jaegertracing / jaeger-lib

Security

The Jaeger library aims to be secure and follow industry best practices. This outline details the security measures implemented in the codebase.

Developer Certificate of Origin

Jaeger employs the Developer Certificate of Origin (DCO) to ensure the authenticity and origin of contributions. This ensures that all code contributions are made by individuals who have the right to contribute.

Dependency Management

Jaeger’s dependency management practices contribute to its security. These practices include:

  • Explicit Dependency Declarations: Jaeger utilizes Gopkg.toml to declare explicit dependencies, ensuring clarity about the software components used.

  • Version Constraints: Version constraints are applied to all dependencies, limiting the use of potentially vulnerable versions.

  • Regular Dependency Updates: Jaeger regularly updates dependencies, minimizing exposure to known vulnerabilities.

  • Security Audits: Regular security audits are conducted to identify and address potential vulnerabilities.

  • Source: Gopkg.toml

Code Review and Testing

Jaeger employs comprehensive code review and testing procedures to enhance security.

  • Code Reviews: All code changes undergo thorough code reviews to identify potential security vulnerabilities.

  • Unit Tests: Unit tests are implemented to verify the functionality and security of individual code components.

  • Integration Tests: Integration tests are conducted to validate the security of the library’s interaction with external systems.

  • Source: README.md

Continuous Integration and Code Quality

Continuous integration (CI) and code quality practices are crucial for security. Jaeger utilizes:

  • Continuous Integration: The library is built, tested, and deployed continuously, enabling the rapid identification and resolution of security issues.

  • Code Style Enforcement: Code style guidelines are enforced, ensuring consistency and reducing the risk of introducing vulnerabilities.

  • Source: README.md

Licensing

Jaeger utilizes the Apache 2.0 license, a widely accepted and permissive license that encourages code reuse and collaboration while fostering security.

Metrics

Jaeger offers various metrics capabilities, including:

  • Go-Kit Integration: Jaeger leverages Go-Kit for integration with metrics systems, enabling the monitoring and analysis of application performance.

  • Tagged Metrics: Certain metrics factories support tagged metrics, allowing for more granular insights.

  • Counter Interface: The Counter interface provides a standardized way to track the occurrence of events.

  • Source: metrics/go-kit/expvar/factory.go, metrics/go-kit/factory.go, metrics/counter.go

Rate Limiting

Jaeger includes a rate limiter based on the leaky bucket algorithm for resource management.

  • Rate Limiter: The RateLimiter interface provides a standardized way to manage the rate of events or resource consumption.

  • Credits Balance: The implementation utilizes a credits balance that is replenished over time.

  • Item Costs: The rate limiter accepts the cost of an item and determines if it can be “purchased” within the rate limit.

  • Source: utils/rate_limiter.go

Build System

Jaeger’s build system helps enforce security.

  • Dependency Management: The build system utilizes tools like dep or glide for dependency management.

  • Linting: The build system runs linters to identify potential code issues, including security vulnerabilities.

  • Testing: The build system includes automated tests for code coverage and security checks.

  • Source: Makefile

Influx Metrics

Jaeger offers Influx-based metrics capabilities.


          ## Top-Level Directory Explanations
          
          <a class='local-link directory-link' data-ref="metrics/" href="#metrics/">metrics/</a> - This directory contains the metrics implementation for the Jaeger Tracing library.
          
          <a class='local-link directory-link' data-ref="metrics/adapters/" href="#metrics/adapters/">metrics/adapters/</a> - This subdirectory contains the various metric adapters for different backends.
          
          <a class='local-link directory-link' data-ref="metrics/go-kit/" href="#metrics/go-kit/">metrics/go-kit/</a> - This subdirectory contains the Go-Kit integration for the Jaeger Tracing library.
          
          <a class='local-link directory-link' data-ref="metrics/go-kit/expvar/" href="#metrics/go-kit/expvar/">metrics/go-kit/expvar/</a> - This subdirectory contains the expvar implementation for the Go-Kit integration.
          
          <a class='local-link directory-link' data-ref="metrics/go-kit/influx/" href="#metrics/go-kit/influx/">metrics/go-kit/influx/</a> - This subdirectory contains the InfluxDB implementation for the Go-Kit integration.
          
          <a class='local-link directory-link' data-ref="metrics/metricstest/" href="#metrics/metricstest/">metrics/metricstest/</a> - This subdirectory contains the testing implementation for the metrics.
          
          <a class='local-link directory-link' data-ref="metrics/prometheus/" href="#metrics/prometheus/">metrics/prometheus/</a> - This subdirectory contains the Prometheus implementation for the Jaeger Tracing library.
          
          <a class='local-link directory-link' data-ref="metrics/tally/" href="#metrics/tally/">metrics/tally/</a> - This subdirectory contains the implementation for counting metrics using the tally package.
          
          <a class='local-link directory-link' data-ref="sample/" href="#sample/">sample/</a> - This directory contains a sample implementation for the Jaeger Tracing library.
          
          <a class='local-link directory-link' data-ref="scripts/" href="#scripts/">scripts/</a> - This directory contains various scripts for the project.
          
          <a class='local-link directory-link' data-ref="utils/" href="#utils/">utils/</a> - This directory contains various utility functions for the project.