Skip to content

Commit e0fa585

Browse files
MaffoochMaffooch
authored
Merge pull request DefectDojo#2704 from DefectDojo/release/1.7.0
Release/1.7.0
2 parents f93e24e + e988172 commit e0fa585

File tree

291 files changed

+29785
-4762
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

291 files changed

+29785
-4762
lines changed

‎.github/ISSUE_TEMPLATE/bug_report.md‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -27,7 +27,7 @@ A clear and concise description of what you expected to happen.
2727

2828
**Environment information**
2929
- Operating System: [e.g. Ubuntu 18.04]
30-
- DefectDojo Commit Message: [use `git show -s --format="%h: %s [%ci]"`]
30+
- DefectDojo Commit Message: [use `git show -s --format="[%ci] %h: %s [%d]"`]
3131

3232
**Sample scan files** (optional)
3333
If applicable, add sample scan files to help reproduce your problem.

‎.travis.yml‎

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -10,8 +10,7 @@ env:
1010
- CHANGE_MINIKUBE_NONE_USER=true
1111
matrix:
1212
- TEST=flake8
13-
- TEST=integration_tests
14-
- TEST=docker
13+
- TEST=docker_integration_tests
1514
- BROKER=rabbitmq DATABASE=mysql
1615
- BROKER=rabbitmq DATABASE=postgresql
1716
- BROKER=redis DATABASE=mysql

‎BRANCHING-MODEL.md‎

Lines changed: 8 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -3,24 +3,20 @@ This section describes
33
- how branches are handled
44
- defectdojo release cycle
55

6-
Please be careful to submit your pull requests to the correct branch:
7-
- bugfix: latest release branch
8-
- evolutions: dev branch
9-
10-
If in doubt please use dev branch.
11-
126
# Release and hotfix model
137
![Schemas](doc/branching_model.png)
148
## Releasing
15-
- Start an x.y.0 release branch off dev branch
16-
- Commit only bug fixes onto this branch (and merge those fixes back to dev)
9+
- Start a release/x.y.0 release branch off dev branch
10+
- Commit only bug fixes from `dev` branch onto this branch
1711
- Dev branch keeps living with further evolutions
18-
- Every 4-8 weeks, merge the release branch to master and tag: this is when the new release is out: x.(y+1).z
12+
- Every 4-8 weeks, merge the release branch to master and tag x.y.0: this is when the new release is out: x.(y+1).0
1913

2014
# Issuing a hotfix
21-
- In case of major issue found after releasing, issue a hotfix branch (first is x.y.1) which is merged to master, dev, and the next release branch
15+
- In case of major issue found after releasing, and fixed in `dev`:
16+
- Issue a hotfix branch (first is x.y.1) holding this fix
17+
- Merge to `master` and the next release branch
2218

2319

24-
(Schemes created with https://www.planttext.com/)
20+
Diagrams created with https://www.planttext.com
2521

26-
(This model is inspired by https://nvie.com/posts/a-successful-git-branching-model/ but without feature branches.)
22+
This model is close to gitflow https://www.atlassian.com/git/tutorials/comparing-workflows/gitflow-workflow, https://nvie.com/posts/a-successful-git-branching-model/ with the feature branch being made in each contributor repository.

‎CONTRIBUTING.md‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -60,3 +60,5 @@ DefectDojo.
6060
[setup_bash]: /setup.bash "Bash setup script"
6161
[pep8]: https://www.python.org/dev/peps/pep-0008/ "PEP8"
6262
[flake8 built-in commit hooks]: https://flake8.pycqa.org/en/latest/user/using-hooks.html#built-in-hook-integration
63+
64+

‎DOCKER.md‎

Lines changed: 11 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -10,8 +10,7 @@ It is one of the supported [Default installation](setup/README.md) methods.
1010
* Proxies
1111
* If you're behind a corporate proxy check https://docs.docker.com/network/proxy/ .
1212
* Known issues
13-
* finding images do not work with docker-compose yet. Making them work in release mode requires additional configuration, some of which will arrive in 1.7.0
14-
13+
* finding images only work in `dev` and `ptvsd` mode. Making them work in `release` mode requires modifications to the docker-compose configuration.
1514

1615
# Setup via Docker Compose - introduction
1716

@@ -71,6 +70,7 @@ For development, use:
7170
```zsh
7271
cp dojo/settings/settings.dist.py dojo/settings/settings.py
7372
docker/setEnv.sh dev
73+
docker-compose build
7474
docker-compose up
7575
```
7676

@@ -155,6 +155,15 @@ docker-compose logs initializer | grep "Admin password:"
155155

156156
Make sure you write down the first password generated as you'll need it when re-starting the application.
157157

158+
# Option to change the password
159+
* If you dont have admin password use the below command to change the password.
160+
* After starting the container and open another tab in the same folder.
161+
* django-defectdojo_uwsgi_1 -- name obtained from running containers using ```zsh docker ps ``` command
162+
163+
```zsh
164+
docker exec -it django-defectdojo_uwsgi_1 ./manage.py changepassword admin
165+
```
166+
158167
# Exploitation, versioning
159168
## Disable the database initialization
160169
The initializer container can be disabled by exporting: `export DD_INITIALIZE=false`.

