Eclipse SW360

ADR Index

Mon, 01 Jan 0001 00:00:00 +0000

Architecture Decision Records (ADRs)

This directory contains the Architecture Decision Records for SW360.

ADR Index

ADR	Title	Status	Date	Format
ADR-001	Use Apache Thrift for Internal Services	Accepted	2014	DAR/SWOT
ADR-002	Use CouchDB as Primary Database	Accepted	2014	DAR/SWOT
ADR-003	Use Keycloak for Authentication	Accepted	2022	DAR/SWOT
ADR-004	Migrate to Spring Boot 3.x	Accepted	2024	DAR/SWOT
ADR-005	Use Apache Tomcat as Servlet Container	Accepted	2014	DAR/SWOT
ADR-006	Migrate to Cloudant SDK for CouchDB Access	Accepted	2024	DAR/SWOT
ADR-007	File-Based API Response Cache for REST Endpoints	Accepted	2026	DAR/SWOT
ADR-008	Upgrade to Spring Boot 4.x and Spring Security 7.x	Accepted	2026	Standard

Templates

Template	Description
ADR-TEMPLATE.md	DAR format with SWOT analysis & T-shirt sizing

AI Policy

Mon, 01 Jan 0001 00:00:00 +0000

AI Policy

Starting 2026, Google has strong advice about the usage of Generative AI in the GSoC program. Please check them at:

For Mentoring Orgs: Usage of AI tooling in Google Summer of Code 2026 (for Mentoring Orgs)
For Contributors: Guidance for GSoC Contributors using AI tooling in GSoC 2026 doc

Based on the suggestions from Google, SW360 has the following guidelines for GSoC contributors:

Login

Mon, 01 Jan 0001 00:00:00 +0000

You need a username and a password to access the software. After reaching the SW360 site you will be in the public area of your account. Liferay distinguishes between public and private area, where the private area is protected by login.

You will see a “Welcome to SW360!” homepage which is a public area with Sign In and Create Account buttons. The Sign In button will redirect to the private area in order to work with the portal.

SW360 Architecture

Mon, 01 Jan 0001 00:00:00 +0000

SW360 Architecture Documentation

Version: 1.0
Date: March 2026
Classification: Public

Document Information

Attribute	Value
Document Title	SW360 Architecture Documentation
Version	1.0
Status	Released
Last Updated	March 2026
Template	Based on Arc42
License	EPL-2.0

1. Introduction and Goals

1.1 Purpose

SW360 is an open source software component management application designed for large organizations to track, manage, and ensure compliance of open source software components. This document provides a comprehensive architecture overview following the Arc42 template.

ADR-001: Apache Thrift for Internal Services

Mon, 01 Jan 0001 00:00:00 +0000

Decision Analysis and Resolution: SW360 Internal RPC Framework

Created by: SW360 Architecture Team
Original Decision: 2014
Reformatted: April 2026
Status: Accepted
Estimated read time: 10 minutes

Background

SW360 was designed as a multi-tier application for open source license compliance management with:

GSoC Idea List - 2026

Mon, 01 Jan 0001 00:00:00 +0000

GSoC Idea List - 2026

Welcome to the idea page for all GSoC 2026 related information.

Check https://github.com/eclipse-sw360/sw360/discussions/3631

Intro

SW360 is applying as a mentoring org again in GSoC 2026 with the ambition to make it as awesome as the GSoC 2025!

Please see two main resources for finding out more SW360 in general:

Check https://eclipse.dev/sw360/ and development and deployment section.
Try to install SW360 from source or your can try the Docker

Meetings: Checkout the Meetings table

Home Page

Mon, 01 Jan 0001 00:00:00 +0000

Home Page

The private area of the home page contains an overview of projects and components which are specific to you and other general information.

Sl.No	Name	Description
1	Main Menu	Main menu consists primarily of the various tasks you can perform.
2	My Projects	Displays the list of projects for a specific role or clearing state.
3	My Task Assignments	Displays the tasks or moderation requests that are assigned to you. These can be change requests submitted for approval related to the “projects, components or releases” for which you are a creator or a moderator.
4	My Components	Displays the list of components that are created by you.
5	My Task Submissions	These are the change requests that are submitted by you for an approval to change any aspect of a “project, component or release” for which you are not a creator or moderator.
6	Search Bar	You can find the search bar on the right top corner of the application. Search bar enables you to search for a specific project/component/release.
7	My Profile	You can find the profile icon on the right top corner of the application. You can perform the following actions in my profile: - My sites, will redirect you to a page where you can view all the sites you have opened in the past. - My profile, will redirect you to a page where you can view your vcard. - My dashboard, will redirect you to a page where you can view summary of your profile. - Notifications, will redirect you to a page where you can view all the latest updates. - Shared content, will redirect you to a page where you can view all the shared content which are shared with you or shared by you. - My submissions, will redirect you to a page where you can view all of your submissions. - My workflow tasks, will redirect you to a page where you can view the tasks which are assined to you or your roles. - Account settings, will redirect you to a page where you can modify general information, passwords, addresses and contact information and alert preferences as needed. - My connected applications, will redirect you to a page where you can view connected applications. - My organization, will redirect you to a page where you can view your organization information. - You can sign out of SW360 using sign out option.
8	My Subscriptions	Displays a list of various components and releases you have subscribed to. `NOTE: YOU CANNOT SUBSCRIBE TO A PROJECT.`
9	Recent Components	Displays a list of recent components which are added to SW360.
10	Recent Releases	Displays a list of recent releases which are added to SW360.

SW360 Frontend Architecture

Mon, 01 Jan 0001 00:00:00 +0000

SW360 Frontend Architecture Documentation

Version: 1.0
Date: May 2026
Classification: Public
Repository: eclipse-sw360/sw360-frontend

Document Information

Attribute	Value
Document Title	SW360 Frontend Architecture Documentation
Version	1.0
Status	Released
Last Updated	May 2026
License	EPL-2.0

1. Introduction and Goals

1.1 Purpose

The SW360 Frontend is a modern web application that replaces the legacy Liferay Portal UI. Built with Next.js and React, it provides a responsive, internationalized user interface for managing software components, licenses, projects, and compliance workflows.

ADR-002: CouchDB as Primary Database

Mon, 01 Jan 0001 00:00:00 +0000

Decision Analysis and Resolution: SW360 Primary Database

Created by: SW360 Architecture Team
Original Decision: 2014
Reformatted: April 2026
Status: Accepted
Estimated read time: 12 minutes

Background

SW360 manages software components, releases, projects, and licenses for open source license compliance. The data model is characterized by:

GSoC Idea List - 2025

Mon, 01 Jan 0001 00:00:00 +0000

GSoC Idea List - 2025

Welcome to the idea page for all GSoC 2025 related information.

Check https://github.com/eclipse-sw360/sw360/discussions/2868

Intro

SW360 project has been selected as a mentoring Org with GSoC 2025. Thank you, Google!

Please see two main resources for finding out more SW360 in general:

Check https://eclipse.dev/sw360/ and development and deployment section.
Try to install SW360 from source or your can try the Docker

Meetings: Checkout the Meetings table

Project

Mon, 01 Jan 0001 00:00:00 +0000

1.0 Project Page

1.01 Introduction

Navigate to your project overview by clicking the menu item Projects. Here you can find the list of projects with description and other related details. On the left side of project list you can find a advanced filters to filter out specific project.

Sl.No.	Description
1	Advanced Search
2	Add Project
3	Import SPDX BOM
4	Export Spreadsheet
5	Project List

1.02 Project List

The Project List lists all the relevant projects with the following information:

ADR-003: Keycloak for Authentication

Mon, 01 Jan 0001 00:00:00 +0000

Decision Analysis and Resolution: SW360 Authentication Provider

Created by: SW360 Architecture Team
Original Decision: 2022
Reformatted: April 2026
Status: Accepted
Estimated read time: 12 minutes

Background

SW360 originally used Liferay Portal’s built-in authentication, which coupled user management to the UI layer. With the migration away from Liferay toward a REST-first architecture, several challenges emerged:

Components

Mon, 01 Jan 0001 00:00:00 +0000

2.0 Components

2.01 Introduction

The components page displays the list of components and releases that are available in SW360. A component is a list of releases with metadata. A release is a specific version of a component.

To open a component page, click Components tab from the main menu. You can find a particular component with Advanced Search, you can also add and edit components in this page.

Sl.No.	Description
1	Advanced Search
2	Add Component
3	Import SPDX BOM
4	Export Spreadsheet
5	Component List

2.02 Component List

On the component page, you can view all the components that are relevant to you. The components are listed with the following information:

ADR-004: Migrate to Spring Boot 3.x

Mon, 01 Jan 0001 00:00:00 +0000

Decision Analysis and Resolution: Spring Boot Version Migration

Created by: SW360 Architecture Team
Original Decision: 2024
Reformatted: April 2026
Status: Accepted
Estimated read time: 10 minutes

Background

SW360’s REST API was built on Spring Boot 2.x with Spring Security 5.x. Several factors drove the need to evaluate migration:

Licenses

Mon, 01 Jan 0001 00:00:00 +0000

3.0 Licenses

3.1 Introduction

A software license is a document that provides legally binding guidelines for the use and distribution of software. Licenses page lists all the available licenses in SW360.

To open the License page, click on the License tab from the main menu bar. You can also add licenses in this page.

Sl.No.	Description
1	Quick Filter
2	Add License
3	Export Spreadsheet, refer to Project Page
4	License List

3.2 Quick Filter

You can use the Quick Filter to search for a License. To search for a particular license, use the type field.

Packages

Mon, 01 Jan 0001 00:00:00 +0000

4.0 Packages

4.01 Introduction

The Packages page in SW360 displays all available software packages. A package is a collection of files and details about a specific version of software. Each package includes details such as its version, license, package manager, and other key information.

To view packages, navigate to the Packages tab in the main menu. You can use the Advanced Search to locate a package by various criteria. Additionally, this page allows you to add new packages and edit existing ones.

Securing SW360

Mon, 01 Jan 0001 00:00:00 +0000

This page is the single reference for securing an SW360 installation. It covers application-level authentication and credential management. For infrastructure-level hardening (TLS, network isolation, file permissions, reverse proxy) see Security Best Practices.

1. Authentication Modes

SW360 v20 supports four authentication methods, selectable per deployment. Both bare-metal and container setups configure the same properties, just in different files.

Mode	Frontend provider	When to use
`sw360basic`	HTTP Basic username/password	Local development only
`sw360oauth`	Built-in OAuth2 Authorization Server	Internal / automation-heavy setups
`keycloak`	External Keycloak OIDC	Recommended for production
`api-token`	Personal Bearer API key (REST API token)	CI, automation, service scripts

1.1. Built-in Basic Auth (`sw360basic`)

The default mode. No extra configuration is required; the frontend sends an Authorization: Basic … header on every request.

ADR-005: Apache Tomcat as Servlet Container

Mon, 01 Jan 0001 00:00:00 +0000

Decision Analysis and Resolution: SW360 Servlet Container

Created by: SW360 Architecture Team
Original Decision: 2014
Reformatted: April 2026
Status: Accepted
Estimated read time: 8 minutes

Background

SW360 was originally designed as a Liferay Portal application, which required a servlet container to host web applications. The servlet container needed to:

Requests

Mon, 01 Jan 0001 00:00:00 +0000

6. Requests

Requests page lists all the requests that are generated by the users in SW360. There are two kind of requests:

Moderation Requests: The requests that are created when a user with limited rights requests a change in a Project/Component/Release. These requests need to be approved by another user with higher rights (Project Owner/ Project Responsible) for the changes to appear in a particular Project/Component/Release. You can also view these requests as tasks in your home page.
- My Task Assignments: Moderation requests that are pending for your approval.
- My Task Submissions: Moderation requests that are created by you.
Clearing Request: For more information on clearing requests, refer to 1.12 Clearing Requests, Project Page.

To open the Requests page, click on the Requests tab from the main menu.

ADR-006: Cloudant SDK for CouchDB Access

Mon, 01 Jan 0001 00:00:00 +0000

Decision Analysis and Resolution: CouchDB Client Library Migration

Created by: SW360 Architecture Team
Original Decision: 2024
Reformatted: April 2026
Status: Accepted
Estimated read time: 10 minutes

Background

SW360 uses Apache CouchDB as its primary database (see ADR-002). The original CouchDB client library was Ektorp, a Java library that provided:

Search

Mon, 01 Jan 0001 00:00:00 +0000

7. Search

On the search page, you can search for Projects, Components, Licenses, Releases, Obligations, Users, Vendors, etc. in SW360.

To search for a particular (object), click on Search tab and follow the procedure:

Type the keyword in the text field.
The checkbox in Restrict To Type allows you to further restrict your search to a specific (object), you can choose to restrict the type to projects, components, licenses etc.
Click on Search to get the search results
Click on the component/project/license/obligation/user/vendor/release to be redirected to their respective page.

Wildcards

The user can search with wildcards. A wildcard is a character which substitue for zero or more characters in a string. For a single character users can use ‘?’ and for multiple character wildcard he can use ‘*’. The Wildcard can stand in the middle of characters or at the end, but not at the beginning.

ADR-007: File-Based API Response Cache

Mon, 01 Jan 0001 00:00:00 +0000

Decision Analysis and Resolution: REST API Response Caching

Created by: SW360 Architecture Team
Original Decision: 2026
Reformatted: April 2026
Status: Accepted
Estimated read time: 12 minutes

Background

The SW360 REST API exposes resource-intensive endpoints that aggregate large amounts of data. The most critical example is GET /releases?allDetails=true, which:

Preferences

Mon, 01 Jan 0001 00:00:00 +0000

8. Preferences

The Preferences page allows you to modify the E-mail notification preferences for changes that occur to project/component/release/license. To open the Preferences page, click on the Preference tab from the main menu.

Sl.No.	Description
1	Email Notification Preferences
2	SW360 User Information
3	REST API Token

8.1 SW360 User Information

On the SW360 User section you can view the following information:

Name
E-mail
Primary Department
External ID: This is your organization ID.
Primary Department Role: This is the role you are assigned in SW360.
Secondary Departments and Roles: Any other roles which are assigned.

8.2 Email Notification preferences

To modify your email notifications, follow the procedure:

ADR-008: Upgrade to Spring Boot 4.x and Spring Security 7.x

Mon, 01 Jan 0001 00:00:00 +0000

Decision Analysis and Resolution: Spring Boot 4.x and Spring Security 7.x Upgrade

Created by: SW360 Architecture Team
Decision Date: April 2026 Status: Accepted
Supersedes: ADR-004 (Spring Boot 3.x Migration)
Reference: eclipse-sw360/sw360#4054

1. Context and Problem Statement

Spring Boot 3.x, while still supported, is approaching its maintenance window end. Spring Boot 4.x (based on Spring Framework 7.x and Spring Security 7.x) introduces performance improvements, modern Java alignment, and security enhancements. However, the upgrade involves breaking changes in package relocations, removed deprecated APIs, and module restructuring.

ADR-009: Modernize Nouveau Search Architecture

Mon, 01 Jan 0001 00:00:00 +0000

Decision Analysis and Resolution: CouchDB Nouveau Search Architecture Modernization

Created by: SW360 Architecture Team Decision Date: July 2026 Status: Proposed

1. Context and Problem Statement

The current SW360 search mechanism constructs queries by appending trailing wildcards to every input token (term1* OR term2* OR term3*). While this maximizes recall for unknown terms, it causes severe issues in production environments:

How to add a backend portlet to sw360

Mon, 01 Jan 0001 00:00:00 +0000

This page how to add some operations / service calls on the backend for the portlet writing on the page that covers the front end. Note that this page does not create a new (thrift service), but just explains how to add more operations.

This explanation follows bottom up approach where we first add the backend methods and then call them later in the frontend. Quick summary:

Add methods to the thrift idl definition
Add methods to the data handler interface
Add implementation
Add tests

Thrift

First we add some methods to the thrift files, components.thrift

How to add a frontend portlet to sw360

Mon, 01 Jan 0001 00:00:00 +0000

We create a class in

sw360/src/frontend/sw360-portlets/src/main/java/com/siemens/sw360/portal/portlets/admin/

called

DatabaseSanitation.java

Here are some code snippets that are important:

public class DatabaseSanitation extends Sw360Portlet

the base class Sw360Portlet adds some convenience methods to render the most common return values of functions into messages.

@Override
public void doView(RenderRequest request, RenderResponse response) throws IOException, PortletException {
 // Proceed with page rendering
 super.doView(request, response);
}

This method is used to render different pages, a common pattern would be to have if/else tree like

Administrator Menu

Mon, 01 Jan 0001 00:00:00 +0000

The Administrator Menu provides centralized access to system management tools and settings. The menu consists of the following sections:

User: Manage system users, including role assignments and bulk import/export.
Department: Manage organizational departments for visibility and access control.
Vendors: Maintain the global list of component and software vendors.
Bulk Release Edit: Batch-update attributes across multiple releases simultaneously.
Licenses: Manage the software licenses.
License Types: Define and categorize different types of licenses.
Obligations: Define and manage legal and compliance obligations for specific licenses.
Schedule: Manage automated background tasks, such as CVE vulnerability searches.
Fossology: Configure and monitor the connection to the FOSSology scanning server.
Import & Export: Bulk manage component, release, and license information via data transfer.
Database Sanitation: Clean up the database and resolve duplicate or inconsistent identifiers.
Attachment Cleanup: Manage and purge orphaned or redundant attachments to save storage.
OAuth Client: Manage and configure external application clients for API access.
Configurations: Fine-tune application behavior and manage feature toggles.

API Access

Mon, 01 Jan 0001 00:00:00 +0000

This page is the canonical authentication guide for calling SW360 REST API endpoints with curl.

For endpoint-level resource documentation, see SW360 Rest API.

Setup

Use these environment variables in the examples:

SW360_HOST='https://<my_sw360_server>'
RESOURCE_API="$SW360_HOST/resource/api"
AUTH_SERVER="$SW360_HOST/authorization"

ADMIN_USER='<admin@sw360.org>'
ADMIN_PASS='<admin-password>'

API_USER='<normal.user@sw360.org>'
API_PASS='<user-password>'

CLIENT_ID='<oauth-client-id>'
CLIENT_SECRET='<oauth-client-secret>'

KC_TOKEN_URL='https://<keycloak-host>/realms/<realm>/protocol/openid-connect/token'

Authentication Mechanisms Overview

Mechanism	Header / Credential	Typical Use	Credential Lifecycle
HTTP Basic	`Authorization: Basic <base64(user:password)>`	One-off admin/debug calls	User password lifecycle
API Token	`Authorization: Token <token>`	User- or service-owned long-lived integrations	SW360 token validity settings
OAuth2 `client_credentials`	`Authorization: Bearer <jwt>`	Service-to-service automation	OAuth client + short-lived JWT
OAuth2 `authorization_code` (+ PKCE)	`Authorization: Bearer <jwt>`	End-user delegated UI access	Browser login + code exchange
Keycloak OIDC/OAuth2	`Authorization: Bearer <jwt>`	External IAM/SSO deployments	Keycloak token lifecycle

Which Mechanism Should I Use?

One-off admin debug or smoke test: use HTTP Basic.
Long-lived integration owned by a SW360 user: use API Token.
Non-interactive service-to-service integration: use OAuth2 client_credentials.
End-user delegated access from browser/UI: use OAuth2 authorization_code + PKCE.
Centralized enterprise identity/SSO: use Keycloak.

Authorization Model in `resource-server`

GET /api/** requires TOKEN_READ.
POST, PUT, PATCH, DELETE /api/** require TOKEN_WRITE.

SW360 merges user-group authorities (for example READ, WRITE, ADMIN) with token capability authorities (TOKEN_READ, TOKEN_WRITE) before endpoint checks.

BR-CLR-001: Release Clearing State Determination & Manual Transitions

Mon, 01 Jan 0001 00:00:00 +0000

BR-CLR-001: Release Clearing State Determination & Manual Transitions

Standard Classification: State Machine / Behavioral Invariant & Lifecycle Constraint
Target Entity: Release, Attachment (CLEARING_REPORT, INTERNAL_USE_SCAN_REPORT, INITIAL_SCAN_REPORT), Integration Actions (Send to FOSSology)
Status: Approved
Enforcement Points: Backend Domain Services (ReleaseService.autosetReleaseClearingState, ComponentDatabaseHandler.evaluateClearingStateForScanAvailable)

1. Executive Summary & Formal Statements

1.1 Formal Statement (RuleSpeak® / EARS)

While updating a Release:
- If the user manually sets clearingState to UNDER_CLEARING and the prior clearingState is either NEW_CLEARING or REPORT_AVAILABLE, then the system shall preserve the manual state and skip automatic recalculation based on attachments.
- Otherwise, the system shall automatically determine and assign the clearingState according to the following evaluation precedence:
  1. If a Clearing Report (BestClearingReport) is attached:
  - If its checkStatus is ACCEPTED, then clearingState shall be APPROVED.
  - Otherwise (checkStatus is not ACCEPTED), then clearingState shall be REPORT_AVAILABLE.
  1. Else if an Internal Use Scan Report (BestInternalUseScanReport) is attached with checkStatus equal to ACCEPTED, then clearingState shall be INTERNAL_USE_SCAN_AVAILABLE.
  2. Else if an Initial Scan Report (INITIAL_SCAN_REPORT) is attached (evaluated via evaluateClearingStateForScanAvailable > 0), then clearingState shall be SCAN_AVAILABLE.
  3. Otherwise (no qualifying scan, internal use, or clearing reports exist), clearingState shall default to NEW_CLEARING.
When a user triggers the action “Send to FOSSology” on a Release:
- Then the system shall transition the release clearingState to SENT_TO_CLEARING_TOOL.

1.2 Purpose & Risk Mitigated

Automating the Release clearing lifecycle based on verified attachment artifacts eliminates human error and status drift, ensuring that releases are never marked APPROVED without an accepted clearing report. Allowing an explicit manual transition to UNDER_CLEARING from unverified or draft states (NEW_CLEARING, REPORT_AVAILABLE) enables clearing specialists to explicitly indicate active work on a release, preventing duplicate clearing efforts across distributed teams.

BR-PROJ-001: Closed Project Update Restrictions

Mon, 01 Jan 0001 00:00:00 +0000

BR-PROJ-001: Closed Project Update Restrictions

Standard Classification: Behavioral Constraint / Access Control
Target Entity: Project
Status: Approved
Governing Configuration: projects.closed.update.strict (Default: false)

1. Executive Summary & Formal Statements

1.1 Formal Statement (RuleSpeak® / EARS)

While a Project has clearing state CLOSED (project.clearingState == ProjectClearingState.CLOSED):
- If projects.closed.update.strict is false, then the system shall allow users with role CLEARING_ADMIN (or above) as well as the project team (Creator, Project Responsible, Moderators, Contributors, and Lead Architects) to modify all fields of the project.
- If projects.closed.update.strict is true, then the system shall allow only CLEARING_ADMIN (or above) to modify all fields. The project team (Creator, Project Responsible, Moderators, Contributors, and Lead Architects) shall only be allowed to modify the allowlisted maintenance fields:
  1. Project State (state, project status, not clearing state)
  2. Project Responsibles (projectResponsible)
  3. Project Owner (projectOwner)
  4. Security Responsible (securityResponsible)
  5. Enable Security Vulnerability Monitoring (securityVulnerabilitiesMonitoring)
  6. Display Vulnerabilities (displayVulnerabilities)
  7. Phase-out date (phaseOutDate)
  8. External IDs (externalIds)
- If any other user attempts an update, or if a restricted user attempts to modify non-allowlisted fields in strict mode, the system shall reject the request with HTTP 403 Forbidden and shall not generate any moderation request.

1.2 Purpose & Risk Mitigated

This restriction is enforced strictly for audit and compliance purposes. A project is transitioned into the CLOSED clearing state only after its license clearing process is fully completed and approved. Once in the closed state, no changes that could result in a drift of license clearing (such as unauthorized modifications, additions, or removals of components, releases, attachments, or license obligations) shall be allowed. This guarantees that the cleared and certified baseline remains immutable and audit-compliant, while still permitting non-clearing operational lifecycle maintenance (e.g., updating security contacts, phase-out dates, or project ownership).

BR-SEC-001: Security User Role & Token Scope REST Filter Restrictions

Mon, 01 Jan 0001 00:00:00 +0000

BR-SEC-001: Security User Role & Token Scope REST Filter Restrictions

Standard Classification: Role Definition & Behavioral Constraint / Access Control
Target Entity: User (Role: SECURITY_USER), Token (Scopes: READ, WRITE), Project, Vulnerability, REST Endpoints
Status: Approved
Enforcement Points: Backend Permissions (PermissionUtils, ProjectPermissions) and Resource Server (EndpointsFilter)

1. Executive Summary & Formal Statements

1.1 Formal Statement (RuleSpeak® / EARS)

While an authenticated user has the role SECURITY_USER:
- The system shall grant read access to all projects (including PRIVATE projects of any department or owner), but only to their Summary and Vulnerabilities information.
- The system shall deny access to clearing, ECC (Export Control and Customs), compliance, attachments, and license obligations details for those projects.
- The system shall not allow the user to create, modify, or delete core catalog entities across the system (strictly read-only role).
While an incoming REST API request is authenticated via an API Token or initiated by a SECURITY_USER:
- If the token possesses READ scope (or the authenticated user is SECURITY_USER):
  - The REST API Gateway (EndpointsFilter) shall intercept and block all HTTP POST, PUT, PATCH, and DELETE requests with HTTP 503 Service Unavailable / 403 Forbidden.
  - Otherwise, the gateway shall allow safe non-mutating query endpoints and self-service token lifecycle operations:
    1. POST /api/releases/batch-summary (Batch data retrieval requiring a JSON request payload).
    2. POST /api/users/tokens (Self-service generation of READ or WRITE scoped user API tokens from the UI/client).
    3. DELETE /api/users/tokens (Self-service revocation and cleanup of the user’s own API tokens).
- If the token possesses WRITE scope and the user is not SECURITY_USER, the system shall permit standard HTTP mutation verbs (POST, PUT, PATCH, DELETE) subject to standard domain permission checks.

1.2 Purpose & Risk Mitigated

The SECURITY_USER role and READ token scopes allow automated security scanners, audit tools, and read-only integrations global visibility into vulnerabilities and security posture across the entire organization’s software catalog without exposure to proprietary project internals, compliance data, or the ability to alter database records. Enforcing strict read-only behavior at the HTTP filter level guarantees defense-in-depth against unauthorized mutation attempts while explicitly allowing batch query POST requests and self-service token generation and revocation (to ensure users can manage their own security credentials and immediately invalidate compromised tokens).

SW360 Development Branches

Mon, 01 Jan 0001 00:00:00 +0000

Branches structure

<github-nickname>/<issue>/<description>

Examples:

maierthomas/#1/fix-dowload-bundle
maierthomas/#3/sw360portal-specific-links

How to add fields to an existing class

Mon, 01 Jan 0001 00:00:00 +0000

The license portlet is different from the other portlets as there is no Details/Edit page for each element. There is only a combined edit/view page. We will add the license text to licenses in the thrift file:

13: optional string text;

To update the text we write a liferay Action in the LicensesPortlet:

 @UsedAsLiferayAction
 public void changeText(ActionRequest request, ActionResponse response) throws PortletException, IOException {
 String licenseId = request.getParameter(LICENSE_ID);
 String text = request.getParameter(License._Fields.TEXT.name());

 if(!Strings.isNullOrEmpty(licenseId)) {

 try {
 User user = UserCacheHolder.getUserFromRequest(request);
 LicenseService.Iface client = thriftClients.makeLicenseClient();
 final License license = client.getFromID(licenseId);

 license.setText(CommonUtils.nullToEmptyString(text));
 final RequestStatus requestStatus = client.updateLicense(license, user);

 renderRequestStatus(request,response,requestStatus);
 } catch (TException e) {
 log.error("Error updating license", e);
 }
 }

 response.setRenderParameter(LICENSE_ID, licenseId);
 response.setRenderParameter(PAGENAME, PAGENAME_DETAIL);
 response.setRenderParameter(SELECTED_TAB, "LicenseText");
 }

To integrate it in the jsp we make the according changes, important to note is the ActionUrl that we define:

Component / Release

Mon, 01 Jan 0001 00:00:00 +0000

TC01: Add a component and release with vendor present

Step	Action	Result
1	Sign In with a known user	User successfully signed in and Home page is displayed
2	Click Components tab	Components page is displayed
3	Click Add Component button	- New Component page is displayed with mandatory fields marked with red star: Name, Categories, Component Type. - A message Success:New Component is displayed
4	Fill in a component Name, Categories and Component Type fields. Eg: - Name: Component 1@1 - Categories: Categories_1@1 - Component Type: OSS	Values are entered in the fields
5	Click Create Component button	- Create component successfully. - Redirect to the edit component page. -Show message: Success:You are editing the original document.
6	Click Releases tab Click Add Release button	Redirect to Add Release page
7	Fill in a release Version and CPE ID Eg: - Version: version1.0.0.x - CPE ID: UUID_1002	Values are entered in the fields: - Version: version1.0.0.x - CPE ID: UUID_1002
8	Click Create Release button	- Create a release successfully. - Redirect to the edit new release page. - The message Success:You are editing the original document. is displayed
9	Click Vendor field	Search Vendor dialog is displayed
10	Click Add Vendor button	Create new Vendor dialog display
11	Input data in fields - Full Name: add vendor 01 -Short Name: add vendor01 -URL: https://github.com/eclipse-sw360/sw360	Values are entered in the fields.
12	Click Add Vendor button	The vendor is added in Vendor field of the release with full name is add vendor 01
13	Click Attachments tab	Attachments page is displayed
14	Click Add Attachment button	Upload Attachment dialog is displayed
15	Click Browse and select the attachment. Eg: attachment1.xlsx	File name is displayed in the dialog
16	Click Upload button	The file is uploaded and dialog is closed. Also the attached file is listed in the Attachment page
17	Change the attachment Type to real type. Eg: Component license information (Combined)	Type changed successfully
18	Click Update Release button	Message: Success:Release {name} ({version}) updated successfully! is displayed

TC02: Verify data after add a component and release with vendor present

Step	Action	Result
1	Search for the component is created in TC01: - Click Components portlet - At Advanced Search area, input Component 1@1 in the Component Name textbox. - Click Search button	The new component display in the table with: - Vendor: add vendor01 - Component Name: Component 1@1 is displayed with hyper link. - Main licenses: blank - Component Type: OSS
2	Click hyper link of name Component 1@1	Redirect to view component Component 1@1 page
3	Click Release Overview tab	The release display with: - Name: Component 1@1 - Version displays with hyper link: version1.0.0.x - Clearing State: New - Clearing Report: no report - Release Mainline State: Open
4	Click hyper link version1.0.0.x	Redirect to view screen of release Component 1@1 version1.0.0.x Data of the release: - Summary tab: + display text with: COMPONENT 1@1 VERSION1.0.0.X + CPE ID: UUID_1002 + Created on: date of created. + Created by: user created. + Modified On: date of modified. + Modified By: user modified. + Clearing State: New + Release Mainline State: Open + Release Vendor with: Full Name: add vendor 01 Short Name: add vendor01 URL: https://github.com/eclipse-sw360/sw360
5	Click Attachments tab	Display file name attachment1.xlsx in the table.

TC03: Modify a component and release with vendor present

Step	Action	Result
1	Search for an existing component (e.g. created in TC01: Component 1@1) and click Edit icon	Success:You are editing the original document message is displayed
2	Click Releases tab	Release list is displayed
3	Click Add Release button	Redirect to Add Release page
4	Fill in a release Version and CPE ID Eg: - Version: v1.0.0.1 - CPE ID: cpe:id:123456	Values are entered in the fields: - Version: v1.0.0.1 - CPE ID: cpe:id:123456
5	Click Create Release button	- Redirect to the edit new release page. - The message Success:You are editing the original document. is displayed
6	Click Vendor field	Search Vendor dialog is displayed
7	Click Search button. Select a vendor (eg: select vendor with full name VendorUp) Click Select Vendor button.	Dialog is closed and selected Vendor is added under Vendor field: VendorUp
8	Click Attachments tab Click Add Attachment button Click Browse and select the attachment. Eg: attachment2.img Click Upload button	The file is uploaded and dialog is closed. Also the attached file is listed in the Attachment page
9	Click Update Release button	Message Success:Release Component 1@1 (v1.0.0.1) updated successfully! is displayed

TC04: Verify data after modify a component and release with vendor present

Step	Action	Result
1	Continue TC03
2	Click Summary tab	Data in the tab: - Modified On: date of modified. - Modified By: user modified. Data of other fields in the tab is same data before updated.
3	Click Release Overview tab	New release with version v1.0.0.1 is added in the release table.
4	Click v1.0.0.1 hyper link	Text display with: COMPONENT 1@1 V1.0.0.1 at the right corner. - At Summary tab: + CPE ID: cpe:id:123456 + Release Vendor: display with Full Name, Short Name and URL correctly with vendor VendorUp - At Attachments tab: attachment attachment2.img display in the attachment table with correct information.
5	Click Component 1@1 hyper link	Redirect to view screen of Component 1@1 component.
6	Click Attachments tab	Data in the tab is same data before updated.
7	Click Vulnerabilities tab	Data in the tab is same data before updated.

TC05: Add and modify a component and release with all fields filled in

Step	Action	Result
1	Click Components tab Click Add Component button Fill in all editable fields Click Create Component button	- Redirect to edit component screen with the message Success:You are editing the original document. is displayed in the left corner. - Create component successfully. Data match with input data.
2	Click Releases tab. Click Add Releases button. At Summary tab, fill in all editable fields under Release Summary and Release Repository. Click Create Release button.	Redirect to edit release screen. Created release successfully. Data match with input data.
3	Click Linked Releases tab Click Click to add Releases button	The dialog Link Releases is displayed.
4	Input search name into textbox Click Search button Select 3 releases. Click Link Releases button	Dialog is closed and selected release is displayed under Linked Releases section.
5	Click Linked Packages tab Click Add Packages button	The dialog Link Packages is displayed.
6	Input an exist orphan package name into textbox. Click Search button. Select a package. Click Link Packages button.	Dialog is closed and selected package is displayed under Linked Packages table
7	Click Clearing Details tab Fill in all editable fields	Values are entered in the fields
8	Click ECC Details tab Fill in all editable fields	Values are entered in the fields
9	Click Attachments tab Click Add Attachment button Click Browse and select the attachment. Eg: attachment3.xlsx Click Upload button	The file is uploaded and dialog is closed. Also the attached file is listed in the Attachment page
10	Click Update Release button	- Success:Release {componentName} ({version}) updated successfully! message is displayed. - Redirect to the view release screen.
11	Check all fields of the release by click tabs: Summary, Linked Releases, Linked Packages, Clearing Details and Attachments.	Values are filled in correctly, match with input data.
12	Click Edit Release button, modify some fields. Eg: - Version field ( in Summary tab): rename version name_updated - ECC Status field (in ECC Details tab): Approved. Click Update Release button.	Values are updated successfully

TC06: Delete a component that is first linked to a project and then not, and a project

Step	Action	Result
1	Create a new component Eg: component with name Component @1234	Component is created successfully
2	Add a new release to this component Eg: release Rel1	Release is added successfully
3	Create a new project P1	Project is created successfully
4	Add the linked release Rel1 to project P1.	Release linked successfully
5	Click Components portlet. Search component Component @1234 by name at advanced search.	Component Component @1234 display on the result table.
6	Click delete icon of component Component @1234	A warning The component Component @1234 cannot be deleted, since it contains 1 releases. Please delete the releases first.
7	Click OK button in the warning dialog.	The dialog is closed, component is not deleted
8	Click Components portlet. Search for the component Component @1234 and click hyper link of component Component @1234.	View screen of Component @1234 component is display
9	Click Release Overview. Click Delete icon button of release Rel1. Click Delete Release button in the dialog.	- Dialog Delete Releases is displayed. - Delete the release is failure. - The message: I could not delete the release, since it is used by another component (release) or project display.
10	Go to project P1, delete project P1.	The project is deleted successfully
11	Go to component Component @1234, at Release Overview tab, click Delete icon button of release Rel1.	Show message: Do you really want to delete the release {componentName} ({version}) ?
12	Click Delete Release button	Release is deleted successfully
13	Click Edit Component button. Click Delete Component button.	The dialog is displayed with message: Do you really want to delete the component {componentName} ?
14	Click Delete Component button	Component is deleted successfully

TC07: Add new attachments to an existing release and delete attachments

Step	Action	Result
1	Search for an existing component (e.g. created in TC01) and click Release Overview tab	The list of releases are displayed
2	Click edit icon in the Action column of release version that needs a new attachment. Eg: release Rel1.	Edit release Rel1 page is displayed.
3	Click Attachments tab Click Add Attachment button Click Browse and select several attachments. Eg: 5 attachment files (att1, att2, att3, att4, att5)	File names are displayed in the dialog
4	Click Delete button near some files not to be added. Eg: delete 2 attachment files (att1, att3)	File names are removed from the list
5	Click Upload button for the remaining files.	The attached file are listed in the Attachment page: att2, att4, att5
6	Change some Attachment type to real type, e.g. source file, clearing report, CLI,…	Type changed successfully
7	Click Update Release button	Release Ree1 is updated correctly.
8	Click Edit Release button	Success:You are editing the original document. message is displayed
9	Click Attachments tab	Attachments page is displayed
10	Click delete icon to delete an attachment	Show message: Do you really want to delete attachment {attachmentName}({attachmentId})?
11	Click Delete Attachment button	Attachment is deleted successfully, data of attachment is removed from attachment table.
12	Click Update Release button	Release Ree1 is updated correctly with message Success: Release {componentName}({version}) updated successfully!

