CII Badge Program Checklist

• Overview at https://www.coreinfrastructure.org/programs/badge-program
• Existing submissions are at https://bestpractices.coreinfrastructure.org/projects
• Example of a certifying submission at https://bestpractices.coreinfrastructure.org/projects/1 (multiple tabs)

Draft of submission, including some open issues and questions below.

Basics

Basic Project Website Content

✓ The project website MUST succinctly describe what the software does (what problem does it solve?).
The Xen ProjectTM is the leading open source virtualization platform that is powering some of the largest clouds in production today. Amazon Web Services, Aliyun, Rackspace Public Cloud, Verizon Cloud and many hosting services use Xen Project software. Plus, it is integrated into multiple cloud orchestration projects like OpenStack.

✓ The project website MUST provide information on how to: obtain, provide feedback (as bug reports or enhancements), and contribute to the software.
http://wiki.xenproject.org/wiki/Reporting_Bugs_against_Xen_Project
http://xenproject.org/help/contribution-guidelines.html

✓ The information on how to contribute MUST explain the contribution process (e.g., are pull requests used?)
http://xenproject.org/developers/governance.html http://xenproject.org/help/contribution-guidelines.html

✓ The information on how to contribute SHOULD include the requirements for acceptable contributions (e.g., a reference to any required coding standard).
http://wiki.xenproject.org/wiki/Submitting_Xen_Project_Patches

FLOSS License

✓ What license(s) is the project released under?
Mostly GPLv2 with some files being released under more permissive licenses to allow interaction with other open source projects

✓ The software MUST be released as FLOSS.
The project is mostly GPLv2, with some exceptions which all must be be OSI approved licenses.

✓It is SUGGESTED that any required license(s) be approved by the Open Source Initiative (OSI).
The project is mostly GPLv2, with some exceptions which all must be be OSI approved licenses.

✓The project MUST post license(s) in a standard location.
http://xenbits.xen.org/gitweb/?p=xen.git;a=blob;f=COPYING
Other repositories by the project also have a COPYING file in the top level of the tree

Documentation

✓The project MUST provide basic documentation for the software.
The project creates man pages and other documentation via http://xenbits.xen.org/docs/

✓The project MUST include reference documentation that describes its interface.
http://xenbits.xen.org/docs/ contains interface definitions, protocol specifications, designs, ...

Other

✗The project sites (website, repository, and download URLs) MUST support HTTPS using TLS.
This is in progress via ticket "[OSSC #77650] Migrating Xen Project websites from http to https"
Notes:

• xenbits.xenproject.org, wiki.xenproject.org, lists.xenproject.org, downloads.xenproject.org are straightforward and can be done by Credativ
• blog.xenproject.org is already done, but does not redirect
• xenproject.org will have to be done via cloudaccess.net at an additional cost of USD 100 per year
• bits.xensource.com does not have a valid certificate which needs to be fixed

✓The project MUST have one or more mechanisms for discussion (including proposed changes and issues) that are searchable, allow messages and topics to be addressed by URL, enable new people to participate in some of the discussions, and do not require client-side installation of proprietary software.
http://www.xenproject.org/help/mailing-list.html

✓The project SHOULD include documentation in English and be able to accept bug reports and comments about code in English.
Besides in-tree documentation as highlighted earlier, the project has an entire website and wiki dedicated to documentation. See http://wiki.xenproject.org/ and http://www.xenproject.org/

Change Control

Public version-controlled source repository

✓The project MUST have a version-controlled source repository that is publicly readable and has a URL.
Repositories are at http://xenbits.xen.org/gitweb/

✓The source repository MUST track what changes were made, who made the changes, and when the changes were made.
Uses git to track.

✓To enable collaborative review, the project's source repository MUST include interim versions for review between releases; it MUST NOT include only final releases.
Interim versions are put on git, not just final versions.

✓It is SUGGESTED that common distributed version control software be used (e.g., git).
Uses git.

Version numbering

✓The project MUST have a unique version number for each release intended to be used by users.
The primary single user uses git commit records to identify releases.

✓It is SUGGESTED that the Semantic Versioning (SemVer) format be used for releases.
Major changes are recorded using Semantic Versioning (SemVer), beginning with version 2.0.0

✓It is SUGGESTED that projects identify each release within their version control system. For example, it is SUGGESTED that those using git identify each release using git tags. Full releases are tagged using 'git tag'.

