Versions Compared

Old Version 13

changes.mady.by.user Damian Nowak

Saved on

compared with

New Version 14

changes.mady.by.user Damian Nowak

Saved on

Key

  • This line was added.
  • This line was removed.
  • Formatting was changed.

...

Test CaseDescriptionImplemented or Not In VNFSDK
Manifest File check

Verifies the MANIFEST file (MainServiceTemplate.mf) and  checks that the defined directories of the PNF package against the manifest file.
For example the manifest file might say a files should exist: "Measurements: source: Artifacts/Deployment/Measurements/PM_Dictionary.yaml", the VNF SDK would check that the file PM_Dictionary.yaml exists in the actual PNF package.

The following VNFRQTS JIRA items contribute this this requirement:
R-146092:

Jira
serverONAP JIRA
serverId425b2b0a-557c-3c0c-b515-579789cceedb
keyVNFRQTS-572

R-10087:

Jira
serverONAP JIRA
serverId425b2b0a-557c-3c0c-b515-579789cceedb
keyVNFRQTS-505


TOSCA MetaFile LICENSE Term File Exists CheckVNF SDK will check a License Term File Check in the PNF package. TOSCA meta file points to a License. Just a check that the file exists no content check at all.
TOSCA MetaFile CERTIFICATE Check

(Test only) CERTIFICATE check. In the PNF package it is expected that there will be MainServiceTemplate.cert. This is mentioned in the TOSCA MetaFile. For example, in the TOSCA MetaFile, it could be mentioned "Entry-Certificate: Artifacts/resource-gnodeb-template.cert". And VNF SDK would check to make sure that the resource-gnodeb-template.cert file exists in the mentioned directory, the Artifacts in this case. VNF SDK does not look inside this file.

(Needs Investigation) SOL004 has option 1 (signing each artifact individually / individual digest) and option 2 (sign entire package). It would be nice if VNF SDK supported both Option 1 and Option 2.


SOL004 PNF Tags

Check keywords. needs VNF SDK to check the PNF keywords. in the MainServiceTemplate.mf there are new tags:

  • pnf_product_name pnf_provider_id,
  • pnf_package_version,
  • pnf_release_date_time
  • non_mano_artifact_sets;

and the NON ETSI MANO artifact tags public tags. These public tags are under the "non_mano_artifact_sets". This would be NEW development in VNF SDK. An example Manifest file is shown in this diagram:

metadata:
   pnf_product_name: gNB
   pnf_provider_id: Ericsson
   pnf_package_version:1.0
   pnf_release_date_time:2018-12-03T08:44:00-05:00

non_mano_artifact_sets: 
onap_ves_events:
  source: Artifacts/Deployment/Events/VES_registration.yaml
onap_pm_dictionary:
  source: Artifacts/Deployment/Measurements/PM_Dictionary.yaml
onap_yang_module:
  source: Artifacts/Deployment/Yang_module/Yang_module.yaml
onap_others:
  source: Artifacts/Informational/scripts/install.sh
  source: Artifacts/Informational/user_guide.txt
  source: Artifacts/Other/installation_guide.txt
  source: Artifacts/Other/review_log.txt

   which shows the use of some of these fields.

ASSOCIATED DEVELOPMENT:

VNFSDK-339 - Support PNF CSAR structure based SOL004 OPEN


VALIDATION FOR META DATA CHECK

Following ETSI SOL004 Validation for Meta-Data file and Manufacturer file, this is the TOSCA.meta file that is part of the PNF Package. Both VNF SDK implementing only meta-data option, in the package there is a meta file. Check TOSCA.meta, while this file is not mandatory, when it is included that it follows the SOL004 standard (ETSI). We expect that "TOSCA-Meta-Version" and "CSAR-Version" and "Created by" are already supported, and new checks for "Entry definition, Entry-manifest, Entry-change-log, Entry-tests, Entry-certificates" would be new VNF SDK development work (needs to be verified).

Following VNFRQTS JIRA items contribute to this requirement:
R- 293901

Jira
serverONAP JIRA
serverId425b2b0a-557c-3c0c-b515-579789cceedb
keyVNFRQTS-567


SOL004 Security

Driven from SOL004: Option 1 (Supported in R4 Dublin): TOSCA.meta (exists) Meta-directory based, XML based approach. Option 2 (NOT support in R4 Dublin): CSAR without TOSCA.meta. Manifest (.mf) file that has everything (so the TOSCA.meta is redundant). Yaml-based approach.

The Public Key a key to open the package. SOL004 Option 1, 2 and use key to open the package - X.509 certificates public key, private key to sign the package and private key correspond to the private key of the package also delivered with the package. a package, a signature, and public key certificate delivered together. There may be more than one signature. Option 1 there is a digest for every file. All of those digests are listed in the manifest file. The manifest file is signed, one signature on the manifest. One signature and one key/pair & 1 certificate. Still optional to sign other files. The signature is a file beside. myimage.iso myimage.xyz but the same file/directory. Every file signed should have a signature files. CSAR file signed in a .sm file, package signature. The public key is signed can be signed by a root certificate.

An X.509 certificate is a digital certificate that uses the widely accepted international X.509 public key infrastructure (PKI) standard to verify that a public key belongs to the user, computer or service identity contained within the certificate.


...