TC08: Duplicate an existing release

Step	Action	Result
1	Search for an existing component with release with all fields filled in (Eg: created in TC05) and click Release Overview	The list of releases are displayed
2	Click Duplicate button under Action column	The page changes to create duplicate release screen
3	Check all fields from copied release	- Summary tab: + CPE ID field: blank + Remain fields are unchanged (exclude disable fields). - Linked Releases tab: there is no linked release.
4	Change the Version field and fill in a CPE ID. Eg: Version: ver_duplicate CPE ID: CPE ID_duplicate Click Create Release button	- Redirect to edit release screen. - Create duplicate release is success with message: Success:You are editing the original document. - Data of duplicate release is correct.
5	Modify some other fields. Eg: Release Date: 2023-06-12. Click Clearing Details tab	Clearing Details page is displayed and does not contain any field from copied release
6	Click Update Release button	The release is updated successfully with data correctly
7	Click component name link on top of the page	Summary page for the component is displayed
8	Click Release Overview tab	The new copied release is listed among previous releases

TC09: Search for and create a new vendor for a new release

Step	Action	Result
1	Click Components portlet At advanced Search, search for an existing component. Eg: input Comp1 in the Component Name text box. Click Search button.	Component Comp1 display in the result table.
2	Click edit icon in Actions column of component Comp1.	Edit screen of component Comp1 is displayed with message: Success:You are editing the original document
3	Click Releases tab Click Add Releases button	The page changes to New Release Edit page
4	Fill in a release Version and CPE ID Eg: + Version: @1.0.2 + CPE ID: moshiano_002	Values are entered in the fields
5	Click Vendor field	Search Vendor dialog is displayed
6	Click Add Vendor	Create New Vendor dialog is displayed
7	Fill in Full name, Short name and URL Eg: Full Name: Fullvendor_0909 Short Name: Short_ven090 URL: https://github.com/	Values are entered in the fields
8	Click Add Vendor	Dialog closes and the new vendor is displayed in release Vendor field with full name Fullvendor_0909
9	Click Create Release	Redirect to edit release page with the message Success:You are editing the original document. is displayed
10	Click component name link on top of the page	Summary page for the component is displayed. The new vendor for the new release, as well as existing vendors from previous releases are listed under Vendors field for the component

TC10: Link a release to the project in view component page and check used by projects

Step	Action	Result
1	Search for an existing component with release and click Release Overview tab	The list of releases are displayed
2	Click Link Project button under Action column	The dialog Link Release to Project is displayed with Link to Project button is disabled
3	Click Search button then choose a project to link	Link to Project button on the dialog is enabled
4	Click Link to Project button	The release {component name} ({version}) has been successfully linked to project {project name} Click here to edit the release relation as well as the project mainline state in the project. message is displayed
5	Click here hyperlink in the dialog	Redirect to the edit project page with the release was linked (displayed on License Clearing page)
6	Re-open the release at view page and click Summary tab	Used by project information is updated correspondingly

TC11: Link a release to a project in the view release page

Step	Action	Result
1	Search for an existing component with release and click Release Overview tab	The list of releases are displayed
2	Click a release name hyperlink. Eg: release R1	Redirect to the view release page
3	Click Link to Project button	The dialog Link Release to Project is displayed with Link to Project button is disabled
4	Click Search button then choose a project to link	Link to Project button on the dialog is enabled
5	Click Link to Project button	The release {component name} ({version}) has been successfully linked to project {project name} Click here to edit the release relation as well as the project mainline state in the project. message is displayed
6	Click here hyperlink in the dialog	Redirect to the edit project page with the release was linked (displayed on License Clearing page)

TC12: Import a new component by .spdx/.xml/ .rdf file

Step	Action	Result
1	Click Components tab	Components page is displayed
2	Click Import SBOM button	A dialog Upload SBOM is displayed
3	Choose a *.spdx* or *.xml* or *.rdf* file by clicking on the Browse button or drop/draft a file into the dialog	The message is displayed in the dialog: The new Component and new Release will be created, do you want to import? New Component: {new component names} New Release: {new release names}
4	Click Import button	The dialog is closed. New releases and new components are imported successfully

TC13: Export components without releases

Step	Action	Result
1	Click Components tab	Components page is displayed
2	Click Export Spreadsheet button and choose Components only option	- A new file with name’s format components-{yyyy}-{mm}-{dd}.xlsx is downloaded - The content of the downloaded file includes information of all components in the system

TC14: Export components with releases

Step	Action	Result
1	Click Components tab	Components page is displayed
2	Click Export Spreadsheet button and choose Components with releases option	- New file with name components-{yyyy}-{mm}-{dd}.xlsx is downloaded. - The content of the downloaded file includes information of all components and releases in the system

TC15: Create a clearing request for a release

Step	Action	Result
1	Search for an existing component with releases and click Release Overview tab	The list of releases are displayed
2	Click Edit button under Action column. Eg: edit release R1	Redirect to view release page and the message Success:You are editing the original document. is displayed
3	Click Attachments tab, then add a source file (Eg: .rdf file) with Type is Source file	The data is updated correspondingly
4	Click Update Release button	The message Success:Release {release name} updated successfully! is displayed
5	Click Clearing details tab, then click Fossology Process icon beside Clearing State field and wait for the process to finish	The message The FOSSology process already finished. You should find the resulting report as attachment at this release. is displayed in the Fossology Process dialog
6	Click Close button in the dialog	The dialog is closed
7	Reload this page, then click Attachments tab	A new file is listed in Attachments page with name’s format {component name}-{version}-{yyyymmdd}-{hhmm}-SPDX.rdf

Version 20.x with Containers

Mon, 01 Jan 0001 00:00:00 +0000

Introduction

For SW360 v20 container deployments, the canonical operational guide is maintained in:

SW360 Frontend Docker Guide (eclipse-sw360/sw360-frontend)

This page intentionally stays minimal and points to the source of truth for:

compose setup and startup flow
service wiring
secrets and runtime configuration files
Keycloak initialization and frontend integration

Prerequisites

Docker (Compose V2) or Podman
Basic container networking and volume knowledge
OpenTofu/Terraform only if you bootstrap Keycloak via automation

Container Topology (High-Level)

Typical SW360 v20 container deployments include:

CouchDB External Documents

Mon, 01 Jan 0001 00:00:00 +0000

Motivation

In some cases inline documents are not sufficient for storing extended information to a document. This is especially the case if these information might be relevant from outside as well. Projects, components and releases contain attachments. The metadata of these attachments are stored as inline documents inside its parent document (which is the project, component or release). However these attachments may be used by other documents as well, e.g. license info files which are attached to releases are used by projects to generate the overall license information for that project. In such cases an external document might be the better model. For example the attachment usage can be stored along the metadata without touching the owner document on update.

Database migration using Costco

Mon, 01 Jan 0001 00:00:00 +0000

Praeamble

Please note that database migrations are done now in python scripts at

https://github.com/eclipse/sw360/tree/master/scripts/migrations

keeping the following page because Costco might be useful for development / testing / quick adaptations.

Problem

The main problem with changing field names in thrift is that existing documents in the couchdb need adjustments. Unfortunately, the futon interface of the couchdb does not offer bulk edits. As a consequence, looking into every document is tedious, for more than 100 documents, maybe unfeasible.

Definition of Done

Mon, 01 Jan 0001 00:00:00 +0000

Policy

Review points should involve one person from another angle (not just the person you were sitting together with anyways)
No self merging of pull requests
Limit items in review to 5, try to coordinate
Using Github assignments to issues or pull requests
Open review items require conversation
Every change must be proposed in the form of a pull request (no commits to main without review)

Definition of Done

File headers in file OK

Filtering in Portlets

Mon, 01 Jan 0001 00:00:00 +0000

For the filters that are shown for components and listings, there are some options:

The Keyword search works directly on the table shown on the main right area. For example in the components portlet, this is in components/view.jsp.
The filters actually result in a new search request, when hitting apply filters button. The project portlet reads the fields and creates a map. Then, ProjectPortlet calls the thrift service refineSearch(), which is handled in ProjectHandler. This method takes the map and the user as input. The search service has a server-side JavaScript function (LuceneSearchView) defined for this particular filter in ProjectSearchHandler.java. This is called with the LuceneAwareDatabaseConnector.java. After filtering, the visibility constraints for the requesting user are applied.

Fossology Integration

Mon, 01 Jan 0001 00:00:00 +0000

Basic communication with the FOSSology server is done over an SSH connection: the fossology service of SW360 executes remote commands on the FOSSology server.

The commands that are executed are the bash scripts found inside src-fossology/src/main/resources/scripts/, they are copied into the home directory of the ssh user (either manually or through the admin portlet). See Setup of connection with Fossology for configuration details.

\- src-fossology/src/main/resources/
 \- scripts/
 |- duplicateUpload
 |- folderManager
 |- getStatusOfUpload
 |- uploadFromSW360
 \- utilsSW360

These scripts utilize the standard command line tools to interact natively with FOSSology (these are the tools found in the src/cli folder of FOSSology, such as cp2foss fossjobs fossupload_status fo_usergroup fo_chmod fo_folder ...).

Home Page

Mon, 01 Jan 0001 00:00:00 +0000

SW360 Project Home Page Test Cases

General Table Requirements

Reload Button

Test Case ID: HOME-001
Description: Verify that each of the 4 sub-tables has a reload button on the top right.
Steps:
1. Navigate to the SW360 project home page.
2. Locate each of the 4 sub-tables.
3. Check for the presence of a reload button on the top right of each table.
Expected Result: Each table has a reload button.

Pagination Buttons

Test Case ID: HOME-002
Description: Verify that each table has pagination buttons on the bottom.
Steps:
1. Navigate to the SW360 project home page.
2. Locate each of the 4 sub-tables.
3. Check for the presence of pagination buttons on the bottom of each table.
Expected Result: Each table has pagination buttons.

Empty Message

Test Case ID: HOME-003
Description: Verify that if a table does not have data, it displays an empty message according to the table title.
Steps:
1. Navigate to the SW360 project home page.
2. Check each table for the presence of data.
3. If a table is empty, verify that the appropriate empty message is displayed.
Expected Result: The appropriate empty message is displayed when the table is empty.

“My Projects” Table

Test Case ID: HOME-004
Description: Verify that the “My Projects” table has a dropdown filter with the specified values.
Steps:
1. Navigate to the SW360 project home page.
2. Locate the “My Projects” table.
3. Check for the presence of a dropdown filter with the following values:
  - Role in Project:
    - Creator
    - Moderator
    - Contributor
    - Project Owner
    - Lead Architect
    - Project Responsible
    - Security Responsible
  - Clearing State:
    - Open
    - Closed
    - In Progress
Expected Result: The dropdown filter contains the specified values.

Project Details

Test Case ID: HOME-005
Description: Verify that each project in the “My Projects” table is clickable to open the project and displays the description and release counts.
Steps:
1. Navigate to the SW360 project home page.
2. Locate the “My Projects” table.
3. Click on a project to open it.
4. Verify that the project name, version, description and release counts are displayed.
Expected Result: Clicking on a project opens the project details page, and the description and release counts are displayed correctly.

“My Components” Table

Component Details

Test Case ID: HOME-006
Description: Verify that the “My Components” table displays the component name, which is clickable to open the component, and the description.
Steps:
1. Navigate to the SW360 project home page.
2. Locate the “My Components” table.
3. Click on a component name to open it.
4. Verify that the component description is displayed.
Expected Result: Clicking on a component name opens the component details page, and the description is displayed correctly.

“My Task Assignments” Table

Moderation Requests

Test Case ID: HOME-007
Description: Verify that the “My Task Assignments” table displays the Moderation Requests (assigned to me) document name, which is clickable to open the MR, and the status.
Steps:
1. Navigate to the SW360 project home page.
2. Locate the “My Task Assignments” table.
3. Click on a document name to open the MR.
4. Verify that the status is displayed.
Expected Result: Clicking on a document name opens the moderation request, and the status is displayed correctly.

“My Task Submissions” Table

Moderation Requests

Test Case ID: HOME-008
Description: Verify that the “My Task Submissions” table displays the Moderation Requests (open by me) document name, which is clickable to open the MR, the status, and a delete icon to delete the MR.
Steps:
1. Navigate to the SW360 project home page.
2. Locate the “My Task Submissions” table.
3. Click on a document name to open the MR.
4. Verify that the status is displayed.
5. Click on the delete icon to delete the MR.
Expected Result: Clicking on a document name opens the moderation request, the status is displayed correctly, and the delete icon allows the user to delete the MR.

Right Side of the Page

“My Subscriptions” List

Test Case ID: HOME-009
Description: Verify that the “My Subscriptions” list contains all of the user’s subscriptions divided by different types and each item is clickable to open.
Steps:
1. Navigate to the SW360 project home page.
2. Locate the “My Subscriptions” list on the right side of the page.
3. Click on an item in the list to open it.
Expected Result: Each item in the list is clickable to open the corresponding subscription.

“Recent Components” List

Test Case ID: HOME-010
Description: Verify that the “Recent Components” list shows recent components and each component is clickable to open.
Steps:
1. Navigate to the SW360 project home page.
2. Locate the “Recent Components” list on the right side of the page.
3. Click on a component in the list to open it.
Expected Result: Each component in the list is clickable to open the component details.

“Recent Releases” List

Test Case ID: HOME-011
Description: Verify that the “Recent Releases” list shows recent releases and their version, and each release is clickable to open.
Steps:
1. Navigate to the SW360 project home page.
2. Locate the “Recent Releases” list on the right side of the page.
3. Click on a release in the list to open it.
Expected Result: Each release in the list is clickable to open the release details.

Legacy API Access

Mon, 01 Jan 0001 00:00:00 +0000

This page keeps older authentication and token workflows for reference only. For current guidance, use API Access.

Legacy: Browser-Based Client Management

Historically, OAuth clients were managed by opening:

https://<my_sw360_server>/authorization/client-management

and issuing POST/DELETE requests from browser developer tools.

Legacy: Token Header Conventions

Earlier guides used these token formats:

Authorization: Token <Token-Value>
Authorization: Bearer <JWT-Value>

Both remain useful as historical context, but current mechanism guidance is maintained in API Access.

Legacy: Password Grant Examples

Older environments frequently used direct password grant requests:

Licenses

Mon, 01 Jan 0001 00:00:00 +0000

TC01: Create a license with mandatory fields then edit External link

Step	Action	Result
1	Sign In with a known user	User successfully signed in and Home page is displayed
2	Click Licenses tab	Licenses page is displayed
3	Click Add License button	New License page is displayed
4	Fill in Fullname and Shortname fields Eg: - Fullname: Open Logistics Foundation License v1.3 - Shortname: OLFL-1.3	Values are entered in the fields
5	Click Create License button	- Navigate to the license list page and the message “Success:License added successfully!” is displayed - The new license should be added to the licenses list
6	At Details tab, update External link for more information field Eg: https://eclipse.dev/sw360/docs/development/testcases/test-cases-licenses/ Click Save button	- The page remains the same and the message “Success:SUCCESS” is displayed - Data of the “External link for more information” field is updated correctly

TC02: Create a license with all fields

Step	Action	Result
1	Sign in with a known clearing admin user Click Licenses tab Click Add License button	New License page is displayed
2	Fill in all editable fields Eg: - Fullname: JAM License - Shortname: Jam - License Type: select a license type - OSI Approved?: Yes - Note: take a note! - License Text: Copyright (C) YEAR by AUTHOR EMAIL Permission to use, copy and modify.	Values are entered in the fields
3	Click Linked Obligation tab	Linked Obligation page is displayed
4	Click Add Obligation button	Screen display a dialog: “Select License Obligations to be added.”
5	Select some obligations and click Add button	The selected obligations have been added to the obligation table
6	Click Create License button	- Navigate to the license portlet and the message “Success:License added successfully!" is displayed - The new license should be added to the licenses list
7	Click the newly created license name hyperlink	The details page of license is displayed
8	Check data of License in Details tab Click Text tab and check data of License in Text tab Click Obligations tab and check data of License in Obligations tab	The displayed data matches the input data

TC03: Create a license with linked obligations then edit whitelist

Step	Action	Result
1	Sign in with a known clearing admin user Click Licenses tab Click Add License button	New License page is displayed
2	Fill in Fullname and Shortname Eg: - Fullname: Apache License 2.0 - Shortname: Apache-2.0	Values are entered in the fields
3	Click Linked Obligation tab	Linked Obligation page is displayed
4	Click Add Obligation button	Screen display a dialog: “Select License Obligations to be added”
5	Select some obligations and click Add button	The selected obligations have been added to the obligation table
6	Click Create License button	- Navigate to the license list screen - The new license should be added to the licenses list
7	Search for new created license, then click hyper link of new created license	The details page of license is displayed
8	Click Obligations tab	Obligation page is displayed
9	Click Edit Whitelist button	Update whitelist page is displayed
10	Unselect the first obligation then click Update Whitelist button	- Redirect to view license page with the message “Success:License updated successfully!” is displayed - The unselected obligation is not displayed anymore on obligations table

TC04: Edit License and remove/ add Obligations

Step	Action	Result
1	Sign In with a known user	User successfully signed in and Home page is displayed
2	Click Licenses tab At Quick Filter area, input existed license with obligations. E.g: JAM License in the textbox Click JAM License license name Click Edit License button	The update license page is displayed
3	Edit some editable fields Eg: - Fullname: JAM License 2.0 - OSI Approved?: (n/a) - FSF Free/Libre?: Yes - License Text:	Values are entered in the fields
4	Click Linked Obligation tab Click Delete icon of the first obligation in Action column	The “Delete Obligation?” dialog is displayed with message: “Do you really want to delete the obligation {deleted obligation name}?”
5	Click “Delete Obligation” button in the dialog	The chosen obligation is removed from the obligations table
6	Click Add Obligation button	Screen display a dialog: “Select License Obligations to be added.”
7	Select some obligations and click Add button	The selected obligations have been added to the obligation table
8	Click Update License button	- Navigate to the license details page - Data of the obligation is updated successfully
9	Click the edited license name (JAM License 2.0)	The details page of license is displayed
10	Check data of License in Details tab, Text tab and Obligation tab	The displayed data matches the input data

TC05: Delete an existing license

Step	Action	Result
1	Sign in with a known clearing admin user Click Licenses tab At Quick Filter area, input existing license in the textbox Eg: “License_delete” Click “License_delete” license name in the result table Click Edit License button	The update license page is displayed
2	Click Delete License button	Screen display dialog with message: “Do you really want to delete the license {licenseFullName ({licenseShortName})}?”
3	Click Delete License button in the dialog	- Navigate to the license portlet and the message “Success:License removed successfully!" is displayed - The removed license has been removed to the license table

TC06: Check Export Licenses

Step	Action	Result
1	Sign In with a known user	User successfully signed in and Home page is displayed
2	Click Licenses tab	Licenses page is displayed
3	Click Export Spreadsheet button	A dialog for opening Licenses.xlsx is displayed
4	Open the newly downloaded Licenses.xlsx file in the local Compare the number of rows with total number of entries from Licenses tab	All licenses names are exported successfully

Liferay Friendly

Mon, 01 Jan 0001 00:00:00 +0000

The normal generated portlet URLs containing a set of internal Liferay request parameters.
These long URLs of links or forms are mostly not readable and its not easy to share it somewhere else.

General Liferay portlet URL:

http://localhost:8080/web/guest/examples?p_p_id=example_WAR_ExamplePortlet&p_p_lifecycle=1&p_p_state=normal&p_p_mode=view&p_p_col_id=column-1&p_p_col_count=1&_example_WAR_ExamplePortlet_javax.portlet.action=new

Explanation of the Liferay request parameters:
p_p_id: The portlet ID (example_WAR_ExamplePortlet)
p_p_state: Liferay windows pages state - 1 (normal) 2 (maximize) 3 (minimize)
p_p_mode: Mode of the portlet look like - (view) (edit) (help)
p_p_lifecycle: This is life cycle of portlet - 0 (render) 1 (action) 2 (server)
p_p_col_id: The reference ID of the column in Liferay template
p_p_col_pos: Specifiy the column position if the the layout having more than one columns
p_p_col_count: Shows the no of columns in the current layout

Manual Keycloak Configuration (Legacy)

Mon, 01 Jan 0001 00:00:00 +0000

Important

This document is provided for historical purposes and to help developers understand the logic behind the automated Terraform/OpenTofu scripts. For all modern installations of SW360 v20+, please refer to the Keycloak Authentication guide.

Legacy / Manual Configuration (Keycloak Admin Console)

(Not Recommended for production environments. Use the Terraform instructions if possible.)

These guides are here for understanding the Keycloak configuration. But the most up-to-date and recommended way to configure Keycloak is using Terraform/OpenTofu.

Moderation

Mon, 01 Jan 0001 00:00:00 +0000

TC01: Accept moderation request, for visible projects by other users

Step	Action	Result
1	Open a first browser instance (Eg: “firefox.exe -p “profile1” -no-remote”) and sign in with a known First user	User successfully signed in and Home page is displayed
2	Open a second browser instance (Eg: “firefox.exe -p “profile2” -no-remote”) and sign in with a known Second user	User successfully signed in and Home page is displayed
3	Activate First browser instance	Instance is active
4	Create a new project visible for Second user Eg: - Name: Project is created by First user - Project visibility: Everyone	Project is created successfully
5	Activate Second browser instance	Instance is active
6	Search for the above created project and click Edit button	“Success: You will create a moderation request if you update” message is displayed
7	Edit Description field or other fields Eg: Description: “Update description to create a moderation request!!” Click Update Project button	Create moderation request dialog is displayed
8	Fill in Please comment your changes field Eg: I want to update this project. Please accept for me. Thanks @@. Click Send moderation request button	Show message: “Success: Moderation request was sent to update the Project {nameProject} {(version)}!”
9	Activate First browser instance	Instance is active
10	Check status of project in the MY TASK ASSIGNMENTS table on Home page	The above project that needs moderation is displayed with status Pending
11	Click Requests page	The moderation request of Second user is displayed with state Pending
12	Click the project name in the Document Name column	- “Success: You have assigned yourself to this moderation request.” message is displayed - Moderation Request Information page is displayed, with proposed changes from step 7 listed
13	Input a comment in the Comment on Moderation Decision box. Eg: The request is approved Click Accept Request button	Request page display and show message: “Success: You have accepted the moderation request”
14	Click Closed Moderation Requests tab Check state of Project is created by First user project	State changed to Approved
15	Check status of project in the MY TASK ASSIGNMENTS table on Home page	The request is removed from the table
16	Activate Second browser instance	Instance is active
17	Check status of project in the MY TASK SUBMISSIONS table on Home page	Status is Approved
18	Open the Projects page and click on previously modified project on step 7	Project Summary page displayed successfully
19	Check the moderation requested changes	Changes are visible in the corresponding fields: Description field was changed to “Update description to create a moderation request!!”

TC02: Decline moderation request, for visible projects by other users

Step	Action	Result
1-11	Same as in TC01
12	Input a comment in the Comment on Moderation Decision box. Eg: The request is declined Click Decline Request button	Requests page display and show message: “Success: You have rejected the moderation request”
13	Click Closed Moderation Requests tab Check state of the above rejected project	State changed to Rejected
14	Check status of project in the MY TASK ASSIGNMENTS table on Home page	The request is removed from the table
15	Activate Second browser instance	Instance is active
16	Check status of project in the MY TASK SUBMISSIONS table on Home page	Status is Rejected
17	Open the Projects page and click on previously modified project on step 7	Project Summary page displayed successfully
18	Check the moderation requested changes	Changes are not visible in the corresponding fields: data of the project is not changed.

TC03: Remove Me from Moderators for moderation request, for visible projects by other users

Step	Action	Result
1-11	Same as in TC01
12	Click Remove Me from Moderators button	- “Warning: You are the last moderator for this request, you are not allowed to unsubscribe !” message is displayed (assuming only First user was listed under Moderators column in step 10) - Can’t remove from Moderators. Nothing to change
13	Input a comment in the Comment on Moderation Decision box. Eg: Decline the request. Click Decline Request button	Requests page display and show message: “Success: You have rejected the moderation request”
14	Edit the project and add a new moderator (Eg: Third user) under Moderators field	Project updated successfully
15	Activate Second browser instance	Instance is active
16	Edit the project and create a new moderation request	Moderation request was sent
17	Activate First browser instance	Instance is active
18	Click Moderation page	The moderation request of Second user is displayed with state Pending
19	Click the project name which the moderation was created in step 16	- “Success: You have assigned yourself to this moderation request.” is displayed - Moderation Request Information page is displayed, with proposed changes from step 16 listed
20	Click Remove Me from Moderators button	“Success: You have unassigned yourself from the moderation request” message is displayed. Also the document is deleted from moderation list.
21	Login with the Third user and check the Moderation request in Request page	The moderation request of Second user is displayed with state Pending

Moderation Requests

Mon, 01 Jan 0001 00:00:00 +0000

The concept of moderation is good for two things:

to cope with a large number of potential edits on documents.
to allow every user to propose edits.

Allowing every user to edit opposed to propose edits would lad to a large number of changes, potentially, not making everyone happy. As such, the changes should be reviewed by an experienced person and can be then approved.

Application Flow

A user changes a moderated document, which are component, release, project and todo’s of licenses (and the white list):

Packages

Mon, 01 Jan 0001 00:00:00 +0000

TC01: Create a package with required fields

Step	Action	Result
1	Sign In with a known user	User successfully signed in and Home page is displayed
2	Click Packages tab Click Add Package button	The Create Package page is displayed
3	Input valid data into required fields Eg: - Name: package1 - Version: 1.0.0 - Package Type: Framework - PURL (Package URL): pkg:npm/angular-sanitize@1.8.2	Values are entered in the fields
4	Click Create Package button	- The message: “Success: Package created successfully” is displayed at the left corner - Redirect to the Package list page - The new package is added to the package list
5	Search for the new project then click the hyperlink of the newly created package name	Redirect to view page of the created package
6	Check data of all fields	Data in all fields match with input values

TC02: Create a package with all fields

Step	Action	Result
1	Sign In with a known user Click Packages tab Click Add Package button	The Create Package page is displayed
2	Input valid data into all editable fields	Values are entered in the fields
3	Click Create Package button	- The message: “Success: Package created successfully” is displayed at the left corner - Redirect to the Package list page - The new package is added to the package list
4	Search for the new package then click the hyperlink of the newly created package name	Redirect to view page of the created package
5	Check data of all fields	Data in all fields match with input values

TC03: Update some fields for package

Step	Action	Result
1	Sign In with a known user Click Component tab Create a component with name is ComponentA Create a release with name is ComponentA (1.0.1)	Release ComponentA (1.0.1) is created successfully
2	Click Packages tab Create a new package with name and version are Package1 (1.0.1)	Package Package1 (1.0.1) is created successfully
3	At advanced Search, search for newly created package Eg: Package1 (1.0.1) Click Edit Package icon at Actions column	Update Package page is displayed
4	Update data of some fields Eg: - Version: 1.0.2 - Homepage URL: pkg:npm/@microsoft/applicationinsights-web@2.5.11 - Release: ComponentA (1.0.1)	Data is filled in fields match with input values
5	Click Update Package button	- The message: “Success: Package updated successfully” is displayed at the left corner - Redirect to the package list page
6	Search for the updated project then click the hyperlink of the package name	Redirect to view page of the updated package
7	Check data of all fields	Data in all fields match with data at update page

TC04: Link package to project with release of the package has not linked to the project yet

Step	Action	Result
1	Create Component with name is ComponentA Create a release with name is ComponentA (1.0.1)	Release is created successfully
2	Click Packages tab Click Add Package button Create a new package with: - Name: PackageA - Version: (1.0.1) - Release: ComponentA (1.0.1)	Package is created successfully
3	Click Project tab Create project with name is ProjectA	Project is created successfully
4	In Edit ProjectA project page then click Linked Packages tab Click Add Packages button	Dialog Link Packages is displayed
5	Input PackageA in textbox then click Search button Choose PackageA package then click Link Packages button	Information of the PackageA package is displayed correctly in the table
6	Click Update Project button	- Redirect to the ProjectA project view screen - Information of Linked Package tab is correct with input data
7	Click License Clearing tab, check information of the table	Display data of ComponentA (1.0.1) release with correctly information

TC05: Unlink package from the project

Step	Action	Result
1	Sign In with a known user Click Packages tab Create a new package with name and version are PackageA (1.0.1)	Package is created successfully
2	Click Project tab Create a project with name is ProjectA and then add PackageA newly created as linked package of ProjectA project	Project is created successfully
3	In edit project page, click Linked Packages tab Click Delete icon of PackageA (1.0.1) package Click Delete Link button	Data of PackageA (1.0.1) package is removed from package table
4	Click Update Project button	- Redirect to view ProjectA page - Project ProjectA is updated successfully - Data in the Linked Packages tab: PackageA (1.0.1) package information is removed

TC06: Delete a package that is first linked to a project and then not

Step	Action	Result
1	Sign In with a known user Click Packages tab Create a new package with name and version are PackageA (1.0.1)	Package is created successfully
2	Click Projects tab Create a project with name is ProjectA and then add PackageA newly created as linked package of ProjectA project	Project is created successfully
3	Click Packages tab At advanced Search, search for newly created package Eg: PackageA(1.0.1) Click Delete Package icon in Actions column of this package	Dialog “Delete Package?” display with message: “Do you really want to delete the package {packageName} ({package version})?”
4	Click Delete Package button	Error message is displayed: “Package cannot be deleted!”
5	Unlink PackageA package from ProjectA project Re-delete PackageA(1.0.1) package follow steps from 3-4	- Delete PackageA package successfully with message “Deleted successfully!” in the dialog - Package PackageA(1.0.1) is not display in the package list table

Projects

Mon, 01 Jan 0001 00:00:00 +0000

TC01: Add a simple project with no relations and no releases

Step	Action	Result
1	Sign In with a known user	User successfully signed in and Home page is displayed
2	Click Projects tab	Projects page is displayed
3	Click Add Project button	New Project page is displayed with mandatory fields marked with red star: - Summary tab: Name, Visibility, Project Type, Group - Administration tab: Project State
4	Fill mandatory Name with a project name, change other fields if needed Eg: - Name: PROJECT_REQUIRED_FIELDS	Values are entered in the fields
5	Click Create Project button	- Navigate to the new project’s viewing screen with the message “Success: Your project is created” is displayed - New project Summary page is displayed
6	Click Projects tab	- The new project “PROJECT_REQUIRED_FIELDS” should be added to the projects list - Data of the project correctly, matches with input data

TC02: Add a full project with relations, releases and send to clearing process

Step	Action	Result
1	Sign In with a known user Click Projects tab Click Add Project button Input Name as “A_FULL_PROJECTS” Fill in all editable fields in Summary and Administration links	Values are entered in the fields
2	Click Linked Releases And Projects link	Linked Releases And Projects page is displayed
3	Click Add Projects button	Search Project dialog is displayed
4	Click Search button then select a project to be linked (Eg: created in TC01 “PROJECT_REQUIRED_FIELDS”) Click Link Projects button	Dialog is closed and selected project is displayed under Linked Projects section
5	Click Add Releases button	Search Release dialog is displayed
6	Click Search button Select releases to be linked Click Link Releases button	Dialog is closed and selected release is displayed under Linked Releases section
7	Click Linked Packages link	Linked Packages page is displayed
8	Click Add Packages button	Search Package dialog is displayed
9	Click Search button in the dialog Select an orphan package to be added then click Link Packages button	Dialog is closed and selected release is displayed under Linked Packages section
10	Click Create Project button	- Navigate to the new project’s viewing screen with the message “Success: Your project is created” is displayed - New project Summary page is displayed
11	Click Projects tab At Advanced Search area, input “A_FULL_PROJECTS” in the “Project Name” textbox Click Search button	The new project should be added to the projects list with data correctly, matches with input data
12	In new project, check Clearing Status by hovering mouse over the numbers	The message should be {number} Releases out of {total number} have approved clearing reports (including sub-projects).
13	Click Create Clearing Request icon under Actions column	The dialog Create Clearing Request is displayed
14	Choose clearing team email id, Clearing Type and Preferred Clearing Date	The data in the fields is displayed as the selected data
15	Click Create Request button	The message: Clearing Request {clearing request id} created successfully! Clearing team will confirm on the agreed clearing date. is displayed in the dialog
16	Click Close button in the dialog	The dialog is closed
17	Re-click the Create Clearing Request icon under Actions column	The View Clearing Request dialog is displayed with: - Requesting User: {requested user} - Created on: {created request date} - Preferred Clearing Date: {displayed as input data} - Clearing Team: {email of chosen clearing team} - Priority: LOW - Request Status: NEW
18	Click Close button in the dialog	The dialog is closed

TC03: Add a project with releases, no relations, remove a release

Step	Action	Result
1	Sign In with a known user Click Projects tab Click Add Project button Fill mandatory Name with a project name, change other fields if needed Click Linked Releases And Projects link Click Add Projects button	Search Project dialog is displayed
2	Click Search and select the project to be linked (Eg: created in TC01 “PROJECT_REQUIRED_FIELDS”) Click Link Projects button	Dialog is closed and selected project is displayed under Linked Projects section
3	Click Delete icon to delete the linked project	Message is displayed: “Do you really want to remove the link to project {linked project name}?”
4	Click Delete Link button	The project is removed from the list of Linked Projects
5	Click Add Releases button	Search Release dialog is displayed
6	Click Search by name and select a release to be added then click Link Releases button	Dialog is closed and selected release is displayed under Linked Releases section
7	Click Delete icon to delete the linked release	Message is displayed: “Do you really want to remove the link to release {linked release name}?”
8	Click Delete Link button	The release is removed from the list of Linked Releases
9	Click Linked Packages link Click Add Packages button	Search Release dialog is displayed
10	Click Search button in the dialog Select an orphan package to be added then click Link Packages button	Dialog is closed and selected release is displayed under Linked Packages section
11	Click Delete icon to delete the linked package	Message is displayed: “Do you really want to remove the link to package {linked package name}?”
12	Click Delete Link button	The release is removed from the list of Linked Packages
13	Click Create Project button	Navigate to the new project’s viewing screen with the message “Success: Your project is created” is displayed
14	Click Projects tab	The new project should be added to the projects list
15	In newly created project, check Clearing Status by hovering mouse over the numbers of the project	The message should be 0 Releases out of 0 have approved clearing reports (including sub-projects)

