Repository Solution License RFI_07302024.pdf

DEPARTMENT OF THE AIR FORCE

AIR FORCE LIFE CYCLE MANAGEMENT CENTER (AFLCMC)

CRYPTOLOGIC AND CYBER SYSTEMS DIVISION

JOINT BASE SAN ANTONIO-LACKLAND, TEXAS 78243-7081

REQUEST FOR INFORMATION

UNIFIED PLATFORM INFRASTRUCTURE VALUE STREAM

30 July 2024

1) This Request for Information (RFI) is issued in accordance with the Federal Acquisition

Regulation (FAR) clause 52.215-3 (Request for Information or Solicitation for Planning

Purposes - Oct 1997) and is published to obtain information for use by the Air Force

Lifecycle Management Center (AFLCMC), Cryptologic and Cyber Systems Division

(CCSD), Joint Base San Antonio - Lackland, Texas, for market research and planning purposes only in support of the Development, Security and Operations (DevSecOps)

Infrastructure Value Stream (IVS) for Unified Platform (UP). UP is responsible for developing and sustaining a cloud-based platform that enables cyber operations across the

Department of Defense (DoD).

2) THIS RFI IS NOT A REQUEST FOR PROPOSAL, INVITATION FOR BID, OR AN

ANNOUNCEMENT OF A SOLICITATION; IT IS ONLY INTENDED FOR

INFORMATION OR PLANNING PURPOSES. There is no bid package or solicitation document associated with this announcement. Response to this RFI is strictly voluntary and will not affect any potential offeror’s ability to submit an offer if a solicitation is released.

Any requests for a solicitation package will be disregarded. The Government does not intend to award a contract based on this RFI or otherwise pay for the information solicited.

No entitlement to payment of direct or indirect costs or charges by the Government will arise as a result of preparing submissions in response to this RFI and the Government's use of such information. Submittals will not be returned to the sender. Respondents to this RFI may be asked to provide additional information/details based on their initial submittals.

3) Our organization is currently leveraging Sonatype Nexus for DSO CI/CD repository management. In an effort to identify potential alternatives, we are conducting market research to evaluate products and solutions that can meet the specific requirements listed in paragraph 5. The organizational objectives of this research are as follows:

a) Identify and catalog available products and solutions in the market.

b) Evaluate the features, functionality, and pricing of each alternative to determine its suitability for our needs.

c) Assess the level of integration and compatibility of each alternative with our DevSecOps platform and CI/CD processes, while ensuring compliance with DoD security requirements.

d) Estimate the level of government resources required to migrate to a new solution, while maintaining our current operational capabilities.

4) Our goal is to identify a solution that can provide a repository manager that organizes, stores and distributes development artifacts in a DevSecOps environment. The repository should provide a single point of reference for approved application containers and software artifacts for users. The repository will store, integrate with keycloak identity credential and access management (ICAM) and make available to operational organizations for evaluation and operational acceptance that have been through Continuous Integration (CI) and automated

Continuous Deployment (CD) pipelines. Thereby, creating a DevSecOps compliant express lane for certification to field (CtF) and deployment of applications.

5) The following are some of the key characteristics that we are using to meet our organizational objectives, as outlined in paragraph 3. While this list is not exhaustive, it does provide a snapshot of some of the most important requirements for our environment:

a) Ability to store artifacts in AWS S3

b) Create Docker repository mirrors

c) Available as a helm chart / containerized deployment for Kubernetes

d) Supports SAML or OIDC authentication and authorization (Group assertions from the

Idp are honored)

e) Role-based access control management (RBAC) for local images

f) Supports the creation and use of apt, docker, raw, maven2, rpm, pypi, npm, conda, go, gitlfs, helm, nuget, r, and yum repositories.

g) Supports the use of api tokens / personal access tokens to retrieve software programmatically

h) Supports the use of subdomain routing, and the use of multiple subdomains for assigning to repositories

i) Support for multiple authentication systems

j) Proxy access to external repositories

k) Ability to record use in auditable logs so that activity can be traced to a single user

l) Optimized for automation

6) Our organization will consider both commercial and open-source solutions.

7) As indicated above, this is market research. Contractor responses will be used for planning purposes. Address any comments and/or questions regarding this RFI in writing by e-mail directly to the Contracting Officer,

a) Contracting Officer: Ms. Karin Werner, Email: karin.werner.1@us.af.mil

b) Program Managers: Mr. Stephen Salinas, Email: stephen.salinas.1@us.af.mil and

Mr. Gregory Broussard, Email: gregory.broussard.1@us.af.mil

8) Response due date: Thursday, 8 Aug 2024, 1100 AM CST. Please annotate the subject line of e-mail responses as: “Repository Solution for Unified Platform RFI”. Responses may be emailed to the addresses listed above. Include your contract vehicle in the subject line of email response along with your CAGE, and DUNs within the message or attachment.

mailto:karin.werner.1@us.af.mil mailto:stephen.salinas.1@us.af.mil https://usaf.dps.mil/teams/aetc-lak-cpsg/directorates/HNCP/BUSOPS/Shared%20Documents/INFRASTRUCTURE%20ACQUISITION%20CELL/Software%20Contracts/SonaTypeNexus/SonaTypeNexus_2024/gregory.broussard.1@us.af.mil