BASIL an Open Source Software for Quality Management
Demonstrates BASIL an Open Source Software for Quality Management and evaluates key implications for security practitioners.
Summary
### Overview In this presentation, Gabriele and Luigi introduce Basil, an open-source software quality management tool developed within the context of the ELISA project. Traditional quality management standards rely on the V-model, a process that is strictly requirement-driven. Conversely, open-source software like the Linux kernel follows a code-driven development model. Basil is designed to bridge this gap by enabling quality management, requirement tracking, and traceability in a code-centric, continuous integration and continuous development (CI/CD) environment.
### Key Topics - **The Gap Between the V-Model and Open Source**: Standards demand traceability from requirements to tests, whereas open-source projects evolve primarily through code commits and CI pipelines without explicit formal requirement collaterals. - **Quality Management Work Items**: Basil manages software requirements, test specifications (descriptions of test maneuvers without implementation), test cases (concrete implementations), test results, and justifications (used to document completeness or assumptions of use). - **Git Tracking and Broken Mapping Detection**: Basil directly maps work items to reference documents such as source code or man pages in remote Git repositories (tracking specific commits or repository HEADs). It detects when referenced sections shift or disappear, flagging warnings and impact analyses. - **Work Item Evolution and Reuse**: Work items can be forked across components while maintaining historical lineage. Change tracking identifies modified fields, dates, and authors. - **Access Control and Collaboration**: Designed as a collaborative web platform, Basil provides user roles (admin, user, guest) and component-level permissions (read, write, edit, owner) to facilitate upstream public work while supporting restricted access such as NDA requirements.
### Technical Details - **Architecture and Stack**: Basil uses a two-tier architecture comprising a React front end (leveraging the Red Hat PatternFly framework and figma designs, fully supported in Google Chrome) and a REST API written with Flask API exchanging JSON. Database persistence is handled via SQLAlchemy, using an SQLite3 database by default with support for external database servers. - **Test Execution via TMT**: Basil integrates with the Test Management Tool (TMT), a Python library developed at Red Hat. Tests and user stories are described using Flexible Metadata Format (FMF) files. Provisioning supports Fedora containers by default as well as remote targets via SSH. Artifacts (e.g., `log.txt`) stored in the path designated by the `TMT_PLAN_DATA` environment variable can be accessed directly through the Basil web UI. - **Interoperability and Automation**: Basil can export collaterals using the SPDX standard and exposes an HTTP API to integrate into CI pipelines. This allows automated identification of affected components, test triggering, bug linking, and calculation of specification coverage.
### Use Cases and Project Road Map Demonstrated use cases include mapping Linux Test Project (LTP) tests and upstream glibc tests to kernel syscall man pages (such as `nanosleep`), as well as adapting Zephyr project requirement files stored in Git via dummy components. The future roadmap includes hosting a public instance of Basil under ELISA, implementing baselining to capture point-in-time snapshots of all work items for certification bodies, and further advancing collaboration in the ELISA tool investigation working group.
Related talks
The Linux Foundation·51 min
Open Source Software: Hollywood’s Secret Sauce for Visual Effects and A... David Morin & Larry Gritz
Analyzes open Source Software: Hollywoods Secret Sauce for Visual Effects and A... David Morin & Larry Gritz and evaluates key implications for security practitioners.
The Linux Foundation·40 min
Stephen Walli
Provides open Source Software Engineering Education and evaluates key implications for security practitioners.
The Linux Foundation·38 min
Tobie Langel
Provides open Source Governance for Software Engineers and evaluates key implications for security practitioners.