TC04: Delete a project that is first linked to another project and then not linked

Step	Action	Result
1	Create a new project with name is Child Project	Child Project project is created successfully
2	Create another project with name is Parent Project and add previously created Child Project as linked project of Parent Project	Parent Project project is created successfully with linked project is Child Project project
3	Click Projects tab At Advanced Search area, input Child Project in the Project Name textbox Click Search button	Child Project project display in the result table
4	Click Delete icon to delete Child Project project	Screen display dialog with message: “Do you really want to delete the project Child Project?”
5	Click Delete Project button	Display message in the dialog: “The project cannot be deleted, since it is used by another project!”
6	Click Cancel button	Dialog is closed and Child Project project wasn’t deleted in the table
7	Go to Parent Project project in the project table and delete it Click Delete button	Parent Project project is deleted successfully
8	Go to Child Project project in the project table and re-delete it	Child Project project is deleted successfully

TC05: Modify an existing project with relations, releases and send to clearing process

Step	Action	Result
1	Create a new project. Eg: PROJECT_REQUIRED_FIELDS	The project is created successfully
2	Click Project tab At Advanced Search area, search for a simple project Eg: project created in TC01: input “PROJECT_REQUIRED_FIELDS” in the “Project Name” textbox Click Search button Click Edit icon of “PROJECT_REQUIRED_FIELDS” project	Summary page is displayed Screen display message: “Success: You are editing the original document.”
3	Update project name to PROJECT_REQUIRED_FIELDS_updated	Values are entered in the field
4	Click Linked Releases And Projects link	Linked Releases And Projects page is displayed
5	Click Add Projects button	Search Project dialog is displayed
6	Click Search and select the project to be linked (Eg: created in TC02 “A_FULL_PROJECTS”) Click Link Projects button	Dialog is closed and selected project is displayed under Linked Projects section
7	Click Add Releases button	Search Release dialog is displayed
8	Click Search button Select an release to be added then click “Link Releases” button	Dialog is closed and selected release is displayed under Linked Releases section
9	Click Linked Packages link	Linked Packages page is displayed
10	Click Add Packages button	Search Release dialog is displayed
11	Click Search button in the dialog Select an orphan package to be added then Click Link Packages button	Dialog is closed and selected release is displayed under Linked Packages section
12	Click Update Project button	- Navigate to the project’s viewing screen with the message “Success: Project {project name} updated successfully!” is displayed - The project is updated according to the input data
13	Click Projects tab At Advanced Search area, input “PROJECT_REQUIRED_FIELDS_updated” in the Project Name textbox Click Search button	The project name PROJECT_REQUIRED_FIELDS_updated is displayed in the project list table
14	Click Create Clearing Request icon under Actions column	The dialog Create Clearing Request is displayed
15	Choose clearing team emaild id, Clearing Type and Preferred Clearing Date	The data in the fields is displayed as the selected data
16	Click Create Request button	The message: Clearing Request {clearing request id} created successfully! Clearing team will confirm on the agreed clearing date. is displayed in the dialog
17	Click Close button in the dialog	The dialog is closed
18	Re-click the Create Clearing Request icon under Actions column	The View Clearing Request dialog is displayed with: - Requesting User: {requested user} - Created on: {created request date} - Preferred Clearing Date: {displayed as input data} - Clearing Team: {email of chosen clearing team} - Priority: LOW - Request Status: NEW
19	Click Close button in the dialog	The dialog is closed

TC06: Add and modify a project with all project fields filled in

Step	Action	Result
1	Click Projects tab Click Add Project button Input Name as A_FULL_BASIC_PROJECT Fill in all editable fields in Summary and Administration links	Projects page is displayed
2	Click Create Project button	Navigate to the new project’s viewing screen with the message “Success: Your project is created” is displayed
3	Click Edit Project button	Summary page is displayed with message: “Success: You are editing the original document.”
5	Modify some fields Eg: - Name: A_FULL_BASIC_PROJECT_changed - Clearing state (in Administration tab): In Progress Click Update Project button	- Screen is display view page and the message “Success: Project A_FULL_BASIC_PROJECT_changed updated successfully!.” is displayed - Values are updated successfully

TC07: Duplicate an existing project

Step	Action	Result
1	Search for an existing project with all fields filled in (Eg: created in TC02 A_FULL_PROJECTS project) and click Duplicate button under Actions column	Project Information page is displayed
2	Check all fields from copied project	- In the Administration tab, the default for the Clearing State field is Open - Other fields are duplicated, including Linked Projects, Linked Releases and Linked Packages
3	Change version. Eg: 1.0.5-duplicate Click Create Project button	Navigate to the new project’s viewing screen with the message “Success: Your project is created” is displayed
4	Check all fields	All fields were copied successfully, except the new name and Project Clearing State of the project

Release and Versioning

Mon, 01 Jan 0001 00:00:00 +0000

We have the following main principles for versioning and releases. We consider semantic versioning:

Given a version number MAJOR.MINOR.PATCH, increment the:

MAJOR version when you make incompatible API changes,

MINOR version when you add functionality in a backwards-compatible manner, and

PATCH version when you make backwards-compatible bug fixes or security fixes.

Additional labels for pre-release and build metadata are available as extensions to the MAJOR.MINOR.PATCH format.

with the following implementation in our project:

Roles and Authorization

Mon, 01 Jan 0001 00:00:00 +0000

Like any other system, SW360 allows for setting different levels of access for different users. Technically, the decision when user should be able to see or to do something happens (generally) on the backend server. This ensures consistency between the REST API and the portal application.

For setting roles of a user, the Liferay control panel is being used (Admin menu -> Control Panel -> Users and Organisations -> Users -> select one user and Edit -> Roles). Setting access at individual records happens in the edit view of that record.

Semantic Commits

Mon, 01 Jan 0001 00:00:00 +0000

The reason and benefit of semantic commit messages

automatic generating of the changelog
simple navigation through git history (e.g. ignoring style changes)

Semantic commit message structure

<type>(<scope>): <commit message>

Signed-off-by: Name <email address>

The following are supported

feat (new feature for the user, not a new feature for build script)
fix (bug fix for the user, not a fix to a build script)
docs (changes to the documentation)
style (formatting, missing semi colons, etc; no production code change)
refactor (refactoring production code, eg. renaming a variable)
test (adding missing tests, refactoring tests; no production code change)
chore (updating grunt tasks etc; no production code change)

Example values:

Testing Frameworks

Mon, 01 Jan 0001 00:00:00 +0000

The implementation of complicated rules is not always easy to read. A good way to document and explain the behaviour of rule engines are natural language tests. A frame work we use for that is jgiven. We write the tests using the [dataprovider] (https://github.com/TNG/junit-dataprovider) runner. This is basically a runner that allows to use parametrized tests.

The basic testing frame work is still JUnit4, assertions are made using hamcrest and we mock complicated input classes with mockito.

Troubleshooting

Mon, 01 Jan 0001 00:00:00 +0000

Development: problems building sw360portal with maven?

Before building the sw360portal with maven, ensure that the following components are installed in the development environment:

A git client
Apache Maven 3.0.X
Apache Thrift 0.9.3
Java 1.8.X
CouchDB, at least 1.5 (only if the tests will be executed locally)

Development: problems using Eclipse?

Please do not use Eclipse, because the integration of Apache Thrift is an open issue and we found no plugin for Eclipse to solve the shown compiler errors. Recommended is IntelliJ IDEA or NetBeans.

Upgrading from Version 18 to Version 20

Mon, 01 Jan 0001 00:00:00 +0000

Overview and Major Architectural Changes

Upgrading from SW360 Version 18 to Version 20 introduces several major architectural shifts. Please read the following notices carefully before beginning the upgrade process:

Warning

New Frontend Architecture: The legacy Liferay UI has been unequivocally removed. SW360 v20 is entirely powered by a modern React/Next.js frontend.

Search & Indexing Engine Changes: The search engine has been heavily redesigned to support full-text search. You must upgrade CouchDB to version >= 3.5 and install the new couchdb-nouveau package alongside it.

Using RequireJS fro Javascript Modules

Mon, 01 Jan 0001 00:00:00 +0000

Today most of the javascript code runs in the global namespace. This increases the risk of overwriting symbols in the global namespace due to different libraries and snippets.

Goal

We want to use RequireJS (http://requirejs.org/) to modularize our code and to have clear namespaces for each component. In addition some of the code may be reused more easily. Other advantages:

libraries like jquery or datatables can be imported by name but without a specified version
if necessary, specific versions can be imported for parts of the page
it is very easy to only load needed dependencies
good support of webjars due to webjars-locator. Webjars a are automatically accessible through RequireJS.

How to use - Example

There is a new jspf-file to be included in jsps to enable RequireJS support:

Vulnerabilities

Mon, 01 Jan 0001 00:00:00 +0000

A vulnerability is a security flaw, glitch, or weakness found in software code that could be exploited by an attacker (threat source). The Vulnerabilities page lists all the vulnerabilities that are available in SW360. The Vulnerabilities are typically synced from SVM tools but can also be manually managed. They are listed independently without any relation to their linked projects/components/releases initially.

To open the Vulnerabilities page, click on the Vulnerabilities tab from the main menu.

Backend Logging

Mon, 01 Jan 0001 00:00:00 +0000

Overview

SW360’s backend runs two kinds of applications on the same Tomcat instance:

Kind	Examples	Framework	Logging stack
Thrift servlet WARs	`vmcomponents.war`, `components.war`, `schedule.war`, `licenses.war`, …	Plain Java servlets (`web.xml`)	Log4j2, via `log4j-1.2-api` bridge
Spring Boot WARs	`resource.war` (REST API), `authorization.war` (OAuth)	Spring Boot (`@SpringBootApplication`)	Log4j2, via `spring-boot-starter-log4j2`

Both use Log4j2 under the hood, but they are configured differently.

Spring Boot applications (REST API & Authorization Server)

The REST resource-server (resource.war) and authorization-server (authorization.war) are full Spring Boot applications deployed as WARs. Spring Boot’s LoggingSystem manages Log4j2 and reads log levels from application.yml.

Committer Pathway & Community Governance

Mon, 01 Jan 0001 00:00:00 +0000

Overview

The Eclipse SW360 project is an open source community operating under the Eclipse Development Process (EDP). We follow an open, merit-based governance model where any active contributor from any organization can become a Committer or Project Lead.

We warmly welcome and invite contributors, maintainers, and adopters from diverse organizations (such as Siemens, Toshiba, CARIAD, Bosch, and wider open source community members) to participate and take active roles in project stewardship.

Architecture

Mon, 01 Jan 0001 00:00:00 +0000

SW360 Architecture Documentation

This document describes the high-level architecture of the SW360 project, its major components, and how they interact.

System Overview

SW360 is a web-based application designed to manage software components, licenses, and security vulnerabilities. It follows a multi-tier architecture consisting of a React-based frontend, a Spring Boot-based REST API (Authorization and Resource Servers), a Thrift-based backend service layer, and a CouchDB database. Integration with Keycloak is supported for enterprise-grade Identity and Access Management.

BR-PROJ-002: License Clearing Tab Status Badges & Color Representation

Mon, 01 Jan 0001 00:00:00 +0000

BR-PROJ-002: License Clearing Tab Status Badges & Color Representation

Standard Classification: Definitional Rule / UI Presentation Invariant
Target Entity: Project, Release, Project Details UI (License Clearing Tab)
Status: Approved
Enforcement Points: Frontend UI Views (ListView.tsx, TreeView.tsx)

1. Executive Summary & Formal Statements

1.1 Formal Statement (RuleSpeak® / EARS)

While an authenticated user is viewing an accessible Project in details mode under the License Clearing tab:
- The system shall render a hierarchical table displaying all linked releases (direct and transitive sub-project releases).
- The system shall display state indicator badges with abbreviations:
  - (PS) for Project Clearing State.
  - (CS) for Release Clearing State.
- When rendering the (PS) badge for a project row, the system shall apply the exact background color mapped to the project clearing state:
  - Closed $\rightarrow$ Green (#68C17C)
  - In-progress $\rightarrow$ Yellow (#FFD351)
  - Open $\rightarrow$ Red (#E6717C)
  - Not Applicable / Unknown $\rightarrow$ Grey (#DEE2E6)
- When rendering the (CS) badge for a release row, the system shall apply the exact background color mapped to the release clearing state:
  - NEW_CLEARING $\rightarrow$ Red (#E6717C)
  - UNDER_CLEARING $\rightarrow$ Yellow (#FFD350)
  - SENT_TO_CLEARING_TOOL or SCAN_AVAILABLE $\rightarrow$ Orange (#F7941E)
  - REPORT_AVAILABLE $\rightarrow$ Blue (#0D6EFD)
  - INTERNAL_USE_SCAN_AVAILABLE $\rightarrow$ Purple (#9370DB)
  - APPROVED $\rightarrow$ Green (#69C17D)
  - null, undefined, or unmapped $\rightarrow$ Grey (#DEE2E6)
- When a user hovers over any (PS) or (CS) badge, the system shall render a tooltip displaying the full, human-readable state name.

1.2 Purpose & Risk Mitigated

Compact color-coded badge representations allow project managers, architects, and clearing officers to assess compliance and clearing readiness across deeply nested dependency trees at a single glance. Standardizing the color mappings prevents misinterpretation of clearing risk across different pages and ensures accessibility via hover tooltips.

Configurations

Mon, 01 Jan 0001 00:00:00 +0000

In SW360 v20, system administrators can manage most application settings directly through the user interface. This eliminates the need for manual configuration file edits for many standard adjustments.

Admin > Configurations

The primary interface for application settings is found under Admin > Configurations.

Update Persistence: Changes made here are stored in the database and typically take effect immediately across the application.
Toggles & Parameters: Most features can be activated or deactivated using simple toggles, some are available as text fields and some with comma separted pills for generating dropdowns.

All the configurations are arranged in 3 columns, Name, Value and Description. Name being a human friendly name of the property, Value holding the current value of the property and Description being a human friendly description for the property. They are divided accross two sections:

Projects Page

Mon, 01 Jan 0001 00:00:00 +0000

SW360 Main Projects Page Test Cases

Advance Search on the Left Hand

Search Fields

Test Case ID: PROJ-001
Description: Verify that the advance search on the left hand contains the specified search fields.
Steps:
1. Navigate to the Main Projects page.
2. Locate the advance search section on the left hand.
3. Verify the presence of the following search fields:
  - Project name
  - Project version
  - Project type (one of Customer Project, Internal Project, Product, Service, Inner Source, Cloud Backend)
  - Project Responsible (Email)
  - Group (dynamically generated by project group)
  - State (one of Active, Phaseout, Unknown)
  - Clearing State (one of Open, In Progress, Closed)
  - Tag
  - Additional Data
  - A checkbox “Exact Match” with a Search button
Expected Result: All specified search fields are present.

Search Behavior

Test Case ID: PROJ-002
Description: Verify the search behavior based on the “Exact Match” checkbox.
Steps:
1. Navigate to the Main Projects page.
2. Locate the advance search section on the left hand.
3. Enter search criteria in the search fields.
4. Perform a search without checking the “Exact Match” checkbox.
5. Verify that the endpoint has “luceneSearch=true” and uses full-text search.
6. Check the “Exact Match” checkbox and perform a search.
7. Verify that the endpoint has “luceneSearch=false” and uses exact match.
Expected Result: The search behavior changes based on the “Exact Match” checkbox.

Buttons in Middle

“Add Project” Button

Test Case ID: PROJ-003
Description: Verify that the “Add Project” button opens a form to create a new project.
Steps:
1. Navigate to the Main Projects page.
2. Click on the “Add Project” button.
Expected Result: A form to create a new project is opened.

Test Case ID: PROJ-004
Description: Verify that the “Import SBOM” dropdown opens a popup to import SBOM files in SPDX format and CycloneDX format.
Steps:
1. Navigate to the Main Projects page.
2. Click on the “Import SBOM” dropdown.
Expected Result: A popup to import SBOM files in SPDX format and CycloneDX format is opened.

Test Case ID: PROJ-005
Description: Verify that the “Export Spreadsheet” dropdown generates an Excel of the search result with either “Projects only” or “Projects with linked release”.
Steps:
1. Navigate to the Main Projects page.
2. Perform a search using the advance search fields.
3. Click on the “Export Spreadsheet” dropdown and select an option.
4. Verify that the exported sheet has restricted data based on the advance search values from the left panel.
5. Check if the file is downloaded or if a message is shown indicating that an email will be sent based on server configuration.
Expected Result: The Excel file is generated with the correct data, and the file is either downloaded or an email is sent based on server configuration.

Table in Middle

Page Size

Test Case ID: PROJ-006
Description: Verify that the table can change page size, with a default of 10.
Steps:
1. Navigate to the Main Projects page.
2. Locate the table in the middle.
3. Change the page size and verify the default is 10.
Expected Result: The table page size can be changed, and the default is 10.

“Print” Button

Test Case ID: PROJ-007
Description: Verify that the “Print” button on the right prints the Table HTML component to the browser.
Steps:
1. Navigate to the Main Projects page.
2. Locate the “Print” button on the right of the table.
3. Click on the “Print” button.
Expected Result: The Table HTML component is printed to the browser.

Column “Project name”

Test Case ID: PROJ-008
Description: Verify that the “Project name” column displays the project name and version (version in brackets), and is a clickable link to open the project.
Steps:
1. Navigate to the Main Projects page.
2. Locate the “Project name” column in the table.
3. Click on a project name to open the project.
Expected Result: The project name and version are displayed, and clicking on it opens the project.

Column “Description”

Test Case ID: PROJ-009
Description: Verify that the “Description” column displays a truncated description of the project, if any, otherwise it is empty.
Steps:
1. Navigate to the Main Projects page.
2. Locate the “Description” column in the table.
Expected Result: The truncated description of the project is displayed, or it is empty if no description is available.

Column “Project Responsible”

Test Case ID: PROJ-010
Description: Verify that the “Project Responsible” column displays a truncated list of project responsible users, if any, otherwise it is empty.
Steps:
1. Navigate to the Main Projects page.
2. Locate the “Project Responsible” column in the table.
Expected Result: The truncated list of project responsible users is displayed, or it is empty if no responsible users are available.

Column “State”

Test Case ID: PROJ-011
Description: Verify that the “State” column shows “PS|CS” buttons.
Steps:
1. Navigate to the Main Projects page.
2. Locate the “State” column in the table.
Expected Result: The “PS|CS” buttons are displayed.

Column “License Clearing”

Test Case ID: PROJ-012
Description: Verify that the “License Clearing” column shows Clearing Done/Total releases counts for the project.
Steps:
1. Navigate to the Main Projects page.
2. Locate the “License Clearing” column in the table.
Expected Result: The Clearing Done/Total releases counts are displayed.

Column “Actions”

Test Case ID: PROJ-013
Description: Verify that the “Actions” column shows the specified buttons.
Steps:
1. Navigate to the Main Projects page.
2. Locate the “Actions” column in the table.
3. Verify the presence of the following buttons:
  - “Edit”: to open the project edit page
  - “Clearing Request”: to open “Clearing Request” popup to either create a new Clearing Request or display the current Clearing Request
  - “Duplicate”: to duplicate the project into a new one, which opens the add project page with values populated
  - “Delete”: to open a popup showing Project Name, version, linked projects count, linked release count, and a comment box for the reason to delete, with a delete button
Expected Result: All specified buttons are present and function as described.

Pagination Components

Test Case ID: PROJ-014
Description: Verify that the table bottom has pagination components.
Steps:
1. Navigate to the Main Projects page.
2. Locate the table in the middle.
3. Scroll to the bottom of the table and verify the presence of pagination components.
Expected Result: Pagination components are present at the bottom of the table.

Search Vulnerabilities

Mon, 01 Jan 0001 00:00:00 +0000

The CVE-Search service of SW360 checks for vulnerabilities that affect releases present in SW360. The CVE-search service runs automatically at the time that has been scheduled by one of the SW360-admins. Typically, this will happen at night. So, in the beginning, SW360 does not know any vulnerabilities for your project.

Vulnerabilities in the Project View

After a CVE-search run has been finished, you can see the number of vulnerabilities associated with your project in the Projects List. To that end, open the Projects menu and click on your project:

System Requirements

Mon, 01 Jan 0001 00:00:00 +0000

For deploying SW360 v20, the following hardware and software requirements apply. Note that the architecture has shifted from a monolithic Liferay setup to a microservices-based stack (Spring Boot Backend, Next.js Frontend, Keycloak Authentication).

Recommended deployment method is container-based for ease of management.

Hardware and Infrastructure

Development / Test instances

For personal development or small test instances with minimal data:

CPU: 2 cores
RAM: 8GB (4GB for Tomcat/Backend, 1GB for Keycloak, 1GB for Frontend, 2GB for OS/CouchDB)
Storage: 40GB SSD
Network: 10Mbit Ethernet link

Staging instances

Testing and working with medium data sets for staging and pre-productive testing. Requires enough RAM to run a full stack including Keycloak and monitoring services.

Workflows

Mon, 01 Jan 0001 00:00:00 +0000

This page is one of the basic user workflow documentation pages. It can give orientation how the sw360 can be used - as guidance or orientation. There is no particular need to follow these workflows, it is just one way. Workflows are shown as flow charts.

Create Component and Release

So, the user would like to create an entry for zlib-1.2.8 for example in sw360. The main thing to know (see page basic concepts)is that sw360 separates releases from components: the release is the zlib-1.2.8 but the component is the zlib. By this approach, components as a kind of container type in sw360, holding several releases.

SW360 User Frequently Asked Questions

Mon, 01 Jan 0001 00:00:00 +0000

Q: Who should be listed as Moderator?

A: Moderator are persons who need to review changes done on certain items (project, component, release or attachment) by persons who do not have the user right to actually do these changes. For BT moderators are the persons with the role ‘Software Clearing Site Representative’.

Q: Who should be listed as Contributor?

A: By default only the owner (or creator) of an item (project, component, release) is allowed to modify this item. Often it is useful that additional people are allowed to edit an item. These additional people (software architects, developers, additional experts) should get listed as contributors.

Naming a Component

Mon, 01 Jan 0001 00:00:00 +0000

The name is the most important criteria to identify software components. Unfortunately there is no common naming scheme available.

Usage and Handling of Components

If you create a component entry, most likely you will go ahead with a release entry, otherwise, the component stays an empty shell
Uploading source packages / actual software as attachment makes sense at the release, not at the component
If you have created a component and release entry, you can go ahead and assign a vendor to a release.

This very clear approach enables a number of issues, please keep the following goals in mind:

Attachment File Types

Mon, 01 Jan 0001 00:00:00 +0000

SW360 maintains attachments for projects, components and releases. Currently, SW360 cannot automatically detect these types and is dependent on that users select the appropriate type accordingly. If not, some functionality will not properly kick of that uses such attachments.

Also, maybe some of the types are redundant by now and are just legacy ideas that should be reviewed after two years now.

In summary, the following the types currently are as follows:

Record Creation

Mon, 01 Jan 0001 00:00:00 +0000

How to Create (Component) Entries?

In order to have a clean and useful catalogue, data hygiene is very important. The main goal is to have clean component / release datasets that allow for versatile use and seamless integration with other systems (see the Handling of Components above). When creating a component, please consider the following rules:

What is the name of the vendor, the name of the component and what is the release designator?
For the Vendor
- Does a CPE entry exist?
  - Look here: ↗ https://nvd.nist.gov/cpe.cfm or ↗ http://scap.nist.gov/specifications/cpe/dictionary.html
  - Use the same writing as found in the CPE dictionary
- A CPE does not exist?
  - Who is the copyright holder: an organization?
    - Use this organization name without “inc”, “Gmbh”, etc.
  - A person
    - Look at the CPE dictionaries for example
    - They use first name last name with “_”, for example “Wedge_Antilles
For a component
- Again, does a CPE entry exist?
- Separate Component name from release designation
For a release
- Do not repeat the component name
- Use the release designation as provided by the software package
- Avoid prefixes, such as “version”, “v” etc
For special cases:
- If you upload a part of a release software package, create a separate release for this
- For example “2.0-MODIFIED”
- Consider that leaving items out from a software release is actually a modification

How to Create Vendors

In order to have a vendor record in the sw360, then choosing a name is important. The vendor in SW360 is the real “manufacturer” independently from where you download it.

Add Project

Mon, 01 Jan 0001 00:00:00 +0000

SW360 “Add Project” Page Test Cases

General Page Behavior

New Page Opening

Test Case ID: PROJ-CRT-001
Description: Verify that upon clicking “Add Project,” a new page opens with a message on top “Creating new Project.”
Steps:
1. Navigate to the Main Projects page.
2. Click on the “Add Project” button.
Expected Result: A new page opens with the message “Creating new Project” on top.

Summary Tab

General Information Section

Test Case ID: PROJ-CRT-002
Description: Verify the “General Information” section in the Summary Tab.
Steps:
1. Navigate to the “Add Project” page.
2. Locate the “General Information” section.
3. Verify the presence of the following fields:
  - Project Name (required)
  - Version
  - Project visibility (required) (one of Private, Me and Moderators, Group and Moderators, Everyone (default))
  - Created By (no edit)
  - Project Type (required) (one of Customer Project, Internal Project, Product (default), Service, Inner Source, Cloud Backend)
  - Tag
  - Description (textbox)
  - Domain (one of Application Software, Documentation, Embedded Software, Hardware, Test and Diagnostics)
  - Vendor (click for popup) with a clear button beneath
  - Modified On (no edit)
  - Modified By (no edit)
  - 3 vulnerability checkboxes
Expected Result: All specified fields are present and function as described.

External URLs Section

Test Case ID: PROJ-CRT-003
Description: Verify the “External URLs” section in the Summary Tab.
Steps:
1. Navigate to the “Add Project” page.
2. Locate the “External URLs” section.
3. Click on the “Click to add row to External URLs” button.
4. Verify the presence of the following fields in the new row:
  - External URL key on the left
  - Type to get default values
  - External URL value on the right
  - Row delete button on the end
Expected Result: A new row is added with the specified fields.

Roles Section

Test Case ID: PROJ-CRT-004
Description: Verify the “Roles” section in the Summary Tab.
Steps:
1. Navigate to the “Add Project” page.
2. Locate the “Roles” section.
3. Verify the presence of the following fields:
  - Group (required) (default user department) with a clear button beneath
  - Project Manager (single value)
  - Project Owner (single value)
  - Owner Accounting Unit
  - Owner Billing Group
  - Owner Country
  - Lead Architect (single value)
  - Moderators (multi value)
  - Contributors (multi value)
  - Security Responsibles (multi value)
Expected Result: All specified fields are present and function as described.

Additional Roles Section

Test Case ID: PROJ-CRT-005
Description: Verify the “Additional Roles” section in the Summary Tab.
Steps:
1. Navigate to the “Add Project” page.
2. Locate the “Additional Roles” section.
3. Click on the “Click to add row to Additional Roles” button.
Expected Result: A new row is added for additional roles.

External Ids Section

Test Case ID: PROJ-CRT-006
Description: Verify the “External Ids” section in the Summary Tab.
Steps:
1. Navigate to the “Add Project” page.
2. Locate the “External Ids” section.
3. Click on the “Click to add row to External Ids” button.
4. Verify the presence of the following fields in the new row:
  - External Id key on the left
  - Type to get default values
  - External Id value on the right
  - Row delete button on the end
Expected Result: A new row is added with the specified fields.

Additional Data Section

Test Case ID: PROJ-CRT-007
Description: Verify the “Additional Data” section in the Summary Tab.
Steps:
1. Navigate to the “Add Project” page.
2. Locate the “Additional Data” section.
3. Click on the “Click to add row to Additional Data” button.
Expected Result: A new row is added for additional data.

Administration Tab

Clearing Section

Test Case ID: PROJ-CRT-008
Description: Verify the “Clearing” section in the Administration Tab.
Steps:
1. Navigate to the “Add Project” page.
2. Locate the “Clearing” section in the Administration Tab.
3. Verify the presence of the following fields:
  - Project Clearing State (one of Open, In Progress, Closed)
  - Clearing Team dropdown (values from backend)
  - Deadline for pre-evaluation (date)
  - Clearing summary (text area)
  - Special risk Open Source Software (text area)
  - General risk 3rd party software (text area)
  - Special risks 3rd party software (text area)
  - Sales and delivery channels (text area)
  - Remarks additional requirements (text area)
Expected Result: All specified fields are present and function as described.

Lifecycle Section

Test Case ID: PROJ-CRT-009
Description: Verify the “Lifecycle” section in the Administration Tab.
Steps:
1. Navigate to the “Add Project” page.
2. Locate the “Lifecycle” section in the Administration Tab.
3. Verify the presence of the following fields:
  - Project State (required) (one of Active, Phaseout, Unknown)
  - System test begin (date)
  - System test end (date)
  - Delivery start date (date)
  - Phase-out date (date)
Expected Result: All specified fields are present and function as described.

License Info Header Section

Test Case ID: PROJ-CRT-010
Description: Verify the “License Info Header” section in the Administration Tab.
Steps:
1. Navigate to the “Add Project” page.
2. Locate the “License Info Header” section in the Administration Tab.
3. Verify the presence of a text area with a default license info header and a bottom on the top right of the area to reset to default text.
Expected Result: The text area with the default license info header and the reset button are present.

Linked Releases And Projects Tab

Linked Projects Section

Test Case ID: PROJ-CRT-011
Description: Verify the “Linked Projects” section in the Linked Releases And Projects Tab.
Steps:
1. Navigate to the “Add Project” page.
2. Locate the “Linked Projects” section in the Linked Releases And Projects Tab.
3. Verify the presence of a table with the following columns:
  - Project name
  - Project version
  - Project Relation (info hover)
  - Enable SVM (checkbox)
  - Delete icon
4. Click on the “Add Projects” button beneath to open the search popup.
Expected Result: The table with the specified columns is present, and the “Add Projects” button opens the search popup.

Linked Releases Section

Test Case ID: PROJ-CRT-012
Description: Verify the “Linked Releases” section in the Linked Releases And Projects Tab.
Steps:
1. Navigate to the “Add Project” page.
2. Locate the “Linked Releases” section in the Linked Releases And Projects Tab.
3. Verify the presence of a table with the following columns:
  - Release name
  - Release version
  - Release relation (info hover)
  - Project Mainline State (info hover)
  - Comments
  - Delete icon
4. Click on the “Add Releases” button beneath to open the search popup.
Expected Result: The table with the specified columns is present, and the “Add Releases” button opens the search popup.

Linked Packages Tab

Linked Packages Section

Test Case ID: PROJ-CRT-013
Description: Verify the “Linked Packages” section in the Linked Packages Tab.
Steps:
1. Navigate to the “Add Project” page.
2. Locate the “Linked Packages” section in the Linked Packages Tab.
3. Verify the presence of a table with the following columns:
  - Package Name
  - Package Version
  - License
  - Package Manager
4. Click on the “Add Packages” button on top to open the search popup.
Expected Result: The table with the specified columns is present, and the “Add Packages” button opens the search popup.

Create Project Button

Project Creation

Test Case ID: PROJ-CRT-014
Description: Verify that upon hitting the “Create Project” button, the project is saved, and the user is redirected to the project edit page for the newly created project.
Steps:
1. Navigate to the “Add Project” page.
2. Fill in the required fields and any additional information.
3. Click on the “Create Project” button.
Expected Result: The project is saved, and the user is redirected to the project edit page for the newly created project.

SW360 Rest API

Mon, 01 Jan 0001 00:00:00 +0000

The sw360 REST API provides access to sw360 resources for external clients. It consists currently of three Maven modules aggregated in one parent module rest in the sw360 distribution.

For access setup and request examples, see API Access. Legacy workflows are kept in Legacy REST API Guides.

Resource Server Authentication and Authorization Flow

This section describes how resource-server identifies the principal and evaluates effective permissions.

Security Pipeline (High-Level)

flowchart TD
 A[Incoming HTTP request] --> B{Authorization header}
 B -->|Basic ...| C[Basic Authentication Provider]
 B -->|Token ...| D[API Token Filter + Provider]
 B -->|Bearer ...| E[JWT Authentication Provider + JWT Converter]
 C --> F[Authenticated principal + authorities]
 D --> F
 E --> F
 F --> G[Resolve SW360 user in RestControllerHelper]
 G --> H[Endpoint + method authorization checks]

How principal identity is resolved

RestControllerHelper.getSw360UserFromAuthentication() resolves the SW360 user from authentication context using this order:

Testing Policy

Mon, 01 Jan 0001 00:00:00 +0000

SW360 Testing Policy

To ensure the reliability, maintainability, and security of the SW360 portal, this policy mandates automated testing for all code contributions.

Policy Requirements

1. New Functionality

Every new feature or major enhancement MUST be accompanied by automated tests. This includes:

Unit Tests: For individual components and business logic.
Integration Tests: For service interactions and data handling layers.
API Tests: For new REST endpoints.

2. Bug Fixes

All bug fixes MUST include one or more regression tests that demonstrate the bug being fixed and prevent it from recurring.

User Management Roles

Mon, 01 Jan 0001 00:00:00 +0000

Every user can create records and edit their own records. However, to change records owned by others, approval is required. This is handled through a Moderation Request — a set of proposed changes that are not applied immediately, but are routed to:

The creator of the record
The moderators defined for that record
The Clearing Admin(s) of the same department

The proposed changes can then be approved or rejected by any of the above.

Generate a Keycloak Token for REST API

Mon, 01 Jan 0001 00:00:00 +0000

This guide explains how to generate a Keycloak access token for SW360 REST API usage with the client_credentials flow.

Before you generate a token: create a client

For SW360 deployments, first create a dedicated Keycloak client and obtain its client_id and client_secret.

Follow the existing deployment guide:

Keycloak Authentication - User Client Management

After that step, come back here with:

Keycloak base URL (for example https://<keycloak-host>)
Realm name (for example sw360)
client_id
client_secret

Token endpoint and discovery

You can discover the token endpoint from OIDC metadata:

Edit Project

Mon, 01 Jan 0001 00:00:00 +0000

SW360 “Edit Project” Page Test Cases

Summary Tab

General Information Section

Test Case ID: PROJ-EDIT-001
Description: Verify the “General Information” section in the Summary Tab.
Steps:
1. Navigate to the “Edit Project” page.
2. Locate the “General Information” section.
3. Verify the presence of the following fields:
  - Project Name (required)
  - Version
  - Project visibility (required) (one of Private, Me and Moderators, Group and Moderators, Everyone (default))
  - Created By (no edit)
  - Project Type (required) (one of Customer Project, Internal Project, Product (default), Service, Inner Source, Cloud Backend)
  - Tag
  - Description (textbox)
  - Domain (one of Application Software, Documentation, Embedded Software, Hardware, Test and Diagnostics)
  - Vendor (click for popup) with a clear button beneath
  - Modified On (no edit)
  - Modified By (no edit)
  - 3 vulnerability checkboxes
Expected Result: All specified fields are present and function as described.

