Application Certification

Rules

• 1 : The application is hosted by a custom repository and is not certified.
• 2 : The application is hosted by the nethforge repository and certified by the NethServer community.
• 3 : The application is hosted by the default or subscription repositories and is certified by Nethesis.
• 4 : The application is developed and maintained by Nethesis developers.
• 5 : he application is developed and maintained by Nethesis developers and is covered by Nethesis support.

• CRC (Community Request for Certification) Level 1 and 2

Detailed steps here, communication via public forum

• NRC (Nethesis Request for Certification) Level 3, 4 and 5

Detailed steps here, communication between developer and Nethesis dev team

• Certified
• Maintained, regularly
• Orphaned, needs new dev
• Certification revoked, no dev and/or outdated

If an administrator wants to install an app, they must be clear about who created it and how robust it is, certified by others.

At the moment there is no clear path for certification, and I would like to create an howto to clarify the matter a bit :slight_smile:

Characteristics/Requirements for an app to belong to one of the three categories:

Official: Supported\Created and certified by Nethesis. Certified: Supported\Created by others but certified by Nethesis. Community: Supported\Created and certified by the community. Software Center Checklist

Certification requirements valid for all to enter the Software Center - in NethForge/Default/Subscription repository:

Does not break anything. Does not crash during usage. LDAP integration (if possible). Optional backup/restore, but if included, must work well. Functional clone/move. Functional update management. Translation support. In the About page: Contact information for the supporting company/person (name, website, email). Links to the original project and app’s source repository. Link to the manual/documentation page. Clarification on support duration, update management, and upstream upgrade (update frequency, major release). App Info page

The App Info page of each app in the software center should display:

The list of certified requirements. The certifier (Nethesis, another company, or entity). Author. Version date. [Number of installations / Rating]. Staging (Level 0) :test_tube: : Apps created by the community and residing in authors’ personal repositories:

Not required to meet the Software Center Checklist. Each app generally has a reference discussion in the App category. These apps remain outside the Software Center; we assume no responsibility for their functioning. Level 0 because it has no entry barrier; creating a new topic and providing installation information is sufficient. Community (Level 1) :people_holding_hands: Apps produced by the community and authorized to enter NethForge. It’s a sort of community self-certification with minimum requirements:

Must meet the Software Center Checklist.

Tested and certified by (at least 2-3?) community members. Support from the app creator in the community ( with link to the reference discussion). App entry in the manual’s table (generated by PR or automatically). Certified (Level 2) :1st_place_medal: Apps produced by third-party (e.g., Software Company Name) but certified by Nethesis (Or people on our behalf).

Requirements:

Developed and supported by another company. Request for a manual page with essential information. It must be clear: who to ask for support. how long the app will be supported how updates will be delivered. Official (Level 3) :star2: Apps produced by Nethesis and certified by Nethesis. Includes Software Center Requirements + Level 1 + and Level 2 requirements. Developed and supported by Nethesis, e.g. WebTop, NethVoice, NethSecurity Controller.

Request for a comprehensive manual page. English and Italian translations.

As said, the badge levels are five. These levels give a concise description of various aspects of the app, so an explanation is necessary.

Origin: Is it from a nethserver.org repository (i.e., subscription, default, nethforge) or not? If the repository is not official, the app is Level 1. Certification: Is it certified by the Community or by Nethesis? Community certification brings Level 2, and Nethesis certification brings Level 3. Author: Applications made by Nethesis are Level 4. Support: If the cluster has an active subscription and the application support is included in the subscription, the app is Level 5.

Private repositories are considered untrusted. When an additional repository is created, a warning is displayed. Applications hosted by custom repositories are assigned a trust level of 1 out of 5.

image image 929×724 39.3 KB The NethForge repository is considered to have medium trust. If an app is hosted on NethForge, it is “certified by the community” and given a trust level of 2 out of 5. Rootfull modules are displayed with a warning if the trust level is less than 3.

image image 1649×831 63.1 KB Note that the App info modal window now displays the repository that contains the application.

image image 1627×837 39.1 KB Rootfull app warning is displayed also in the install window.

Applications hosted by the default or subscription repositories have the highest level of trust, “certified by Nethesis,” and are assigned a trust level of 3, 4, or 5 out of 5. A level 5 trust is visible only if the cluster has an active subscription.

image image 1657×838 86.2 KB In addition to the app certification system, this development branch includes other improvements, such as limiting the installation of the Mail app to a single instance on any given node.

Looking ahead, we must address important security aspects related to app distribution. Beyond evaluating the work of app developers—who, at this stage of the project, are personally known and trusted—we must also consider the container images that compose the app. These are listed in the App Info modal window, as shown in this detail from previous screenshots:

image image 970×101 3.35 KB The Software Center we plan to release in the coming weeks, after testing is complete, still doesn’t fully realize our vision. However, it is a step toward the goal of having an NS8 Software Center with many quality applications, open to contributions from everyone.

the best secure way of development for a module to nethforge

do not be rootfull backup & restore action clone action to move the module among the cluster documentation well designed to configure/interact with the module from the CLI API a wiki where the community can add tips and use cases be available to fix bugs and issues no redundant apps, if you have ideas, or enhancements, try to do a PR to the apps, do not ask to fork it. the apps must be updated, follow the version of the apps listening to the needs of the community Indeed to pass the certification it will need a work between the responsible guy and the developer, like we do at Nethesis among all developers. We ask to another or a group of developers, what do you think, please argue and comment

This is the only way to get the best code and to be sure to think to all possible problems or issues. It is not a harsh talk, nor a a police interrogation but the good way to do things. For sure it is always easier to code alone, you go faster, but together we go further

so

ask the need to the community code the apps (possibly in your repo) test the apps with the community ask to be certified to NethForge do a PR to NethForge work together with NethServer team to complete the validation be happy you have been accepted