychi-blox. Thank you all.

[MVrachev]

Hopefully it isn't too late to join as an observer in this assessment.

Here is my conflict statement:

Hard conflicts:

Reviewer is a maintainer of the project - NO
Reviewer is a direct report of/to a maintainer of the project - NO
Reviewer is paid to work on the project - NO
Reviewer has significant financial interest directly tied to success of the project - NO

Soft conflicts:

Reviewer belongs to the same company/organization of the project, but does not work on the project - YES
Reviewer uses the project in his/her work - NO
Reviewer has contributed to the project. - NO
Reviewer has a personal stake in the project (personal relationships, etc.) - NO

I wrote that I have a soft conflict with Reviewer belongs to the same company/organization of the project, but does not work on the project because Harbor was initially created at VMware and I work there although Harbor was donated to CNCF for year and a half already.

[MVrachev]

@JustinCappos @dshaw am I accepted as an observer in this assessment?

[JustinCappos]

@JustinCappos @dshaw am I accepted as an observer in this assessment?

yes, done!

[michmike]

@anvega is the process that sig-security performs a TOC presentation for a security assessment? the other SIGs that did an assessment for Harbor's graduation bid just wrote their assessment in a doc and shared the findings. i am asking since we need to reserve the TOC slot in advance.
@caniszczyk for your thoughts as well.

[anvega]

@michmike The assessment summary once committed and merged will be used as a reference. Looking back no presentations have been made to share the summary from SIG-Security to TOC.

[michmike]

got it. thanks @anvega

[michmike]

PR for the self-assessment is at https://github.com/cncf/sig-security/pull/378

[dshaw]

Security Assessment complete. We are now finalizing due diligence documentation.

[dshaw]

Due diligence and SIG-Security's recommendation that Harbor graduate has been submitted to the TOC. https://github.com/cncf/toc/pull/311

[dshaw]

I'm going to leave this open for SIG-Security Assessment feedback and commendation with the Tech Leads in two weeks. All expected actions from the Harbor team are complete.

[JustinCappos]

I'm going to leave this open for SIG-Security Assessment feedback and commendation with the Tech Leads in two weeks. All expected actions from the Harbor team are complete.

Looks like that time has passed! I'll close this issue and mark this as done.