External URLs Section

Test Case ID: PROJ-EDIT-002
Description: Verify the “External URLs” section in the Summary Tab.
Steps:
1. Navigate to the “Edit Project” page.
2. Locate the “External URLs” section.
3. Click on the “Click to add row to External URLs” button.
4. Verify the presence of the following fields in the new row:
  - External URL key on the left
  - Type to get default values
  - External URL value on the right
  - Row delete button on the end
Expected Result: A new row is added with the specified fields.

Roles Section

Test Case ID: PROJ-EDIT-003
Description: Verify the “Roles” section in the Summary Tab.
Steps:
1. Navigate to the “Edit Project” page.
2. Locate the “Roles” section.
3. Verify the presence of the following fields:
  - Group (required) (default user department) with a clear button beneath
  - Project Manager (single value)
  - Project Owner (single value)
  - Owner Accounting Unit
  - Owner Billing Group
  - Owner Country
  - Lead Architect (single value)
  - Moderators (multi value)
  - Contributors (multi value)
  - Security Responsibles (multi value)
Expected Result: All specified fields are present and function as described.

Additional Roles Section

Test Case ID: PROJ-EDIT-004
Description: Verify the “Additional Roles” section in the Summary Tab.
Steps:
1. Navigate to the “Edit Project” page.
2. Locate the “Additional Roles” section.
3. Click on the “Click to add row to Additional Roles” button.
Expected Result: A new row is added for additional roles.

External Ids Section

Test Case ID: PROJ-EDIT-005
Description: Verify the “External Ids” section in the Summary Tab.
Steps:
1. Navigate to the “Edit Project” page.
2. Locate the “External Ids” section.
3. Click on the “Click to add row to External Ids” button.
4. Verify the presence of the following fields in the new row:
  - External Id key on the left
  - Type to get default values
  - External Id value on the right
  - Row delete button on the end
Expected Result: A new row is added with the specified fields.

Additional Data Section

Test Case ID: PROJ-EDIT-006
Description: Verify the “Additional Data” section in the Summary Tab.
Steps:
1. Navigate to the “Edit Project” page.
2. Locate the “Additional Data” section.
3. Click on the “Click to add row to Additional Data” button.
Expected Result: A new row is added for additional data.

Administration Tab

Clearing Section

Test Case ID: PROJ-EDIT-007
Description: Verify the “Clearing” section in the Administration Tab.
Steps:
1. Navigate to the “Edit Project” page.
2. Locate the “Clearing” section in the Administration Tab.
3. Verify the presence of the following fields:
  - Project Clearing State (one of Open, In Progress, Closed)
  - Clearing Team dropdown (values from backend)
  - Deadline for pre-evaluation (date)
  - Clearing summary (text area)
  - Special risk Open Source Software (text area)
  - General risk 3rd party software (text area)
  - Special risks 3rd party software (text area)
  - Sales and delivery channels (text area)
  - Remarks additional requirements (text area)
Expected Result: All specified fields are present and function as described.

Lifecycle Section

Test Case ID: PROJ-EDIT-008
Description: Verify the “Lifecycle” section in the Administration Tab.
Steps:
1. Navigate to the “Edit Project” page.
2. Locate the “Lifecycle” section in the Administration Tab.
3. Verify the presence of the following fields:
  - Project State (required) (one of Active, Phaseout, Unknown)
  - System test begin (date)
  - System test end (date)
  - Delivery start date (date)
  - Phase-out date (date)
Expected Result: All specified fields are present and function as described.

License Info Header Section

Test Case ID: PROJ-EDIT-009
Description: Verify the “License Info Header” section in the Administration Tab.
Steps:
1. Navigate to the “Edit Project” page.
2. Locate the “License Info Header” section in the Administration Tab.
3. Verify the presence of a text area with a default license info header and a bottom on the top right of the area to reset to default text.
Expected Result: The text area with the default license info header and the reset button are present.

Linked Releases And Projects Tab

Linked Projects Section

Test Case ID: PROJ-EDIT-010
Description: Verify the “Linked Projects” section in the Linked Releases And Projects Tab.
Steps:
1. Navigate to the “Edit Project” page.
2. Locate the “Linked Projects” section in the Linked Releases And Projects Tab.
3. Verify the presence of a table with the following columns:
  - Project name
  - Project version
  - Project Relation (info hover)
  - Enable SVM (checkbox)
4. Click on the “Add Projects” button beneath to open the search popup.
Expected Result: The table with the specified columns is present, and the “Add Projects” button opens the search popup.

Linked Releases Section

Test Case ID: PROJ-EDIT-011
Description: Verify the “Linked Releases” section in the Linked Releases And Projects Tab.
Steps:
1. Navigate to the “Edit Project” page.
2. Locate the “Linked Releases” section in the Linked Releases And Projects Tab.
3. Verify the presence of a table with the following columns:
  - Release name
  - Release version
  - Release relation (info hover)
  - Project Mainline State (info hover)
  - Comments
4. Click on the “Add Releases” button beneath to open the search popup.
Expected Result: The table with the specified columns is present, and the “Add Releases” button opens the search popup.

Linked Packages Tab

Linked Packages Section

Test Case ID: PROJ-EDIT-012
Description: Verify the “Linked Packages” section in the Linked Packages Tab.
Steps:
1. Navigate to the “Edit Project” page.
2. Locate the “Linked Packages” section in the Linked Packages Tab.
3. Verify the presence of a table with the following columns:
  - Package Name
  - Package Version
  - License
  - Package Manager
4. Click on the “Add Packages” button on top to open the search popup.
Expected Result: The table with the specified columns is present, and the “Add Packages” button opens the search popup.

Attachments Tab

Attachments Table

Test Case ID: PROJ-EDIT-013
Description: Verify the “Attachments” table in the Attachments Tab.
Steps:
1. Navigate to the “Edit Project” page.
2. Locate the “Attachments” table in the Attachments Tab.
3. Verify the presence of the following columns:
  - Filename
  - Type
  - Comment (entered by uploader)
  - Group (department of uploader)
  - Name (name of uploader)
  - Date (date of upload)
  - Status (status set by approver)
  - Comment (entered by approver)
  - Group (department of approver)
  - Name (name of approver)
  - Date (date of approve)
  - Delete icon (remove attachment)
4. Click on the “Add Attachment” button on the bottom to add a new attachment.
5. Make sure the changed values about comment, status, etc. are saved.
6. Verify if the Edit views shows the saved values for the comment, status, etc.
Expected Result: The table with the specified columns is present, and the “Add Attachment” button allows adding a new attachment.

Delete Attachment

Test Case ID: PROJ-EDIT-014
Description: Verify the “Delete Attachment” functionality in the Attachments Tab.
Steps:
1. Navigate to the “Edit Project” page.
2. Locate the “Attachments” table in the Attachments Tab.
3. Click on the delete icon for an attachment.
4. If the attachment was “Accepted”, popup with error “An attachment cannot be deleted while it is approved. You have to reject the approval first.” should appear.
5. “Rejected” or “Unchecked” attachments should be deleted with a popup for confirmation.
Expected Result: The delete functionality shows error for “Accepted” attachments, confirmation popup for other attachments.

Obligations Tab

Obligations View or Release View Switch

Test Case ID: PROJ-EDIT-015
Description: Verify the “Obligations View or Release View” switch in the Obligations Tab.
Steps:
1. Navigate to the “Edit Project” page.
2. Locate the “Obligations View or Release View” switch in the Obligations Tab.
Expected Result: The switch is present and functional.

Obligations Tabs

Test Case ID: PROJ-EDIT-016
Description: Verify the presence of the 4 tabs: License Obligation, Component Obligation, Project Obligation, Organisation Obligation.
Steps:
1. Navigate to the “Edit Project” page.
2. Locate the Obligations Tab.
3. Verify the presence of the following tabs:
  - License Obligation
  - Component Obligation
  - Project Obligation
  - Organisation Obligation
Expected Result: All specified tabs are present.

License Obligation Tab

Test Case ID: PROJ-EDIT-017
Description: Verify the “License Obligation” tab in the Obligations Tab.
Steps:
1. Navigate to the “Edit Project” page.
2. Locate the “License Obligation” tab in the Obligations Tab.
3. Click on the leftmost expand button to expand everything.
4. Verify the presence of the following fields:
  - License Obligation (title)
  - Licenses (show one, expand to show all)
  - Releases (show one, expand to show all)
  - Status (dropdown)
  - Type
  - Id
  - Comment
5. Click on the button on the top right to “Add Obligations from License Database” and verify that a popup opens to get obligations not in the project and select to add.
Expected Result: The specified fields are present, and the button to add obligations from the license database functions as described.

Component Obligation Tab

Test Case ID: PROJ-EDIT-018
Description: Verify the “Component Obligation” tab in the Obligations Tab.
Steps:
1. Navigate to the “Edit Project” page.
2. Locate the “Component Obligation” tab in the Obligations Tab.
3. Click on the leftmost expand button to expand to show the obligation text.
4. Verify the presence of the following fields:
  - Component Obligation (title)
  - Status
  - Type
  - Id
  - Comment
Expected Result: The specified fields are present.

Project Obligation Tab

Test Case ID: PROJ-EDIT-019
Description: Verify the “Project Obligation” tab in the Obligations Tab.
Steps:
1. Navigate to the “Edit Project” page.
2. Locate the “Project Obligation” tab in the Obligations Tab.
3. Verify the presence of the same fields as in the “Component Obligation” tab.
Expected Result: The specified fields are present.

Organisation Obligation Tab

Test Case ID: PROJ-EDIT-020
Description: Verify the “Organisation Obligation” tab in the Obligations Tab.
Steps:
1. Navigate to the “Edit Project” page.
2. Locate the “Organisation Obligation” tab in the Obligations Tab.
3. Verify the presence of the same fields as in the “Component Obligation” tab.
Expected Result: The specified fields are present.

Release View

Test Case ID: PROJ-EDIT-021
Description: Verify the “Release View” in the Obligations Tab.
Steps:
1. Navigate to the “Edit Project” page.
2. Locate the “Obligations View or Release View” switch in the Obligations Tab and switch to “Release View.”
3. Verify that all releases are shown with the total license count in brackets.
4. Expand a release to get Global or Other licenses.
5. Further expand to get a list of licenses.
6. Further expand a license to get the following fields:
  - Obligation (title)
  - Obligation text
  - Type
  - Id
  - Status (readonly)
  - Comment (readonly)
Expected Result: The “Release View” shows all releases with the specified details and fields.

Enumerations

Mon, 01 Jan 0001 00:00:00 +0000

SW360 thrift API is comprised of the following methods:

attachments
codescoop
components
cvesearch
fossology
importstatus
licenseinfo
licenses
moderation
projectimport
projects
schedule
search
sw360
users
vendors
vulnerabilities

Reference: https://github.com/eclipse-sw360/sw360/tree/main/libraries/datahandler/src/main/thrift

Attachments

https://github.com/eclipse-sw360/sw360/blob/main/libraries/datahandler/src/main/thrift/attachments.thrift

AttachmentType

Value	Description.
DOCUMENT	justa document
SOURCE	original course code
DESIGN	design document
REQUIREMENT	requirements document
CLEARING_REPORT	OSS licensing reporting
COMPONENT_LICENSE_INFO_XML	XML document with licenseing information - e.g. SPDX
COMPONENT_LICENSE_INFO_COMBINED	XML document with licensing information covering multiple componnts at once - e.g. SPDX
SCAN_RESULT_REPORT	Output what a scanner for licenses has found
SCAN_RESULT_REPORT_XML	Output what a scanner for licenses has found this time in XML
SOURCE_SELF	Self assembled source code distribution
BINARY	Binary of component from vendor
BINARY_SELF	Self built binary
DECISION_REPORT	documenting importing decisions for using this item
LEGAL_EVALUATION	Some legal evaluation created for this item
LICENSE_AGREEMENT	A ruling license agreement for this item, note that this could be for commercial software for example
SCREENSHOT	Screenshot, usually screenshot of the Website with licensing information
OTHER	anything that dos not match to the given above

CheckStatus

Value	Description.
NOTCHECKED	Default value after upload.
ACCEPTED	Reviewed and confirmed attachment.
REJECTED	Document or attachment cannot be used.

CodeScoop Thrift File

https://github.com/eclipse/sw360/blob/master/libraries/lib-datahandler/src/main/thrift/codescoop.thrift

Secure Design

Mon, 01 Jan 0001 00:00:00 +0000

SW360 Secure Design Principles

This document outlines how the SW360 project incorporates fundamental security design principles into its architecture and development processes.

1. Fail-safe Defaults

In-depth Authorization: By default, any new API endpoint or UI action requires authentication. Access is denied unless explicitly permitted by the user’s roles.
Secure Configuration: The system is designed to run in a secure state out-of-the-box. Environment variables are used for sensitive configurations, ensuring that secrets are never hardcoded in the repository.

2. Complete Mediation

Centralized Authentication: Every access request is mediated through the core Authorization Server (OIDC/OAuth2). No resource can be accessed without a valid, verified token. Integration with Keycloak is supported for enhanced IAM features.
REST Interceptors: Spring Security and customized filters serve as mediators for all REST traffic, ensuring that every request is checked against the user’s authority before being processed.

3. Least Privilege

Role-Based Access Control (RBAC): SW360 uses granular roles (e.g., USER, ADMIN, MAINTAINER). Users are granted only the minimum permissions necessary for their tasks.
Record-Level Permissions: Visibility and edit rights are enforced at the data handler level, ensuring that users can only interact with projects and components they have specific rights to view.

4. Defense in Depth

Multi-layer Validation: Input validation is performed at both the frontend (Next.js) and the backend (Spring Boot/Data Handler) to prevent malformed or malicious data from reaching the database.
Network Security: The architecture separation of frontend, backend, and database provides multiple layers where security controls can be applied (e.g., CSP on the frontend, TLS between services).

5. Economy of Mechanism (Keep it Simple)

Standardized Frameworks: By utilizing established frameworks like Spring Security and Next.js, the project avoids the complexities and vulnerabilities associated with “rolling your own” security solutions.
Clean Architecture: The modular separation of concerns ensures that security logic is isolated and easy to audit.

6. Open Design

Open Standards: The project relies on open, widely-scrutinized standards such as OIDC and OAuth2 for security, rather than proprietary or “hidden” mechanisms.
Public Auditability: As an open-source project, the security policy, source code, and design are public, allowing for continuous community review and transparency.

7. Psychological Acceptability

SSO Integration: By using Keycloak for Single Sign-On, we minimize “password fatigue” for users while maintaining robust security controls.
Intuitive UI: Security-related states (e.g., read-only vs. edit mode) are clearly reflected in the UI, making it easy for users to understand their current permission level.

Assurance Case

Mon, 01 Jan 0001 00:00:00 +0000

SW360 Security Assurance Case

This document provides a formal justification for why the SW360 project’s security requirements are met. It serves as a comprehensive “argument for security” based on design, tools, and processes.

1. Threat Model & Trust Boundaries

Assets to Protect

Intellectual Property: Component data, license information, and project metadata.
System Integrity: The correctness of moderation requests and project status, ensured through audit trails and changelogs for all records.
Availability: Continuous access for organizational software compliance.

Trust Boundaries

User/System Boundary: The point where external users (or automated clients) interact with the SW360 Frontend or REST layer (Authorization and Resource Servers).
Frontend/Backend Boundary: The interaction between the Next.js application and the REST layer services.
Internal service Boundary: Communication between the REST layer and the business logic (Thrift).
Data layer Boundary: Interaction between the backend services and the CouchDB database.

2. Secure Design Application

As detailed in Secure Design, the project strictly follows:

CVE-Search Scheduling

Mon, 01 Jan 0001 00:00:00 +0000

SW360 gets vulnerability information from an external provider of Common Vulnerability Enumeration (CVE) data. By default SW360 can connect to cve-search [https://www.circl.lu/services/cve-search/] which is either available as an online service [http://cve.circl.lu] or can be installed locally. For security and privacy reasons it is strongly advised to install a local cve-search service.

Synchronization between SW360 and CVE Provider

Automatic Scheduling

CveSearch-updates can either be scheduled automatically when launching the schedule-service (e.g. when re/starting SW360) or it can be scheduled or unscheduled manually by an SW360 admin. It is automatically scheduled with the start of the scheduling service, if in the /resources/sw360.properties file of the schedule-service in the backend, cvesearchService is mentioned in the autostart-property:

Project Details

Mon, 01 Jan 0001 00:00:00 +0000

SW360 “Project Details” Page Test Cases

General Page Behavior

Top Buttons

Test Case ID: PROJ-PROJ-DTL-001
Description: Verify the presence of the “Edit Project”, “Link to Projects”, “Import SBOM”, and “Export SBOM” buttons on top.
Steps:
1. Navigate to the “Project Details” page.
2. Locate the top section of the page.
Expected Result: The specified buttons are present.

Summary Tab

General Information Section

Test Case ID: PROJ-PROJ-DTL-002
Description: Verify the “General Information” section in the Summary Tab.
Steps:
1. Navigate to the “Project Details” page.
2. Locate the “General Information” section in the Summary Tab.
3. Verify the presence of the following fields:
  - ID of the project
  - Name
  - Version
  - Visibility
  - Created on
  - Created by (mailto link)
  - Modified on
  - Modified by (mailto link)
  - Project type
  - Domain
  - Tag
  - External IDs (as UL, key in bold, value next to it)
  - Additional data (same as External IDs)
  - External URLs (same as External IDs display, but values are clickable URLs)
Expected Result: All specified fields are present and function as described.

Roles Section

Test Case ID: PROJ-PROJ-DTL-003
Description: Verify the “Roles” section in the Summary Tab.
Steps:
1. Navigate to the “Project Details” page.
2. Locate the “Roles” section in the Summary Tab.
3. Verify the presence of the following fields:
  - Group of project
  - Project Responsible
  - Project Owner
  - Owner Accounting Unit
  - Owner Billing Group
  - Owner Country
  - Lead Architect
  - Moderators
  - Contributors
  - Security Responsibles
  - Additional Roles
4. Verify that all users displayed are mailto links.
5. Verify that Moderators, Contributors, and Security Responsibles are displayed as a comma-separated list.
6. Verify that Additional Roles are displayed similar to External URLs.
Expected Result: All specified fields are present and function as described.

Project Vendor Section

Test Case ID: PROJ-PROJ-DTL-004
Description: Verify the “Project Vendor” section in the Summary Tab.
Steps:
1. Navigate to the “Project Details” page.
2. Locate the “Project Vendor” section in the Summary Tab.
3. Verify the presence of the following fields:
  - Vendor’s Full Name
  - Short Name
  - URL
Expected Result: All specified fields are present and function as described.

Administration Tab

Clearing Section

Test Case ID: PROJ-DTL-005
Description: Verify the “Clearing” section in the Administration Tab.
Steps:
1. Navigate to the “Project Details” page.
2. Locate the “Clearing” section in the Administration Tab.
3. Verify the presence of the following fields:
  - Project clearing state
  - Clearing details (New releases count, Under clearing count, Report available count, Approved count)
  - Clearing Team
  - Deadline for pre-evaluation
  - Clearing summary
  - Special risk Open Source Software
  - General risks 3rd party software
  - Special risks 3rd party software
  - Sales and delivery channels
  - Remarks additional requirements
4. Verify that the values for Clearing summary, Special risk Open Source Software, General risks 3rd party software, Special risks 3rd party software, Sales and delivery channels, Remarks additional requirements are in a readonly text area.
Expected Result: All specified fields are present and function as described.

Lifecycle Section

Test Case ID: PROJ-DTL-006
Description: Verify the “Lifecycle” section in the Administration Tab.
Steps:
1. Navigate to the “Project Details” page.
2. Locate the “Lifecycle” section in the Administration Tab.
3. Verify the presence of the following fields:
  - Project state
  - System test begin
  - System test end
  - Delivery start
  - Phase-out since
Expected Result: All specified fields are present and function as described.

License Info Header Section

Test Case ID: PROJ-DTL-007
Description: Verify the “License Info Header” section in the Administration Tab.
Steps:
1. Navigate to the “Project Details” page.
2. Locate the “License Info Header” section in the Administration Tab.
3. Verify the presence of the license info header of the project in a big text area.
Expected Result: The license info header is displayed in a big text area.

Obligation Tab

Tab Name and Count

Test Case ID: PROJ-DTL-008
Description: Verify that the tab name itself shows the count of “Status changed obligations / Total obligations.”
Steps:
1. Navigate to the “Project Details” page.
2. Locate the Obligation Tab.
Expected Result: The tab name shows the count of “Status changed obligations / Total obligations.”

Obligation Information

Test Case ID: PROJ-DTL-009
Description: Verify the display of obligation information as per test cases EDIT-014, EDIT-015, EDIT-016, EDIT-017, EDIT-018, and EDIT-019.
Steps:
1. Navigate to the “Project Details” page.
2. Locate the Obligation Tab.
Expected Result: The obligation information is displayed as per the specified test cases.

Test Case ID: PROJ-DTL-010
Description: Verify the presence of the “Create Project Clearing Report” dropdown on top with “Project only” and “Project with sub project” options.
Steps:
1. Navigate to the “Project Details” page.
2. Locate the Obligation Tab.
3. Verify the presence of the “Create Project Clearing Report” dropdown.
Expected Result: The dropdown is present with the specified options.

Report Button

Test Case ID: PROJ-DTL-011
Description: Verify that clicking on the report button redirects to the CLI Attachment usage view with a “Download” button.
Steps:
1. Navigate to the “Project Details” page.
2. Locate the Obligation Tab.
3. Click on the report button.
Expected Result: The page redirects to the CLI Attachment usage view with a “Download” button.

ECC Tab

ECC Information Table

Test Case ID: PROJ-DTL-012
Description: Verify the display of ECC information for all releases (including sub projects) in a table with the specified columns.
Steps:
1. Navigate to the “Project Details” page.
2. Locate the ECC Tab.
3. Verify the presence of a table with the following columns:
  - Status
  - Release name (clickable link to open release)
  - Release version
  - Creator Group
  - ECC Assessor
  - ECC Assessor Group
  - ECC Assessment Date
  - ECCN
Expected Result: The table with the specified columns is present.

Vulnerability Tracking Status Tab

Vulnerability State Information Section

Test Case ID: PROJ-DTL-013
Description: Verify the “Vulnerability State Information” section in the Vulnerability Tracking Status Tab.
Steps:
1. Navigate to the “Project Details” page.
2. Locate the Vulnerability Tracking Status Tab.
3. Verify the presence of the following fields:
  - “Security Vulnerability Monitoring” for the project as Enabled / Disabled
  - “Do not create monitoring list, but use list from external id” for the project as Enabled / Disabled
  - “com.siemens.svm.monitoringlist.id” for the project
Expected Result: All specified fields are present and function as described.

Tracking Status Table

Test Case ID: PROJ-DTL-014
Description: Verify the table below with the tracking status of releases displaying the specified columns.
Steps:
1. Navigate to the “Project Details” page.
2. Locate the Vulnerability Tracking Status Tab.
3. Verify the presence of a table with the following columns:
  - Name (clickable link to open the release)
  - Project Origin (which project release is linked with)
  - SVM Tracking Status (tracked or not)
  - Short Status
  - Type
Expected Result: The table with the specified columns is present.

Attachments Tab

Download Attachment Bundle Button

Test Case ID: PROJ-DTL-015
Description: Verify the presence of the “Download Attachment Bundle” button on top, which opens Attachment Usage for SRC.
Steps:
1. Navigate to the “Project Details” page.
2. Locate the Attachments Tab.
3. Click on the “Download Attachment Bundle” button.
Expected Result: The Attachment Usage for SRC is opened.

Attachments Table

Test Case ID: PROJ-DTL-016
Description: Verify the display of the following column information in the Attachments Table.
Steps:
1. Navigate to the “Project Details” page.
2. Locate the Attachments Tab.
3. Verify the presence of the following columns:
  - Download button to download all attachments as a zip. In rows, it will act as an expand button, showing SHA1, Uploaded On, Uploaded Comment, Checked On, and Checked Comment.
  - File name (uploaded file name)
  - Size (file size)
  - Type (attachment type)
  - Group (uploader’s Department)
  - Uploaded by (uploader)
  - Group (approver Department, in green if approved, red or black)
  - Checked by (approver, green, red, or black)
  - Usages (attachment usage count)
  - Actions (download button for attachment)
Expected Result: The table with the specified columns is present. The data is correct from the database.

Vulnerabilities Tab

Test Case ID: PROJ-DTL-017
Description: Verify the dropdown on top with options to show the latest 200/500/1000/All vulnerabilities.
Steps:
1. Navigate to the “Project Details” page.
2. Locate the Vulnerabilities Tab.
Expected Result: The dropdown with the specified options is present.

Tabs

Test Case ID: PROJ-DTL-018
Description: Verify the presence of tabs: Summary, Current project, Child projects, etc. If no child project, only 1 tab: Current project.
Steps:
1. Navigate to the “Project Details” page.
2. Locate the Vulnerabilities Tab.
Expected Result: The specified tabs are present.

Summary Tab

Test Case ID: PROJ-DTL-019
Description: Verify the “Summary” tab in the Vulnerabilities Tab.
Steps:
1. Navigate to the “Project Details” page.
2. Locate the “Summary” tab in the Vulnerabilities Tab.
3. Verify the presence of the following fields:
  - Total vulnerabilities (current + child projects)
  - Vulnerabilities table with columns: Project name, Release, External ID (link to vulnerability), Priority (hover info with value), Matched by, Title, Relevance for project (hover info with value), Actions
Expected Result: The specified fields are present and function as described.

Project Tab

Test Case ID: PROJ-DTL-020
Description: Verify the “Project” tab in the Vulnerabilities Tab (only tab if no sub project).
Steps:
1. Navigate to the “Project Details” page.
2. Locate the “Project” tab in the Vulnerabilities Tab.
3. Verify the presence of the following fields:
  - Total vulnerabilities (current)
  - Vulnerability state information: Security Vulnerabilities Display Enabled/Disabled
  - Vulnerabilities table with columns: Checkbox, Release, External ID (link to vulnerability), Priority (hover info with value), Matched by, Title, Relevance for project (hover info with value), Actions
  - Change rating and action of selected vulnerabilities with “Change” button, open popup with Selected vulnerabilities count, Rating, Action, and comment, and Change Rating button to submit
  - Vulnerability Matching statistic with Matched By histogram
Expected Result: The specified fields are present and function as described.

Changelog Tab

Toggle on Top

Test Case ID: PROJ-DTL-021
Description: Verify the presence of the “Change Log” and “Changes” toggle on top.
Steps:
1. Navigate to the “Project Details” page.
2. Locate the Changelog Tab.
Expected Result: The toggle is present with the specified options.

Changelog Table

Test Case ID: PROJ-DTL-022
Description: Verify the display of the table with the specified columns.
Steps:
1. Navigate to the “Project Details” page.
2. Locate the Changelog Tab.
3. Verify the presence of a table with the following columns:
  - Date
  - Change Log Id
  - Change Type
  - User
  - Actions (button to open changelog)
Expected Result: The table with the specified columns is present.

Opening Changelog

Test Case ID: PROJ-DTL-023
Description: Verify that opening a changelog changes the toggle on top to “Changes.”
Steps:
1. Navigate to the “Project Details” page.
2. Locate the Changelog Tab.
3. Click on the “Actions” button to open a changelog.
Expected Result: The toggle on top changes to “Changes.”

Basic Info Section

Test Case ID: PROJ-DTL-024
Description: Verify the “Basic Info” section when a specific changelog is open.
Steps:
1. Navigate to the “Project Details” page.
2. Locate the Changelog Tab.
3. Open a changelog.
4. Verify the presence of the following fields in the “Basic Info” section:
  - User
  - Date
  - Operation
  - Document Id
  - Document Type
  - Reference Doc (list)
Expected Result: The specified fields are present and function as described.

Changed Fields Table

Test Case ID: PROJ-DTL-025
Description: Verify the display of each changed field as a separate table with original value in left (in red), new value in right (in green), and diff highlighted between old and new value.
Steps:
1. Navigate to the “Project Details” page.
2. Locate the Changelog Tab.
3. Open a changelog.
4. Verify the presence of a table for each changed field with the specified details.
Expected Result: The table with the specified details is present.

Returning to List

Test Case ID: PROJ-DTL-026
Description: Verify that clicking on the “Change Log” toggle on top returns to the list.
Steps:
1. Navigate to the “Project Details” page.
2. Locate the Changelog Tab.
3. Open a changelog.
4. Click on the “Change Log” toggle on top.
Expected Result: The page returns to the list view.

License Clearing Tab

New Buttons on Top

Test Case ID: PROJ-DTL-027
Description: Verify the presence of the “Tree View | List View” toggle, Export Spreadsheet dropdown, Generate License Info dropdown, Generate Source Code Bundle, and Create Clearing Request button on top.
Steps:
1. Navigate to the “Project Details” page.
2. Locate the License Clearing Tab.
Expected Result: The specified buttons and dropdowns are present.

Conditional Buttons

Test Case ID: PROJ-DTL-028
Description: Verify the presence of conditional buttons based on user roles and project permissions.
Steps:
1. Navigate to the “Project Details” page.
2. Locate the License Clearing Tab.
3. Verify the presence of the “Add License Info to Release” button if the user is with Clearing Admin role or above.
4. Verify the presence of the “Sync Linked Releases” button if the project has linked Packages and the user has write access to the current project.
Expected Result: The specified buttons are present based on the user’s role and project permissions.

Linked Release Table

Test Case ID: PROJ-DTL-029
Description: Verify the display of the linked release table with the specified columns.
Steps:
1. Navigate to the “Project Details” page.
2. Locate the License Clearing Tab.
3. Verify the presence of a table with the following columns:
  - Name (release name and version, clickable link to open release, expand button next to subproject and release with linked releases)
  - Type (filterable)
  - Relation (filterable)
  - Main licenses (truncated, but expandable, i next to it to show license info, if multiple release “Failed to load source”)
  - Other licenses (same as Main licenses)
  - State (filterable)
  - Release Mainline State
  - Project Mainline State
  - Release Linked Date
  - Comment
  - Actions (edit icon to edit release or subproject)
Expected Result: The table with the specified columns is present.

List View Toggle

Test Case ID: PROJ-DTL-030
Description: Verify the behavior of the “List View” toggle.
Steps:
1. Navigate to the “Project Details” page.
2. Locate the License Clearing Tab.
3. Toggle to “List View” from “Tree View.”
4. Verify that all releases expand from current or sub projects recursively, no more expand button, and a new column “Project Path” is added showing the current project or path to sub project from where the release is coming.
Expected Result: The specified behavior is observed when toggling to “List View.”

Linked Packages Tab

Linked Packages Table

Test Case ID: PROJ-DTL-031
Description: Verify the display of the linked packages table with the specified columns.
Steps:
1. Navigate to the “Project Details” page.
2. Locate the Linked Packages Tab.
3. Verify the presence of a table with the following columns:
  - Vendor (filterable)
  - Package Name Version (filterable)
  - Release Name version (filterable)
  - Release clearing state (filterable)
  - Licenses (filterable)
  - Package Manager (filterable)
  - Actions (with edit icon to edit package)
Expected Result: The table with the specified columns is present.

SVM SSL/TLS Configuration

Mon, 01 Jan 0001 00:00:00 +0000

SW360 communicates with the SVM service over HTTPS. Two files can be configured in /etc/sw360/sw360.properties:

File	Purpose	Property
Trust store (JKS)	Trust the SVM server’s CA certificate	`svm.sw360.truststore.filename`
Client key store (PKCS12)	Authenticate SW360 to the SVM server (mutual TLS)	`svm.sw360.certificate.filename`

Both files are resolved by SW360’s CommonUtils.loadResource, which searches /etc/sw360/<filename> first and then falls back to the classpath. Set only the filename (e.g. svm-truststore.jks), not an absolute path.

Trust-store lookup order

For SSL connections to the SVM API to be trusted, the CA certificate must be present in the JVM default cacerts or provided via a custom JKS trust store.

SW360 Configurations

Mon, 01 Jan 0001 00:00:00 +0000

Introduction

SW360 configurations are divided into two main categories: Non-changeable (File-based) and Changeable (Database-backed).

Applicable Property Files:

sw360.properties (Core configurations)
couchdb.properties (CouchDB and Lucene connectivity)
orgmapping.properties (Organization mapping features)
couchdb-test.properties (CouchDB test purpose)
authorization/application.yml (Authorization server settings)
rest/application.yml (Resource server settings)

Database Configurations:

Most of the SW360-related properties (UI settings and backend features) are now moved to a database and are accessible via a REST endpoint. These are divided into two containers:

Project - Attachment Usages

Mon, 01 Jan 0001 00:00:00 +0000

SW360 “Attachment Usages” Page Test Cases

General Page Behavior

Availability as a Tab

Test Case ID: PROJ-AU-001
Description: Verify that the “Attachment Usages” tab is available under the Projects Details page.
Steps:
1. Navigate to the “Projects Details” page.
2. Locate the “Attachment Usages” tab.
Expected Result: The “Attachment Usages” tab is present.

Top Buttons and Filters

Test Case ID: PROJ-AU-002
Description: Verify the presence of the “Save Usages” button, Linked Releases and Projects, Expand all, Collapse all, Release Filter (dropdown), and Search box on top.
Steps:
1. Navigate to the “Attachment Usages” page.
2. Locate the top section of the page.
3. Verify the presence of the following elements:
  - “Save Usages” button
  - Linked Releases and Projects
  - Expand all button
  - Collapse all button
  - Release Filter (dropdown) with options: With CLI Attachments, With Attachments, Without Source Attachments, Without Attachments
  - Search box
Expected Result: All specified elements are present and function as described.

Attachment Usages Table

Columns

Test Case ID: PROJ-AU-003
Description: Verify the presence of the specified columns in the Attachment Usages Table.
Steps:
1. Navigate to the “Attachment Usages” page.
2. Locate the Attachment Usages Table.
3. Verify the presence of the following columns:
  - Name
  - Relation
  - Uploaded by
  - Type
  - License Info (for CLX/SRR)
  - Conclusions (ends with .rdf)
  - Source Code Bundle
  - Other
Expected Result: All specified columns are present and function as described.

No Linked Releases or Projects Message

Test Case ID: PROJ-AU-004
Description: Verify the display of the message “No Linked releases or projects” if no sub projects or linked releases are present.
Steps:
1. Navigate to the “Attachment Usages” page.
2. Locate the Attachment Usages Table.
Expected Result: The message “No Linked releases or projects” is displayed if no sub projects or linked releases are present.

Linked Release Details

Test Case ID: PROJ-AU-005
Description: Verify the display of each Linked Release in the Project with an expand button, release name and version (max 60 char), CLI count (if 0: red, 1: green, else yellow), and relation.
Steps:
1. Navigate to the “Attachment Usages” page.
2. Locate the Attachment Usages Table.
3. Click on the expand button of a Linked Release.
Expected Result: The Linked Release details are displayed as specified.

Expanded Release Details

Test Case ID: PROJ-AU-006
Description: Verify the details displayed when a release is expanded.
Steps:
1. Navigate to the “Attachment Usages” page.
2. Locate the Attachment Usages Table.
3. Click on the expand button of a Linked Release.
4. Verify the presence of the following details:
  - Title: “Created on: date\nStatus: checked\nIf checked Checked By: email\nChecked On: date”
  - Attachment name (max 60 char)
  - Uploader name
  - Attachment type shortname
  - Checkbox for License Info enabled if CLX or CLI (combined)
  - Checkbox for Conclusions enabled if CLX or CLI and ends with “.rdf”
  - Checkbox for Source Code bundle enabled if SRC or SRS
  - Checkbox for Other is always enabled
  - All the checkboxes are disabled if the user does not have write permission (admin or contributor or clearing admin or clearing expert)
  - Subproject’s releases are indented
Expected Result: All specified details are present and function as described.

