Software supply services (Германия - Тендер #42826694)

Official name: SPRIND GmbH
Town: Leipzig
NUTS code: DED51 Leipzig, Kreisfreie Stadt
Country: Germany
Contact person: Leo Lerch
E-mail: leo.lerch@mazars.de
Internet address(es):
Main address: https://sovereigntechfund.de/

Other type: Beneficiary

Other activity: Software

Log4j

72268000 Software supply services

Services

Logging, the act of keeping a record of what has happened in an application, is a ubiquitous software component. Developers use logging libraries to keep this record. Log4j is one of the

most widely deployed logging libraries used by almost every Java-based software in the wild at massive scale.

Recent Log4j vulnerabilities (aka. Log4Shell) severely affecting billions of applications and services all over the world (Amazon, Alibaba, Twitter, Microsoft, Steam, etc.) reminded of the crucial role Log4j plays in the world’s IT infrastructure. Contrary to the scale of its deployment, Log4j is a free and open source project developed by a handful of volunteers.

This contract is divided into lots: no

Value excluding VAT: 596 160.00 EUR

73000000 Research and development services and related consultancy services

NUTS code: DED51 Leipzig, Kreisfreie Stadt

Logging, the act of keeping a record of what has happened in an application, is a ubiquitous software component. Developers use logging libraries to keep this record. Log4j is one of the

most widely deployed logging libraries used by almost every Java-based software in the wild at massive scale.

Recent Log4j vulnerabilities (aka. Log4Shell) severely affecting billions of applications and services all over the world (Amazon, Alibaba, Twitter, Microsoft, Steam, etc.) reminded of the crucial role Log4j plays in the world’s IT infrastructure. Contrary to the scale of its deployment, Log4j is a free and open source project developed by a handful of volunteers.

This proposal aims to improve the release pipeline, documentation, source code repository structure, efficiency (garbage-free source location capture and unified memory management), introduce fuzz testing, a performance testbed, etc. Next to being functional improvement, these all have security related implications: improved release pipeline enables quick releases for security vulnerabilities, fuzz testing allows early vulnerability detection, etc.

The following milestones are planned:

August-December 2023

● Milestone 1: Migrating to a multi-repository structure

○ Prepare Repositories, set up authentication credentials (secrets), set up Nexus

repository, and align documentation.

○ Create first release, prepare code sources

● Milestone 2: Modernization

○ Upgrade Core Dependencies

○ Set up Spotless (code formatter) and set up static code analysis tools.

● Milestone 3: Software Bill of Materials (SBOM)

○ Implementation and Evaluation of SBOM

● Milestone 4: Unified Memory Management

○ Refactor recycler, and replace ThreadLocals outside of the core and api implementations

○ Replace ThreadLocals in the core and api implementations.

○ Clean up remaining code, fix configuration, improve documentation for new Recycler

January - December 2024

● Milestone 5: Code and documentation generation from API

○ Implement code/documentation generation from API

● Milestone 6: Online configuration validation tool

○ Auto-Generate Schemas

○ Provide online tool to validate user configurations.

● Milestone 7: Rewriting Manual

○ New Website, Javadoc, Security, Download, and Support pages

○ Create auto-generate content from source code

○ Manual introduction and Architect’s guide

○ Configuration manual

○ User’s Guide

○ Developer’s Guide

○ Committer’s guide

● Milestone 8: Google OSS Fuzz

○ Implementation and evaluation of proof of concept.

○ Test core implementation, and complete reports

● Milestone 9: Native Compilation support

○ Create Reflection Points, Attack Plan, Attack Plan Validation

○ Fix issues in log4j-core implementation

○ Fix popular modules (log4j-layout-template)

○ Complete Native Compilation support

● Milestone 10: Unified date-time formatting

○ Move instant formatter to core implementation

○ Fix layouts, deprecate old code, release new version.

● Milestone 11: Automatic migration tools

○ Research and Implement Source Migration

○ Research and Implement Byte Code migration

● Milestone 12: Fix API compatibility checks

○ Fix all API compatibility issues, also resorts as some buffer

Options: no

The procurement is related to a project and/or programme financed by European Union funds: no

Award of a contract without prior publication of a call for competition in the Official Journal of the European Union in the cases listed below

Explanation:

As a research and development service, the contract is excluded from the scope of application of public procurement law (cf. Section 116 (1) No. 2 Act against Restraints on Competition).

The procurement is covered by the Government Procurement Agreement: no

30/05/2023

The contract has been awarded to a group of economic operators: no

Official name: Grobmeier Solutions GmbH
Town: Langerringen
NUTS code: DE276 Augsburg, Landkreis
Country: Germany

The contractor/concessionaire will be an SME: yes

Total value of the contract/lot/concession: 596 160.00 EUR

Official name: Die Vergabekammern der Bundes
Town: Bonn
Country: Germany

12/06/2023