Tab 04 SOW.pdf
PDF 132 KB Posted
- Attached to
- Renewal of Coverity Software license
- Solicitation number
- 80NSSC876836Q
About this file
This document is a Statement of Work (SOW) for the renewal of a Coverity software license. The objective is to migrate High Delay Networking (HDTN) software from class D (basic research) to class B or A (space systems) for use on the International Space Station. This requires testing the software for defects and vulnerabilities using Coverity static analysis tools.
The SOW outlines the capabilities of the Coverity software, including its ability to identify critical software defects and security vulnerabilities early in the development process, provide actionable remediation advice, and integrate seamlessly with CI/CD pipelines. It also covers the Rapid Scan feature, which provides immediate analysis feedback during coding and with each code commit. The license terms are for 12 months and 10 code contributors, including support and maintenance, as well as access to training videos. The related federal contract opportunity is a Special Notice for the renewal of the Coverity software license, with a Solicitation Number of 80NSSC876836Q. The procuring agency is the National Aeronautics and Space Administration (NASA).
View the file
Other files
| File | Type | Posted |
|---|---|---|
| Tab 07 Capability Statement SAM.pdf |
On GovTribe
Work with this file
- Download the original file
- Contacts named in this file
- Similar government files
- Ask GovTribe AI about this file
Text version
STATEMENT OF WORK
1. Objective/Requirements Contractor shall migrate High Delay Networking (HDTN) software from class D (basic research experiment software) to class B or class A (space software systems) so that it can be used on the ISS as the forefront space networking solution. One of the requirements of these classifications is for the software to be tested for defects and vulnerabilities as part of our software development process. Coverity static analysis software tool has the capabilities to meet these requirements and enables developers to find and fix defects early in our Software Development Life Cycle.
2. Characteristics, Scope, and Specs Coverity Static Analysis gives the speed, ease of use, accuracy, industry standards compliance, and scalability that is needed to develop high-quality, secure applications.
Coverity identifies critical software quality defects and security vulnerabilities in code as it’s written, early in the development process when it’s least costly and easiest to fix.
Precise actionable remediation advice and context-specific eLearning help the developers understand how to fix their prioritized issues quickly, without having to become security experts. Coverity seamlessly integrates automated security testing into the CI/CD pipelines and supports existing development tools and workflows.
Coverity includes Rapid Scan, a fast, lightweight static analysis engine that can be used to scan web and mobile applications, microservices, and infrastructure-as-code (IaC) configurations. Rapid Scan runs automatically, without additional configuration, with every Coverity scan and can also be run as part of full CI builds with conventional scan completion times. Rapid Scan can also be deployed as a standalone scan engine in Code Sight or via the command line interface, as well as in automated build pipelines. For this use case, Rapid Scan provides actionable early results in seconds for most projects. It’s easy to use simply point to a directory or Git repository—no setup is required. Broad support for platforms and file formats makes it easy to scan IaC configuration files. API and configuration checkers can help identify API misuse and vulnerable configurations in settings files. This is ideal for developers who want immediate analysis feedback, while they are coding and with every code commit. Support for multiple analysis output formats (SARIF, JSON, and console) as well as GitHub Actions and GitLab CI provides pipeline scan automation and issue management support. Rapid Scan can also assign issues to a policy file to automatically break builds.
Part Number: F868-0
3. License terms 12 months for 10 code contributors. License includes all support and maintenance as well as access to videos for training
File details come from the government source that posted it. Updated .