Save Usages Button

Save Usages Message

Test Case ID: PROJ-AU-007
Description: Verify that clicking on the “Save Usages” button shows a saved message.
Steps:
1. Navigate to the “Attachment Usages” page.
2. Click on the “Save Usages” button.
Expected Result: A saved message is shown.

Project - License Info Usages

Mon, 01 Jan 0001 00:00:00 +0000

SW360 “Generate License Info” Page Test Cases

General Page Behavior

Page Similarity

Test Case ID: PROJ-LI-AU-001
Description: Verify that the page shown when the “Generate License Info” button is clicked in the “License Clearing Tab” is similar to the Attachment Usages page.
Steps:
1. Navigate to the “License Clearing Tab” in a project.
2. Click on the “Generate License Info” button.
Expected Result: A page similar to the Attachment Usages page is shown.

Top Buttons and Toggles

Test Case ID: PROJ-LI-AU-002
Description: Verify the presence of the “Download” button and the “Show All” or “Only Approved” toggle on top. The “Only Approved” toggle should show only approved CLI attachments.
Steps:
1. Navigate to the “Generate License Info” page.
2. Locate the top section of the page.
3. Click on the “Only Approved” toggle.
Expected Result: The “Download” button and toggles are present. The “Only Approved” toggle shows only approved CLI attachments.

Selection Restore Message

Test Case ID: PROJ-LI-AU-003
Description: Verify the display of the selection restore message.
Steps:
1. Navigate to the “Generate License Info” page.
2. Locate the message section.
Expected Result: The selection restore message is displayed.

License Info Table

Columns

Test Case ID: PROJ-LI-AU-004
Description: Verify the presence of the specified columns in the License Info Table.
Steps:
1. Navigate to the “Generate License Info” page.
2. Locate the License Info Table.
3. Verify the presence of the following columns:
  - Checkbox (clicking will uncheck all checkboxes (except self) and restore selection at page load)
  - Lvl (starts at 1, increases at each subproject)
  - Name
  - Conclusions
  - Type
  - State
  - Uploaded by
  - Clearing Team
Expected Result: All specified columns are present and function as described.

Row Colors

Test Case ID: PROJ-LI-AU-005
Description: Verify the row colors based on the number of attachments.
Steps:
1. Navigate to the “Generate License Info” page.
2. Locate the License Info Table.
3. Verify the row colors:
  - Red for no attachments
  - Green for 1 attachment
  - Yellow for more than 1 attachment
Expected Result: The row colors are displayed as specified.

Release Clearing State

Test Case ID: PROJ-LI-AU-006
Description: Verify that the State column displays the Release’s clearing state.
Steps:
1. Navigate to the “Generate License Info” page.
2. Locate the License Info Table.
Expected Result: The State column displays the Release’s clearing state.

Attachment Rows

Test Case ID: PROJ-LI-AU-007
Description: Verify the details displayed for each attachment row.
Steps:
1. Navigate to the “Generate License Info” page.
2. Locate the License Info Table.
3. Click on an attachment row to expand it.
4. Verify the presence of the following details:
  - Checkbox if License Info is selected for the attachment
  - Level number
  - If file ends with .rdf and concluded license is enabled, a checkbox for that
  - If used in number of projects else show “Not used in any projects yet” in the Type column
  - Attachment status
  - Uploader name
  - Uploader Department
Expected Result: All specified details are present and function as described.

Expanded Attachment Details

Test Case ID: PROJ-LI-AU-008
Description: Verify the details displayed when an attachment is expanded.
Steps:
1. Navigate to the “Generate License Info” page.
2. Locate the License Info Table.
3. Click on an attachment row to expand it.
4. Verify the presence of the following details:
  - Lvl
  - Name of license
  - License text from the CLI
5. Click on a license name to verify the checkbox behavior.
Expected Result: The specified details are present and function as described. Clicking on a license name enables the checkbox of the attachment, and individual licenses can be excluded.

Subprojects

Test Case ID: PROJ-LI-AU-009
Description: Verify the presence of the “Use selection of this subproject” button and the warning next to it. Clicking this button should import the usage for the subproject.
Steps:
1. Navigate to the “Generate License Info” page.
2. Locate the subproject section.
3. Click on the “Use selection of this subproject” button.
Expected Result: The button and warning are present. Clicking the button imports the usage for the subproject.

Download Button

Report Generation Options

Test Case ID: PROJ-LI-AU-010
Description: Verify that clicking the “Download” button shows a report generation options popup. Clicking “Download” on the popup triggers the report and also saves the attachment usage of the current page.
Steps:
1. Navigate to the “Generate License Info” page.
2. Click on the “Download” button.
3. Verify the report generation options popup.
4. Click on the “Download” button in the popup.
Expected Result: The report generation options popup is shown. Clicking “Download” in the popup triggers the report and saves the attachment usage of the current page.

Project - Source Bundle Usages

Mon, 01 Jan 0001 00:00:00 +0000

SW360 “Generate Source Code Bundle” Page Test Cases

General Page Behavior

Page Similarity

Test Case ID: PROJ-SCB-AU-001
Description: Verify that the page shown when the “Generate Source Code” button is clicked in the “License Clearing Tab” is similar to the Generate License Info usage page.
Steps:
1. Navigate to the “License Clearing Tab” in a project.
2. Click on the “Generate Source Code” button.
Expected Result: A page similar to the Generate License Info usage page is shown.

Top Button

Test Case ID: PROJ-SCB-AU-002
Description: Verify the presence of the “Download” button on top.
Steps:
1. Navigate to the “Generate Source Code Bundle” page.
2. Locate the top section of the page.
Expected Result: The “Download” button is present.

Selection Restore Message

Test Case ID: PROJ-SCB-AU-003
Description: Verify the display of the selection restore message.
Steps:
1. Navigate to the “Generate Source Code Bundle” page.
2. Locate the message section.
Expected Result: The selection restore message is displayed.

Source Code Bundle Table

Columns

Test Case ID: PROJ-SCB-AU-004
Description: Verify the presence of the specified columns in the Source Code Bundle Table.
Steps:
1. Navigate to the “Generate Source Code Bundle” page.
2. Locate the Source Code Bundle Table.
3. Verify the presence of the following columns:
  - Checkbox (clicking will uncheck all checkboxes (except self) and restore selection at page load)
  - Lvl (starts at 1, increases at each subproject)
  - Name
  - Conclusions
  - Type
  - State
  - Uploaded by
  - Clearing Team
Expected Result: All specified columns are present and function as described.

Attachment Type

Test Case ID: PROJ-SCB-AU-005
Description: Verify that the table displays only attachments of type SRC, and they cannot be expanded.
Steps:
1. Navigate to the “Generate Source Code Bundle” page.
2. Locate the Source Code Bundle Table.
Expected Result: Only attachments of type SRC are displayed, and they cannot be expanded.

Row Colors

Test Case ID: PROJ-SCB-AU-006
Description: Verify the row colors based on the number of attachments.
Steps:
1. Navigate to the “Generate Source Code Bundle” page.
2. Locate the Source Code Bundle Table.
3. Verify the row colors:
  - Red for no attachments
  - Green for 1 attachment
  - Yellow for more than 1 attachment
Expected Result: The row colors are displayed as specified.

Release Clearing State

Test Case ID: PROJ-SCB-AU-007
Description: Verify that the State column displays the Release’s clearing state.
Steps:
1. Navigate to the “Generate Source Code Bundle” page.
2. Locate the Source Code Bundle Table.
Expected Result: The State column displays the Release’s clearing state.

Attachment Rows

Test Case ID: PROJ-SCB-AU-008
Description: Verify the details displayed for each attachment row.
Steps:
1. Navigate to the “Generate Source Code Bundle” page.
2. Locate the Source Code Bundle Table.
3. Verify the presence of the following details:
  - Checkbox if License Info is selected for the attachment
  - Level number
  - If used in number of projects else show “Not used in any projects yet” in the Type column
  - Attachment status
  - Uploader name
  - Uploader Department
Expected Result: All specified details are present and function as described.

Download Button

Report Generation

Test Case ID: PROJ-SCB-AU-009
Description: Verify that clicking the “Download” button triggers the bungle generation and saves the attachment usage of the current page.
Steps:
1. Navigate to the “Generate Source Code Bundle” page.
2. Click on the “Download” button.
Expected Result: The bundle is generated, and the attachment usage of the current page is saved.

Authorization Concept

Mon, 01 Jan 0001 00:00:00 +0000

SW360 uses a tiered authorization model that balances global roles with granular, record-level access. In v20, the architecture clearly separates Authentication (handled by Keycloak or an OIDC provider) from Authorization (handled by the SW360 Backend using CouchDB as the source of truth).

Role Management

Role management is performed through the SW360 Frontend in the Admin > Users section. An administrator can search for users and modify their primary and secondary roles. These changes are stored in CouchDB and synchronized to Keycloak (if enabled) via federation.

Components Page

Mon, 01 Jan 0001 00:00:00 +0000

SW360 “Main Components” Page Test Cases

Advance Search on the Left Hand

Search Fields

Test Case ID: COMP-001
Description: Verify that the advance search on the left hand contains the specified search fields.
Steps:
1. Navigate to the Main Components page.
2. Locate the advance search section on the left hand.
3. Verify the presence of the following search fields:
  - Component Name
  - Categories
  - Component Type (one of OSS, COTS, Internal, Inner Source, Service, Freeware, Code Snippet)
  - Languages (type to get defaults)
  - Software Platforms (type to get defaults)
  - Operating Systems (type to get defaults)
  - Vendors (type to get values)
  - Main licenses
  - Created by
  - Created on (with filter type adding or removing date field)
  - A checkbox “Exact Match” with a Search button
Expected Result: All specified search fields are present.

Search Behavior

Test Case ID: COMP-002
Description: Verify the search behavior based on the “Exact Match” checkbox.
Steps:
1. Navigate to the Main Components page.
2. Locate the advance search section on the left hand.
3. Enter search criteria in the search fields.
4. Perform a search without checking the “Exact Match” checkbox.
5. Verify that the endpoint has “luceneSearch=true” and uses full-text search.
6. Check the “Exact Match” checkbox and perform a search.
7. Verify that the endpoint has “luceneSearch=false” and uses exact match.
Expected Result: The search behavior changes based on the “Exact Match” checkbox.

Buttons in Middle

“Add Component” Button

Test Case ID: COMP-003
Description: Verify that the “Add Component” button opens a form to create a new component.
Steps:
1. Navigate to the Main Components page.
2. Click on the “Add Component” button.
Expected Result: A form to create a new component is opened.

Test Case ID: COMP-004
Description: Verify that the “Export Spreadsheet” dropdown generates an Excel of the search result with either “Components only” or “Components with releases”.
Steps:
1. Navigate to the Main Components page.
2. Perform a search using the advance search fields.
3. Click on the “Export Spreadsheet” dropdown and select an option.
4. Verify that the exported sheet has restricted data based on the advance search values from the left panel.
5. Check if the file is downloaded or if a message is shown indicating that an email will be sent based on server configuration.
Expected Result: The Excel file is generated with the correct data, and the file is either downloaded or an email is sent based on server configuration.

Table in Middle

Page Size

Test Case ID: COMP-005
Description: Verify that the table can change page size, with a default of 10.
Steps:
1. Navigate to the Main Components page.
2. Locate the table in the middle.
3. Change the page size and verify the default is 10.
Expected Result: The table page size can be changed, and the default is 10.

“Print” Button

Test Case ID: COMP-006
Description: Verify that the “Print” button on the right prints the Table HTML component to the browser.
Steps:
1. Navigate to the Main Components page.
2. Locate the “Print” button on the right of the table.
3. Click on the “Print” button.
Expected Result: The Table HTML component is printed to the browser.

Column “Vendor”

Test Case ID: COMP-007
Description: Verify that the “Vendor” column displays the vendor name.
Steps:
1. Navigate to the Main Components page.
2. Locate the “Vendor” column in the table.
Expected Result: The vendor name is displayed.

Column “Component Name”

Test Case ID: COMP-008
Description: Verify that the “Component Name” column displays the component name with a clickable link to open the component.
Steps:
1. Navigate to the Main Components page.
2. Locate the “Component Name” column in the table.
3. Click on a component name to open the component.
Expected Result: The component name is displayed, and clicking on it opens the component.

Column “Main licenses”

Test Case ID: COMP-009
Description: Verify that the “Main licenses” column displays truncated lists of main licenses, with a clickable link to open the license.
Steps:
1. Navigate to the Main Components page.
2. Locate the “Main licenses” column in the table.
Expected Result: The truncated lists of main licenses are displayed, and clicking on a license opens the license.

Column “Component Type”

Test Case ID: COMP-010
Description: Verify that the “Component Type” column displays the component type.
Steps:
1. Navigate to the Main Components page.
2. Locate the “Component Type” column in the table.
Expected Result: The component type is displayed.

Column “Actions”

Test Case ID: COMP-011
Description: Verify that the “Actions” column shows an Edit Icon or Delete icon.
Steps:
1. Navigate to the Main Components page.
2. Locate the “Actions” column in the table.
Expected Result: The Edit Icon or Delete icon is displayed.

Pagination Components

Test Case ID: COMP-012
Description: Verify that the table bottom has pagination components.
Steps:
1. Navigate to the Main Components page.
2. Locate the table in the middle.
3. Scroll to the bottom of the table and verify the presence of pagination components.
Expected Result: Pagination components are present at the bottom of the table.

Release Signing

Mon, 01 Jan 0001 00:00:00 +0000

Release Signing and Verification

To ensure the integrity and authenticity of SW360 deliverables, we use cryptographic signing for both our container images and source code tags.

Container Image Signing (Cosign)

All Docker images published to the GitHub Container Registry (GHCR) are signed using Sigstore/Cosign with keyless signing (OIDC). This process links the image to the specific GitHub Action workflow that built it.

How to Verify

Install Cosign: Follow the official installation guide.

Add Component

Mon, 01 Jan 0001 00:00:00 +0000

SW360 “Add Component” Page Test Cases

General Page Behavior

New Page Opening

Test Case ID: COMP-CRT-013
Description: Verify that upon clicking “Add Component,” a new page opens with a message on top “Creating new Component.”
Steps:
1. Navigate to the Main Components page.
2. Click on the “Add Component” button.
Expected Result: A new page opens with the message “Creating new Component” on top.

Summary Tab

General Information Section

Test Case ID: COMP-CRT-014
Description: Verify the “General Information” section in the Summary Tab.
Steps:
1. Navigate to the “Add Component” page.
2. Locate the “General Information” section.
3. Verify the presence of the following fields:
  - Name (required)
  - Created by
  - Categories (required) (type to auto complete)
  - Component Type (required) (one of OSS, COTS, Internal, Inner Source, Service, Freeware, Code Snippet) (info hover beneath)
  - CycloneDX Component Type (one of CDX type) (info hover beneath)
  - Default vendor (click to open vendor popup) (clear button beneath)
  - Homepage URL
  - VCS/Repository URL
  - Block URL
  - Wiki URL
  - Mailing List URL
  - Short Description (text area)
  - Modified By
Expected Result: All specified fields are present and function as described.

Roles Section

Test Case ID: COMP-CRT-015
Description: Verify the “Roles” section in the Summary Tab.
Steps:
1. Navigate to the “Add Component” page.
2. Locate the “Roles” section.
3. Verify the presence of the following fields:
  - Component Owner (single value)
  - Owner Accounting Unit
  - Owner Billing Group
  - Owner Country
  - Moderators (multi value)
Expected Result: All specified fields are present and function as described.

Additional Roles Section

Test Case ID: COMP-CRT-016
Description: Verify the “Additional Roles” section in the Summary Tab.
Steps:
1. Navigate to the “Add Component” page.
2. Locate the “Additional Roles” section.
3. Click on the “Click to add row to Additional Roles” button.
Expected Result: A new row is added for additional roles.

External Ids Section

Test Case ID: COMP-CRT-017
Description: Verify the “External Ids” section in the Summary Tab.
Steps:
1. Navigate to the “Add Component” page.
2. Locate the “External Ids” section.
3. Click on the “Click to add row to External Ids” button.
4. Verify the presence of the following fields in the new row:
  - External Id key on the left
  - Type to get default values
  - External Id value on the right
  - Row delete button on the end
Expected Result: A new row is added with the specified fields.

Additional Data Section

Test Case ID: COMP-CRT-018
Description: Verify the “Additional Data” section in the Summary Tab.
Steps:
1. Navigate to the “Add Component” page.
2. Locate the “Additional Data” section.
3. Click on the “Click to add row to Additional Data” button.
Expected Result: A new row is added for additional data.

Create Component Button

Component Creation

Test Case ID: COMP-CRT-019
Description: Verify that upon hitting the “Create Component” button, the component is saved, and the user is redirected to the component edit page for the newly created component.
Steps:
1. Navigate to the “Add Component” page.
2. Fill in the required fields and any additional information.
3. Click on the “Create Component” button.
Expected Result: The component is saved, and the user is redirected to the component edit page for the newly created component.

Keycloak Authentication

Mon, 01 Jan 0001 00:00:00 +0000

This guide covers the installation and configuration of Keycloak for SW360. While manual configuration is possible, using the provided Terraform scripts is the highy recommended approach to maintain a modern, version-controlled authentication setup.

Installation (Brief)

Prerequisites:

Java 21: Ensure OpenJDK 21 is installed and JAVA_HOME is set.

PostgreSQL: Install PostgreSQL 14 or higher and create a database/user for Keycloak:

CREATE USER keycloak WITH ENCRYPTED PASSWORD 'mystrongpassword';
CREATE DATABASE keycloak;
GRANT ALL PRIVILEGES ON DATABASE keycloak TO keycloak;

Keycloak: Download the latest Keycloak (e.g., v26+) and extract it to /opt/keycloak.

Keycloak Configuration (`keycloak.conf`)

For a development setup, you can use the following keycloak.conf. For production, refer to the Production Tips below.

Edit Component

Mon, 01 Jan 0001 00:00:00 +0000

SW360 “Edit Component” Page Test Cases

General Page Behavior

Info Message on Page Load

Test Case ID: COMP-EDIT-001
Description: Verify the info message on top on page load: “Success: You are editing the original document.”
Steps:
1. Navigate to the “Edit Component” page.
Expected Result: The info message “Success: You are editing the original document.” is displayed on top.

Summary Tab

General Information Section

Test Case ID: COMP-EDIT-002
Description: Verify the “General Information” section in the Summary Tab.
Steps:
1. Navigate to the “Edit Component” page.
2. Locate the “General Information” section.
3. Verify the presence of the following fields:
  - Name (required)
  - Created by
  - Categories (required) (type to auto complete)
  - Component Type (required) (one of OSS, COTS, Internal, Inner Source, Service, Freeware, Code Snippet) (info hover beneath)
  - CycloneDX Component Type (one of CDX type) (info hover beneath)
  - Default vendor (click to open vendor popup) (clear button beneath)
  - Homepage URL
  - VCS/Repository URL
  - Block URL
  - Wiki URL
  - Mailing List URL
  - Short Description (text area)
  - Modified By
Expected Result: All specified fields are present and function as described.

Roles Section

Test Case ID: COMP-EDIT-003
Description: Verify the “Roles” section in the Summary Tab.
Steps:
1. Navigate to the “Edit Component” page.
2. Locate the “Roles” section.
3. Verify the presence of the following fields:
  - Component Owner (single value)
  - Owner Accounting Unit
  - Owner Billing Group
  - Owner Country
  - Moderators (multi value)
Expected Result: All specified fields are present and function as described.

Additional Roles Section

Test Case ID: COMP-EDIT-004
Description: Verify the “Additional Roles” section in the Summary Tab.
Steps:
1. Navigate to the “Edit Component” page.
2. Locate the “Additional Roles” section.
3. Click on the “Click to add row to Additional Roles” button.
Expected Result: A new row is added for additional roles.

External Ids Section

Test Case ID: COMP-EDIT-005
Description: Verify the “External Ids” section in the Summary Tab.
Steps:
1. Navigate to the “Edit Component” page.
2. Locate the “External Ids” section.
3. Click on the “Click to add row to External Ids” button.
4. Verify the presence of the following fields in the new row:
  - External Id key on the left
  - Type to get default values
  - External Id value on the right
  - Row delete button on the end
Expected Result: A new row is added with the specified fields.

Additional Data Section

Test Case ID: COMP-EDIT-006
Description: Verify the “Additional Data” section in the Summary Tab.
Steps:
1. Navigate to the “Edit Component” page.
2. Locate the “Additional Data” section.
3. Click on the “Click to add row to Additional Data” button.
Expected Result: A new row is added for additional data.

Releases Tab

Releases Table

Test Case ID: COMP-EDIT-007
Description: Verify the table with releases in the Releases Tab.
Steps:
1. Navigate to the “Edit Component” page.
2. Locate the Releases Tab.
3. Verify the presence of a table with the following column:
  - Name Version (clickable link to release)
Expected Result: The table with the specified column is present.

Add Releases Button

Test Case ID: COMP-EDIT-008
Description: Verify the “Add Releases” button in the Releases Tab.
Steps:
1. Navigate to the “Edit Component” page.
2. Locate the Releases Tab.
3. Click on the “Add Releases” button.
Expected Result: A new page opens to create a release.

Attachments Tab

Attachments Table

Test Case ID: /sw360/docs/development/completiontests/projects-edit/#attachments-table

Security Best Practices

Mon, 01 Jan 0001 00:00:00 +0000

Securing an SW360 deployment involves multiple layers, from the infrastructure and container orchestration to the application and identity management. For v20, the architecture relies on a microservices stack (Spring Boot, Next.js, Keycloak) which necessitates new security patterns.

Recommended: Container-Based Security

The easiest way to manage a secure SW360 instance is through container-based deployments using Docker or Podman. This allows for clear service isolation and centralized secret management.

1. Secret Management

Never store plain-text passwords in environment variables if possible. Use Docker Secrets for sensitive data:

Component Details

Mon, 01 Jan 0001 00:00:00 +0000

SW360 “Component Details” Page Test Cases

General Page Behavior

Top Buttons

Test Case ID: COMP-DTL-001
Description: Verify the presence of the “Edit Component”, “Merge”, “Split”, and “Subscribe”/“Unsubscribe” buttons on top.
Steps:
1. Navigate to the “Component Details” page.
2. Locate the top section of the page.
Expected Result: The specified buttons are present.

Summary Tab

Description of Component

Test Case ID: COMP-DTL-002
Description: Verify the presence of the description of the component in the Summary Tab.
Steps:
1. Navigate to the “Component Details” page.
2. Locate the Summary Tab.
Expected Result: The description of the component is present.

General Section

Test Case ID: COMP-DTL-003
Description: Verify the “General” section in the Summary Tab.
Steps:
1. Navigate to the “Component Details” page.
2. Locate the “General” section in the Summary Tab.
3. Verify the presence of the following fields:
  - ID of the Component
  - Name
  - Created on
  - Created by (mailto link)
  - Modified on
  - Modified by (mailto link)
  - Component Type
  - CycloneDX Component Type
  - Default vendor (can be clickable link)
  - Homepage (click URL)
  - VCS/Repository URL (click URL)
  - Block (click URL)
  - Wiki (click URL)
  - Miling list (click URL)
  - External IDs (as UL, key in bold, value next to it)
  - Additional data (same as External IDs)
Expected Result: All specified fields are present and function as described.

Release Aggregate Data Section

Test Case ID: COMP-DTL-004
Description: Verify the “Release Aggregate Data” section in the Summary Tab.
Steps:
1. Navigate to the “Component Details” page.
2. Locate the “Release Aggregate Data” section in the Summary Tab.
3. Verify the presence of the following details as a comma-separated list:
  - Vendors
  - Languages
  - Platforms
  - Operating Systems
  - Main licenses
Expected Result: The specified details are present as a comma-separated list.

Roles Section

Test Case ID: COMP-DTL-005
Description: Verify the “Roles” section in the Summary Tab.
Steps:
1. Navigate to the “Component Details” page.
2. Locate the “Roles” section in the Summary Tab.
3. Verify the presence of the following fields:
  - Component Owner (mailto link)
  - Owner Accounting Unit
  - Owner Billing Group
  - Owner Country
  - Moderators (comma-separated mailto list)
  - Subscribers (comma-separated mailto list)
  - Additional Roles
4. Verify that all users displayed are mailto links.
Expected Result: All specified fields are present and function as described.

Component Used By

Test Case ID: COMP-DTL-006
Description: Verify the display of the total count of visible and restricted projects using the component.
Steps:
1. Navigate to the “Component Details” page.
2. Locate the Summary Tab.
Expected Result: The total count of visible and restricted projects using the component is displayed.

Table to Visible Projects

Test Case ID: COMP-DTL-007
Description: Verify the table of visible projects with the specified columns.
Steps:
1. Navigate to the “Component Details” page.
2. Locate the Summary Tab.
3. Verify the presence of a table with the following columns:
  - Project name (with version, clickable link to open project)
  - Group
  - Responsible
Expected Result: The table with the specified columns is present.

Component Used By Other Components

Test Case ID: COMP-DTL-020
Description: Verify the display of the table “Component name is used by the following components” if a release of the current component is linked to another release of another component.
Steps:
1. Navigate to the “Component Details” page.
2. Locate the Summary Tab.
3. Verify the presence of a table with the following columns:
  - Vendor
  - Name (Link to open component)
  - Main licenses
  - Component Type
Expected Result: The table with the specified columns is present if a release of the current component is linked to another release of another component.

Release Overview Tab

Releases Table

Test Case ID: COMP-DTL-008
Description: Verify the table of releases in the Release Overview Tab.
Steps:
1. Navigate to the “Component Details” page.
2. Locate the Release Overview Tab.
3. Verify the presence of a table with the following columns:
  - Name
  - Version (click to open release)
  - Clearing State
  - Clearing Report (download link to approved reports, hover to see filename, status, comment, and created)
  - Release Mainline State
  - Action (FOSSology, edit, duplicate, link project, merge, delete)
4. Verify the presence of a search bar on top.
Expected Result: The table with the specified columns is present, and the search bar is functional.

Attachments Tab

Attachments Table

Test Case ID: PROJ-DTL-016

Vulnerabilities Tab

Tab Name and Count

Test Case ID: COMP-DTL-010
Description: Verify the display of “number of checked or unchecked vulnerabilities + number of incorrect vulnerabilities” on the tab name.
Steps:
1. Navigate to the “Component Details” page.
2. Locate the Vulnerabilities Tab.
Expected Result: The specified count is displayed on the tab name.

Total Vulnerabilities

Test Case ID: COMP-DTL-011
Description: Verify the display of the total number of vulnerabilities on top.
Steps:
1. Navigate to the “Component Details” page.
2. Locate the Vulnerabilities Tab.
Expected Result: The total number of vulnerabilities is displayed on top.

Vulnerabilities Table

Test Case ID: COMP-DTL-012
Description: Verify the vulnerabilities table as per test cases DTL-017 & DTL-020.
Steps:
1. Navigate to the “Component Details” page.
2. Locate the Vulnerabilities Tab.
3. Verify the presence of a table with the specified columns.
Expected Result: The table with the specified columns is present.

Changing Vulnerability State

Test Case ID: COMP-DTL-013
Description: Verify the behavior when changing the state of selected vulnerability rows.
Steps:
1. Navigate to the “Component Details” page.
2. Locate the Vulnerabilities Tab.
3. Select vulnerability rows to change the state.
4. Verify that the updated row’s verification column updates the state.
5. Verify that the hover icon says “You just changed this value. Please reload page.”
6. Verify that the count from point a changes to a reload icon with a warning background.
Expected Result: The specified behavior is observed when changing the state of selected vulnerability rows.

Change Log Tab

Change Log Table

Test Case ID: PROJ-DTL-021, PROJ-DTL-022, PROJ-DTL-023, PROJ-DTL-024, PROJ-DTL-025 and PROJ-DTL-026

Data Backup Strategy

Mon, 01 Jan 0001 00:00:00 +0000

Regular backups are critical for maintaining the integrity and availability of your SW360 instance. Given the importance of compliance data, a robust backup strategy ensures that you can recover from hardware failures, data corruption, or accidental deletions.

Backup Frequency & Retention Policy

For production environments, the following retention policy is recommended as a baseline:

Backup Type	Frequency	Retention Period
High-Frequency	Every 24 hours	14 days
Long-Term	Every 30 days	1 year

Recommended: Offline Backups

For SW360 v20+, offline backups are the recommended method for ensuring maximum data consistency. This involves briefly stopping the services to capture a point-in-time snapshot of the underlying databases and configuration files.

ADR Template (DAR/SWOT)

Mon, 01 Jan 0001 00:00:00 +0000

ADR Template: Decision Analysis and Resolution (DAR)

Template Version: 1.0
Based on: ABT UI Technology Stack Decision Framework
Approach: SWOT Analysis + T-Shirt Sizing for Weighted Criteria Evaluation

ADR-XXX: [Decision Title]

Created by: [Author Name]
Last updated: [Date]
Estimated read time: [X] minutes

Background

[Describe the experience and context that led to this decision point. Include:]

Business Rule Specification Template

Mon, 01 Jan 0001 00:00:00 +0000

Business Rule Specification Template

Template Version: 1.0
Standards Basis: OMG SBVR / RuleSpeak® + Specification by Example (SBE) / ISO/IEC/IEEE 29148 + EARS

---
id: "BR-[DOMAIN]-[NNN]"
title: "[Rule Title]"
domain: "[Projects | Components | Releases | Licenses | Clearing | Security]"
rule_type: "[Behavioral | Definitional | Constraint]"
status: "[Draft | Approved | Deprecated]"
governing_config: "[Optional configuration key or none]"
impacted_services:
 - "[ServiceName / Component]"
related_issues:
 - "[#IssueNumber]"
last_verified: "YYYY-MM-DD"
---

1. Executive Summary & Statement

1.1 Formal Statement (RuleSpeak® / EARS)

While [precondition state, e.g. entity in status X],
If [condition/trigger, e.g. configuration property Y is enabled],
Then the system shall [allow/deny/execute specific behavior].
Otherwise, the system shall [fallback / default behavior].

1.2 Purpose & Risk Mitigated

[Describe why this business rule exists, what business or operational risks it prevents, and the domain rationale.]

Create Release

Mon, 01 Jan 0001 00:00:00 +0000

SW360 “Add Releases” Page Test Cases

General Page Behavior

Button Visibility

Test Case ID: RED-CRT-001
Description: Verify that the button to open the “Add Releases” page is visible from the “Edit Component” page, under the “Releases” Tab only.
Steps:
1. Navigate to the “Edit Component” page.
2. Locate the “Releases” Tab.
Expected Result: The button to open the “Add Releases” page is present.

Summary Tab

Release Summary Section

Test Case ID: RED-CRT-002
Description: Verify the “Release Summary” section in the Summary Tab.
Steps:
1. Navigate to the “Add Releases” page.
2. Locate the “Release Summary” section in the Summary Tab.
3. Verify the presence of the following fields in the form:
  - Vendor (set the default value if Component has default vendor set) (clear button beneath)
  - Name (required, readonly with component name)
  - Version (required)
  - Programming Languages (type to get default values, multivalue)
  - Operating Systems (type to get default values, multivalue)
  - CPE ID (hover info beneath)
  - Software Platforms (type to get default values, multivalue)
  - Release date
  - Main Licenses (multivalue)
  - Other licenses (multivalue)
  - Source Code Download URL
  - Binary Download URL
  - Clearing State (New, readonly)
  - Release Mainline State (dropdown, with info hover beneath)
  - Created On
  - Created By
  - Contributors (multivalue)
  - Moderators (multivalue)
  - Modified On
  - Modified By
Expected Result: All specified fields are present and function as described.

Additional Roles Section

Test Case ID: RED-CRT-003
Description: Verify the “Additional Roles” section in the Summary Tab.
Steps:
1. Navigate to the “Add Releases” page.
2. Locate the “Additional Roles” section in the Summary Tab.
3. Click on the “Click to add row to Additional Roles” button.
Expected Result: A new row is added for additional roles.

External IDs Section

Test Case ID: RED-CRT-004
Description: Verify the “External IDs” section in the Summary Tab.
Steps:
1. Navigate to the “Add Releases” page.
2. Locate the “External IDs” section in the Summary Tab.
3. Click on the “Click to add row to External Ids” button.
4. Verify the presence of the following fields in the new row:
  - External Id key on the left
  - Type to get default values
  - External Id value on the right
  - Row delete button on the end
Expected Result: A new row is added with the specified fields.

Additional Data Section

Test Case ID: RED-CRT-005
Description: Verify the “Additional Data” section in the Summary Tab.
Steps:
1. Navigate to the “Add Releases” page.
2. Locate the “Additional Data” section in the Summary Tab.
3. Click on the “Click to add row to Additional Data” button.
Expected Result: A new row is added for additional data.

Release Repository Section

Test Case ID: RED-CRT-006
Description: Verify the “Release Repository” section in the Summary Tab.
Steps:
1. Navigate to the “Add Releases” page.
2. Locate the “Release Repository” section in the Summary Tab.
3. Verify the presence of the following fields:
  - Repository Type (dropdown)
  - Repository URL (textbox)
Expected Result: The specified fields are present and function as described.

Linked Releases Tab

Click to Add Releases Button

Test Case ID: RED-CRT-007
Description: Verify the “Click to add Releases” button and the releases table in the Linked Releases Tab.
Steps:
1. Navigate to the “Add Releases” page.
2. Locate the Linked Releases Tab.
3. Click on the “Click to add Releases” button.
4. Verify the presence of a table with the following columns:
  - Vendor name
  - Release name
  - Release version
  - Release relation (info hover) (dropdown)
  - delete icon
Expected Result: The button and table with the specified columns are present.

Linked Packages Tab

Add Packages Button

Test Case ID: RED-CRT-008
Description: Verify the “Add Packages” button and the table in the Linked Packages Tab.
Steps:
1. Navigate to the “Add Releases” page.
2. Locate the Linked Packages Tab.
3. Click on the “Add Packages” button.
4. Verify the presence of a table with the following columns:
  - Package Name
  - Package Version
  - License
  - Package Manager
  - delete icon
Expected Result: The button and table with the specified columns are present.

Create Release Button

Release Creation

Test Case ID: RED-CRT-009
Description: Verify that upon clicking the “Create Release” button, the release is created, and the user is redirected to the “Edit Release” page of the created release.
Steps:
1. Navigate to the “Add Releases” page.
2. Fill in the required fields and any additional information.
3. Click on the “Create Release” button.
Expected Result: The release is created, and the user is redirected to the “Edit Release” page of the created release.

Dependency Network Feature

Mon, 01 Jan 0001 00:00:00 +0000

How to enable this feature

To use this function, please:

Build the source code and deploy.
Add config enable.flexible.project.release.relationship=true (/etc/sw360/sw360.properties) to enable the feature.

The following changes will work when enable.flexible.project.release.relationship=true only.

Use the migration script (056_migrate_project_dependency_network.py) we provided to mograte the database.

Before you run the script, please change two places in the script:

(1) Line 30: DRY_RUN = True -> DRY_RUN = False

(2) Line 32: COUCHSERVER = 'http://localhost:5984/' -> COUCHSERVER = 'http://admin:password@localhost:5984/'

Export and Import

Mon, 01 Jan 0001 00:00:00 +0000

- note that only export and import of users is active,
- everything else is deprecated functionality.
- The export and import functionality has not been
- updated at some point and thus will not function
- properly anymore.

