Eclipse Steady

Basics

This proposal is in the Project Proposal Phase (as defined in the Eclipse Development Process) and is written to declare its intent and scope. We solicit additional participation and input from the community. Please login and add your feedback in the comments section.

Parent Project:

Eclipse Technology

Background:

The project addresses the OWASP Top 10 security risk A9, Using Components with Known Vulnerabilities, which is often the root cause of data breaches. It supports software development organizations in regards to the secure use of open-source components during application development.

Scope:

Eclipse Steady analyses Java and Python applications to identify, assess and mitigate the use of open-source dependencies with known vulnerabilities.

Description:

Analyses your Java and Python applications for open-source dependencies with known vulnerabilities, collects evidence regarding the execution of vulnerable code in a given application context (through the combination of static and dynamic analysis techniques), and supports developers in the mitigation of such dependencies.

Why Here?:

The Eclipse Foundation hosts a significant number of Java projects, which makes it a natural fit for the Java-focussed project at hand.

Licenses:

Apache License, Version 2.0

Legal Issues:

Current license is Apache License, version 2.0.

There is no registered trademark for "Steady".

All project dependencies have been subject to license reviews, hence, we do not expect any issues regarding incompatible licenses.

ECCN classifications are as follows: EU: not listed, US: 5D002

Future Work:

Functionalities:

Authentication and authorization checks
Support of Node.js
UI redesign

Communication/dissemination:

Several meetings are scheduled with commercial development organizations
Several presentations are scheduled (or proposed) at developer and open source events, e.g., Heise devSec(), LinuxFoundation Open Source Summit, EclipseCon

People

Project Leads:

Committers:

Henrik Plate

Mentors:

Interested Parties:

University of Trento, Sogeti, University of Paderborn