Release Notes (ChangeLog)

✓The project MUST provide, in each release, release notes that are a human-readable summary of major changes in that release.
Release notes for major and minor releases are available from download pages, e.g. http://xenproject.org/downloads/xen-archives/xen-46-series/xen-460.html and http://xenproject.org/downloads/xen-archives/xen-46-series/xen-461.html.

✓The release notes MUST identify every publicly known vulnerability that is fixed in each new release.
We do this explicitly for point releases (e.g. http://xenproject.org/downloads/xen-archives/xen-46-series/xen-461.html). However, we do not explicitly list fixed vulnerabilities for major releases which by default contain fixes for all known vulnerabilities as listed in http://xenbits.xen.org/xsa/ up to the release date, unless there has been an oversight (note that this has not happened yet), in which case this would be stated in release notes.

Reporting

Bug reporting process

✓The project MUST provide a process for users to submit bug reports (e.g., using an issue tracker or a mailing list).
http://wiki.xenproject.org/wiki/Reporting_Bugs_against_Xen_Project

✓The project SHOULD use an issue tracker for tracking individual issues.
http://wiki.xenproject.org/wiki/Xen_Bug_Management_Interface

✓The project MUST acknowledge a majority of bug reports submitted in the last 2-12 months (inclusive); the response need not include a fix.
The vast majority of bug reports are acknowledged.

✗The project SHOULD respond to most enhancement requests in the last 2-12 months (inclusive). The project MAY choose not to respond.
It is up to contributors to submit enhancement requests: the Xen Project developers almost never accept "enhancement requests" on their own, unless these are very popular requests from https://xenorg.uservoice.com/forums/172169-xen-development.

✓The project MUST have a publicly available archive for reports and responses for later searching.
Reports and responses are handled as described in http://wiki.xenproject.org/wiki/Reporting_Bugs_against_Xen_Project http://wiki.xenproject.org/wiki/Reporting_Bugs_against_Xen_Project]. Many reports are initially handled via mailing lists, which are searchable via http://xen.markmail.org/ (subject:BUG). The bug tracker is also used (and is searchable); it is described at http://wiki.xenproject.org/wiki/Xen_Bug_Management_Interface

Vulnerability reporting process

✓The project MUST publish the process for reporting vulnerabilities on the project site.
See http://xenproject.org/security-policy.html

✓If private vulnerability reports are supported, the project MUST include how to send the information in a way that is kept private.
See http://xenproject.org/security-policy.html

✓The project's initial response time for any vulnerability report received in the last 6 months MUST be less than or equal to 14 days.
The project's security team typically responds within one working day.

Quality

Working build system

✓If the software requires building for use, the project MUST provide a working build system that can automatically rebuild the software from source code.
http://wiki.xenproject.org/wiki/Compiling_Xen_From_Source

✓It is SUGGESTED that common tools be used for building the software.

✓The project SHOULD be buildable using only FLOSS tools.

Automated test suite

✓The project MUST have at least one automated test suite that is publicly released as FLOSS (this test suite may be maintained as a separate FLOSS project).
See http://xenbits.xen.org/gitweb/?p=osstest.git;a=summary

✓A test suite SHOULD be invocable in a standard way for that language.
See http://xenbits.xen.org/gitweb/?p=osstest.git;a=blob;f=README

✓It is SUGGESTED that the test suite cover most (or ideally all) the code branches, input fields, and functionality.
The OSSTEST suite and the Test Farm which executes OSSTEST tests all official git code branches. However, the test coverage of OSSTEST does not cover all input fields and functionality. However several vendors (e.g. Citrix and Oracle) have their own extensive test suites (including test infrastructure), which are executed on release candidates which have an extremely high degree of coverage. It would not be possible for the project to run these suites and operate the infrastructure.

✓It is SUGGESTED that the project implement continuous integration (where new or changed code is frequently integrated into a central code repository and automated tests are run on the result).
OSSTEST and the projects Test Farm implements continuous integration

New functionality testing

✗The project MUST have a general policy (formal or not) that as major new functionality is added, tests of that functionality SHOULD be added to an automated test suite.
We do not currently do this for all new features: only for supported features. Experimental and preview features are excluded.

✗The project MUST have evidence that such tests are being added in the most recent major changes to the project.
TODO: check - not quite clear

✗It is SUGGESTED that this policy on adding tests be documented in the instructions for change proposals.
We do not have a documented policy. A formal policy was discussed (but not agreed) that require all supported features to be automatically tested by OSSTEST, a 3rd party test system or manually with test reports sent in for RCs, otherwise features would be downgraded.