Full Export

The easiest way to fully export the data is to copy all the .couch files of Couch-DB. Where the files are can be found out from Futon. e.g.

http://localhost:5984/_utils/config.html

under

Initial Setup of Liferay 6.2 and sw360

Mon, 01 Jan 0001 00:00:00 +0000

Liferay administrator steps

This part describes how to setup a new liferay instance after you went through the initial Liferay setup: create an admin account, confirm the license and terms and fill out your personal details. Alternatively in the sw360vagrant or the sw360chores deployment, the default setup user credentials are setup@sw360.org with the unsafe password sw360fossy.

Login as setup administrator (if you are using the default unsafe password, you should replace it on productive instances)

Initial Setup of Liferay 7.2 and sw360

Mon, 01 Jan 0001 00:00:00 +0000

Starting SW360 for the First Time

So, the vagrant setup has deployed sw360, but unfortunately, there is some major issue: With Liferay, certain configuration need to be applied manually in the UI. If you would know how to import *.lar files and apply some setting from the command line (without implementing an approach based on HTML testing frameworks, like selenium), please let us know.

Until then, some tasks need to be done manually, after everything has been built up:

Initial Setup of Liferay 7.3 and sw360

Mon, 01 Jan 0001 00:00:00 +0000

After successful installation, the vagrant ends like the following terminal output:

Then if you open the server with the URL https://localhost:8443/ the following screen should appear:

Note that the actual image changes with every liferay version. If there is weird html output without images and plain text, then likely some port settings did not work and the pages generated have wrong URLs inside.

Sign in_the icon_the upper left corner. If you did not change the values in configuration.rbthe default login is setup@sw360.org and sw360fossy.

Liferay 7.3 and Java 11

Mon, 01 Jan 0001 00:00:00 +0000

Introduction

We are covering the update for ubuntu here, because that is our main / agreed base system for running sw360. sw360 may run on a varienty of other linux distributions or OSes such as macosx, but in order to avoid problem we agreed on having a reference OS, which are the ubuntu long term releases.

With the update to Java 11, we upgraded from Ubuntu 16.04 to Ubuntu 18.04, both LTS version. This OS is used for example by the https://github.com/sw360/sw360vagrant project.

Native Install v14 and v16

Mon, 01 Jan 0001 00:00:00 +0000

How to install and run SW360 v16.0.0

These instructions worked on Ubuntu 20.04 and has detailed explanations for newcomers.

This is a guide with detailed explanation of how to install and run SW360 natively on you local machine. It includes installation of all dependencies manually, which will not use docker or other container system during the installation or run.

SW360 is an Open Source project. The SW360 repository and SW360 website repositories are published on GitHub.

Native Install v17

Mon, 01 Jan 0001 00:00:00 +0000

How to install and run SW360 v17.0.0

These instructions worked on Ubuntu 20.04 and has detailed explanations for newcomers.

SW360 is an Open Source project. The SW360 repository and SW360 website repositories are published on GitHub.

Native Install v18.1

Mon, 01 Jan 0001 00:00:00 +0000

How to install and run SW360 v18.1.0

These instructions worked on Ubuntu 20.04 and has detailed explanations for newcomers.

SW360 is an Open Source project. The SW360 repository and SW360 website repositories are published on GitHub.

SPDX Document

Mon, 01 Jan 0001 00:00:00 +0000

How to enable this feature

To use this function, please:

Build the source code and deploy.
Add config spdx.document.enabled = true (/etc/sw360/sw360.properties) to enable the feature.

The following changes will work when spdx.document.enabled = true only.

Introduction

SPDX Document manages Document Creation Information, Package Information, Other Licensing Information Detected, Relationships between SPDX Elements, Annotations

How to use?

File Test Import

https://github.com/spdx/tools-java/blob/master/testResources/SPDXRdfExample-v2.3.spdx.rdf

Import SPDX in Page Component

Import

Support RDF/XML, SPDX.
Import all Packages in the SPDX file (main package and dependent packages)
Import relationships related to Packages and SPDX Documents (relationships related to File and Snippet are not imported)

Steps

Go to component page
Click “Import SPDX BOM” button
Upload SPDXRdfExample-v2.3.spdx.rdf

Validate

“Apache Commons Lang”, “glibc”, “Jena” and “Saxon” components were created
“glibc (2.11.1)”, “Saxon(8.8)” and " Jena (3.12.0) " releases were created
Tab SPDX Document exits in release glibc (2.11.1), Jena (3.12.0) and Saxon (8.8)

Result

Tab SPDX Document - Full Page of Release Glibc(2.11.1)

Tab SPDX Document - Lite Page of Release Glibc(2.11.1)

Tab SPDX Document - Full Page of Release Jena (3.12.0)

Tab SPDX Document - Lite Page of Release Jena (3.12.0)

Tab SPDX Document - Full Page of Release Saxon (8.8)

Tab SPDX Document - Lite Page of Release Saxon (8.8)

Feature: Edit, Add tab SPDX Document in Release

Edit tab SPDX Document - Full Page

Edit tab SPDX Document - Lite Page

Add tab SPDX Document

Ubuntu 18.04 LTS, Java 11

Mon, 01 Jan 0001 00:00:00 +0000

Introduction

We are covering the update for Ubuntu 18.04 LTS here because it is our main and agreed-upon base system for running SW360. While SW360 may run on a variety of other Linux distributions or operating systems such as macOS, we have agreed to use Ubuntu Long-Term Releases as a reference OS to avoid compatibility issues. The author of this guide also uses macOS with Homebrew, which works fairly well.

Upgrade Sw360 from 14.0 to 15.0

Mon, 01 Jan 0001 00:00:00 +0000

Upgrade SW360 version 15.0

1. Upgrade sw360 from 14.0 to 15.0

1.1 Checkout source code SW360 to Tag Version 15
1.2 Version of libraries
1.3 Migrate database
1.4 Build and deploy Sw360 Version 15.0

1.1 Checkout source code SW360 to Tag Version 15

Link contains source: https://github.com/eclipse/sw360.git

Path SW360_REPOSITORY = /home/user/work/sw360
Source code sw360 is in master branch with commit version 14.0 . User into ${SW360_REPOSITORY} use git checkout to tag version 15 on the master branch of SW360

Upgrade Sw360 from 15.0 to 16.0

Mon, 01 Jan 0001 00:00:00 +0000

Upgrade SW360 version 16.0

1. Upgrade sw360 from 15.0 to 16.0

1.1 Checkout source code SW360 to Tag Version 16
1.2 Version of libraries
1.3 Migrate database
1.4 Build and deploy Sw360 Version 16
1.5 Start and Configure Liferay

1.1 Create Folder contains source code SW360 to Tag Version 16

Link contains source: https://github.com/eclipse/sw360.git

Path SW360_REPOSITORY = /home/user/work15to16/sw360
Source code sw360 is in main branch with commit version 14.0 . User into ${SW360_REPOSITORY} use git checkout to tag version 16 on the main branch of SW360

Upgrade SW360 from 16.0 to 17.0

Mon, 01 Jan 0001 00:00:00 +0000

Checkout source code SW360 to Tag Version 17

Version of libraries

Migrate Database

Build and deploy SW360 Version 17

Start and Configure Liferay

Prepare source code to use release 17

Link contains source: https://github.com/eclipse/sw360.git

Path SW360_REPOSITORY = /home/user/work16to17/sw360
Source code sw360 is in main branch with commit version 16.0.0 . User into ${SW360_REPOSITORY} use git checkout to tag version 16 on the main branch of SW360
Checkout to tag Version 17.0.0

Upgrade SW360 from 17.00 to 18.1.0

Mon, 01 Jan 0001 00:00:00 +0000

Version of libraries

Checkout source code SW360 to Tag Version 18.1.0

Config Couchdb Lucene

Build and deploy

Start and Configure Liferay

Setup SW360 for Liferay: Import *.lar Files

Version of libraries

Package Name	Version
Liferay	7.4.3
Tomcat	9.0.56
Couchdb	3.2.2
Open JDK	11.0.15
Thrift	0.16.0

To check couchdb version: run curl http://localhost_or_yourcouchdbserver:5984 | json_pp

Prepare source code to use release 18.1.0

Link contains source: https://github.com/eclipse/sw360.git

Create folder to store new source code of version 18.1.0:

Version 20.x on Debian 12

Mon, 01 Jan 0001 00:00:00 +0000

Introduction

We are covering the installation for Debian based Linux distros. sw360 may run on a variety of other linux distributions or OSes such as Mac OSX (amd64 only).

This is a guide with detailed explanation of how to install and run SW360 natively on you local machine. It includes installation of all dependencies manually, and will not use docker or other container system during the installation or run.

Requirements

The installation consists of quite some tasks, as an overview:

Version 19.x on Debian 12

Mon, 01 Jan 0001 00:00:00 +0000

Introduction

We are covering the installation for Debian based Linux distros. sw360 may run on a variety of other linux distributions or OSes such as Mac OSX (amd64 only).

Requirements

The installation consists of quite some tasks, as an overview:

Legacy (v18.x) on Ubuntu / Debian

Mon, 01 Jan 0001 00:00:00 +0000

Introduction

We are covering the update for Debian based Linux distros, because that is our main / agreed base system for running sw360. sw360 may run on a variety of other linux distributions or OSes such as Mac OSX (amd64 only).

Requirements

The installation consists of quite some tasks, as an overview:

Java 11
Postgresql >= 15.x
CouchDB >= 3.2.x
Thrift 0.18.1
Liferay CE 7.4.3 GA18

Initial steps

In order to “calibrate the system” just run the update / upgrade cycle once:

CVE Scheduler

Mon, 01 Jan 0001 00:00:00 +0000

How to use SW360 CVE schedule

SW360 gets vulnerability information from Common Vulnerability Enumeration (CVE) data. SW360 can connect to your local cve-search server.
Few years ago, sw360 was able to get vulnerability information from online CVE serverr, but it is not active.

Install CVE-search

cve-search is a tool to import CVE (Common Vulnerabilities and Exposures) and CPE (Common Platform Enumeration) into a MongoDB to facilitate search and processing of CVEs. You can choose Docker install or Native install.

Edit Release

Mon, 01 Jan 0001 00:00:00 +0000

SW360 “Edit Release” Page Test Cases

Summary Tab

Release Summary Section

Test Case ID: EDIT-REL-001
Description: Verify the “Release Summary” section in the Summary Tab, which is the same as the “Add Releases” page.
Steps:
1. Navigate to the “Edit Release” page.
2. Locate the “Release Summary” section in the Summary Tab.
3. Verify the presence of the following fields in the form:
  - Vendor (set the default value if Component has default vendor set) (clear button beneath)
  - Name (required, readonly with component name)
  - Version (required)
  - Programming Languages (type to get default values, multivalue)
  - Operating Systems (type to get default values, multivalue)
  - CPE ID (hover info beneath)
  - Software Platforms (type to get default values, multivalue)
  - Release date
  - Main Licenses (multivalue)
  - Other licenses (multivalue)
  - Source Code Download URL
  - Binary Download URL
  - Clearing State (New, readonly)
  - Release Mainline State (dropdown, with info hover beneath)
  - Created On
  - Created By
  - Contributors (multivalue)
  - Moderators (multivalue)
  - Modified On
  - Modified By
Expected Result: All specified fields are present and function as described.

Additional Roles Section

Test Case ID: EDIT-REL-002
Description: Verify the “Additional Roles” section in the Summary Tab.
Steps:
1. Navigate to the “Edit Release” page.
2. Locate the “Additional Roles” section in the Summary Tab.
3. Click on the “Click to add row to Additional Roles” button.
Expected Result: A new row is added for additional roles.

External IDs Section

Test Case ID: EDIT-REL-003
Description: Verify the “External IDs” section in the Summary Tab.
Steps:
1. Navigate to the “Edit Release” page.
2. Locate the “External IDs” section in the Summary Tab.
3. Click on the “Click to add row to External Ids” button.
4. Verify the presence of the following fields in the new row:
  - External Id key on the left
  - Type to get default values
  - External Id value on the right
  - Row delete button on the end
Expected Result: A new row is added with the specified fields.

Additional Data Section

Test Case ID: EDIT-REL-004
Description: Verify the “Additional Data” section in the Summary Tab.
Steps:
1. Navigate to the “Edit Release” page.
2. Locate the “Additional Data” section in the Summary Tab.
3. Click on the “Click to add row to Additional Data” button.
Expected Result: A new row is added for additional data.

Release Repository Section

Test Case ID: EDIT-REL-005
Description: Verify the “Release Repository” section in the Summary Tab.
Steps:
1. Navigate to the “Edit Release” page.
2. Locate the “Release Repository” section in the Summary Tab.
3. Verify the presence of the following fields:
  - Repository Type (dropdown)
  - Repository URL (textbox)
Expected Result: The specified fields are present and function as described.

Linked Releases Tab

Click to Add Releases Button

Test Case ID: EDIT-REL-006
Description: Verify the “Click to add Releases” button and the releases table in the Linked Releases Tab.
Steps:
1. Navigate to the “Edit Release” page.
2. Locate the Linked Releases Tab.
3. Click on the “Click to add Releases” button.
4. Verify the presence of a table with the following columns:
  - Vendor name
  - Release name
  - Release version
  - Release relation (info hover) (dropdown)
  - delete icon
Expected Result: The button and table with the specified columns are present.

Linked Packages Tab

Add Packages Button

Test Case ID: EDIT-REL-007
Description: Verify the “Add Packages” button and the table in the Linked Packages Tab.
Steps:
1. Navigate to the “Edit Release” page.
2. Locate the Linked Packages Tab.
3. Click on the “Add Packages” button.
4. Verify the presence of a table with the following columns:
  - Package Name
  - Package Version
  - License
  - Package Manager
  - delete icon
Expected Result: The button and table with the specified columns are present.

Clearing Details Tab

Clearing Details Section

Test Case ID: EDIT-REL-008
Description: Verify the “Clearing Details” section in the Clearing Details Tab.
Steps:
1. Navigate to the “Edit Release” page.
2. Locate the Clearing Details Tab.
3. Verify the presence of the following fields:
  - 13 checkboxes
  - Scanned text box
  - Clearing Standard text box
  - External URL text box
  - Comments text box
Expected Result: All specified fields are present and function as described.

Request Information Section

Test Case ID: EDIT-REL-009
Description: Verify the “Request Information” section in the Clearing Details Tab.
Steps:
1. Navigate to the “Edit Release” page.
2. Locate the Clearing Details Tab.
3. Verify the presence of the following fields:
  - Request ID
  - Additional request Info
  - Evaluation Start
  - Evaluation End
Expected Result: All specified fields are present and function as described.

Supplemental Information Section

Test Case ID: EDIT-REL-010
Description: Verify the “Supplemental Information” section in the Clearing Details Tab.
Steps:
1. Navigate to the “Edit Release” page.
2. Locate the Clearing Details Tab.
3. Verify the presence of the following fields:
  - External Supplier ID
  - Count of Security Vulnerabilities
Expected Result: All specified fields are present and function as described.

ECC Details Tab

ECC Information Section

Test Case ID: EDIT-REL-011
Description: Verify the “ECC Information” section in the ECC Details Tab.
Steps:
1. Navigate to the “Edit Release” page.
2. Locate the ECC Details Tab.
3. Verify the presence of the following fields:
  - ECC Status (dropdown) (info hover beneath)
  - ECC Comment
  - Ausfuhrliste
  - ECCN
  - Material Index Number
  - Assessor Contact Person (readonly)
  - Assessor Department (readonly)
  - Assessment Date (readonly)
Expected Result: All specified fields are present and function as described.

Attachments Tab

Attachments Table

Test Case ID: PROJ-EDIT-013

Release Details

Mon, 01 Jan 0001 00:00:00 +0000

SW360 “Release Details” Page Test Cases

General Page Behavior

Test Case ID: REL-DTL-001
Description: Verify the dropdown button showing the release version, which opens to show other versions. The button has a Red or Green indicator on the left indicating the Clearing State (Report approved: Green, otherwise red).
Steps:
1. Navigate to the “Release Details” page.
2. Locate the dropdown button for the release version.
Expected Result: The dropdown button is present with the specified behavior and indicator.

Top Buttons

Test Case ID: REL-DTL-002
Description: Verify the presence of the “Edit Release”, “Link to Project”, “merge”, and “Subscribe” buttons on top.
Steps:
1. Navigate to the “Release Details” page.
2. Locate the top section of the page.
Expected Result: The specified buttons are present.

Summary Tab

General Section

Test Case ID: REL-DTL-003
Description: Verify the “General” section in the Summary Tab.
Steps:
1. Navigate to the “Release Details” page.
2. Locate the “General” section in the Summary Tab.
3. Verify the presence of the following fields:
  - Release ID
  - CPE ID
  - Release Date of this Release
  - Created on
  - Created By
  - Modified On
  - Modified By
  - Contributors
  - Moderators
  - Subscribers
  - Additional Roles
  - Source Code Download URL
  - Binary Download URL
  - Clearing State
  - Release Mainline State
  - Main licenses (i button next to license name, click to show src file for this license, fail if multiple files)
  - Other licenses (i button next to license name)
  - Programming Languages
  - Operating Systems
  - External ids
  - Additional Data
Expected Result: All specified fields are present and function as described.

Release Repository Section

Test Case ID: REL-DTL-004
Description: Verify the “Release Repository” section in the Summary Tab.
Steps:
1. Navigate to the “Release Details” page.
2. Locate the “Release Repository” section in the Summary Tab.
3. Verify the presence of the following fields:
  - “Repository:” link of the repository
  - Repository type in brackets
Expected Result: The specified fields are present and function as described.

Release Vendor Section

Test Case ID: REL-DTL-005
Description: Verify the “Release Vendor” section in the Summary Tab.
Steps:
1. Navigate to the “Release Details” page.
2. Locate the “Release Vendor” section in the Summary Tab.
3. Verify the presence of the following fields:
  - FullName
  - Short Name
  - URL
Expected Result: The specified fields are present and function as described.

Used By Section

Test Case ID: REL-DTL-006
Description: Verify the “Used By” section in the Summary Tab.
Steps:
1. Navigate to the “Release Details” page.
2. Locate the “Used By” section in the Summary Tab.
3. Verify the presence of the following fields:
  - Release name
  - Used by total of visible / restricted projects
  - Table of visible projects with columns: Project name (click to open project), Group, Responsible
4. If the release is a linked release in another release, verify the presence of the table “Release is used by the following components” with columns: Vendor, Name (click to open Component), Main licenses, Component Type
Expected Result: The specified fields and tables are present and function as described.

Linked Releases Tab

Table of Linked Releases

Test Case ID: REL-DTL-007
Description: Verify the table of linked releases in the Linked Releases Tab.
Steps:
1. Navigate to the “Release Details” page.
2. Locate the Linked Releases Tab.
3. Verify the presence of a table with the following columns:
  - Name (click to open release)
  - Release relation
  - License Names
  - Clearing State
Expected Result: The table with the specified columns is present.

Linked Packages Tab

Table of Linked Packages

Test Case ID: REL-DTL-008
Description: Verify the table of linked packages in the Linked Packages Tab.
Steps:
1. Navigate to the “Release Details” page.
2. Locate the Linked Packages Tab.
3. Verify the presence of a table with the following columns:
  - Vendor (filterable)
  - Package Name version (filterable)
  - Licenses (filterable)
  - Package Manager (filterable)
  - Actions (edit package and delete package)
Expected Result: The table with the specified columns is present.

Clearing Details Tab

SPDX Attachments Section

Test Case ID: REL-DTL-009
Description: Verify the “SPDX Attachments” section in the Clearing Details Tab.
Steps:
1. Navigate to the “Release Details” page.
2. Locate the Clearing Details Tab.
3. Verify the presence of the following fields for each CLI report:
  - First column displays filename
  - Second column shows “Show License Info” button
  - On click on “Show License Info” button, verify that it changes to “Add data to this release” button and displays “Main / Concluded License Ids:” and “Other License Ids:” as UL in the third column “Result”
Expected Result: The specified fields and behavior are present.

Assessment Summary Info Section

Test Case ID: REL-DTL-010
Description: Verify the “Assessment Summary Info” section in the Clearing Details Tab.
Steps:
1. Navigate to the “Release Details” page.
2. Locate the Clearing Details Tab.
3. Click on the “Show Assessment Summary Info” button.
4. Verify the presence of a table with the AssessmentSummary section from the CLIXML file of the approved attachment.
5. If multiple accepted CLI are found, verify that “Multiple approved CLI are found in release!” is displayed.
Expected Result: The specified fields and behavior are present.

Clearing Details: Release Section

Test Case ID: REL-DTL-011
Description: Verify the “Clearing Details: Release” section in the Clearing Details Tab.
Steps:
1. Navigate to the “Release Details” page.
2. Locate the Clearing Details Tab.
3. Verify the presence of the following fields:
  - Clearing State (fossology button next to it)
  - The 13 checkboxes with Red (No) or Green (Yes) state
  - The text boxes values
  - External URL as clickable link
Expected Result: All specified fields are present and function as described.

Request Information Section

Test Case ID: REL-DTL-012
Description: Verify the “Request Information” section in the Clearing Details Tab.
Steps:
1. Navigate to the “Release Details” page.
2. Locate the Clearing Details Tab.
3. Verify the presence of the following fields:
  - Request ID
  - Additional Request Information
  - Evaluation Start
  - Evaluation End
Expected Result: All specified fields are present and function as described.

Supplemental Information Section

Test Case ID: REL-DTL-013
Description: Verify the “Supplemental Information” section in the Clearing Details Tab.
Steps:
1. Navigate to the “Release Details” page.
2. Locate the Clearing Details Tab.
3. Verify the presence of the following fields:
  - External Supplier ID
  - Number of Security Vulnerabilities
Expected Result: All specified fields are present and function as described.

ECC Details Tab

ECC Information Section

Test Case ID: REL-DTL-014
Description: Verify the “ECC Information” section in the ECC Details Tab.
Steps:
1. Navigate to the “Release Details” page.
2. Locate the ECC Details Tab.
3. Verify the presence of the following fields:
  - ECC Status
  - AL
  - ECCN
  - Material Index Number
  - ECC Comment
  - Assessor Contact Person
  - Assessor Department
  - Assessment Date
Expected Result: All specified fields are present and function as described.

Attachments Tab

Attachments Table

Test Case ID: PROJ-DTL-016

Vulnerabilities Tab

Vulnerabilities Table

Test Case ID: COMP-DTL-010, COMP-DTL-011, COMP-DTL-012 and COMP-DTL-013

Change Log Tab

Change Log Table

Test Case ID: PROJ-DTL-021, PROJ-DTL-022, PROJ-DTL-023, PROJ-DTL-024, PROJ-DTL-025 and PROJ-DTL-026

Merge Components

Mon, 01 Jan 0001 00:00:00 +0000

SW360 “Merge Components” Page Test Cases

General Page Behavior

Accessing the Merge Components Page

Test Case ID: COMP-MRG-001
Description: Verify that the merge components page can be reached by clicking the “Merge” button on a component. The component from which the button was clicked is called the Target component.
Steps:
1. Navigate to the “Component Details” page of a component.
2. Click on the “Merge” button.
Expected Result: The merge components page is opened with the Target component specified.

Choose Source Section

Source Components Table

Test Case ID: COMP-MRG-002
Description: Verify the display of the table with all components except the Target component, with a search bar on top.
Steps:
1. Navigate to the “Merge Components” page.
2. Locate the “Choose source” section.
3. Verify the presence of a table with the following columns:
  - Component Name
  - Created by
  - Releases (count)
Expected Result: The table with the specified columns is present, and the search bar is functional.

Selecting a Source Component

Test Case ID: COMP-MRG-003
Description: Verify the process of choosing one source component and clicking “Next.”
Steps:
1. Navigate to the “Merge Components” page.
2. Locate the “Choose source” section.
3. Select a source component from the table.
4. Click on the “Next” button.
Expected Result: The selected source component is chosen, and the page navigates to the “Merge data” section.

Merge Data Section

Display of Data

Test Case ID: COMP-MRG-004
Description: Verify the display of all data from the Target component on the left and the Source component on the right with a <= button in between.
Steps:
1. Navigate to the “Merge Components” page.
2. Locate the “Merge data” section.
Expected Result: The data from the Target component is displayed on the left, and the Source component data is displayed on the right with a <= button in between.

Data Carry Forward

Test Case ID: COMP-MRG-005
Description: Verify that the data on the left will be carried forward to the Target component.
Steps:
1. Navigate to the “Merge Components” page.
2. Locate the “Merge data” section.
Expected Result: The data on the left is carried forward to the Target component.

Created by Info Hover

Test Case ID: COMP-MRG-006
Description: Verify the presence of an info hover for the “Created by” field.
Steps:
1. Navigate to the “Merge Components” page.
2. Locate the “Merge data” section.
3. Hover over the “Created by” field.
Expected Result: The info hover is present.

`<=` Button Action

Test Case ID: COMP-MRG-007
Description: Verify the action of pressing the <= button.
Steps:
1. Navigate to the “Merge Components” page.
2. Locate the “Merge data” section.
3. Press the <= button.
Expected Result: The action can be undone with the undo button.

Conflict Releases

Test Case ID: COMP-MRG-008
Description: Verify the behavior of releases with the same version.
Steps:
1. Navigate to the “Merge Components” page.
2. Locate the “Merge data” section.
3. Press the <= button on releases with the same version.
Expected Result: The undo button is disabled, and a conflict is indicated.

Finalizing Data

Test Case ID: COMP-MRG-009
Description: Verify the process of finalizing data and clicking “Next.”
Steps:
1. Navigate to the “Merge Components” page.
2. Locate the “Merge data” section.
3. Finalize the data.
4. Click on the “Next” button.
Expected Result: The page navigates to the “Confirm” section.

Going Back

Test Case ID: COMP-MRG-010
Description: Verify the ability to click “Back” to go to the “Merge data” section.
Steps:
1. Navigate to the “Merge Components” page.
2. Locate the “Merge data” section.
3. Click on the “Next” button to go to the “Confirm” section.
4. Click on the “Back” button.
Expected Result: The page navigates back to the “Merge data” section.

Confirm Section

Display of Data

Test Case ID: COMP-MRG-011
Description: Verify that only the data on the left is displayed in the “Confirm” section.
Steps:
1. Navigate to the “Merge Components” page.
2. Locate the “Confirm” section.
Expected Result: Only the data on the left is displayed.

Merge Selection Payload

Test Case ID: COMP-MRG-012
Description: Verify that only the displayed data is sent as the merge selection payload.
Steps:
1. Navigate to the “Merge Components” page.
2. Locate the “Confirm” section.
3. Click on the “Finish” button.
Expected Result: Only the displayed data is sent as the merge selection payload.

Submitting the Merge

Test Case ID: COMP-MRG-013
Description: Verify the process of clicking “Finish” to submit the merge.
Steps:
1. Navigate to the “Merge Components” page.
2. Locate the “Confirm” section.
3. Click on the “Finish” button.
Expected Result: The merge is submitted, and the user lands on the Component Details page of the Target component.

Going Back from Confirm Section

Test Case ID: COMP-MRG-014
Description: Verify the ability to click “Back” to go to the “Merge data” section from the “Confirm” section.
Steps:
1. Navigate to the “Merge Components” page.
2. Locate the “Confirm” section.
3. Click on the “Back” button.
Expected Result: The page navigates back to the “Merge data” section.

Special Deployment Guides

Mon, 01 Jan 0001 00:00:00 +0000

General Deployment Guides

Comprehensive blog post on SW360 Installation in Japanese

Split Components

Mon, 01 Jan 0001 00:00:00 +0000

SW360 “Split Component” Page Test Cases

General Page Behavior

Accessing the Split Component Page

Test Case ID: COMP-SPLT-001
Description: Verify that the split component page can be reached by clicking the “Split” button on a component. The component from which the button was clicked is called the Source component.
Steps:
1. Navigate to the “Component Details” page of a component.
2. Click on the “Split” button.
Expected Result: The split component page is opened with the Source component specified.

Choose Target Section

Target Components Table

Test Case ID: COMP-SPLT-002
Description: Verify the display of the table with all components except the Source component, with a search bar on top.
Steps:
1. Navigate to the “Split Component” page.
2. Locate the “Choose target” section.
3. Verify the presence of a table with the following columns:
  - Component Name
  - Created by
  - Releases (count)
Expected Result: The table with the specified columns is present, and the search bar is functional.

Selecting a Target Component

Test Case ID: COMP-SPLT-003
Description: Verify the process of choosing one target component and clicking “Next.”
Steps:
1. Navigate to the “Split Component” page.
2. Locate the “Choose target” section.
3. Select a target component from the table.
4. Click on the “Next” button.
Expected Result: The selected target component is chosen, and the page navigates to the “Split data” section.

Split Data Section

Display of Data

Test Case ID: COMP-SPLT-004
Description: Verify the display of all data from the Source component on the left and the Target component on the right with a => button in between for releases and attachments.
Steps:
1. Navigate to the “Split Component” page.
2. Locate the “Split data” section.
Expected Result: The data from the Source component is displayed on the left, and the Target component data is displayed on the right with a => button in between for releases and attachments.

Data Carry Forward

Test Case ID: COMP-SPLT-005
Description: Verify that the releases and attachments on the right will be carried forward to the Target component.
Steps:
1. Navigate to the “Split Component” page.
2. Locate the “Split data” section.
Expected Result: The releases and attachments on the right are carried forward to the Target component.

`=>` Button Action

Test Case ID: COMP-SPLT-006
Description: Verify the action of pressing the => button.
Steps:
1. Navigate to the “Split Component” page.
2. Locate the “Split data” section.
3. Press the => button.
Expected Result: The action can be undone with the undo button.

Conflict Releases

Test Case ID: COMP-SPLT-007
Description: Verify the behavior of releases with the same version.
Steps:
1. Navigate to the “Split Component” page.
2. Locate the “Split data” section.
3. Press the => button on releases with the same version.
Expected Result: The undo button is disabled, and a conflict is indicated.

Finalizing Data

Test Case ID: COMP-SPLT-008
Description: Verify the process of finalizing data and clicking “Next.”
Steps:
1. Navigate to the “Split Component” page.
2. Locate the “Split data” section.
3. Finalize the data.
4. Click on the “Next” button.
Expected Result: The page navigates to the “Confirm” section.

Going Back

Test Case ID: COMP-SPLT-009
Description: Verify the ability to click “Back” to go to the “Split data” section.
Steps:
1. Navigate to the “Split Component” page.
2. Locate the “Split data” section.
3. Click on the “Next” button to go to the “Confirm” section.
4. Click on the “Back” button.
Expected Result: The page navigates back to the “Split data” section.

Confirm Section

Display of Data

Test Case ID: COMP-SPLT-010
Description: Verify that the data in the “Confirm” section is similar to the “Split data” section without the buttons.
Steps:
1. Navigate to the “Split Component” page.
2. Locate the “Confirm” section.
Expected Result: The data is displayed similarly to the “Split data” section without the buttons.

Submitting the Split

Test Case ID: COMP-SPLT-011
Description: Verify the process of clicking “Finalize” to submit the split.
Steps:
1. Navigate to the “Split Component” page.
2. Locate the “Confirm” section.
3. Click on the “Finalize” button.
Expected Result: The split is submitted, and the user lands on the Component Details page of the Source component.

Going Back from Confirm Section

Test Case ID: COMP-SPLT-012
Description: Verify the ability to click “Back” to go to the “Split data” section from the “Confirm” section.
Steps:
1. Navigate to the “Split Component” page.
2. Locate the “Confirm” section.
3. Click on the “Back” button.
Expected Result: The page navigates back to the “Split data” section.

Merge Releases

Mon, 01 Jan 0001 00:00:00 +0000

SW360 “Merge Release” Page Test Cases

General Page Behavior

Accessing the Merge Release Page

Test Case ID: MERGE-REL-001
Description: Verify that the merge releases page can be reached by clicking the “Merge” button on a release or the merge icon in the release tab of a component details page. The release from which the button was clicked is called the Target release.
Steps:
1. Navigate to the “Release Details” page of a release.
2. Click on the “Merge” button.
Expected Result: The merge releases page is opened with the Target release specified.

Choose Source Section

Source Releases Table

Test Case ID: MERGE-REL-002
Description: Verify the display of the table with all releases of the component except the Target release, with a search bar on top.
Steps:
1. Navigate to the “Merge Release” page.
2. Locate the “Choose source” section.
3. Verify the presence of a table with the following columns:
  - Release Name
  - Version
  - Created by
Expected Result: The table with the specified columns is present, and the search bar is functional.

Selecting a Source Release

Test Case ID: MERGE-REL-003
Description: Verify the process of choosing one source release and clicking “Next.”
Steps:
1. Navigate to the “Merge Release” page.
2. Locate the “Choose source” section.
3. Select a source release from the table.
4. Click on the “Next” button.
Expected Result: The selected source release is chosen, and the page navigates to the “Merge data” section.

Merge Data Section

Different Source Attachments

Test Case ID: MERGE-REL-004
Description: Verify the message displayed if releases have different source attachments.
Steps:
1. Navigate to the “Merge Release” page.
2. Locate the “Merge data” section.
3. Verify the presence of the message: “Cannot continue to merge of releases: Both releases must have at least one pair of same source attachments or no source attachments at all. Otherwise a merge is not possible.”
Expected Result: The specified message is displayed.

Abort Button

Test Case ID: MERGE-REL-005
Description: Verify the presence of the “Abort” button on the bottom.
Steps:
1. Navigate to the “Merge Release” page.
2. Locate the “Merge data” section.
3. Click on the “Abort” button.
Expected Result: The page navigates back to the release.

Same Source Attachment or No Attachment

Test Case ID: MERGE-REL-006
Description: Verify the display of the section “following documents will be effected” if releases have the same source attachment or no attachment.
Steps:
1. Navigate to the “Merge Release” page.
2. Locate the “Merge data” section.
3. Verify the presence of the following fields:
  - Count for projects
  - Count for releases
  - Count for vulnerabilities
  - Count for attachment usage
  - Count for project vulnerability ratings
Expected Result: The specified fields are present.

Display of Data

Test Case ID: MERGE-REL-007
Description: Verify the display of all data from the Target release on the left and the Source release on the right with a <= button in between.
Steps:
1. Navigate to the “Merge Release” page.
2. Locate the “Merge data” section.
Expected Result: The data from the Target release is displayed on the left, and the Source release data is displayed on the right with a <= button in between.

Data Carry Forward

Test Case ID: MERGE-REL-008
Description: Verify that the data on the left will be carried forward to the Target release.
Steps:
1. Navigate to the “Merge Release” page.
2. Locate the “Merge data” section.
Expected Result: The data on the left is carried forward to the Target release.

Created by Info Hover

Test Case ID: MERGE-REL-009
Description: Verify the presence of an info hover for the “Created by” field.
Steps:
1. Navigate to the “Merge Release” page.
2. Locate the “Merge data” section.
3. Hover over the “Created by” field.
Expected Result: The info hover is present.

`<=` Button Action

Test Case ID: MERGE-REL-010
Description: Verify the action of pressing the <= button.
Steps:
1. Navigate to the “Merge Release” page.
2. Locate the “Merge data” section.
3. Press the <= button.
Expected Result: The action can be undone with the undo button.

Attachments

Test Case ID: MERGE-REL-011
Description: Verify the display of attachments with name and attachment type in brackets. Matching source attachments section has an i icon. Other Attachments can be carried over.
Steps:
1. Navigate to the “Merge Release” page.
2. Locate the “Merge data” section.
Expected Result: The attachments are displayed with the specified details.

Finalizing Data

Test Case ID: MERGE-REL-012
Description: Verify the process of finalizing data and clicking “Next.”
Steps:
1. Navigate to the “Merge Release” page.
2. Locate the “Merge data” section.
3. Finalize the data.
4. Click on the “Next” button.
Expected Result: The page navigates to the “Confirm” section.