‎Dockerfile.django‎

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -4,16 +4,16 @@
44
# The code for the build image should be idendical with the code in
55
# Dockerfile.nginx to use the caching mechanism of Docker.
66

7-
# Using 3.5.7 to avoid compatibility issues that may be introduced by python 3.6 and 3.7.
8-
# Please upgrade before end-of-life in september 2020!
97
# Ref: https://devguide.python.org/#branchstatus
10-
FROM python:3.5.9-buster@sha256:1baef6be00b82fbd77f1b60ab227a1dbede6f23825ce1b7f1e9c6f7d1469a45c as build
8+
FROM python:3.6.11-slim-buster@sha256:9111ff37d96bdcd84bcac261951ac410ee276144eb8a02f06e5907ff4ff2ffea as build
119
WORKDIR /app
1210
RUN \
1311
apt-get -y update && \
1412
apt-get -y install \
13+
build-essential \
1514
dnsutils \
1615
default-mysql-client \
16+
libmariadb-dev-compat \
1717
postgresql-client \
1818
xmlsec1 \
1919
git \
@@ -24,7 +24,7 @@ RUN \
2424
COPY requirements.txt ./
2525
RUN pip3 wheel --wheel-dir=/tmp/wheels -r ./requirements.txt
2626

27-
FROM python:3.5.9-slim-buster@sha256:dfb042910e4ef352b5c6aa223031ce768f53f4f1aacf95936152e5508162bcb0
27+
FROM python:3.6.11-slim-buster@sha256:9111ff37d96bdcd84bcac261951ac410ee276144eb8a02f06e5907ff4ff2ffea
2828
WORKDIR /app
2929
RUN \
3030
apt-get -y update && \
@@ -72,7 +72,7 @@ RUN \
7272
cp dojo/settings/settings.dist.py dojo/settings/settings.py
7373
COPY tests/ ./tests/
7474
RUN \
75-
mkdir dojo/migrations && \
75+
mkdir -p dojo/migrations && \
7676
chmod g=u dojo/migrations && \
7777
chmod g=u /var/run && \
7878
true

‎Dockerfile.integration-tests‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11

22
# code: language=Dockerfile
33

4-
FROM python:3.5.9-slim-buster@sha256:8068eec6231ae9b097b296068ba4ed0da08eff5f8a4b44c585d25afaea9e8b33 as build
4+
FROM python:3.6.11-slim-buster@sha256:9111ff37d96bdcd84bcac261951ac410ee276144eb8a02f06e5907ff4ff2ffea as build
55
WORKDIR /app
66
RUN \
77
apt-get -y update && \

‎Dockerfile.nginx‎

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -3,13 +3,15 @@
33
# The code for the build image should be idendical with the code in
44
# Dockerfile.django to use the caching mechanism of Docker.
55

6-
FROM python:3.5.9-buster@sha256:1baef6be00b82fbd77f1b60ab227a1dbede6f23825ce1b7f1e9c6f7d1469a45c as build
6+
FROM python:3.6.11-slim-buster@sha256:9111ff37d96bdcd84bcac261951ac410ee276144eb8a02f06e5907ff4ff2ffea as build
77
WORKDIR /app
88
RUN \
99
apt-get -y update && \
1010
apt-get -y install \
11+
build-essential \
1112
dnsutils \
1213
default-mysql-client \
14+
libmariadb-dev-compat \
1315
postgresql-client \
1416
xmlsec1 \
1517
git \
@@ -29,7 +31,7 @@ ENV \
2931
node="nodejs"
3032
RUN \
3133
apt-get -y update && \
32-
apt-get -y install apt-transport-https ca-certificates && \
34+
apt-get -y install apt-transport-https ca-certificates curl wget && \
3335
curl -sSL https://deb.nodesource.com/gpgkey/nodesource.gpg.key | apt-key add --no-tty - && \
3436
curl -sL https://deb.nodesource.com/setup_12.x | bash - && \
3537
curl -sS https://dl.yarnpkg.com/debian/pubkey.gpg | apt-key add - && \
@@ -62,14 +64,12 @@ RUN \
6264
python3 manage.py collectstatic --noinput && \
6365
true
6466

