diff --git a/README.md b/README.md index 66da6c1e..fb216663 100644 --- a/README.md +++ b/README.md @@ -340,17 +340,17 @@ $ python tests/.py ``` ## Project Status -Release 2.8.0 is out! See the [release notes](docs/releases/v2_8_0.md) for more information. +Release 2.9.0 is out! See the [release notes](docs/releases/v2_9_0.md) for more information. -We try to keep the [project roadmap](./docs/project-roadmap.md) as up to date as possible. We are currently working on Release 2.9.0. +We try to keep the [project roadmap](./docs/project-roadmap.md) as up to date as possible. We are currently working on Release 2.10.0. ## Recent Past Releases Be advised: version 2.4.0 and below contain a high-severity security vulnerability (CVE-2021-28363). Please update to version 2.5.0 or later. +* [v2.8.0](docs/releases/v2_8_0.md) * [v2.7.0](docs/releases/v2_7_0.md) * [v2.6.1](docs/releases/v2_6_1.md) * [v2.5.0](docs/releases/v2_5_0.md) * [v2.4.0](docs/releases/v2_4_0.md) -* [v2.3.0](docs/releases/v2_3_0.md) ## Documentation Architecture, function blocks, code descriptions and the project roadmap are located in the docs folder. Contributions to the documentation are welcome! See the [contributing guide](/CONTRIBUTING.md) to find out how to submit changes. diff --git a/docs/project-roadmap-archive.md b/docs/project-roadmap-archive.md index 78f6865d..4dad7644 100644 --- a/docs/project-roadmap-archive.md +++ b/docs/project-roadmap-archive.md @@ -1,3 +1,11 @@ +## 2021-12-15 +###2021 +Our goal is to meet these requirements by the end of the year. +- We will continue investigating how we can run Tern without root privileges. +- We want to transition away from using the Docker Python library to pull container images from Dockerhub. For motivation and context, see the Kubernetes [announcement](https://kubernetes.io/blog/2020/12/02/dont-panic-kubernetes-and-docker/) and past [discussion](https://github.com/tern-tools/meetings/blob/main/minutes/04-13-2021.md) on the topic from Tern's community meeting. +- Create a database backend with an associated API. +- Automate aspects of Tern's release process. + ## 2021-02-18 ### 2020 diff --git a/docs/project-roadmap.md b/docs/project-roadmap.md index 81170f53..c9680d52 100644 --- a/docs/project-roadmap.md +++ b/docs/project-roadmap.md @@ -1,11 +1,7 @@ # Project Road Map -## 2021 -We are getting very close to a beta release. Our beta release is targeted for the second half of the year. - -Our goal is to meet these requirements by the end of the year. -- We will continue investigating how we can run Tern without root privileges. -- We want to transition away from using the Docker Python library to pull container images from Dockerhub. For motivation and context, see the Kubernetes [announcement](https://kubernetes.io/blog/2020/12/02/dont-panic-kubernetes-and-docker/) and past [discussion](https://github.com/tern-tools/meetings/blob/main/minutes/04-13-2021.md) on the topic from Tern's community meeting. +## 2022 +- Create a Kubernetes admission controller for Tern - Create a database backend with an