Going Back

Test Case ID: MERGE-REL-013
Description: Verify the ability to click “Back” to go to the “Merge data” section.
Steps:
1. Navigate to the “Merge Release” page.
2. Locate the “Merge data” section.
3. Click on the “Next” button to go to the “Confirm” section.
4. Click on the “Back” button.
Expected Result: The page navigates back to the “Merge data” section.

Confirm Section

Display of Data

Test Case ID: MERGE-REL-014
Description: Verify that only the data on the left is displayed in the “Confirm” section, and the effected notification is visible on top.
Steps:
1. Navigate to the “Merge Release” page.
2. Locate the “Confirm” section.
Expected Result: Only the data on the left is displayed, and the effected notification is visible on top.

Merge Selection Payload

Test Case ID: MERGE-REL-015
Description: Verify that only the displayed data is sent as the merge selection payload.
Steps:
1. Navigate to the “Merge Release” page.
2. Locate the “Confirm” section.
3. Click on the “Finish” button.
Expected Result: Only the displayed data is sent as the merge selection payload.

Submitting the Merge

Test Case ID: MERGE-REL-016
Description: Verify the process of clicking “Finish” to submit the merge.
Steps:
1. Navigate to the “Merge Release” page.
2. Locate the “Confirm” section.
3. Click on the “Finish” button.
Expected Result: The merge is submitted, and the user lands on the Release Details page of the Target release.

Going Back from Confirm Section

Test Case ID: MERGE-REL-017
Description: Verify the ability to click “Back” to go to the “Merge data” section from the “Confirm” section.
Steps:
1. Navigate to the “Merge Release” page.
2. Locate the “Confirm” section.
3. Click on the “Back” button.
Expected Result: The page navigates back to the “Merge data” section.

Packages Page

Mon, 01 Jan 0001 00:00:00 +0000

SW360 “Main Packages” Page Test Cases

Advance Search on the Left Hand

Search Fields

Test Case ID: PKGS-001
Description: Verify that the advance search on the left hand contains the specified search fields.
Steps:
1. Navigate to the Main Packages page.
2. Locate the advance search section on the left hand.
3. Verify the presence of the following search fields:
  - Package Name
  - Package Version
  - Package Manager (one of PackageManager thrift enum)
  - License
  - Created by
  - Created on (with filter type adding or removing date field)
  - “Orphan Package” checkbox
  - A checkbox “Exact Match” with a Search button
Expected Result: All specified search fields are present.

Search Behavior

Test Case ID: PKGS-002
Description: Verify the search behavior based on the “Exact Match” checkbox.
Steps:
1. Navigate to the Main Packages page.
2. Locate the advance search section on the left hand.
3. Enter search criteria in the search fields.
4. Perform a search without checking the “Exact Match” checkbox.
5. Verify that the endpoint has “luceneSearch=true” and uses full-text search.
6. Check the “Exact Match” checkbox and perform a search.
7. Verify that the endpoint has “luceneSearch=false” and uses exact match.
Expected Result: The search behavior changes based on the “Exact Match” checkbox.

Buttons in Middle

“Add Package” Button

Test Case ID: PKGS-003
Description: Verify that the “Add Package” button opens a form to create a new package.
Steps:
1. Navigate to the Main Packages page.
2. Click on the “Add Package” button.
Expected Result: A form to create a new package is opened.

Table in Middle

Page Size

Test Case ID: PKGS-004
Description: Verify that the table can change page size, with a default of 10.
Steps:
1. Navigate to the Main Packages page.
2. Locate the table in the middle.
3. Change the page size and verify the default is 10.
Expected Result: The table page size can be changed, and the default is 10.

“Print” Button

Test Case ID: PKGS-005
Description: Verify that the “Print” button on the right prints the Table HTML component to the browser.
Steps:
1. Navigate to the Main Packages page.
2. Locate the “Print” button on the right of the table.
3. Click on the “Print” button.
Expected Result: The Table HTML component is printed to the browser.

Column “Package Name (Version)”

Test Case ID: PKGS-006
Description: Verify that the “Package Name (Version)” column displays the package name and version, with a clickable link to open the package.
Steps:
1. Navigate to the Main Packages page.
2. Locate the “Package Name (Version)” column in the table.
3. Click on a package name to open the package.
Expected Result: The package name and version are displayed, and clicking on it opens the package.

Column “Release Name (Version)”

Test Case ID: PKGS-007
Description: Verify that the “Release Name (Version)” column displays the linked release name, or “No Linked Release” with a clickable link to open the release.
Steps:
1. Navigate to the Main Packages page.
2. Locate the “Release Name (Version)” column in the table.
Expected Result: The linked release name is displayed, or “No Linked Release” with a clickable link to open the release.

Column “Release Clearing State”

Test Case ID: PKGS-008
Description: Verify that the “Release Clearing State” column displays the clearing state of the release, or “Not Applicable”.
Steps:
1. Navigate to the Main Packages page.
2. Locate the “Release Clearing State” column in the table.
Expected Result: The clearing state of the release is displayed, or “Not Applicable”.

Column “Licenses”

Test Case ID: PKGS-009
Description: Verify that the “Licenses” column displays the licenses.
Steps:
1. Navigate to the Main Packages page.
2. Locate the “Licenses” column in the table.
Expected Result: The licenses are displayed.

Column “Package Manager”

Test Case ID: PKGS-010
Description: Verify that the “Package Manager” column displays the package manager.
Steps:
1. Navigate to the Main Packages page.
2. Locate the “Package Manager” column in the table.
Expected Result: The package manager is displayed.

Column “Actions”

Test Case ID: PKGS-011
Description: Verify that the “Actions” column shows an Edit Icon or Delete icon.
Steps:
1. Navigate to the Main Packages page.
2. Locate the “Actions” column in the table.
Expected Result: The Edit Icon or Delete icon is displayed.

Pagination Components

Test Case ID: PKGS-012
Description: Verify that the table bottom has pagination components.
Steps:
1. Navigate to the Main Packages page.
2. Locate the table in the middle.
3. Scroll to the bottom of the table and verify the presence of pagination components.
Expected Result: Pagination components are present at the bottom of the table.

Create Packages

Mon, 01 Jan 0001 00:00:00 +0000

SW360 “Create Packages” Page Test Cases

General Page Behavior

Add Package Button

Test Case ID: PKGS-CRT-001
Description: Verify that clicking on the “Add Package” button opens a form to create a new package.
Steps:
1. Navigate to the Main Packages page.
2. Click on the “Add Package” button.
Expected Result: A form to create a new package is opened.

Summary Tab

Information Fields

Test Case ID: PKGS-CRT-002
Description: Verify the presence of the specified information fields in the Summary Tab.
Steps:
1. Navigate to the “Create Packages” page.
2. Locate the Summary Tab.
3. Verify the presence of the following fields:
  - Name (required)
  - Version (required)
  - Package Type (required) (one of CDX package type) (info hover beneath)
  - PURL (required)
  - Package Manager (required) (readonly)
  - VCS
  - Main licenses
  - Release (click to open popup with clear button)
  - Homepage URL
  - Created on (readonly)
  - Created by (readonly)
  - Modified By (readonly)
  - Description (text area)
Expected Result: All specified fields are present and function as described.

Create Package Button

Package Creation

Test Case ID: PKGS-CRT-003
Description: Verify that upon clicking the “Create Package” button, the package is created, and the user is redirected to the “Edit Package” page of the created package.
Steps:
1. Navigate to the “Create Packages” page.
2. Fill in the required fields and any additional information.
3. Click on the “Create Package” button.
Expected Result: The package is created, and the user is redirected to the “Edit Package” page of the created package.

Edit Package

Mon, 01 Jan 0001 00:00:00 +0000

SW360 “Edit Packages” Page Test Cases

General Page Behavior

Top Buttons

Test Case ID: PKGS-EDIT-001
Description: Verify the presence of the “Update Package”, “Delete Package” (disabled if used in a project), and “Cancel” buttons on top.
Steps:
1. Navigate to the “Edit Packages” page.
2. Locate the top section of the page.
Expected Result: The specified buttons are present.

Summary Tab

Information Fields

Test Case ID: PKGS-EDIT-002
Description: Verify the presence of the specified information fields in the Summary Tab.
Steps:
1. Navigate to the “Edit Packages” page.
2. Locate the Summary Tab.
3. Verify the presence of the following fields:
  - Name (required)
  - Version (required)
  - Package Type (required) (one of CDX package type) (info hover beneath)
  - PURL (required)
  - Package Manager (required) (readonly)
  - VCS
  - Main licenses
  - Release (click to open popup with clear button)
  - Homepage URL
  - Created on (readonly)
  - Created by (readonly)
  - Modified By (readonly)
  - Description (text area)
Expected Result: All specified fields are present and function as described.

Update Package Button

Package Update

Test Case ID: PKGS-EDIT-003
Description: Verify that clicking the “Update Package” button saves the changes and takes the user to the “Package Details” page of the current package.
Steps:
1. Navigate to the “Edit Packages” page.
2. Fill in the required fields and any additional information.
3. Click on the “Update Package” button.
Expected Result: The changes are saved, and the user is redirected to the “Package Details” page of the current package.

Cancel Button

Discard Changes

Test Case ID: PKGS-EDIT-004
Description: Verify that clicking the “Cancel” button discards the changes and takes the user to the “Package Details” page of the current package.
Steps:
1. Navigate to the “Edit Packages” page.
2. Make changes to the fields.
3. Click on the “Cancel” button.
Expected Result: The changes are discarded, and the user is redirected to the “Package Details” page of the current package.

Package Details

Mon, 01 Jan 0001 00:00:00 +0000

SW360 “Package Details” Page Test Cases

General Page Behavior

Top Button

Test Case ID: PKGS-DTL-001
Description: Verify the presence of the “Edit Package” button on top, which takes the user to the edit package page.
Steps:
1. Navigate to the “Package Details” page.
2. Locate the top section of the page.
Expected Result: The “Edit Package” button is present and functional.

Summary Tab

Summary Section

Test Case ID: PKGS-DTL-002
Description: Verify the presence of the specified fields in the Summary Section.
Steps:
1. Navigate to the “Package Details” page.
2. Locate the Summary Section in the Summary Tab.
3. Verify the presence of the following fields:
  - Id
  - Name
  - Version
  - Package Type
  - PURL
  - Package Manager
  - VCS
  - Homepage URL
  - Licenses
  - Linked Release (clickable link to open release)
  - Description (note: should be on top like components)
  - Created on
  - Created by
  - Modified On
  - Modified By
Expected Result: All specified fields are present and function as described.

Used In Section

Test Case ID: PKGS-DTL-003
Description: Verify the display of the “Used In” section if the Package is used in a project.
Steps:
1. Navigate to the “Package Details” page.
2. Locate the “Used In” section in the Summary Tab.
3. Verify the presence of the following fields:
  - Package is used in total of visible / restricted projects count
  - Table with columns: Project name (click to open project), Group, Responsible
Expected Result: The specified fields and table are present and function as described if the Package is used in a project.

Change Log Tab

Change Log Table

Test Case ID: PROJ-DTL-021, PROJ-DTL-022, PROJ-DTL-023, PROJ-DTL-024, PROJ-DTL-025 and PROJ-DTL-026

Licenses Page

Mon, 01 Jan 0001 00:00:00 +0000

SW360 “Licenses” Page Test Cases

General Page Behavior

Quick Filter

Test Case ID: LIC-001
Description: Verify the presence of a Quick Filter on the left which allows the user to filter the license table as they type. The filter works for License Shortname and License Fullname.
Steps:
1. Navigate to the “Licenses” page.
2. Locate the Quick Filter on the left.
3. Type in the filter and observe the changes in the license table.
Expected Result: The license table filters based on the input for License Shortname and License Fullname.

Top Buttons

Test Case ID: LIC-002
Description: Verify the presence of the “Add License” button and “Export Spreadsheet” button on top.
Steps:
1. Navigate to the “Licenses” page.
2. Locate the top section of the page.
Expected Result: The “Add License” button and “Export Spreadsheet” button are present.

License Table

Pagination Parameters

Test Case ID: LIC-003
Description: Verify the presence of pagination parameters in the license table.
Steps:
1. Navigate to the “Licenses” page.
2. Locate the license table.
Expected Result: Pagination parameters are present in the license table.

Columns

Test Case ID: LIC-004
Description: Verify the presence of the specified columns in the license table.
Steps:
1. Navigate to the “Licenses” page.
2. Locate the license table.
3. Verify the presence of the following columns:
  - License Shortname (clickable link to open license)
  - License Fullname
  - Is checked? (red or green)
  - License Type ("–" if missing)
Expected Result: All specified columns are present and function as described.

Create License

Mon, 01 Jan 0001 00:00:00 +0000

SW360 “Create License” Page Test Cases

General Page Behavior

Top Buttons

Test Case ID: LIC-CRT-001
Description: Verify the presence of the “Create License” and “Cancel” buttons on top.
Steps:
1. Navigate to the “Create License” page.
2. Locate the top section of the page.
Expected Result: The “Create License” and “Cancel” buttons are present.

License Tab

License Details Section

Test Case ID: LIC-CRT-002
Description: Verify the presence of the specified fields in the License Details section.
Steps:
1. Navigate to the “Create License” page.
2. Locate the License Details section in the License Tab.
3. Verify the presence of the following fields:
  - Fullname (required)
  - Shortname (required)
  - License Type (dropdown, dynamic)
  - OSI Approved? (one of (n/a), Yes)
  - FSF Free/Libre? (one of (n/a), Yes)
  - Is checked (checkbox)
  - Note (text area)
Expected Result: All specified fields are present and function as described.

License Text Section

Test Case ID: LIC-CRT-003
Description: Verify the presence of a big text area for license text.
Steps:
1. Navigate to the “Create License” page.
2. Locate the License Text section in the License Tab.
Expected Result: The big text area for license text is present.

Linked Obligations Tab

Add Obligation Button

Test Case ID: LIC-CRT-004
Description: Verify the presence of the “Add Obligation” button on top.
Steps:
1. Navigate to the “Create License” page.
2. Locate the Linked Obligations Tab.
Expected Result: The “Add Obligation” button is present.

Obligations Table

Test Case ID: LIC-CRT-005
Description: Verify the presence of the specified columns in the obligations table.
Steps:
1. Navigate to the “Create License” page.
2. Locate the Linked Obligations Tab.
3. Verify the presence of a table with the following columns:
  - Collapse
  - Obligation Title
  - Obligation Type
  - Action (delete icon)
4. Click on the “Expand” button to reveal the obligation text.
Expected Result: The table with the specified columns is present, and the “Expand” button reveals the obligation text.

Test Case ID: LIC-CRT-006
Description: Verify that clicking on the “Add Obligation” button opens a popup showing obligations which can be added.
Steps:
1. Navigate to the “Create License” page.
2. Locate the Linked Obligations Tab.
3. Click on the “Add Obligation” button.
Expected Result: A popup showing obligations which can be added is opened.

Create License Button

License Creation

Test Case ID: LIC-CRT-007
Description: Verify that clicking on the “Create License” button saves the license, shows the message “License created,” and navigates the user back to the Main Licenses page.
Steps:
1. Navigate to the “Create License” page.
2. Fill in the required fields and any additional information.
3. Click on the “Create License” button.
Expected Result: The license is saved, the message “License created” is shown, and the user is navigated back to the Main Licenses page.

License Detail

Mon, 01 Jan 0001 00:00:00 +0000

SW360 “License Details” Page Test Cases

General Page Behavior

License Fullname and Status

Test Case ID: LIC-DTL-001
Description: Verify the display of the License Fullname (License Shortname) on top and the status of whether the license is checked or unchecked (green or red).
Steps:
1. Navigate to the “License Details” page.
2. Locate the top section of the page.
Expected Result: The License Fullname and status are displayed as specified.

Edit License Button

Test Case ID: LIC-DTL-002
Description: Verify the presence of the “Edit License” button.
Steps:
1. Navigate to the “License Details” page.
2. Locate the top section of the page.
Expected Result: The “Edit License” button is present.

Details Tab

Unchecked License Warning

Test Case ID: LIC-DTL-003
Description: Verify the display of a red warning “This license is UNCHECKED” if the license is unchecked.
Steps:
1. Navigate to the “License Details” page.
2. Locate the Details Tab.
Expected Result: The red warning is displayed if the license is unchecked.

License Details Section

Test Case ID: LIC-DTL-004
Description: Verify the presence of the specified fields in the License Details section.
Steps:
1. Navigate to the “License Details” page.
2. Locate the License Details section in the Details Tab.
3. Verify the presence of the following fields:
  - Fullname
  - Shortname
  - Is checked
  - Type
  - OSI Approved? (Yes in green, else red)
  - FSF Free/Libre? (Yes in green, else red)
  - External link for more information (text box with Save button)
  - Note
Expected Result: All specified fields are present and function as described.

Text Tab

License Text Section

Test Case ID: LIC-DTL-005
Description: Verify the presence of the License Text section with the license text in pre-formatted font.
Steps:
1. Navigate to the “License Details” page.
2. Locate the Text Tab.
Expected Result: The License Text section with the license text in pre-formatted font is present.

Obligations Tab

Edit Whitelist Button

Test Case ID: LIC-DTL-006
Description: Verify the presence of the “Edit Whitelist” button if obligations are linked. Clicking on the button should show the whitelist table.
Steps:
1. Navigate to the “License Details” page.
2. Locate the Obligations Tab.
3. Click on the “Edit Whitelist” button.
Expected Result: The “Edit Whitelist” button is present, and clicking on it shows the whitelist table.

Obligations Table

Test Case ID: LIC-DTL-007
Description: Verify the presence of the specified columns in the obligations table.
Steps:
1. Navigate to the “License Details” page.
2. Locate the Obligations Tab.
3. Verify the presence of a table with the following columns:
  - Expand (show obligation text)
  - Obligation
  - Obligation Type
  - Further properties
4. Verify the presence of a search bar on top.
Expected Result: The table with the specified columns is present, and the search bar is functional.

Change Log Tab

Change Log Table

Test Case ID: PROJ-DTL-021, PROJ-DTL-022, PROJ-DTL-023, PROJ-DTL-024, PROJ-DTL-025 and PROJ-DTL-026

Edit License

Mon, 01 Jan 0001 00:00:00 +0000

SW360 “Edit License” Page Test Cases

General Page Behavior

Top Buttons

Test Case ID: LIC-EDIT-001
Description: Verify the presence of the “Update License”, “Delete License” and “Cancel” buttons on top.
Steps:
1. Navigate to the “Edit License” page.
2. Locate the top section of the page.
Expected Result: The “Update License”, “Delete License” and “Cancel” buttons are present.

License Tab

License Details Section

Test Case ID: LIC-EDIT-002
Description: Verify the presence of the specified fields in the License Details section.
Steps:
1. Navigate to the “Edit License” page.
2. Locate the License Details section in the License Tab.
3. Verify the presence of the following fields:
  - Fullname (required)
  - Shortname (required)
  - License Type (dropdown, dynamic)
  - OSI Approved? (one of (n/a), Yes)
  - FSF Free/Libre? (one of (n/a), Yes)
  - Is checked (checkbox)
  - Note (text area)
Expected Result: All specified fields are present and function as described.

License Text Section

Test Case ID: LIC-EDIT-003
Description: Verify the presence of a big text area for license text.
Steps:
1. Navigate to the “Edit License” page.
2. Locate the License Text section in the License Tab.
Expected Result: The big text area for license text is present.

Linked Obligations Tab

Add Obligation Button

Test Case ID: LIC-EDIT-004
Description: Verify the presence of the “Add Obligation” button on top.
Steps:
1. Navigate to the “Edit License” page.
2. Locate the Linked Obligations Tab.
Expected Result: The “Add Obligation” button is present.

Obligations Table

Test Case ID: LIC-EDIT-005
Description: Verify the presence of the specified columns in the obligations table.
Steps:
1. Navigate to the “Edit License” page.
2. Locate the Linked Obligations Tab.
3. Verify the presence of a table with the following columns:
  - Collapse
  - Obligation Title
  - Obligation Type
  - Action (delete icon)
4. Click on the “Expand” button to reveal the obligation text.
Expected Result: The table with the specified columns is present, and the “Expand” button reveals the obligation text.

Test Case ID: LIC-EDIT-006
Description: Verify that clicking on the “Add Obligation” button opens a popup showing obligations which can be added.
Steps:
1. Navigate to the “Edit License” page.
2. Locate the Linked Obligations Tab.
3. Click on the “Add Obligation” button.
Expected Result: A popup showing obligations which can be added is opened.

Update License Button

License update

Test Case ID: LIC-EDIT-007
Description: Verify that clicking on the “Update License” button saves the changes, shows the message “License updated,” and navigates the user back to the Main Licenses page.
Steps:
1. Navigate to the “Edit License” page.
2. Fill in the required fields and any additional information.
3. Click on the “Update License” button.
Expected Result: The license is saved, the message “License updated” is shown, changelog created, and the user is navigated back to the Main Licenses page.

Delete License Button

License deletion

Test Case ID: LIC-EDIT-008
Description: Verify that clicking on the “Delete License” button shows a confirmation popup. Clicking “Yes” should delete the license and navigate the user back to the Main Licenses page.
Steps:
1. Navigate to the “Edit License” page.
2. Click on the “Delete License” button.
3. In the confirmation popup, click “Yes”.
Expected Result: The license is deleted, and the user is navigated back to the Main Licenses page.

ECC Page

Mon, 01 Jan 0001 00:00:00 +0000

SW360 “ECC Main” Page Test Cases

General Page Behavior

Quick Filter

Test Case ID: ECC-001
Description: Verify the presence of a Quick Filter on the left which updates the ECC Overview table as the user types.
Steps:
1. Navigate to the “ECC Main” page.
2. Locate the Quick Filter on the left.
3. Type in the filter and observe the changes in the ECC Overview table.
Expected Result: The ECC Overview table updates based on the input in the Quick Filter.

ECC Overview Table

Columns

Test Case ID: ECC-002
Description: Verify the presence of the specified columns in the ECC Overview table.
Steps:
1. Navigate to the “ECC Main” page.
2. Locate the ECC Overview table.
3. Verify the presence of the following columns:
  - Status
  - Release name
  - Release version
  - Creator Group
  - ECC Assessor
  - ECC Assessor Group
  - Ecc Assessment Date
Expected Result: All specified columns are present and function as described.

Pagination Parameters

Test Case ID: ECC-003
Description: Verify the presence of pagination parameters in the ECC Overview table.
Steps:
1. Navigate to the “ECC Main” page.
2. Locate the ECC Overview table.
Expected Result: Pagination parameters are present in the ECC Overview table.

Vulnerabilities Page

Mon, 01 Jan 0001 00:00:00 +0000

SW360 “Main Vulnerabilities” Page Test Cases

General Page Behavior

Quick Filter

Test Case ID: VUL-001
Description: Verify the presence of a Quick Filter on the left which updates the vulnerability table as the user types.
Steps:
1. Navigate to the “Main Vulnerabilities” page.
2. Locate the Quick Filter on the left.
3. Type in the filter and observe the changes in the vulnerability table.
Expected Result: The vulnerability table updates based on the input in the Quick Filter.

Advanced Filter

Test Case ID: VUL-002
Description: Verify the presence of an Advanced Filter on the left with CVE ID and Vulnerable Configuration inputs and a “Filter” button.
Steps:
1. Navigate to the “Main Vulnerabilities” page.
2. Locate the Advanced Filter on the left.
3. Enter values in the CVE ID and Vulnerable Configuration inputs and click on the “Filter” button.
Expected Result: The vulnerability table filters based on the input in the Advanced Filter.

Page Title

Test Case ID: VUL-003
Description: Verify that the page title displays “Vulnerabilities (count of total vulnerabilities)”.
Steps:
1. Navigate to the “Main Vulnerabilities” page.
2. Locate the page title.
Expected Result: The page title displays “Vulnerabilities (count of total vulnerabilities)”.

Top Buttons

Test Case ID: VUL-004
Description: Verify the presence of the “Add Vulnerability” button and the “Show 200/500/1000/All” dropdown on top.
Steps:
1. Navigate to the “Main Vulnerabilities” page.
2. Locate the top section of the page.
Expected Result: The “Add Vulnerability” button and the “Show 200/500/1000/All” dropdown are present.

Vulnerability Table

Columns

Test Case ID: VUL-005
Description: Verify the presence of the specified columns in the vulnerability table.
Steps:
1. Navigate to the “Main Vulnerabilities” page.
2. Locate the vulnerability table.
3. Verify the presence of the following columns:
  - External ID (clickable to open vulnerability)
  - Title (tooltip of info)
  - Weighting (note: check https://code.siemens.com/sw360/sw360portal/blob/c397e64d48b93b6120681a75ed8c9c4a58eb630d/frontend/sw360-portlet/src/main/resources/META-INF/resources/html/vulnerabilities/view.jsp#L219)
  - Publish Date
  - Last update
  - Actions (edit icon and delete icon) (Clicking on delete should open a confirmation dialog)
Expected Result: All specified columns are present and function as described.

Pagination Parameters

Test Case ID: VUL-006
Description: Verify the presence of pagination parameters around the vulnerability table.
Steps:
1. Navigate to the “Main Vulnerabilities” page.
2. Locate the vulnerability table.
Expected Result: Pagination parameters are present around the vulnerability table.

Create Vulnerability

Mon, 01 Jan 0001 00:00:00 +0000

SW360 “Add Vulnerability” Page Test Cases

General Page Behavior

Top Buttons

Test Case ID: VUL-CRT-001
Description: Verify the presence of the “Create Vulnerability” and “Cancel” buttons on top.
Steps:
1. Navigate to the “Add Vulnerability” page.
2. Locate the top section of the page.
Expected Result: The “Create Vulnerability” and “Cancel” buttons are present.

Vulnerability Detail Section

Fields

Test Case ID: VUL-CRT-002
Description: Verify the presence of the specified fields in the Vulnerability Detail section.
Steps:
1. Navigate to the “Add Vulnerability” page.
2. Locate the Vulnerability Detail section.
3. Verify the presence of the following fields:
  - External ID (required)
  - Title
  - Description (text area)
  - Priortiy
  - Priority Text
  - Action
  - Legal Notice
  - Cwe (“CWE-” then a textbox)
  - Extended Description
  - CVSS Score (floating numbers)
  - CVSS Date
  - CVSS Time
  - Publish Date
  - Publish Time
  - Last External Update Date
  - Last External Update Time
Expected Result: All specified fields are present and function as described.

Vulnerability Impact Section

Fields

Test Case ID: VUL-CRT-003
Description: Verify the presence of the specified fields in the Vulnerability Impact section.
Steps:
1. Navigate to the “Add Vulnerability” page.
2. Locate the Vulnerability Impact section.
3. Verify the presence of the following fields:
  - Availability (dropdown)
  - Confidentiality (dropdown)
  - Integrity (dropdown)
Expected Result: All specified fields are present and function as described.

Vulnerability Access Section

Fields

Test Case ID: VUL-CRT-004
Description: Verify the presence of the specified fields in the Vulnerability Access section.
Steps:
1. Navigate to the “Add Vulnerability” page.
2. Locate the Vulnerability Access section.
3. Verify the presence of the following fields:
  - Authentication (dropdown)
  - Complexity (dropdown)
  - Vecotr (dropdown)
Expected Result: All specified fields are present and function as described.

CVE References Section

Add CVE Reference Button

Test Case ID: VUL-CRT-005
Description: Verify the presence of the “Add CVE Reference” button and the ability to add a row with the specified fields.
Steps:
1. Navigate to the “Add Vulnerability” page.
2. Locate the CVE References section.
3. Click on the “Add CVE Reference” button.
4. Verify the presence of a row with the following fields:
  - CVE Year (required)
  - CVE Number (required)
  - Delete row button
Expected Result: The “Add CVE Reference” button is present, and a row with the specified fields is added.

Assigned External Component Ids Section

Add Assigned External Component Id Button

Test Case ID: VUL-CRT-006
Description: Verify the presence of the “Add Assigned External Component Id” button and the ability to add a row with the specified field.
Steps:
1. Navigate to the “Add Vulnerability” page.
2. Locate the Assigned External Component Ids section.
3. Click on the “Add Assigned External Component Id” button.
4. Verify the presence of a row with the following field:
  - External Component Id
  - Delete row button
Expected Result: The “Add Assigned External Component Id” button is present, and a row with the specified field is added.

Vulnerability References Section

Add Vulnerability Reference Button

Test Case ID: VUL-CRT-007
Description: Verify the presence of the “Add Vulnerability Reference” button and the ability to add a row with the specified field.
Steps:
1. Navigate to the “Add Vulnerability” page.
2. Locate the Vulnerability References section.
3. Click on the “Add Vulnerability Reference” button.
4. Verify the presence of a row with the following field:
  - Reference
  - Delete row button
Expected Result: The “Add Vulnerability Reference” button is present, and a row with the specified field is added.

Vendor Advisories Section

Add Vendor Advisory Button

Test Case ID: VUL-CRT-008
Description: Verify the presence of the “Add Vendor Advisory” button and the ability to add a row with the specified fields.
Steps:
1. Navigate to the “Add Vulnerability” page.
2. Locate the Vendor Advisories section.
3. Click on the “Add Vendor Advisory” button.
4. Verify the presence of a row with the following fields:
  - Advisory Vendor (required)
  - Adivsory Name (required)
  - Advisory URL (required)
  - delete row button
Expected Result: The “Add Vendor Advisory” button is present, and a row with the specified fields is added.

Vulnerability Configuration Section

Add Vulnerability Configuration Button

Test Case ID: VUL-CRT-009
Description: Verify the presence of the “Add Vulnerability Configuration” button and the ability to add a row with the specified fields.
Steps:
1. Navigate to the “Add Vulnerability” page.
2. Locate the Vulnerability Configuration section.
3. Click on the “Add Vulnerability Configuration” button.
4. Verify the presence of a row with the following fields:
  - Configuration Key
  - Configuration Value
  - delete row button
Expected Result: The “Add Vulnerability Configuration” button is present, and a row with the specified fields is added.

Create Vulnerability Button

Vulnerability Creation

Test Case ID: VUL-CRT-010
Description: Verify that clicking on the “Create Vulnerability” button saves the vulnerability and redirects the user to the main vulnerability page with the message “Vulnerability (external ID) added successfully!” displayed.
Steps:
1. Navigate to the “Add Vulnerability” page.
2. Fill in the required fields and any additional information.
3. Click on the “Create Vulnerability” button.
Expected Result: The vulnerability is saved, the user is redirected to the main vulnerability page, and the message “Vulnerability (external ID) added successfully!” is displayed.

Vulnerability Detail

Mon, 01 Jan 0001 00:00:00 +0000

SW360 “Vulnerability Details” Page Test Cases

General Page Behavior

Opening Vulnerability Detail

Test Case ID: VUL-DTL-001
Description: Verify that the vulnerability detail can be opened with its external ID.
Steps:
1. Navigate to the “Main Vulnerabilities” page.
2. Click on the External ID of a vulnerability to open its detail.
Expected Result: The vulnerability detail page is opened with the specified external ID.

Page Title

Test Case ID: VUL-DTL-002
Description: Verify that the vulnerability title is displayed in the page title.
Steps:
1. Navigate to the “Vulnerability Details” page.
2. Locate the page title.
Expected Result: The vulnerability title is displayed in the page title.

Summary Tab

Vulnerability Summary Section

Test Case ID: VUL-DTL-003
Description: Verify the presence of the specified fields in the Vulnerability Summary section.
Steps:
1. Navigate to the “Vulnerability Details” page.
2. Locate the Vulnerability Summary section in the Summary Tab.
3. Verify the presence of the following fields:
  - Title
  - Description
  - External Id
  - Publish Date
  - Last update
  - Priority
  - Priority text
  - Action
  - Impact (if available, list of integrity, availability, confidentiality)
  - Legal Notice
  - Assigned external component ids (comma-separated list)
  - CVE references (comma-separated list)
  - Vendor advisories (list of vendor, name, url)
  - Vulnerablity scoring CVSS (score, date)
  - Access (list of complexity, vector, authentication)
  - Common weakness enumeration (CWE with link)
  - Vulnerable configurations (list of key-value pairs)
Expected Result: All specified fields are present and function as described.

Releases Table

Test Case ID: VUL-DTL-004
Description: Verify the presence of the table of releases following the “Vulnerability Title is present in the following releases” title.
Steps:
1. Navigate to the “Vulnerability Details” page.
2. Locate the table of releases in the Summary Tab.
3. Verify the presence of the following columns:
  - Release (link to release)
  - CPE-ID
  - Release date (not creation date)
Expected Result: The table with the specified columns is present.

Metadata Tab

Vulnerability Metadata Section

Test Case ID: VUL-DTL-005
Description: Verify the display of the Vulnerability Metadata section if cveFurtherMetaDataPerSource is present in the object.
Steps:
1. Navigate to the “Vulnerability Details” page.
2. Locate the Metadata Tab.
3. Verify the presence of an unordered list of Key (bold): Value (another unordered list of Key (bold) Value) if cveFurtherMetaDataPerSource is present in the object.
Expected Result: The specified unordered list is displayed if cveFurtherMetaDataPerSource is present.

References Tab

Vulnerability References

Test Case ID: VUL-DTL-006
Description: Verify the presence of an unordered list of clickable URLs in the Vulnerability References section.
Steps:
1. Navigate to the “Vulnerability Details” page.
2. Locate the References Tab.
3. Verify the presence of an unordered list of clickable URLs.
Expected Result: The unordered list of clickable URLs is present.

Vulnerability Edit

Mon, 01 Jan 0001 00:00:00 +0000

SW360 “Vulnerability Edit” Page Test Cases

General Page Behavior

Opening Vulnerability Edit

Test Case ID: VUL-EDIT-001
Description: Verify that the vulnerability edit can be opened from the Vulnerability Details page.
Steps:
1. Navigate to the “Vulnerability Details” page.
2. Click on the “Edit” button to open the vulnerability edit page.
Expected Result: The vulnerability edit page is opened with the data from the vulnerability already filled.

Top Buttons

Test Case ID: VUL-EDIT-002
Description: Verify the presence of the “Update Vulnerability”, “Delete Vulnerability”, and “Cancel” buttons on top.
Steps:
1. Navigate to the “Vulnerability Edit” page.
2. Locate the top section of the page.
Expected Result: The “Update Vulnerability”, “Delete Vulnerability”, and “Cancel” buttons are present.

Vulnerability Detail Section

Fields

Test Case ID: VUL-EDIT-003
Description: Verify the presence of all fields from the “Create Vulnerability” page with the data from the vulnerability already filled.
Steps:
1. Navigate to the “Vulnerability Edit” page.
2. Locate the Vulnerability Detail section.
3. Verify the presence of the following fields:
  - External ID (required)
  - Title
  - Description (text area)
  - Priortiy
  - Priority Text
  - Action
  - Legal Notice
  - Cwe (“CWE-” then a textbox)
  - Extended Description
  - CVSS Score (floating numbers)
  - CVSS Date
  - CVSS Time
  - Publish Date
  - Publish Time
  - Last External Update Date
  - Last External Update Time
Expected Result: All specified fields are present and function as described, with the data from the vulnerability already filled.

Vulnerability Impact Section

Fields

Test Case ID: VUL-EDIT-004
Description: Verify the presence of the specified fields in the Vulnerability Impact section with the data from the vulnerability already filled.
Steps:
1. Navigate to the “Vulnerability Edit” page.
2. Locate the Vulnerability Impact section.
3. Verify the presence of the following fields:
  - Availability (dropdown)
  - Confidentiality (dropdown)
  - Integrity (dropdown)
Expected Result: All specified fields are present and function as described, with the data from the vulnerability already filled.