65-
FROM nginx:1.17.9@sha256:7ac7819e1523911399b798309025935a9968b277d86d50e5255465d6592c0266
67+
FROM nginx:1.19.1-alpine@sha256:966f134cf5ddeb12a56ede0f40fff754c0c0a749182295125f01a83957391d84
6668
COPY --from=collectstatic /app/static/ /usr/share/nginx/html/static/
6769
COPY wsgi_params nginx/nginx.conf nginx/nginx_TLS.conf /etc/nginx/
6870
COPY docker/entrypoint-nginx.sh /
6971
RUN \
70-
apt-get -y update && \
71-
apt-get -y install openssl && \
72-
apt-get clean && \
72+
apk add --no-cache openssl && \
7373
chmod -R g=u /var/cache/nginx && \
7474
chmod -R g=u /var/run && \
7575
mkdir -p /etc/nginx/ssl && \

‎MAINTAINERS.md‎

Lines changed: 25 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -1,21 +1,36 @@
1-
## Maintainer Responsibilities
1+
## Maintainer responsibilities
22

3-
* Maintainers regularly attend quarterly project meetings.
3+
* Maintainers regularly attend monthly project meetings on the first Tuesday, and maintainers "office hours" on the third Tuesday of every month.
4+
* Participate in the #defectdojo and #defectdojo-dev channels regularly.
5+
* Reviews pull requests.
46
* Volunteer for and willingly accept assignments and complete them thoroughly and on time.
57
* Stay informed about project matters.
68
* Prepare themselves well for meetings.
79
* Build a collegial working relationship that contributes to consensus.
8-
* Is an active participant in the project’s annual evaluating and planning efforts.
9-
* Reviews pull requests within two weeks if requested.
10-
11-
## Becoming a Maintainer
1210

11+
## Becoming a maintainer
1312
New maintainers are selected by consensus from the current group of maintainers on an invite-only basis.
1413

15-
## Current Maintainers
14+
## Stop being a maintainer
15+
Maintainership is not a necesarily a lifetime subscription. Maintainers can withdraw at any time.
16+
17+
Furthermore, maintainers that have not had any activities (commits, PR, PR reviews, no meeting attendance) in:
18+
- 3 months: Current maintainers will attempt a contact.
19+
- 6 months: If no sign of life, will be automatically removed from maintainers groups.
1620

17-
Greg Anderson
21+
## Current maintainers
22+
### OWASP Project Leaders:
23+
* Greg Anderson (@devGregA)
24+
* Aaron Weaver (@aaronweaver)
25+
* Matt Tesauro (@mtesauro)
1826

19-
Aaron Weaver
27+
### Core Maintainers
28+
* Valentijn Scholten (@valentijnscholten)
29+
* Fred Blaise (@madchap)
30+
* Cody Maffucci (@Maffooch)
2031

21-
Matt Tesauro
32+
### Maintainers
33+
* Anthony Pipia (@apipia)
34+
* Saurabh (@dr3dd589)
35+
* Jannik Jürgens (@alles-klar)
36+
* Pascal Trovatelli (@ptrovatelli)

‎PULL_REQUEST_TEMPLATE.md‎

Lines changed: 7 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1,28 +1,30 @@
11
This template is for your information. Please clear everything when submitting your pull request.
22

3-
**Note: DefectDojo is now on Python3.5 and Django 2.2.x Please submit your pull requests to the 'dev' branch as the 'legacy-python2.7' branch is only for bug fixes. Any new features submitted to the legacy branch will be ignored and closed.**
3+
**Note: DefectDojo is now on Python3.6 and Django 2.2.x. Please submit your pull requests to the 'dev' branch as the 'legacy-python2.7' branch is only for bug fixes. Any new features submitted to the legacy branch will be ignored and closed.**
44

55
When submitting a pull request, please make sure you have completed the following checklist:
66

7+
- [ ] Give a meaninful name to your PR, as it may end up being used in the release notes.
78
- [ ] Your code is flake8 compliant.
8-
- [ ] Your code is python 3.5 compliant (specific python >=3.6 syntax is currently not accepted).
9+
- [ ] Your code is python 3.6 compliant (specific python >3.6 syntax is currently not accepted).
910
- [ ] If this is a new feature and not a bug fix, you've included the proper documentation in the ReadTheDocs documentation folder. https://github.com/DefectDojo/Documentation/tree/master/docs or provide feature documentation in the PR.
1011
- [ ] Model changes must include the necessary migrations in the dojo/db_migrations folder.
1112
- [ ] Add applicable tests to the unit tests.
1213
- [ ] Add the proper label to categorize your PR.
1314

1415

15-
Current accepted labels for PRs:
16+
Moderators: Labels currently accepted for PRs:
1617
- Import Scans (for new scanners/importers)
1718
- enhancement
1819
- performance
1920
- feature
2021
- bugfix
2122
- maintenance (a.k.a chores)
2223
- dependencies
23-
- New Migration
24+
- New Migration (when the PR introduces a DB migration)
25+
- settings_changes (when the PR introduces changes or new settings in settings.dist.py)
2426

25-
# Git Tips
27+
# Contributors: Git Tips
2628
## Rebase on dev branch
2729
If the dev branch has changed since you started working on it, please rebase your work after the current dev.
2830

0 commit comments

Comments
 (0)