associated API. - Automate aspects of Tern's release process. diff --git a/docs/releases/release_checklist.md b/docs/releases/release_checklist.md index 8ddc0d89..07532a72 100644 --- a/docs/releases/release_checklist.md +++ b/docs/releases/release_checklist.md @@ -34,8 +34,8 @@ This is a checklist for cutting a release - Future Work - Changelog * "Note: This changelog will not include these release notes" - * "Changelog produced by command: `git log --pretty=format:"%h %s" v..main`" - - Contributors (look at Authors in the changelog `git log --pretty=format:"%an %ae" v..main | sort | uniq`). Remove the maintainers name from the contributor list. + * "Changelog produced by command: `git log --pretty=format:"%h %s" v..HEAD`" + - Contributors (look at Authors in the changelog `git log --pretty=format:"%an %ae" v..HEAD | sort | uniq`). Remove the maintainers name from the contributor list. - Contact the Maintainers * Update the Project Status part of the README.md to reflect this release and add it to the list of releases. diff --git a/docs/releases/v2_9_0-requirements.txt b/docs/releases/v2_9_0-requirements.txt new file mode 100644 index 00000000..215f1a67 --- /dev/null +++ b/docs/releases/v2_9_0-requirements.txt @@ -0,0 +1,205 @@ +# +# This file is autogenerated by pip-compile with python 3.8 +# To update, run: +# +# pip-compile --generate-hashes --output-file=v2_8_0-requirements.txt +# +attrs==21.2.0 \ + --hash=sha256:149e90d6d8ac20db7a955ad60cf0e6881a3f20d37096140088356da6c716b0b1 \ + --hash=sha256:ef6aaac3ca6cd92904cdd0d83f629a15f18053ec84e6432106f7a4d04ae4f5fb + # via debian-inspector +certifi==2021.10.8 \ + --hash=sha256:78884e7c1d4b00ce3cea67b44566851c4343c120abd683433ce934a68ea58872 \ + --hash=sha256:d62a0163eb4c2344ac042ab2bdf75399a71a2d8c7d47eac2e2ee91b9d6339569 + # via requests +chardet==4.0.0 \ + --hash=sha256:0d6f53a15db4120f2b08c94f11e7d93d2c911ee118b6b30a04ec3ee8310179fa \ + --hash=sha256:f864054d66fd9118f2e67044ac8981a54775ec5b67aed0441892edb553d21da5 + # via debian-inspector +charset-normalizer==2.0.9 \ + --hash=sha256:1eecaa09422db5be9e29d7fc65664e6c33bd06f9ced7838578ba40d58bdf3721 \ + --hash=sha256:b0b883e8e874edfdece9c28f314e3dd5badf067342e42fb162203335ae61aa2c + # via requests +debian-inspector==30.0.0 \ + --hash=sha256:d0f4f9b13e9a75aaa0610b568e4b35db2b34cf50b79f5d7a69e25a10a47f5b18 \ + --hash=sha256:f6b706be9c8087521fdd0226c92433f2405182cb16949fe3455805754e19b6ef + # via -r requirements.in +docker==5.0.3 \ + --hash=sha256:7a79bb439e3df59d0a72621775d600bc8bc8b422d285824cb37103eab91d1ce0 \ + --hash=sha256:d916a26b62970e7c2f554110ed6af04c7ccff8e9f81ad17d0d40c75637e227fb + # via -r requirements.in +dockerfile-parse==1.2.0 \ + --hash=sha256:07e65eec313978e877da819855870b3ae47f3fac94a40a965b9ede10484dacc5 \ + --hash=sha256:c3fc8f491e1af8cb5f9e23ea6437a2913467b88a4be143095f150330b090be7e + # via -r requirements.in +gitdb==4.0.9 \ + --hash=sha256:8033ad4e853066ba6ca92050b9df2f89301b8fc8bf7e9324d412a63f8bf1a8fd \ + --hash=sha256:bac2fd45c0a1c9cf619e63a90d62bdc63892ef92387424b855792a6cabe789aa + # via