Skip to content

Add resources required for oss-scanner enrollment #9031

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
jack-berg wants to merge 1 commit into
base: main
Choose a base branch
from
Open

Add resources required for oss-scanner enrollment #9031

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
9 changes: 9 additions & 0 deletions .oss-scanner/Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,9 @@
FROM eclipse-temurin:25-jdk-noble

ENV DISABLE_REMOTE_BUILD_CACHE=1

COPY . /src
WORKDIR /src

RUN ./gradlew --no-daemon --max-workers=2 \
-Porg.gradle.java.installations.auto-download=false build
42 changes: 42 additions & 0 deletions THREAT_MODEL.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,42 @@
# Threat model

See the [Security Policy](https://github.com/open-telemetry/.github/blob/main/SECURITY.md) for OpenTelemetry projects.

Additional context specific to this project can be found below.

## What this project does and where untrusted input enters

- This project provides the Java OpenTelemetry API and SDK for recording, processing, and exporting traces, metrics, logs, and profiles.
- Untrusted input enters through telemetry recorded by applications and instrumentation, and through headers used for baggage and trace propagation.
- Additional network inputs include exporter responses, Prometheus scrape requests, and Jaeger remote sampling strategies.
- SDK configuration is normally controlled by the application operator.

## Components that matter most / least

The following components matter most:

- `api/all`, `api/incubator`, and `extensions/trace-propagators`: core primitives for recording telemetry and propagating context within and across processes.
- `sdk/trace`, `sdk/metrics`, `sdk/logs`, `sdk/profiles`, and `sdk/common`: telemetry processing, aggregation, and resource limits.
- `exporters/otlp`, `exporters/common`, and `exporters/sender`: telemetry serialization and HTTP and gRPC transport.
- `exporters/prometheus`: Prometheus HTTP scrape endpoint and metric serialization.
- `sdk-extensions/autoconfigure`, `sdk-extensions/autoconfigure-spi`, and `sdk-extensions/declarative-config`: SDK configuration through environment variables, system properties, YAML files, and service providers.
- `sdk-extensions/jaeger-remote-sampler`: sampling configuration received from a remote gRPC endpoint.

The following components have lower priority:

- `exporters/logging` and `exporters/logging-otlp`: exporters primarily used for local development and diagnostics.
- `sdk/testing` and `testing-internal`: testing utilities.
- `opencensus-shim` and `opentracing-shim`: deprecated compatibility shims.

## How to exercise it

- Unit tests and fuzz tests are colocated with their modules. Cross-component tests live under `integration-tests`.
- See [build guidance](docs/knowledge/build.md) for requirements and commands.

## How you rate severity

Follow the OpenTelemetry Security Policy, including its availability assessment and severity guidance. No additional Java-specific severity rules apply.

## Anything to leave alone

Ignore tests, test utilities, benchmarks, and other code not intended for production use.
Loading