halnasri-Resolve_TT_CONFIDENCE_Feedback #132
There are no files selected for viewing
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,6 +1,10 @@ | ||
| --- | ||
| level: 1.1 | ||
| normative: true | ||
| references: | ||
| - type: web_content | ||
| url: "https://eclipse-score.github.io/inc_nlohmann_json/main/generated/dashboard.html#summary" | ||
| description: "Dashboard showing distributions of evidence scores and SME (subject-matter expert) scores." | ||
| --- | ||
|
|
||
| Each leaf node in the Trustable Graph is scored either based on an SME review alone or on a combination of an SME review and an automatic validation function. |
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,6 +1,10 @@ | ||
| --- | ||
| level: 1.1 | ||
| normative: true | ||
| references: | ||
| - type: web_content | ||
| url: "https://score-json.github.io/json/main/concept.html#scoring" | ||
| description: "Description of the algorithm how scores are accumulated, reviewed." | ||
| --- | ||
|
|
||
| Scores are reasonably, systematically and repeatably accumulated. | ||
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,10 @@ | ||
| --- | ||
| level: 1.1 | ||
| normative: true | ||
| references: | ||
| - type: verbose_file | ||
| path: "/workspaces/json/TSF/README.md" | ||
|
Collaborator
There was a problem hiding this comment. please use relative path instead (i.e., without the "workspaces/json") |
||
| description: "release management and update process description" | ||
| --- | ||
|
|
||
| Releases and updates of the score-json repository are carried out in accordance with defined and documented release and update process. | ||
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,10 @@ | ||
| --- | ||
| level: 1.1 | ||
| normative: true | ||
| references: | ||
| - type: web_content | ||
| url: "https://score-json.github.io/json/main/generated/trustable_report_for_Software.html#compliance-for-ta" | ||
|
Collaborator
There was a problem hiding this comment. Please always use the report of the inc_nlohmann_json repo |
||
| description: "Trustable Compliance Report showing scores for different TA items." | ||
| --- | ||
|
|
||
| The confidence in the nlohmann/json library also incorporates confidence scores derived from other TA items. | ||
|
There was a problem hiding this comment. I dont really understand this statement or the idea behind it. Can you explain?
Collaborator
There was a problem hiding this comment. I understand that you are trying to target this However, I think the combination of JLS-08 and JLS-09 are already indirectly stating the same thing as this. Instead, I would reformulate it to something like |
||
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,26 @@ | ||
| --- | ||
| level: 1.1 | ||
| normative: true | ||
| references: | ||
| - type: project_website | ||
| url: "https://github.com/nlohmann/json/blob/develop/.github/CONTRIBUTING.md" | ||
| description: "nlohmann/json contribution guidelines describing analysis, testing, and review expectations" | ||
| - type: project_website | ||
| url: "https://github.com/nlohmann/json/tree/develop/.github" | ||
| description: "Project workflows and configuration supporting automated analysis and testing for nlohmann/json" | ||
| - type: file | ||
| path: "TSF/scripts/generate_list_of_misbehaviours.py" | ||
| description: "Script generating a report of known misbehaviours of the nlohmann/json library based on GitHub issues" | ||
| - type: verbose_file | ||
| path: "TSF/README.md" | ||
| description: "TSF-related description of analysis, verification processes, and update concepts for score-json" | ||
| evidence: | ||
| type: https_response_time | ||
| configuration: | ||
| target_seconds: 2 | ||
| urls: | ||
| - "https://github.com/nlohmann/json/blob/develop/.github/CODE_OF_CONDUCT.md" | ||
| - "https://github.com/nlohmann/json/tree/develop/.github" | ||
| --- | ||
|
|
||
| Manual verification activities that complement automated analysis for the nlohmann/json library are documented, reviewed against defined criteria, and considered for their impact on identifying and addressing misbehaviours. | ||
|
Collaborator
There was a problem hiding this comment. Misbehaviour is an established term in TSF (defined as 'any behaviour of the software that deviates from the defined expectations'). However, I think this statement is still on a too high level. It needs to be more explicit (or broken down into further supporting statements). What are the manual activities? what are the defined criteria?
Collaborator
There was a problem hiding this comment. For example: Then reference to e.g., this https://github.com/nlohmann/json/security/advisories/new
Collaborator
There was a problem hiding this comment. Maybe even better examples: "The manual activity of issuing a vulnerability or bug report for the nlohmann/json library is a well-defined process." "All manual pull requests to the nlohmann/json repository are expected to describe the rationale behind any non-trivial changes, and link to an existing issue"
"Feature requests for the nlohmann/json library are actively investigated by Niels Lohmann"
|
||
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,27 @@ | ||
| --- | ||
| level: 1.1 | ||
| normative: true | ||
| references: | ||
| - type: project_website | ||
| url: "https://github.com/nlohmann/json/blob/develop/.github/CODEOWNERS" | ||
| description: "Definition of responsible owners and reviewers for the nlohmann/json repository" | ||
| - type: project_website | ||
| url: "https://github.com/nlohmann/json/blob/develop/.github/CONTRIBUTING.md" | ||
| description: "nlohmann/json contribution guidelines describing contribution, testing, and review expectations" | ||
| - type: project_website | ||
| url: "https://github.com/nlohmann/json/blob/develop/.github/CODE_OF_CONDUCT.md" | ||
| description: "Code of Conduct defining behavioural expectations during collaboration and review" | ||
| - type: verbose_file | ||
| path: "TSF/README.md" | ||
| description: "TSF documentation describing responsibilities, verification processes, and change control for score-json" | ||
| evidence: | ||
| type: https_response_time | ||
| configuration: | ||
| target_seconds: 2 | ||
| urls: | ||
| - "https://github.com/nlohmann/json/blob/develop/.github/CODE_OF_CONDUCT.md" | ||
| - "https://github.com/nlohmann/json/blob/develop/.github/CONTRIBUTING.md" | ||
| - "https://github.com/nlohmann/json/blob/develop/.github/CODEOWNERS" | ||
| --- | ||
|
|
||
| Responsibilities for manual verification and review follow documented, competence-based processes and guidelines, and the associated processes and checks are regularly reviewed and updated under defined change control. | ||
|
There was a problem hiding this comment. Here we need the information to which repos/libraries this statement should apply. In the references you name score-json and nlohmann/json - is the statement meant for both?
Collaborator
There was a problem hiding this comment. Again, also needs to be more explicit or broken down into smaller statements. What are the "responsibilities" and "competence based processes and guidelines"? |
||
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
what exactly is reviewed here? is the description reviewed or how scores are accumulated?
Uh oh!
There was an error while loading. Please reload this page.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
The description here is just copied from Mr. Schemmel's PR. I guess it is referring to the fact that we updated the concept section of the report.
We should remove the "reviewed" and just have "Description of the algorithm on how scores are calculated and accumulated"