gitpython +gitpython==3.1.24 \ + --hash=sha256:dc0a7f2f697657acc8d7f89033e8b1ea94dd90356b2983bca89dc8d2ab3cc647 \ + --hash=sha256:df83fdf5e684fef7c6ee2c02fc68a5ceb7e7e759d08b694088d0cacb4eba59e5 + # via -r requirements.in +idna==3.3 \ + --hash=sha256:84d9dd047ffa80596e0f246e2eab0b391788b0503584e8945f2368256d2735ff \ + --hash=sha256:9d643ff0a55b762d5cdb124b8eaa99c66322e2157b69160bc32796e824360e6d + # via requests +packageurl-python==0.9.6 \ + --hash=sha256:676dcb8278721df952e2444bfcd8d7bf3518894498050f0c6a5faddbe0860cd0 \ + --hash=sha256:c01fbaf62ad2eb791e97158d1f30349e830bee2dd3e9503a87f6c3ffae8d1cf0 + # via -r requirements.in +pbr==5.8.0 \ + --hash=sha256:176e8560eaf61e127817ef93d8a844803abb27a4d4637f0ff3bb783129be2e0a \ + --hash=sha256:672d8ebee84921862110f23fcec2acea191ef58543d34dfe9ef3d9f13c31cddf + # via + # -r requirements.in + # stevedore +prettytable==2.4.0 \ + --hash=sha256:18e56447f636b447096977d468849c1e2d3cfa0af8e7b5acfcf83a64790c0aca \ + --hash=sha256:2492f29e8686bdbcce815a568bff74cb71cbb704747c3abb9c9c6cfe25f985a2 + # via -r requirements.in +pyyaml==6.0 \ + --hash=sha256:0283c35a6a9fbf047493e3a0ce8d79ef5030852c51e9d911a27badfde0605293 \ + --hash=sha256:055d937d65826939cb044fc8c9b08889e8c743fdc6a32b33e2390f66013e449b \ + --hash=sha256:07751360502caac1c067a8132d150cf3d61339af5691fe9e87803040dbc5db57 \ + --hash=sha256:0b4624f379dab24d3725ffde76559cff63d9ec94e1736b556dacdfebe5ab6d4b \ + --hash=sha256:0ce82d761c532fe4ec3f87fc45688bdd3a4c1dc5e0b4a19814b9009a29baefd4 \ + --hash=sha256:1e4747bc279b4f613a09eb64bba2ba602d8a6664c6ce6396a4d0cd413a50ce07 \ + --hash=sha256:213c60cd50106436cc818accf5baa1aba61c0189ff610f64f4a3e8c6726218ba \ + --hash=sha256:231710d57adfd809ef5d34183b8ed1eeae3f76459c18fb4a0b373ad56bedcdd9 \ + --hash=sha256:277a0ef2981ca40581a47093e9e2d13b3f1fbbeffae064c1d21bfceba2030287 \ + --hash=sha256:2cd5df3de48857ed0544b34e2d40e9fac445930039f3cfe4bcc592a1f836d513 \ + --hash=sha256:40527857252b61eacd1d9af500c3337ba8deb8fc298940291486c465c8b46ec0 \ + --hash=sha256:473f9edb243cb1935ab5a084eb238d842fb8f404ed2193a915d1784b5a6b5fc0 \ + --hash=sha256:48c346915c114f5fdb3ead70312bd042a953a8ce5c7106d5bfb1a5254e47da92 \ + --hash=sha256:50602afada6d6cbfad699b0c7bb50d5ccffa7e46a3d738092afddc1f9758427f \ + --hash=sha256:68fb519c14306fec9720a2a5b45bc9f0c8d1b9c72adf45c37baedfcd949c35a2 \ + --hash=sha256:77f396e6ef4c73fdc33a9157446466f1cff553d979bd00ecb64385760c6babdc \ + --hash=sha256:819b3830a1543db06c4d4b865e70ded25be52a2e0631ccd2f6a47a2822f2fd7c \ + --hash=sha256:897b80890765f037df3403d22bab41627ca8811ae55e9a722fd0392850ec4d86 \ + --hash=sha256:98c4d36e99714e55cfbaaee6dd5badbc9a1ec339ebfc3b1f52e293aee6bb71a4 \ + --hash=sha256:9df7ed3b3d2e0ecfe09e14741b857df43adb5a3ddadc919a2d94fbdf78fea53c \ + --hash=sha256:9fa600030013c4de8165339db93d182b9431076eb98eb40ee068700c9c813e34 \ + --hash=sha256:a80a78046a72361de73f8f395f1f1e49f956c6be882eed58505a15f3e430962b \ + --hash=sha256:b3d267842bf12586ba6c734f89d1f5b871df0273157918b0ccefa29deb05c21c \ + --hash=sha256:b5b9eccad747aabaaffbc6064800670f0c297e52c12754eb1d976c57e4f74dcb \ + --hash=sha256:c5687b8d43cf58545ade1fe3e055f70eac7a5a1a0bf42824308d868289a95737 \ + --hash=sha256:cba8c411ef271aa037d7357a2bc8f9ee8b58b9965831d9e51baf703280dc73d3 \ + --hash=sha256:d15a181d1ecd0d4270dc32edb46f7cb7733c7c508857278d3d378d14d606db2d \ + --hash=sha256:d4db7c7aef085872ef65a8fd7d6d09a14ae91f691dec3e87ee5ee0539d516f53 \ + --hash=sha256:d4eccecf9adf6fbcc6861a38015c2a64f38b9d94838ac1810a9023a0609e1b78 \ + --hash=sha256:d67d839ede4ed1b28a4e8909735fc992a923cdb84e618544973d7dfc71540803 \ + --hash=sha256:daf496c58a8c52083df09b80c860005194014c3698698d1a57cbcfa182142a3a \ + --hash=sha256:e61ceaab6f49fb8bdfaa0f92c4b57bcfbea54c09277b1b4f7ac376bfb7a7c174 \ + --hash=sha256:f84fbc98b019fef2ee9a1cb3ce93e3187a6df0b2538a651bfb890254ba9f90b5 + # via -r requirements.in +regex==2021.11.10 \ + --hash=sha256:0416f7399e918c4b0e074a0f66e5191077ee2ca32a0f99d4c187a62beb47aa05 \ + --hash=sha256:05b7d6d7e64efe309972adab77fc2af8907bb93217ec60aa9fe12a0dad35874f \ + --hash=sha256:0617383e2fe465732af4509e61648b77cbe3aee68b6ac8c0b6fe934db90be5cc \ + --hash=sha256:07856afef5ffcc052e7eccf3213317fbb94e4a5cd8177a2caa69c980657b3cb4 \ + --hash=sha256:0f594b96fe2e0821d026365f72ac7b4f0b487487fb3d4aaf10dd9d97d88a9737 \ + --hash=sha256:139a23d1f5d30db2cc6c7fd9c6d6497872a672db22c4ae1910be22d4f4b2068a \ + --hash=sha256:162abfd74e88001d20cb73ceaffbfe601469923e875caf9118333b1a4aaafdc4 \ + --hash=sha256:2207ae4f64ad3af399e2d30dde66f0b36ae5c3129b52885f1bffc2f05ec505c8 \ + --hash=sha256:2409b5c9cef7054dde93a9803156b411b677affc84fca69e908b1cb2c540025d \ + --hash=sha256:2fee3ed82a011184807d2127f1733b4f6b2ff6ec7151d83ef3477f3b96a13d03 \ + --hash=sha256:30ab804ea73972049b7a2a5c62d97687d69b5a60a67adca07eb73a0ddbc9e29f \ + --hash=sha256:3598893bde43091ee5ca0a6ad20f08a0435e93a69255eeb5f81b85e81e329264 \ + --hash=sha256:3b5df18db1fccd66de15aa59c41e4f853b5df7550723d26aa6cb7f40e5d9da5a \ + --hash=sha256:3c5fb32cc6077abad3bbf0323067636d93307c9fa93e072771cf9a64d1c0f3ef \ + --hash=sha256:416c5f1a188c91e3eb41e9c8787288e707f7d2ebe66e0a6563af280d9b68478f \ + --hash=sha256:42b50fa6666b0d50c30a990527127334d6b96dd969011e843e726a64011485da \ + --hash=sha256:432bd15d40ed835a51617521d60d0125867f7b88acf653e4ed994a1f8e4995dc \ + --hash=sha256:473e67837f786404570eae33c3b64a4b9635ae9f00145250851a1292f484c063 \ + --hash=sha256:4aaa4e0705ef2b73dd8e36eeb4c868f80f8393f5f4d855e94025ce7ad8525f50 \ + --hash=sha256:50a7ddf3d131dc5633dccdb51417e2d1910d25cbcf842115a3a5893509140a3a \ + --hash=sha256:529801a0d58809b60b3531ee804d3e3be4b412c94b5d267daa3de7fadef00f49 \ + --hash=sha256:537ca6a3586931b16a85ac38c08cc48f10fc870a5b25e51794c74df843e9966d \ + --hash=sha256:53db2c6be8a2710b359bfd3d3aa17ba38f8aa72a82309a12ae99d3c0c3dcd74d \ + --hash=sha256:5537f71b6d646f7f5f340562ec4c77b6e1c915f8baae822ea0b7e46c1f09b733 \ + --hash=sha256:563d5f9354e15e048465061509403f68424fef37d5add3064038c2511c8f5e00 \ + --hash=sha256:5d408a642a5484b9b4d11dea15a489ea0928c7e410c7525cd892f4d04f2f617b \ + --hash=sha256:61600a7ca4bcf78a96a68a27c2ae9389763b5b94b63943d5158f2a377e09d29a \ + --hash=sha256:6650f16365f1924d6014d2ea770bde8555b4a39dc9576abb95e3cd1ff0263b36 \ + --hash=sha256:666abff54e474d28ff42756d94544cdfd42e2ee97065857413b72e8a2d6a6345 \ + --hash=sha256:68a067c11463de2a37157930d8b153005085e42bcb7ad9ca562d77ba7d1404e0 \ + --hash=sha256:6e1d2cc79e8dae442b3fa4a26c5794428b98f81389af90623ffcc650ce9f6732 \ + --hash=sha256:74cbeac0451f27d4f50e6e8a8f3a52ca074b5e2da9f7b505c4201a57a8ed6286 \ + --hash=sha256:780b48456a0f0ba4d390e8b5f7c661fdd218934388cde1a974010a965e200e12 \ + --hash=sha256:788aef3549f1924d5c38263104dae7395bf020a42776d5ec5ea2b0d3d85d6646 \ + --hash=sha256:7ee1227cf08b6716c85504aebc49ac827eb88fcc6e51564f010f11a406c0a667 \ + --hash=sha256:7f301b11b9d214f83ddaf689181051e7f48905568b0c7017c04c06dfd065e244 \ + --hash=sha256:83ee89483672b11f8952b158640d0c0ff02dc43d9cb1b70c1564b49abe92ce29 \ + --hash=sha256:85bfa6a5413be0ee6c5c4a663668a2cad2cbecdee367630d097d7823041bdeec \ + --hash=sha256:9345b6f7ee578bad8e475129ed40123d265464c4cfead6c261fd60fc9de00bcf \ + --hash=sha256:93a5051fcf5fad72de73b96f07d30bc29665697fb8ecdfbc474f3452c78adcf4 \ + --hash=sha256:962b9a917dd7ceacbe5cd424556914cb0d636001e393b43dc886ba31d2a1e449 \ + --hash=sha256:96fc32c16ea6d60d3ca7f63397bff5c75c5a562f7db6dec7d412f7c4d2e78ec0 \ + --hash=sha256:98ba568e8ae26beb726aeea2273053c717641933836568c2a0278a84987b2a1a \ + --hash=sha256:a3feefd5e95871872673b08636f96b61ebef62971eab044f5124fb4dea39919d \ + --hash=sha256:a955b747d620a50408b7fdf948e04359d6e762ff8a85f5775d907ceced715129 \ + --hash=sha256:b43c2b8a330a490daaef5a47ab114935002b13b3f9dc5da56d5322ff218eeadb \ + --hash=sha256:b483c9d00a565633c87abd0aaf27eb5016de23fed952e054ecc19ce32f6a9e7e \ + --hash=sha256:b9ed0b1e5e0759d6b7f8e2f143894b2a7f3edd313f38cf44e1e15d360e11749b \ + --hash=sha256:ba05430e819e58544e840a68b03b28b6d328aff2e41579037e8bab7653b37d83 \ + --hash=sha256:ca49e1ab99593438b204e00f3970e7a5f70d045267051dfa6b5f4304fcfa1dbf \ + --hash=sha256:ca5f18a75e1256ce07494e245cdb146f5a9267d3c702ebf9b65c7f8bd843431e \ + --hash=sha256:cd410a1cbb2d297c67d8521759ab2ee3f1d66206d2e4328502a487589a2cb21b \ + --hash=sha256:ce298e3d0c65bd03fa65ffcc6db0e2b578e8f626d468db64fdf8457731052942 \ + --hash=sha256:d5ca078bb666c4a9d1287a379fe617a6dccd18c3e8a7e6c7e1eb8974330c626a \ + --hash=sha256:d5fd67df77bab0d3f4ea1d7afca9ef15c2ee35dfb348c7b57ffb9782a6e4db6e \ + --hash=sha256:da1a90c1ddb7531b1d5ff1e171b4ee61f6345119be7351104b67ff413843fe94 \ + --hash=sha256:dba70f30fd81f8ce6d32ddeef37d91c8948e5d5a4c63242d16a2b2df8143aafc \ + --hash=sha256:dc07f021ee80510f3cd3af2cad5b6a3b3a10b057521d9e6aaeb621730d320c5a \ + --hash=sha256:dd33eb9bdcfbabab3459c9ee651d94c842bc8a05fabc95edf4ee0c15a072495e \ + --hash=sha256:e0538c43565ee6e703d3a7c3bdfe4037a5209250e8502c98f20fea6f5fdf2965 \ + --hash=sha256:e1f54b9b4b6c53369f40028d2dd07a8c374583417ee6ec0ea304e710a20f80a0 \ + --hash=sha256:e32d2a2b02ccbef10145df9135751abea1f9f076e67a4e261b05f24b94219e36 \ + --hash=sha256:e6096b0688e6e14af6a1b10eaad86b4ff17935c49aa774eac7c95a57a4e8c296 \ + --hash=sha256:e71255ba42567d34a13c03968736c5d39bb4a97ce98188fafb27ce981115beec \ + --hash=sha256:ed2e07c6a26ed4bea91b897ee2b0835c21716d9a469a96c3e878dc5f8c55bb23 \ + --hash=sha256:eef2afb0fd1747f33f1ee3e209bce1ed582d1896b240ccc5e2697e3275f037c7 \ + --hash=sha256:f23222527b307970e383433daec128d769ff778d9b29343fb3496472dc20dabe \ + --hash=sha256:f341ee2df0999bfdf7a95e448075effe0db212a59387de1a70690e4acb03d4c6 \ + --hash=sha256:f5be7805e53dafe94d295399cfbe5227f39995a997f4fd8539bf3cbdc8f47ca8 \ + --hash=sha256:f7f325be2804246a75a4f45c72d4ce80d2443ab815063cdf70ee8fb2ca59ee1b \ + --hash=sha256:f8af619e3be812a2059b212064ea7a640aff0568d972cd1b9e920837469eb3cb \ + --hash=sha256:fa8c626d6441e2d04b6ee703ef2d1e17608ad44c7cb75258c09dd42bacdfc64b \ + --hash=sha256:fbb9dc00e39f3e6c0ef48edee202f9520dafb233e8b51b06b8428cfcb92abd30 \ + --hash=sha256:fff55f3ce50a3ff63ec8e2a8d3dd924f1941b250b0aac3d3d42b687eeff07a8e + # via -r requirements.in +requests==2.26.0 \ + --hash=sha256:6c1246513ecd5ecd4528a0906f910e8f0f9c6b8ec72030dc9fd154dc1a6efd24 \ + --hash=sha256:b8aa58f8cf793ffd8782d3d8cb19e66ef36f7aba4353eec859e74678b01b07a7 + # via + # -r requirements.in + # docker +six==1.16.0 \ + --hash=sha256:1e61c37477a1626458e36f7b1d82aa5c9b094fa4802892072e49de9c60c4c926 \ + --hash=sha256:8abb2f1d86890a2dfb989f9a77cfcfd3e47c2a354b01111771326f8aa26e0254 + # via dockerfile-parse +smmap==5.0.0 \ + --hash=sha256:2aba19d6a040e78d8b09de5c57e96207b09ed71d8e55ce0959eeee6c8e190d94 \ + --hash=sha256:c840e62059cd3be204b0c9c9f74be2c09d5648eddd4580d9314c3ecde0b30936 + # via gitdb +stevedore==3.5.0 \ + --hash=sha256:a547de73308fd7e90075bb4d301405bebf705292fa90a90fc3bcf9133f58616c \ + --hash=sha256:f40253887d8712eaa2bb0ea3830374416736dc8ec0e22f5a65092c1174c44335 + # via -r requirements.in +typing-extensions==4.0.1 \ + --hash=sha256:4ca091dea149f945ec56afb48dae714f21e8692ef22a395223bcd328961b6a0e \ + --hash=sha256:7f001e5ac290a0c0401508864c7ec868be4e701886d5b573a9528ed3973d9d3b + # via gitpython +urllib3==1.26.7 \ + --hash=sha256:4987c65554f7a2dbf30c18fd48778ef124af6fab771a377103da0585e2336ece \ + --hash=sha256:c4fdf4019605b6e5423637e01bc9fe4daef873709a7973e195ceba0a62bbc844 + # via requests +wcwidth==0.2.5 \ + --hash=sha256:beb4802a9cebb9144e99086eff703a642a13d6a0052920003a230f3294bbe784 \ + --hash=sha256:c4d647b99872929fdb7bdcaa4fbe7f01413ed3d98077df798530e5b04f116c83 + # via prettytable +websocket-client==1.2.3 \ + --hash=sha256:1315816c0acc508997eb3ae03b9d3ff619c9d12d544c9a9b553704b1cc4f6af5 \ + --hash=sha256:2eed4cc58e4d65613ed6114af2f380f7910ff416fc8c46947f6e76b6815f56c0 + # via docker diff --git a/docs/releases/v2_9_0.md b/docs/releases/v2_9_0.md new file mode 100644 index 00000000..abd0c434 --- /dev/null +++ b/docs/releases/v2_9_0.md @@ -0,0 +1,91 @@ +# Release 2.9.0 + +## Summary +This release contains a handful of exciting new features. First, Tern is now able to run in an unprivileged container. This is beneficial from a security standpoint on platforms that do not allow privileged containers to run. It also removes the dependency on the overlay2fs storage driver. Next, there is now source package information reported in the JSON and YAML formats for rpm