Warning flags

✓The project MUST enable one or more compiler warning flags, a "safe" language mode, or use a separate "linter" tool to look for code quality errors or common simple mistakes, if there is at least one FLOSS tool that can implement this criterion in the selected language.
We compile with -Wall -Wextra, and use Coverity

✓The project MUST address warnings.
We compile with -Werror, so warnings cannot be ignored.

✓It is SUGGESTED that projects be maximally strict with warnings, but this is not always practical. .
We compile with -Wall -Wextra to turn on as many warnings as possible

Security

Secure development knowledge

✓The project MUST have at least one primary developer who knows how to design secure software.
The project has a dedicated security team that has a track record of designing secure software

✓At least one of the primary developers MUST know of common kinds of errors that lead to vulnerabilities in this kind of software, as well as at least one method to counter or mitigate each of them.
The project has a dedicated security team that has a track record of fixing reported vulnerabilities

Good cryptographic practices

Note that some software does not need to directly use cryptographic capabilities. A "project security mechanism" is a security mechanism provided by the delivered project's software.

This section is (largely) irrelevant. We don't provide cryptographic libraries or facilities. The Xen hypervisor itself doesn't do any cryptography. The toolstack software uses cryptography for migration, but it just uses whatever ssh you have as a transport (by default). We do support VNC, which has some encryption features. The encryption is entirely done by qemu. For qemu upstream, this is handled by the qemu project. qemu-trad may fail some of these criteria (although it just uses whatever GNUTLS you have) but we are trying to obsolete qemu-trad.

N/A The project's cryptographic software MUST use by default only cryptographic protocols and algorithms that are publicly published and reviewed by experts.
We don't provide cryptographic libraries or facilities. The Xen hypervisor itself doesn't do any cryptography.

N/A If the project software is an application or library, and its primary purpose is not to implement cryptography, then it SHOULD only call on software specifically designed to implement cryptographic functions; it SHOULD NOT re-implement its own.
We don't provide cryptographic libraries or facilities. The Xen hypervisor itself doesn't do any cryptography.

N/A All functionality that depends on cryptography MUST be implementable using FLOSS.
We don't provide cryptographic libraries or facilities. The Xen hypervisor itself doesn't do any cryptography.

N/A The project security mechanisms MUST use default keylengths that at least meet the NIST minimum requirements through the year 2030 (as stated in 2012).
We don't provide cryptographic libraries or facilities. The Xen hypervisor itself doesn't do any cryptography.

N/A The default project security mechanisms MUST NOT depend on cryptographic algorithms that are broken (e.g., MD4, MD5, single DES, RC4, or Dual_EC_DRBG).
We don't provide cryptographic libraries or facilities. The Xen hypervisor itself doesn't do any cryptography.

N/A The project security mechanisms SHOULD NOT by default depend on cryptographic algorithms with known serious weaknesses (e.g., SHA-1).
We don't provide cryptographic libraries or facilities. The Xen hypervisor itself doesn't do any cryptography.

N/A The project SHOULD implement perfect forward secrecy for key agreement protocols so a session key derived from a set of long-term keys cannot be compromised if one of the long-term keys is compromised in the future.
We don't provide cryptographic libraries or facilities. The Xen hypervisor itself doesn't do any cryptography.

N/A If passwords are stored for authentication of external users, the project MUST store them as iterated hashes with a per-user salt by using a key stretching (iterated) algorithm (e.g., PBKDF2, Bcrypt or Scrypt).
We don't provide cryptographic libraries or facilities. The Xen hypervisor itself doesn't do any cryptography.

N/A The project MUST generate all cryptographic keys and nonces using a cryptographically secure random number generator, and MUST NOT do so using generators that are not cryptographically secure.
We don't provide cryptographic libraries or facilities. The Xen hypervisor itself doesn't do any cryptography.

Secured delivery against man-in-the-middle (MITM) attacks

✗The project MUST use a delivery mechanism that counters MITM attacks. Using https or ssh+scp is acceptable.
This is in progress via ticket "[OSSC #77650] Migrating Xen Project websites from http to https"

✓A cryptographic hash (e.g., a sha1sum) MUST NOT be retrieved over http and used without checking for a cryptographic signature.
We provided PGP-signed tarballs and PGP-signed git tags, so that the recipient can verify that they are getting the right bits.

