https://pact.io logo
Join Slack
Powered by
Hi, we are trying to do a POC with pact-broker 2.1...
# pact-broker
r
Hi, we are trying to do a POC with pact-broker 2.106.0. Before installing pact-broker, our security check needs an official proof from pact-broker that the following versions of jquery are installed with pact-broker 2.106.0. Do you have anything like a release notes/install guide that I can find the info? jquery-3.6.0.min.js (path: vendor/hal-browser/vendor/js/) jquery-3.5.1.js (path: public/javascripts/)
m
Sorry I'm confused by the question. They want an exact version of jQuery or they don't want a set of jQuery versions? Asking for an exact version doesn't make any sense in a world where dependencies need to be updated regularly for security and big fixes etc
r
Hi @Matt (pactflow.io / pact-js / pact-go), sorry for the confusion. The ask is the exact versions of jquery which is used in pact-broker version 2.106.0, particularly. So I am looking for an evidence of the combination of: pact-broker: version 2.106.0 -- jquery-3.6.0.min.js -- jquery-3.5.1.js
m
Looks like 3.5.1
r
@Matt (pactflow.io / pact-js / pact-go) I only see 3.5.1 in the search result and changelog. Anywhere I can find jquery-3.6.0.min.js? (path: vendor/hal-browser/vendor/js/). If there is no document showing jquery-3.6.0.min.js is included in pact-broker 2.106.0. Our security team also accepts email with confirmation of the versions combination as evidence. Is it possible that you can provide an email?
m
Think about this request:
Copy code
pact-broker: version 2.106.0
       -- jquery-3.6.0.min.js
       -- jquery-3.5.1.js
Why would we want to have 3.6.0 and 3.5.1? That doesn’t make any sense
It’s open source software Ran - the code is public on the Internet
r
it is not what we want. We download the source code and did a scan. The scan shows the versions.
m
I’m not sure what you want us to tell you then? My guess is there is two parts of the UI that use jquery and perhaps use both (there is a HAL browser which might rely on a different jquery version).
r
We are bank and are very restricted on what we will introduce and install. So for every software, we need to certify all the dependencies/embeded software with exact version.
m
I’m not sure how more transparent we can be Ran - our source code is literally on the Internet
(I understand, Bank security teams are… fun to work with!)
r
Copy code
It will satisfy our security if you could provide an email confirming that jquery-3.6.0.min.js and jquery-3.5.1.js are the official versions in pact-broker 2.106.0
m
Who would send them the email Ran? It’s a community maintained project by a collective set of volunteers. Tell your security team to do their job, and look at the source code.
If you need a supported version of the software, that’s what PactFlow is for. And then you can get your security people to ask SmartBear to do a security review and ask about dependencies etc.
r
understand.
m
sorry to be curt, but do you (your security team, that is) ask other open source library maintainers to confirm in writing versions of libraries they use? Why is this any different?
r
thanks for all your help! I completely understand your points.
m
If it helps:
Copy code
✗ docker run -it --rm --entrypoint /bin/sh pactfoundation/pact-broker                                                                                                                             
~ $ find . -name "*jquery*"
./vendor/bundle/ruby/2.7.0/gems/pact_broker-2.102.2/vendor/hal-browser/vendor/js/jquery-3.6.0.min.js
./vendor/bundle/ruby/2.7.0/gems/pact_broker-2.102.2/public/stylesheets/jquery-confirm.min.css
./vendor/bundle/ruby/2.7.0/gems/pact_broker-2.102.2/public/javascripts/jquery-3.5.1.js
./vendor/bundle/ruby/2.7.0/gems/pact_broker-2.102.2/public/javascripts/jquery.tablesorter.js
./vendor/bundle/ruby/2.7.0/gems/pact_broker-2.102.2/public/javascripts/jquery-confirm.min.js
./vendor/bundle/ruby/2.7.0/gems/pact_broker-2.102.2/public/javascripts/jquery-3.5.1.min.map
./vendor/bundle/ruby/2.7.0/gems/pact_broker-2.102.2/public/javascripts/jquery-3.5.1.min.js
./vendor/bundle/ruby/2.7.0/gems/pact_broker-2.102.2/public/javascripts/jquery.tablesorter.min.js
Looks like the pact broker uses 3.5.1, and the HAL browser uses 3.6.0.
t
As a non-pactflow person, it sounds like you want pactflow if you need specific enterprise requirements around security etc
👍 1
y
we don’t provide proof other than the source code, we don’t need to anyway, you are using an open source project without warranty that isn’t the latest version of the pact broker you can see the full source code and build it yourself online.
your security team can check the source code and confirm, we are not going to
you haven’t provided us a copy of the scan, therefore i don’t know what you are looking at
we’ve provided you the entire source code, please reconsider your request
https://pact-foundation.slack.com/archives/C9VPNUJR2/p1686713561489269?thread_ts=1686693555.299459&channel=C9VPNUJR2&message_ts=1686713561.489269 if you go to the release page you can see a tag, from the tag you see a commit associated with it, which is the point in time of the codebase at the point on release. obviously you could just look in the distributed gem or image which would give you definitive proof of what in installed
Open in Slack
PreviousNext
Powered by