and dpkg based package managers. Source package information can be helpful when looking up known vulnerabilities or CVEs for packages. Additionally, Tern will now report Debian package license information in the default report table instead of users having to look at other formats like JSON for this information. Lastly, Tern removed its dependency on Docker for pulling containers in favor of [Skopeo](https://github.com/containers/skopeo) (the Docker requirement still exists for Dockerfile analysis). This huge change brings Tern one step closer to running on Kubernetes since it was [announced](https://kubernetes.io/blog/2020/12/02/dont-panic-kubernetes-and-docker/) that the Docker container runtime would be removed in favor of other runtimes that use [CRI](https://kubernetes.io/blog/2016/12/container-runtime-interface-cri-in-kubernetes/) created for K8s. + +## New Features +* [Run Tern in an unprivileged container](https://github.com/tern-tools/tern/issues/1082): Tern now runs in an unprivileged container. This is possible due to a new method of applying the diff filesystem layers using bulk copying of the files and directories into the merge directory rather than using a storage driver like overlay2 or fuse as was previously used. The overlay2 and fuse drivers are still available to maintain backwards compatability by using the`--driver` command line option. +* [Add source package information to reports](https://github.com/tern-tools/tern/issues/1083): Tern now reports source package name (`src_name`) and version (`src_version`) in the JSON and YAML reports. This source package information can be fed to security scanners to look up known vulnerabilities. +* [Use skopeo to pull container images](https://github.com/tern-tools/tern/issues/948): Tern now uses skopeo to pull container images for container analysis. This removes the dependency on Docker to pull container images. +* [Report Debian package licenses in default report](https://github.com/tern-tools/tern/pull/1029): Tern now reports Debian package licenses in the default report table for easy viewing. + +## Bug Fixes +* [Fix deprecated values in setup.cfg](https://github.com/tern-tools/tern/issues/1084) +* [Fix SPDX JSON format to match SPDX JSON schema](https://github.com/tern-tools/tern/issues/1064) +* [Add 'document DESCRIBES container' relationship to SPDX report](https://github.com/tern-tools/tern/issues/1079) + +## Technical Debt +* [Run ScanCode with n-1 cores](https://github.com/tern-tools/tern/issues/1062) +* [Remove unused clean_image_tars function](https://github.com/tern-tools/tern/issues/1044) +* [Direct check for key in command_lib](https://github.com/tern-tools/tern/issues/1041) +* [Direct check for key in os_release](https://github.com/tern-tools/tern/issues/1043) +* [Change SPDX pkg download location to NOASSERTION](https://github.com/tern-tools/tern/issues/1039) +* [Improve error message when docker is not running](https://github.com/tern-tools/tern/issues/1073) + + +## Future Work +* Add source package information to SPDX and CycloneDX