Publicly-known vulnerabilities fixed

✓There MUST be no unpatched vulnerabilities of medium or high severity that have been publicly known for more than 60 days.
See http://xenbits.xen.org/xsa/

✓Projects SHOULD fix all critical vulnerabilities rapidly after they are reported.
See http://xenproject.org/security-policy.html under "Embargo and disclosure schedule"

Other security

✓The public repositories MUST NOT leak a valid private credential (e.g., a working password or private key) that is intended to limit public access.
Private credentials are stored securely or in private repositories

Analysis

Static code analysis

✓At least one static code analysis tool MUST be applied to any proposed major production release of the software before its release, if there is at least one FLOSS tool that implements this criterion in the selected language.
The project uses Coverity Scan.

✓It is SUGGESTED that at least one of the static analysis tools used for the static_analysis criterion include rules or approaches to look for common vulnerabilities in the analyzed language or environment.

✓All medium and high severity exploitable vulnerabilities discovered with static code analysis MUST be fixed in a timely way after they are confirmed.
These are reported to the security team, which handles the issues.

✓It is SUGGESTED that static source code analysis occur on every commit or at least daily.
Coverity Scan is run daily

Dynamic analysis

✓It is SUGGESTED that at least one dynamic analysis tool be applied to any proposed major production release of the software before its release.
According to the LF, running the fuzzer portion of XenRT on RCs as part of a Xen Test Day would be sufficient. Need to double check, but I believe this does actually happen.

✓It is SUGGESTED that if the software is application-level software written using a memory-unsafe language (e.g., C or C++) then at least one dynamic tool (e.g., a fuzzer or web application scanner) be routinely used with a mechanism to detect memory safety problems such as buffer overwrites.
Vendors such as Citrix and Oracle, run their own test suites which for example in the case of Citrix who runs XenRT includes fuzzing functionality on XEN PROJECT release candidates.

✓It is SUGGESTED that the software include many run-time assertions that are checked during dynamic analysis.
Vendors such as Citrix and Oracle, run their own test suites which for example in the case of Citrix who runs XenRT includes fuzzing functionality on XEN PROJECT release candidates. This test suite is running debug builds testing assertions in all cases but for performance testing.

✓All medium and high severity exploitable vulnerabilities discovered with dynamic code analysis MUST be fixed in a timely way after they are confirmed.
These are handled in the same way as we handle vulnerabilities.

Future

These are criteria we intend to add in the near future, but are not currently required for a badge. This grace period allows projects to update to changed criteria and retain their badge as best practices improve.

Someone technical needs to go over this section and decide what is N/A ✓ ✗. I marked those which I do not know as ✗ for now, with a TODO in the justification

✓(Future criterion) The project SHOULD provide a way to easily install and uninstall the software using a commonly-used convention.
Many third parties provide packages (e.g., .deb for apt-get, .rpm). Since Xen is operating system like, installation is in general different than application software.

✗(Future criterion) It is SUGGESTED that the project have a reproducible build.
This would be a good idea. We don't have it right now, but we have accepted patches towards this goal (submitted, I think, by the Debian reproducible builds folks).

✓(Future criterion) The project SHOULD NOT use unencrypted network communication protocols (such as HTTP and telnet) if there an encrypted equivalent (e.g., HTTPS/TLS and SSH), unless the user specifically requests or configures it.
We do not use HTTP as an RPC transport. The toolstack software uses cryptography for migration, but it just uses whatever ssh you have as a transport (by default). We do support VNC, which has some encryption features. The encryption is entirely done by qemu using TLS.

✗(Future criterion) The project SHOULD, if it supports TLS, support at least TLS version 1.2. Note that the predecessor of TLS was called SSL.
TODO: Check qemu-trad and qemu-xen, both of which support some TLS for VNC.

✗(Future criterion) The project MUST, if it supports TLS, perform TLS certificate verification by default when using TLS, including on subresources.
XXX: This doesn't seem like it could work given TLS's security model: the VNC server is the user's and it would have to get a cert somehow.

N/A (Future criterion) The project SHOULD, if it supports TLS, perform certificate verification before sending HTTP headers with private information (such as secure cookies).
We do not use HTTP as an RPC transport.

✗(Future criterion) It is SUGGESTED that the project website, repository (if accessible via the web), and download site (if separate) include key hardening headers with nonpermissive values.
According to https://securityheaders.io/

• the xenproject.org site does support Strict-Transport-Security (HSTS) and X-Frame-Options. However, it does not support: Content-Security-Policy (CSP), X-XSS-Protection, or X-Content-Type-Options.
• however *.xenproject.org sites support neither

✗(Future criterion) It is SUGGESTED that hardening mechanisms be used so software defects are less likely to result in security vulnerabilities.
TODO