Vulnerability Access Section

Fields

Test Case ID: VUL-EDIT-005
Description: Verify the presence of the specified fields in the Vulnerability Access section with the data from the vulnerability already filled.
Steps:
1. Navigate to the “Vulnerability Edit” page.
2. Locate the Vulnerability Access section.
3. Verify the presence of the following fields:
  - Authentication (dropdown)
  - Complexity (dropdown)
  - Vecotr (dropdown)
Expected Result: All specified fields are present and function as described, with the data from the vulnerability already filled.

CVE References Section

Add CVE Reference Button

Test Case ID: VUL-EDIT-006
Description: Verify the presence of the “Add CVE Reference” button and the ability to add a row with the specified fields.
Steps:
1. Navigate to the “Vulnerability Edit” page.
2. Locate the CVE References section.
3. Click on the “Add CVE Reference” button.
4. Verify the presence of a row with the following fields:
  - CVE Year (required)
  - CVE Number (required)
  - Delete row button
Expected Result: The “Add CVE Reference” button is present, and a row with the specified fields is added.

Assigned External Component Ids Section

Add Assigned External Component Id Button

Test Case ID: VUL-EDIT-007
Description: Verify the presence of the “Add Assigned External Component Id” button and the ability to add a row with the specified field.
Steps:
1. Navigate to the “Vulnerability Edit” page.
2. Locate the Assigned External Component Ids section.
3. Click on the “Add Assigned External Component Id” button.
4. Verify the presence of a row with the following field:
  - External Component Id
  - Delete row button
Expected Result: The “Add Assigned External Component Id” button is present, and a row with the specified field is added.

Vulnerability References Section

Add Vulnerability Reference Button

Test Case ID: VUL-EDIT-008
Description: Verify the presence of the “Add Vulnerability Reference” button and the ability to add a row with the specified field.
Steps:
1. Navigate to the “Vulnerability Edit” page.
2. Locate the Vulnerability References section.
3. Click on the “Add Vulnerability Reference” button.
4. Verify the presence of a row with the following field:
  - Reference
  - Delete row button
Expected Result: The “Add Vulnerability Reference” button is present, and a row with the specified field is added.

Vendor Advisories Section

Add Vendor Advisory Button

Test Case ID: VUL-EDIT-009
Description: Verify the presence of the “Add Vendor Advisory” button and the ability to add a row with the specified fields.
Steps:
1. Navigate to the “Vulnerability Edit” page.
2. Locate the Vendor Advisories section.
3. Click on the “Add Vendor Advisory” button.
4. Verify the presence of a row with the following fields:
  - Advisory Vendor (required)
  - Adivsory Name (required)
  - Advisory URL (required)
  - delete row button
Expected Result: The “Add Vendor Advisory” button is present, and a row with the specified fields is added.

Vulnerability Configuration Section

Add Vulnerability Configuration Button

Test Case ID: VUL-EDIT-010
Description: Verify the presence of the “Add Vulnerability Configuration” button and the ability to add a row with the specified fields.
Steps:
1. Navigate to the “Vulnerability Edit” page.
2. Locate the Vulnerability Configuration section.
3. Click on the “Add Vulnerability Configuration” button.
4. Verify the presence of a row with the following fields:
  - Configuration Key
  - Configuration Value
  - delete row button
Expected Result: The “Add Vulnerability Configuration” button is present, and a row with the specified fields is added.

Update Vulnerability Button

Vulnerability Update

Test Case ID: VUL-EDIT-011
Description: Verify that clicking on the “Update Vulnerability” button saves the changes and redirects the user to the main vulnerability page with the message “Vulnerability (external ID) updated successfully!” displayed.
Steps:
1. Navigate to the “Vulnerability Edit” page.
2. Make changes to the fields.
3. Click on the “Update Vulnerability” button.
Expected Result: The changes are saved, the user is redirected to the main vulnerability page, and the message “Vulnerability (external ID) updated successfully!” is displayed.

Cancel Button

Discard Changes

Test Case ID: VUL-EDIT-012
Description: Verify that clicking the “Cancel” button discards the changes and takes the user back to the Vulnerability Details page.
Steps:
1. Navigate to the “Vulnerability Edit” page.
2. Make changes to the fields.
3. Click on the “Cancel” button.
Expected Result: The changes are discarded, and the user is redirected to the Vulnerability Details page.

Search Page

Mon, 01 Jan 0001 00:00:00 +0000

SW360 “Search” Page Test Cases

Keyword Search Panel

Test Case ID: SEARCH-001
Description: Verify the presence of the search box in the Keyword Search panel on the left.
Steps:
1. Navigate to the “Search” page.
2. Locate the Keyword Search panel on the left.
Expected Result: The search box is present.

Restrict to Type

Test Case ID: SEARCH-002
Description: Verify the presence of the “Restrict to type” option with an info hover and the specified restrictions.
Steps:
1. Navigate to the “Search” page.
2. Locate the “Restrict to type” option in the Keyword Search panel on the left.
3. Hover over the “Restrict to type” option.
Expected Result: The “Restrict to type” option is present with an info hover, and the specified restrictions are available.

Toggle and Deselect All Buttons

Test Case ID: SEARCH-003
Description: Verify the presence of the “Toggle” and “Deselect all” buttons which change the checkboxes in the Restrictions.
Steps:
1. Navigate to the “Search” page.
2. Locate the “Toggle” and “Deselect all” buttons in the Keyword Search panel on the left.
3. Click on the “Toggle” button.
4. Click on the “Deselect all” button.
Expected Result: The “Toggle” and “Deselect all” buttons are present and function as described.

Search Button

Test Case ID: SEARCH-004
Description: Verify the presence of the “Search” button to submit the search.
Steps:
1. Navigate to the “Search” page.
2. Locate the “Search” button in the Keyword Search panel on the left.
3. Click on the “Search” button.
Expected Result: The “Search” button is present and functional.

Search Result

Total Count

Test Case ID: SEARCH-005
Description: Verify the display of the search result total count on the top right.
Steps:
1. Navigate to the “Search” page.
2. Locate the top right section of the page.
Expected Result: The search result total count is displayed.

Result Table

Test Case ID: SEARCH-006
Description: Verify the presence of the result table with the specified columns.
Steps:
1. Navigate to the “Search” page.
2. Locate the result table.
3. Verify the presence of the following columns:
  - Type (icons matching restriction)
  - Text (Name of document, click to open)
Expected Result: The result table with the specified columns is present.

Page First Load Message

Entire Document Message

Test Case ID: SEARCH-007
Description: Verify the display of the message about “Entire Document” at the bottom of the table on the page first load.
Steps:
1. Navigate to the “Search” page.
2. Locate the bottom of the result table.
Expected Result: The message about “Entire Document” is displayed at the bottom of the table.

Preferences Page

Mon, 01 Jan 0001 00:00:00 +0000

SW360 “Preferences” Page Test Cases

General Page Behavior

Update Settings Button

Test Case ID: PREF-001
Description: Verify the presence of the “Update Settings” button at the top.
Steps:
1. Navigate to the “Preferences” page.
2. Locate the top section of the page.
Expected Result: The “Update Settings” button is present.

E-Mail Notification Preferences Section

Enable E-Mail Notifications Checkbox

Test Case ID: PREF-002
Description: Verify the presence of the “Enable E-Mail Notifications” checkbox and its behavior.
Steps:
1. Navigate to the “Preferences” page.
2. Locate the E-Mail Notification Preferences section.
3. Uncheck the “Enable E-Mail Notifications” checkbox.
Expected Result: The checkbox is present, and unchecking it disables all checkboxes in this section.

Individual Checkboxes

Test Case ID: PREF-003
Description: Verify the presence of individual checkboxes for Project, Component, Release, Moderation & Clearing in the form of a Carousel.
Steps:
1. Navigate to the “Preferences” page.
2. Locate the E-Mail Notification Preferences section.
3. Verify the presence of the following checkboxes:
  - Project
  - Component
  - Release
  - Moderation & Clearing
Expected Result: All specified checkboxes are present and function as described.

SW360 User Section

User Details

Test Case ID: PREF-004
Description: Verify the presence of the specified details in the SW360 User section.
Steps:
1. Navigate to the “Preferences” page.
2. Locate the SW360 User section.
3. Verify the presence of the following details:
  - Name
  - E-mail (mailto link)
  - Primary Department
  - External Id
  - Primary Department Role
  - Secondary Departments and Roles (unordered list of Department (Bold): Role)
Expected Result: All specified details are present and function as described.

Rest API Token Section

Fields

Test Case ID: PREF-005
Description: Verify the presence of the specified fields in the Rest API Token section.
Steps:
1. Navigate to the “Preferences” page.
2. Locate the Rest API Token section.
3. Verify the presence of the following fields:
  - Name
  - Authorities (checkbox “Read Access”, (if enabled) “Write Access”)
  - Expiration Date
  - Token (info hover)
Expected Result: All specified fields are present and function as described.

Generate Token Button

Test Case ID: PREF-006
Description: Verify the presence of the “Generate Token” button and its behavior.
Steps:
1. Navigate to the “Preferences” page.
2. Locate the Rest API Token section.
3. Click on the “Generate Token” button.
Expected Result: The button is present, and clicking it submits a request to generate a new token, which is then displayed in the “Token” field above.

Token Table

Columns

Test Case ID: PREF-007
Description: Verify the presence of the specified columns in the Token table.
Steps:
1. Navigate to the “Preferences” page.
2. Locate the Token table.
3. Verify the presence of the following columns:
  - Token Name
  - Created on
  - Expiration Date
  - Authorities ([list])
  - Action (Revoke Token button)
Expected Result: All specified columns are present and function as described.

Requests Page

Mon, 01 Jan 0001 00:00:00 +0000

SW360 “Requests” Page Test Cases

General Page Behavior

Moderation Requests and Clearing Requests

Test Case ID: REQ-001
Description: Verify that the page shows both Moderation Requests and Clearing Requests.
Steps:
1. Navigate to the “Requests” page.
Expected Result: Both Moderation Requests and Clearing Requests are displayed.

Open Moderation Request Tab

Advanced Search

Test Case ID: REQ-002
Description: Verify the presence of the Advanced Search on the left with the specified fields.
Steps:
1. Navigate to the “Requests” page.
2. Locate the Open Moderation Request Tab.
3. Verify the presence of the following fields in the Advanced Search:
  - Date
  - Type (dropdown)
  - Document Name
  - Requesting User
  - Department (User Department)
  - Moderators
  - State (Dropdown)
  - Exact Match checkbox
4. Click on the “Search” button at the bottom to submit the search.
Expected Result: The Advanced Search is present with the specified fields, and the “Search” button is functional.

Moderation Count

Test Case ID: REQ-003
Description: Verify the display of the moderation open count/closed count in the top right.
Steps:
1. Navigate to the “Requests” page.
2. Locate the Open Moderation Request Tab.
Expected Result: The moderation open count/closed count is displayed in the top right.

MR Table

Test Case ID: REQ-004
Description: Verify the presence of the specified columns in the MR Table.
Steps:
1. Navigate to the “Requests” page.
2. Locate the Open Moderation Request Tab.
3. Verify the presence of the following columns in the MR Table:
  - Date
  - Type
  - Document Name (Click to open)
  - Requesting User (mailto link)
  - Department
  - Moderators (truncated, expanded to see all)
  - State
  - Actions (If open by user to delete)
Expected Result: All specified columns are present and function as described.

Pagination Components

Test Case ID: REQ-005
Description: Verify the presence of pagination components around the MR Table.
Steps:
1. Navigate to the “Requests” page.
2. Locate the Open Moderation Request Tab.
Expected Result: Pagination components are present around the MR Table.

Closed Moderation Request Tab

Advanced Search

Test Case ID: REQ-006
Description: Verify the presence of the Advanced Search on the left like the “Open Moderation Request” Tab.
Steps:
1. Navigate to the “Requests” page.
2. Locate the Closed Moderation Request Tab.
Expected Result: The Advanced Search is present with the specified fields.

Moderation Count

Test Case ID: REQ-007
Description: Verify the display of the moderation open count/closed count in the top right.
Steps:
1. Navigate to the “Requests” page.
2. Locate the Closed Moderation Request Tab.
Expected Result: The moderation open count/closed count is displayed in the top right.

MR Table

Test Case ID: REQ-008
Description: Verify the presence of the specified columns in the MR Table.
Steps:
1. Navigate to the “Requests” page.
2. Locate the Closed Moderation Request Tab.
3. Verify the presence of the following columns in the MR Table:
  - Date
  - Type
  - Document Name (Click to open)
  - Requesting User (mailto link)
  - Department
  - Moderators (truncated, expanded to see all)
  - State
  - Actions (If open by user to delete)
Expected Result: All specified columns are present and function as described.

Open Clearing Request Tab

Quick Filter

Test Case ID: REQ-009
Description: Verify the presence of the Quick Filter search box on the left.
Steps:
1. Navigate to the “Requests” page.
2. Locate the Open Clearing Request Tab.
Expected Result: The Quick Filter search box is present.

Advanced Filter

Test Case ID: REQ-010
Description: Verify the presence of the Advanced Filter on the left with the specified fields.
Steps:
1. Navigate to the “Requests” page.
2. Locate the Open Clearing Request Tab.
3. Verify the presence of the following fields in the Advanced Filter:
  - Select date type and range (dropdown which shows another dropdown)
  - Priority (dropdown)
  - BA-BL/Group (dropdown)
  - Status (dropdown)
  - Clearing Type (dropdown)
Expected Result: The Advanced Filter is present with the specified fields.

Clearing Count

Test Case ID: REQ-011
Description: Verify the display of the clearing open count/closed count in the top right.
Steps:
1. Navigate to the “Requests” page.
2. Locate the Open Clearing Request Tab.
Expected Result: The clearing open count/closed count is displayed in the top right.

Clearing Request Table

Test Case ID: REQ-012
Description: Verify the presence of the specified columns in the Clearing Request Table.
Steps:
1. Navigate to the “Requests” page.
2. Locate the Open Clearing Request Tab.
3. Verify the presence of the following columns in the Clearing Request Table:
  - Request ID (click to open CR)
  - BA-BL/Group
  - Project (open project)
  - Open Releases
  - Status
  - Priority (color coded)
  - Requesting User (mailto link)
  - Clearing Progress (percentage)
  - Created on
  - Preferred Clearing Date
  - Agreed Clearing Date
  - Clearing Type
  - Actions (edit icon)
Expected Result: All specified columns are present and function as described.

Closed Clearing Request Tab

Quick Filter

Test Case ID: REQ-013
Description: Verify the presence of the Quick Filter search box on the left.
Steps:
1. Navigate to the “Requests” page.
2. Locate the Closed Clearing Request Tab.
Expected Result: The Quick Filter search box is present.

Advanced Filter

Test Case ID: REQ-014
Description: Verify the presence of the Advanced Filter on the left with the specified fields.
Steps:
1. Navigate to the “Requests” page.
2. Locate the Closed Clearing Request Tab.
3. Verify the presence of the following fields in the Advanced Filter:
  - Select date type and range (dropdown which shows another dropdown)
  - BA-BL/Group (dropdown)
  - Status (dropdown)
  - Clearing Type (dropdown)
Expected Result: The Advanced Filter is present with the specified fields.

Clearing Count

Test Case ID: REQ-015
Description: Verify the display of the clearing open count/closed count in the top right.
Steps:
1. Navigate to the “Requests” page.
2. Locate the Closed Clearing Request Tab.
Expected Result: The clearing open count/closed count is displayed in the top right.

Clearing Request Table

Test Case ID: REQ-016
Description: Verify the presence of the specified columns in the Clearing Request Table.
Steps:
1. Navigate to the “Requests” page.
2. Locate the Closed Clearing Request Tab.
3. Verify the presence of the following columns in the Clearing Request Table:
  - Request ID (click to open CR)
  - BA-BL/Group
  - Project (open project)
  - Open Releases
  - Status
  - Priority (color coded)
  - Requesting User (mailto link)
  - Clearing Progress (percentage)
  - Created on
  - Preferred Clearing Date
  - Agreed Clearing Date
  - Clearing Type
  - Actions (edit icon)
Expected Result: All specified columns are present and function as described.

Requests - Moderation Request Details

Mon, 01 Jan 0001 00:00:00 +0000

SW360 “Moderation Request Details” Page Test Cases

General Page Behavior

Assignment Message

Test Case ID: MR-DTL-001
Description: Verify the display of the message “Success: You have assigned yourself to this moderation request” when a user first opens a Moderation Request in Open state and can be a moderator.
Steps:
1. Navigate to the “Moderation Request Details” page of an Open state request.
2. Locate the top section of the page.
Expected Result: The message “Success: You have assigned yourself to this moderation request” is displayed.

Top Buttons

Test Case ID: MR-DTL-002
Description: Verify the presence of the “Accept Request”, “Decline Request”, “Postpone Request”, “Remove Me from moderators”, and “Cancel” buttons on top. Clicking on them should open a popup. If the moderation request is closed, no buttons should be displayed on top.
Steps:
1. Navigate to the “Moderation Request Details” page of an Open state request.
2. Locate the top section of the page.
3. Click on each of the buttons to verify the popup.
4. Navigate to the “Moderation Request Details” page of a closed request.
Expected Result: The specified buttons are present and function as described for Open state requests. No buttons are displayed for closed requests.

Document Name and Type

Test Case ID: MR-DTL-003
Description: Verify the display of the document name and type on the top right.
Steps:
1. Navigate to the “Moderation Request Details” page.
2. Locate the top right section of the page.
Expected Result: The document name and type are displayed on the top right.

Moderation Request Information Section

Moderation Request Fields

Test Case ID: MR-DTL-004
Description: Verify the presence of the specified fields in the Moderation Request section.
Steps:
1. Navigate to the “Moderation Request Details” page.
2. Locate the Moderation Request Information section.
3. Verify the presence of the following fields:
  - Requesting user
  - Submitted on
  - Comment on Moderation Request (text area)
Expected Result: All specified fields are present and function as described.

Moderation Decision Fields

Test Case ID: MR-DTL-005
Description: Verify the presence of the specified fields in the Moderation Decision section.
Steps:
1. Navigate to the “Moderation Request Details” page.
2. Locate the Moderation Request Information section.
3. Verify the presence of the following fields:
  - Status
  - Moderator
  - Comment on Moderation Decision (text area) (used for Accept/Decline)
Expected Result: All specified fields are present and function as described.

Proposed Changes Section

View Based on Document Type

Test Case ID: MR-DTL-006
Description: Verify that the Proposed Changes section shows a view based on the document type.
Steps:
1. Navigate to the “Moderation Request Details” page.
2. Locate the Proposed Changes section.
Expected Result: The Proposed Changes section shows a view based on the document type.

Current Component Section

Display of Component

Test Case ID: MR-DTL-007
Description: Verify that the Current Component section shows the entire component based on the document type.
Steps:
1. Navigate to the “Moderation Request Details” page.
2. Locate the Current Component section.
Expected Result: The Current Component section shows the entire component based on the document type.

Requests - Clearing Request Details

Mon, 01 Jan 0001 00:00:00 +0000

SW360 “Clearing Request Details” Page Test Cases

General Page Behavior

Top Buttons

Test Case ID: CR-DTL-001
Description: Verify the presence of the “Edit Request” button and CR ID on top. If the CR is closed, the “Reopen Request” button should be shown instead, clicking which opens a Reopen dialog box.
Steps:
1. Navigate to the “Clearing Request Details” page of an Open state request.
2. Locate the top section of the page.
3. Click on the “Edit Request” button.
4. Navigate to the “Clearing Request Details” page of a closed request.
5. Click on the “Reopen Request” button.
Expected Result: The “Edit Request” button and CR ID are present for Open state requests. The “Reopen Request” button is present for closed requests and opens a Reopen dialog box.

Clearing Request Information for Project Section

Project Link

Test Case ID: CR-DTL-002
Description: Verify the presence of the project link to open the project.
Steps:
1. Navigate to the “Clearing Request Details” page.
2. Locate the Clearing Request Information for Project section.
Expected Result: The project link is present and functional.

Clearing Request Fields

Test Case ID: CR-DTL-003
Description: Verify the presence of the specified fields in the Clearing Request section.
Steps:
1. Navigate to the “Clearing Request Details” page.
2. Locate the Clearing Request Information for Project section.
3. Verify the presence of the following fields:
  - Requesting User
  - Created on
  - Preferred Clearing Date
  - Business Area/Line
  - Clearing Type
  - Requester comment
Expected Result: All specified fields are present and function as described.

Clearing Decision Fields

Test Case ID: CR-DTL-004
Description: Verify the presence of the specified fields in the Clearing Decision section.
Steps:
1. Navigate to the “Clearing Request Details” page.
2. Locate the Clearing Request Information for Project section.
3. Verify the presence of the following fields:
  - Request Status
  - Priority
  - Clearing Team
  - Agreed Clearing Date
  - Last Updated on
Expected Result: All specified fields are present and function as described.

Clearing Request Comments Section

Comment Count

Test Case ID: CR-DTL-005
Description: Verify the display of the comment count.
Steps:
1. Navigate to the “Clearing Request Details” page.
2. Locate the Clearing Request Comments section.
Expected Result: The comment count is displayed.

Comment Box

Test Case ID: CR-DTL-006
Description: Verify the presence of the comment box with an “Add comment” button and a search bar on the right.
Steps:
1. Navigate to the “Clearing Request Details” page.
2. Locate the Clearing Request Comments section.
Expected Result: The comment box with an “Add comment” button and a search bar on the right is present.

Comment Rows

Test Case ID: CR-DTL-007
Description: Verify the presence of comment rows below the comment box.
Steps:
1. Navigate to the “Clearing Request Details” page.
2. Locate the Clearing Request Comments section.
Expected Result: Comment rows are present below the comment box.

Edit Clearing Request

Editable Fields

Test Case ID: CR-DTL-008
Description: Verify that the “Edit Clearing Request” allows changes to the specified fields.
Steps:
1. Navigate to the “Clearing Request Details” page.
2. Click on the “Edit Request” button.
3. Verify the presence of the following fields:
  - Requesting User
  - Clearing Type
  - Request Status
  - Priority
  - Clearing Team
  - Agreed Clearing Date
Expected Result: The specified fields are present and editable.

Update and Cancel Buttons

Test Case ID: CR-DTL-009
Description: Verify the presence of the “Update Request” and “Cancel” buttons on top.
Steps:
1. Navigate to the “Clearing Request Details” page.
2. Click on the “Edit Request” button.
3. Locate the top section of the edit page.
Expected Result: The “Update Request” and “Cancel” buttons are present.

Admin User Page

Mon, 01 Jan 0001 00:00:00 +0000

SW360 “Admin > User” Page Test Cases

Advance Search on the Left Panel

Search Fields

Test Case ID: ADMIN-USER-001
Description: Verify the presence of the advance search on the left panel with the specified fields.
Steps:
1. Navigate to the “Admin > User” page.
2. Locate the advance search section on the left panel.
3. Verify the presence of the following search fields:
  - Given Name
  - Last Name
  - Email
  - Primary Department
  - Primary Department Role (dropdown)
4. Click on the “Search” button.
Expected Result: The search fields are present, and clicking the “Search” button loads the results in the same page.

Users Count

Display of Users Count

Test Case ID: ADMIN-USER-002
Description: Verify the display of the users count in the top right.
Steps:
1. Navigate to the “Admin > User” page.
2. Locate the top right section of the page.
Expected Result: The users count is displayed in the top right.

Users Table

Columns

Test Case ID: ADMIN-USER-003
Description: Verify the presence of the specified columns in the Users table.
Steps:
1. Navigate to the “Admin > User” page.
2. Locate the Users table.
3. Verify the presence of the following columns:
  - Given name
  - Last name
  - Email (click to open user)
  - Active status
  - Primary Department
  - Primary Department Role
  - Secondary Departments and Roles (unordered list of Department (bold) and role)
  - Actions (Edit and Edit secondary department)
4. Click on the “Edit secondary department” action to verify the popup for Secondary department and role.
Expected Result: All specified columns are present and function as described. Clicking on “Edit secondary department” opens a popup for Secondary department and role.

SW360 “User Details” Page Test Cases

General Page Behavior

Top Buttons

Test Case ID: USER-DTL-001
Description: Verify the presence of the “Edit User” button on the top left and the user email on the top right.
Steps:
1. Navigate to the “User Details” page.
2. Locate the top section of the page.
Expected Result: The “Edit User” button and user email are present.

User Information Section

Fields

Test Case ID: USER-DTL-002
Description: Verify the presence of the specified fields in the User Information section.
Steps:
1. Navigate to the “User Details” page.
2. Locate the User Information section.
3. Verify the presence of the following fields:
  - Given name
  - Last name
  - Email Id
  - Global Identifier (external ID)
  - Active status
  - Department
  - Primary roles
  - Secondary Department and Roles (as unordered list)
Expected Result: All specified fields are present and function as described.

SW360 “User Edit” Page Test Cases

General Page Behavior

Top Buttons

Test Case ID: USER-EDIT-001
Description: Verify the presence of the “Update User”, “Deactivate User”, and “Cancel” buttons on top, and the user email on the top right.
Steps:
1. Navigate to the “User Edit” page.
2. Locate the top section of the page.
Expected Result: The “Update User”, “Deactivate User”, and “Cancel” buttons are present, and the user email is displayed on the top right.

General Information Section

Editable Fields

Test Case ID: USER-EDIT-002
Description: Verify the presence of the specified editable fields in the General Information section.
Steps:
1. Navigate to the “User Edit” page.
2. Locate the General Information section.
3. Verify the presence of the following editable fields:
  - Given name
  - Last name
  - Email ID
  - Gobal Identifier
  - Department
  - Primary roles
Expected Result: All specified editable fields are present and function as described.

Secondary Departments and Roles Section

Fields and Buttons

Test Case ID: USER-EDIT-003
Description: Verify the presence of the specified fields and buttons in the Secondary Departments and Roles section.
Steps:
1. Navigate to the “User Edit” page.
2. Locate the Secondary Departments and Roles section.
3. Verify the presence of the following fields and buttons:
  - Secondary department (text box)
  - Secondary department role (dropdown)
  - delete row button
  - “Click to add” button below
Expected Result: All specified fields and buttons are present and function as described.

Update User Button

User Update and Redirection

Test Case ID: USER-EDIT-004
Description: Verify that clicking on the “Update User” button saves the changes and redirects the user to the user’s detail page.
Steps:
1. Navigate to the “User Edit” page.
2. Make changes to the fields.
3. Click on the “Update User” button.
Expected Result: The changes are saved, and the user is redirected to the user’s detail page.

Admin Vendors Page

Mon, 01 Jan 0001 00:00:00 +0000

SW360 “Admin > Vendors” Page Test Cases

General Page Behavior

Quick Filter and Buttons

Test Case ID: ADMIN-VENDORS-001
Description: Verify the presence of the Quick Filter on the left, “Add Vendor” and “Export Spreadsheet” buttons on top, and the Vendors count on the right.
Steps:
1. Navigate to the “Admin > Vendors” page.
2. Locate the Quick Filter on the left, the buttons on top, and the Vendors count on the right.
Expected Result: The Quick Filter, buttons, and Vendors count are present.

Vendors Table

Columns

Test Case ID: ADMIN-VENDORS-002
Description: Verify the presence of the specified columns in the Vendors table.
Steps:
1. Navigate to the “Admin > Vendors” page.
2. Locate the Vendors table.
3. Verify the presence of the following columns:
  - Full Name (click to open vendor)
  - Short name
  - URL
  - Actions (edit, merge, and delete)
Expected Result: All specified columns are present and function as described.

SW360 “Add Vendor” Page Test Cases

General Page Behavior

Top Buttons

Test Case ID: ADD-VENDOR-001
Description: Verify the presence of the “Create Vendor” and “Cancel” buttons on top.
Steps:
1. Navigate to the “Add Vendor” page.
2. Locate the top section of the page.
Expected Result: The “Create Vendor” and “Cancel” buttons are present.

Fields

Test Case ID: ADD-VENDOR-002
Description: Verify the presence of the specified fields in the table.
Steps:
1. Navigate to the “Add Vendor” page.
2. Locate the table.
3. Verify the presence of the following fields:
  - Full Name
  - Short Name
  - URL
Expected Result: All specified fields are present and function as described.

Create Vendor Button

Vendor Creation and Redirection

Test Case ID: ADD-VENDOR-003
Description: Verify that clicking on the “Create Vendor” button shows the message “Vendor created” and redirects the user to the Vendors main page.
Steps:
1. Navigate to the “Add Vendor” page.
2. Fill in the required fields.
3. Click on the “Create Vendor” button.
Expected Result: The message “Vendor created” is shown, and the user is redirected to the Vendors main page.

SW360 “Vendor Details” Page Test Cases

General Page Behavior

Opening Vendor Edit Page

Test Case ID: VENDOR-DTL-001
Description: Verify that clicking on the Vendor Name opens the Vendor Edit Page.
Steps:
1. Navigate to the “Vendor Details” page.
2. Click on the Vendor Name.
Expected Result: The Vendor Edit Page is opened.

SW360 “Vendor Edit” Page Test Cases

General Page Behavior

Top Buttons

Test Case ID: VENDOR-EDIT-001
Description: Verify the presence of the “Update Vendor”, “Delete Vendor”, and “Cancel” buttons on top left, and the Vendor full name on top right.
Steps:
1. Navigate to the “Vendor Edit” page.
2. Locate the top section of the page.
Expected Result: The “Update Vendor”, “Delete Vendor”, and “Cancel” buttons are present, and the Vendor full name is displayed on the top right.

Editable Fields

Test Case ID: VENDOR-EDIT-002
Description: Verify the presence of the specified editable fields in the Vendor table.
Steps:
1. Navigate to the “Vendor Edit” page.
2. Locate the Vendor table.
3. Verify the presence of the following editable fields:
  - Full Name
  - Short Name
  - URL
Expected Result: All specified editable fields are present and function as described.

Update Vendor Button

Vendor Update and Redirection

Test Case ID: VENDOR-EDIT-003
Description: Verify that clicking on the “Update Vendor” button saves the changes and redirects the user to the Vendor Details page.
Steps:
1. Navigate to the “Vendor Edit” page.
2. Make changes to the fields.
3. Click on the “Update Vendor” button.
Expected Result: The changes are saved, and the user is redirected to the Vendor Details page.

About Eclipse SW360

Mon, 01 Jan 0001 00:00:00 +0000

About Eclipse SW360

In most cases, modern software is not built from scratch but is instead assembled using various prepackaged third-party software components. As a result, organizations face several challenges:

Verifying compliance when using third-party software components, including license compliance, ECC checks, and IP assessments.
Sharing knowledge about software components and their qualities, such as which components should be recommended and which should be phased out based on specific criteria.
Providing a broad overview of the components used in an organization and its supply chain to track which assets are integrated into different products or solutions.

These three main use cases cater to different roles within an organization, including quality managers, software developers, legal counsels, software architects, and R&D managers. However, all these roles share a common need for a centralized hub that manages insights into software components.

Bitkom AK Open Source

Mon, 01 Jan 0001 00:00:00 +0000

Bitkom AK Open Source

Mon, 01 Jan 0001 00:00:00 +0000

Bitkom Forum Open Source 2018

Mon, 01 Jan 0001 00:00:00 +0000

EclipseCon 2022

Mon, 01 Jan 0001 00:00:00 +0000

EclipseCon Europe 2016

Mon, 01 Jan 0001 00:00:00 +0000

EclipseCon Europe 2017

Mon, 01 Jan 0001 00:00:00 +0000

EclipseCon France 2017

Mon, 01 Jan 0001 00:00:00 +0000

FOSDEM 2022

Mon, 01 Jan 0001 00:00:00 +0000

Inner Source Commons 2018

Mon, 01 Jan 0001 00:00:00 +0000

JAXenter

Mon, 01 Jan 0001 00:00:00 +0000

License Naming

Mon, 01 Jan 0001 00:00:00 +0000

Guidelines

Generally the license naming should conform with the SPDX Spec and the SPDX License List

Please see the “License List Fields” from ↗ https://github.com/spdx/license-list-XML/blob/main/DOCS/license-fields.md

where there is especially for identifier:

License or Exception Identifier (aka “SPDX Short Identifier”)

Short identifier to be used to identify a license or exception match to licenses or exceptions contained on the SPDX License List in the context of an SPDX file, in source file, or elsewhere

Linux Foundation Collab Summit 2016

Mon, 01 Jan 0001 00:00:00 +0000

Open Compliance Summit 2017

Mon, 01 Jan 0001 00:00:00 +0000

Open Source Leadership Summit 2017

Mon, 01 Jan 0001 00:00:00 +0000

Open Source Summit Europe 2017

Mon, 01 Jan 0001 00:00:00 +0000

Open Source Summit Europe 2021

Mon, 01 Jan 0001 00:00:00 +0000

Open Source Summit Japan 2019

Mon, 01 Jan 0001 00:00:00 +0000

Open Source Summit Japan 2022

Mon, 01 Jan 0001 00:00:00 +0000

Screenshots

Mon, 01 Jan 0001 00:00:00 +0000

Screenshots

A picture is worth a thousand words

The SW360 application is divided into several sections around managing a catalogue of software components and the software bill-of-material of your software projects, products or services. The menu bar as shown on home screen cover the following main sections.

Home

A dashboard listing the components and projects created by the user logged in. With this overview, the own projects and components can be directly accessed.

The Free Software Legal and Licensing Workshop 2018

Mon, 01 Jan 0001 00:00:00 +0000

Yanking the Chain Open Source Software Compliance in the Supply Chain

Mon, 01 Jan 0001 00:00:00 +0000

Eclipse SW360

ADR Index

Architecture Decision Records (ADRs)

ADR Index

Templates

AI Policy

AI Policy

Login

SW360 Architecture

SW360 Architecture Documentation

Document Information

Table of Contents

1. Introduction and Goals

1.1 Purpose

ADR-001: Apache Thrift for Internal Services

Decision Analysis and Resolution: SW360 Internal RPC Framework

Table of Contents

Background

GSoC Idea List - 2026

GSoC Idea List - 2026

Intro

Home Page

Home Page

SW360 Frontend Architecture

SW360 Frontend Architecture Documentation

Document Information

Table of Contents

1. Introduction and Goals

1.1 Purpose

ADR-002: CouchDB as Primary Database

Decision Analysis and Resolution: SW360 Primary Database

Table of Contents

Background

GSoC Idea List - 2025

GSoC Idea List - 2025

Intro

Project

1.0 Project Page

1.01 Introduction

1.02 Project List

ADR-003: Keycloak for Authentication

Decision Analysis and Resolution: SW360 Authentication Provider

Table of Contents

Background

Components

2.0 Components

2.01 Introduction

2.02 Component List

ADR-004: Migrate to Spring Boot 3.x

Decision Analysis and Resolution: Spring Boot Version Migration

Table of Contents

Background

Licenses

3.0 Licenses

3.1 Introduction

3.2 Quick Filter

Packages

4.0 Packages

4.01 Introduction

Securing SW360

1. Authentication Modes

1.1. Built-in Basic Auth (sw360basic)

ADR-005: Apache Tomcat as Servlet Container

Decision Analysis and Resolution: SW360 Servlet Container

Table of Contents

Background

Requests

6. Requests

ADR-006: Cloudant SDK for CouchDB Access

Decision Analysis and Resolution: CouchDB Client Library Migration

Table of Contents

Background

Search

7. Search

Wildcards

ADR-007: File-Based API Response Cache

Decision Analysis and Resolution: REST API Response Caching

Table of Contents

Background

Preferences

1.1. Built-in Basic Auth (`sw360basic`)

Authorization Model in `resource-server`