reports +* Investigate running Tern in a Kubernetes admission controller + +## Changelog +Note: This changelog will not include these release notes + +Changelog generated by command: `git log --pretty=format:"%h %s" v2.8.0..HEAD` + +``` +e16a468 Use Skopeo to pull container images +3bdbd08 formats: Modify layer title based on manifest +3a0ac50 Modify environments to install skopeo +0891287 Change -i option to use OCIImage +1644456 Replace get_untar_dir with ImageLayer method +e340f66 classes: Add OCIImage class and use image_layout +6fcdcb9 classes: Move get_untar_dir to ImageLayer +fad5fb1 fix: unmount rootfs only for fuse and overlay2 +0b87b0c Collect dpkg and rpm source pkg info +94aacb1 Collect dpkg and rpm source information +5b4bbde Add source package info to package data model +5011db0 Enable Tern to run in an unprivileged container +fb160a0 Update README.md with new Docker instructions +4fcae9b Use the default driver in Dockerfile +6c0d1e9 Fix application for multiple cached layers +ab13f1c Enable multi-layer analysis with no mount +7bcbf6c Remove unnecessary mounting and unshare commands +3911d04 classes: Add new property is_whiteout +1551162 Allow whiteout files to be accessed by fs_hash.sh +aecba38 Multiple checks for keys in check_sourcable func +f9d9669 updating setup.cfg fields +38d5c76 Report Debian package licenses in default report +9751f1b Add SPDX "document DESCRIBES image" relationship +ff9d71a Add DockerException when daemon not running +fd94b38 Fix for SPDX JSON format to match SPDX JSON schema +c3938c7 Scancode should run n-1 core +9534ac1 Remove unused clean_image_tars function +a3e76cd Change SPDX pkg download location to NOASSERTION +87e7cdd Remove unused functions from lock.py +99fdb5f Direct check for key in command_lib['snippets'] +ce1c6d2 Update VS Code documentation for Mac/Windows +fcb367b Direct check for key in command['base'] dictionary +55a8a1e Change package download location to NOASSERTION +956a5e6 Fix CI status badge +33ffbeb Direct check for key in os_release_dict +``` + +## Contributors +``` +ashmaajmera samaiya.ashma@gmail.com +Debbie Leung dsl2162@columbia.edu +Hannah Lumapas lumapas.h@gmail.com +Jason Hall jasonhall@redhat.com +jayeritz jamila.ritter@rutgers.edu +Kerin Pithawala kerinpithawala7@gmail.com +Mukul Taneja mtaneja@vmware.com +sayantani11 ii.sayantani.ii@gmail.com +Vini Parimala vini.parimala@verizonmedia.com +vsoch vsoch@users.noreply.github.com +``` + + +## Contact the Maintainers + +Nisha Kumar: nishak@vmware.com +Rose Judge: rjudge@vmware.com diff --git a/requirements.txt b/requirements.txt index 05ddb008..16f2af60 100644 --- a/requirements.txt +++ b/requirements.txt @@ -6,14 +6,14 @@ # transitive dependencies listed make it more difficult to figure out # what should be updated. -PyYAML>=5.4 +PyYAML>=6.0 docker~=5.0 dockerfile-parse~=1.2 requests~=2.26 -stevedore>=3.4 -pbr>=5.6 +stevedore>=3.5 +pbr>=5.8 debian-inspector>=30.0 -regex>=2021.9 +regex>=2021.11 GitPython~=3.1 -prettytable~=2.2 -packageurl-python>=0.9.4 +prettytable~=2.4 +packageurl-python>=0.9.6