From ce6b2ef9808baf084457931484ed90e7756e56b6 Mon Sep 17 00:00:00 2001 From: PandaeDo Date: Fri, 9 Oct 2026 17:25:11 +0200 Subject: [PATCH] update security documents --- .../persistency/security_planning/index.rst | 105 ++++++++++++++++-- docs/module/manuals/security_manual.rst | 6 +- .../security_mgt/module_security_plan.rst | 63 +++++------ 3 files changed, 129 insertions(+), 45 deletions(-) diff --git a/docs/features/persistency/security_planning/index.rst b/docs/features/persistency/security_planning/index.rst index 41cd5b865..2153d1286 100644 --- a/docs/features/persistency/security_planning/index.rst +++ b/docs/features/persistency/security_planning/index.rst @@ -13,32 +13,119 @@ # ******************************************************************************* -Feature Security Planning -========================= +Persistency Security Work Products List +####################################### .. document:: Persistency KVS Security WPs :id: doc__persistency_security_wp :status: valid - :version: 1 + :version: 2 :safety: ASIL_B :security: YES :realizes: wp__platform_security_plan[version==1] :tags: persistency +Tailoring +========= -.. list-table:: Feature persistency Workproducts +Additional to the tailoring in the SW platform project as defined in the project's :need:`wp__platform_security_plan` we define here the additional tailoring on feature level. + +- Excluded for this feature are additionally the following work products (and their related requirements): + + - none + +Security Work Products List +=========================== + +.. list-table:: Persistency Security Work products :header-rows: 1 - * - Workproduct Id + * - Work product Id - Link to process - Process status - - Link to issue - Link to WP - - WP status + + * - :need:`wp__feat_request` + - :need:`gd_temp__change_feature_request` + - :ndf:`copy('status', need_id='gd_temp__change_feature_request')` + - :need:`doc__persistency` + + * - :need:`wp__requirements_feat` + - :need:`gd_temp__req_feat_req` + - :ndf:`copy('status', need_id='gd_temp__req_feat_req')` + - :need:`doc__feature_persistency_requirements` + + * - :need:`wp__requirements_feat_aou` + - :need:`gd_temp__req_aou_req` + - :ndf:`copy('status', need_id='gd_temp__req_aou_req')` + - :need:`doc__feature_persistency_requirements` + + * - :need:`wp__feature_arch` + - :need:`gd_temp__arch_feature` + - :ndf:`copy('status', need_id='gd_temp__arch_feature')` + - :need:`doc__persistency_architecture` * - :need:`wp__feature_security_analysis` - :need:`gd_guidl__security_analysis` - :ndf:`copy('status', need_id='gd_guidl__security_analysis')` - - TBD - :need:`doc__persistency_stride` - - valid + + * - :need:`wp__requirements_inspect` + - :need:`gd_chklst__req_inspection` + - :ndf:`copy('status', need_id='gd_chklst__req_inspection')` + - :need:`doc__feature_persistency_requirements_chklst` + + * - :need:`wp__sw_arch_verification` + - :need:`gd_chklst__arch_inspection_checklist` + - :ndf:`copy('status', need_id='gd_chklst__arch_inspection_checklist')` + - :need:`doc__persistency_arc_inspection` + + * - :need:`wp__verification_feat_int_test` + - :need:`gd_guidl__verification_guide` + - :ndf:`copy('status', need_id='gd_guidl__verification_guide')` + - Not yet available + +Feature Security Package +======================== + +To create the security package (according to :need:`gd_guidl__security_package`) the following +documents and work products status have to go to "valid" (after the relevant verification were performed). + +Feature Documents Status +------------------------ + +For all the work product documents the status can be seen by following the "Link to WP" and in +:ref:`persistency_module_documentation`. + +Feature Requirements Status +--------------------------- + +The feature requirements are maintained in the SCORE platform repository. + +.. needtable:: + :filter: type == "feat_req" and id.startswith("feat_req__persistency__") and security == "YES" + :style: table + :columns: id;status + :colwidths: 25,25 + :sort: title + +Feature AoU Status +------------------ + +.. needtable:: + :filter: type == "aou_req" and id.startswith("aou_req__persistency__") and security == "YES" + :style: table + :columns: id;status + :colwidths: 25,25 + :sort: title + +Feature Architecture Status +--------------------------- + +.. needtable:: + :filter: docname is not None and "persistency" in docname and "architecture" in docname and security == "YES" + :style: table + :types: feat_arc_sta; feat_arc_dyn + :columns: id;status + :colwidths: 25,25 + :sort: title diff --git a/docs/module/manuals/security_manual.rst b/docs/module/manuals/security_manual.rst index 0ed022bb0..4eeb1c181 100644 --- a/docs/module/manuals/security_manual.rst +++ b/docs/module/manuals/security_manual.rst @@ -90,5 +90,7 @@ Security Weaknesses, Vulnerabilities References ---------- -| -| +| Module user manual: :need:`doc__persistency_user_manual` +| Module security plan: :need:`doc__persistency_security_plan` +| Feature security analysis: :need:`doc__persistency_stride` +| Feature architecture: :need:`doc__persistency_kvs_architecture` diff --git a/docs/module/security_mgt/module_security_plan.rst b/docs/module/security_mgt/module_security_plan.rst index f563ad252..918e1265e 100644 --- a/docs/module/security_mgt/module_security_plan.rst +++ b/docs/module/security_mgt/module_security_plan.rst @@ -48,7 +48,7 @@ Security Management Roles - Karthik Vanka * - Module Project Manager (= Feature team lead) - - TBD + - Uwe Maucher Tailoring ========= @@ -103,8 +103,8 @@ Security Module Workproducts - :need:`gd_guidl__security_analysis` - :ndf:`copy('status', need_id='gd_guidl__security_analysis')` - - - - - + - Not yet available + - n/a * - :need:`wp__audit_report_security` - performed by external experts @@ -135,14 +135,14 @@ Security Module Workproducts - :ndf:`copy('status', need_id='doc__persistency_release_note')` * - :need:`wp__sw_module_sbom` - - template not yet created - - not started + - :need:`wf__cr_mt_security_sbom` + - :ndf:`copy('status', need_id='wf__cr_mt_security_sbom')` - - - - - + - Bazel target ``//:sbom_product`` (product SBOM of ``//score/kvs:kvs`` and ``//score/kvs/rust_kvs:rust_kvs``) + - Generated with ``bazel build //:sbom_product``, not yet part of the release workflow -.. list-table:: Component Workproducts +.. list-table:: Component KVS Work products :header-rows: 1 * - Workproduct Id @@ -157,72 +157,67 @@ Security Module Workproducts - :ndf:`copy('status', need_id='gd_temp__req_comp_req')` - - :need:`doc__kvs_requirements` - - + - :ndf:`copy('status', need_id='doc__kvs_requirements')` * - :need:`wp__requirements_comp_aou` - :need:`gd_temp__req_aou_req` - :ndf:`copy('status', need_id='gd_temp__req_aou_req')` - - :need:`doc__kvs_requirements` - - + - :ndf:`copy('status', need_id='doc__kvs_requirements')` * - :need:`wp__requirements_inspect` - :need:`gd_chklst__req_inspection` - :ndf:`copy('status', need_id='gd_chklst__req_inspection')` - - n/a - - Checklist used in Pull Request Review - - n/a + - + - :need:`doc__kvs_req_inspection` + - :ndf:`copy('status', need_id='doc__kvs_req_inspection')` * - :need:`wp__component_arch` - :need:`gd_temp__arch_comp` - :ndf:`copy('status', need_id='gd_temp__arch_comp')` - - - :need:`doc__kvs_architecture` - - + - :need:`doc__kvs_component_architecture` + - :ndf:`copy('status', need_id='doc__kvs_component_architecture')` * - :need:`wp__sw_component_security_analysis` - - :need:`wp__sw_component_security_analysis` - - :ndf:`copy('status', need_id='wp__sw_component_security_analysis')` + - :need:`gd_guidl__security_analysis` + - :ndf:`copy('status', need_id='gd_guidl__security_analysis')` - - - - - + - Not yet available + - n/a * - :need:`wp__sw_arch_verification` - :need:`gd_chklst__arch_inspection_checklist` - :ndf:`copy('status', need_id='gd_chklst__arch_inspection_checklist')` - - - Checklist used in Pull Request Review - - + - :need:`doc__kvs_arc_inspection` + - :ndf:`copy('status', need_id='doc__kvs_arc_inspection')` * - :need:`wp__sw_implementation` - :need:`gd_guidl__implementation` - :ndf:`copy('status', need_id='gd_guidl__implementation')` - - - - - + - :need:`doc__kvs_detailed_design` & `source code `__ + - :ndf:`copy('status', need_id='doc__kvs_detailed_design')` * - :need:`wp__verification_sw_unit_test` - :need:`gd_guidl__verification_guide` - :ndf:`copy('status', need_id='gd_guidl__verification_guide')` - - - - - + - Bazel test suites ``//score/kvs:unit_tests`` and ``//score/kvs/rust_kvs:unit_tests``, results in :need:`doc__persistency_verification_report` + - :ndf:`copy('status', need_id='doc__persistency_verification_report')` * - :need:`wp__sw_implementation_inspection` - :need:`gd_chklst__impl_inspection_checklist` - :ndf:`copy('status', need_id='gd_chklst__impl_inspection_checklist')` - - - Checklist used in Pull Request Review - - + - :need:`doc__kvs_impl_inspection` + - :ndf:`copy('status', need_id='doc__kvs_impl_inspection')` * - :need:`wp__verification_comp_int_test` - :need:`gd_guidl__verification_guide` - :ndf:`copy('status', need_id='gd_guidl__verification_guide')` - - - - - - -Special Note -============ - -Module security plan template will be refined and existing content will be synchronized as per new template. + - Bazel test suites ``//score/kvs/tests/test_cases:cit_cpp`` and ``//score/kvs/tests/test_cases:cit_rust``, results in :need:`doc__persistency_verification_report` + - :ndf:`copy('status', need_id='doc__persistency_verification_report')`