Skip to content
Closed
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
18 changes: 9 additions & 9 deletions README.md
Original file line number Diff line number Diff line change
Expand Up @@ -3,22 +3,22 @@ sidebar_position: 2
---

# Carbon Aware SDK
Carbon aware software does more when it can leverage greener energy sources, and less when the energy CO2 emissions are higher.
Carbon aware software does more when it can leverage greener energy sources, and less when the energy CO2 emissions are higher.

The Carbon Aware SDK is a toolset to help you measure the carbon emissions of your software, in turn helping you **measure and reduce your software's carbon emissions**, and choose when and where you run your software to make it greener.

![Carbon Aware Software](./images/readme/carbon-aware-software.png)


By knowing the carbon emissions of the energy that powers your applications, you and your organisation can leverage greener energy sources to reduce your CO2 emissions by:
By knowing the carbon emissions of the energy that powers your applications, you and your organisation can leverage greener energy sources to reduce your CO2 emissions by:

* Building AI models when carbon emissions are lower
* Building AI models when carbon emissions are lower
* Deploying software into the cloud in locations that have greener energy sources
* Running software updates at greener energy time windows
* Using data to run hypothetical models to understand how you could start driving impact and reduce emissions, drive business cases for change, and create a greener future.
* Running software updates at greener energy time windows
* Using data to run hypothetical models to understand how you could start driving impact and reduce emissions, drive business cases for change, and create a greener future.


Within the [Green Software Foundations Theory of Change](https://greensoftware.foundation/articles/theory-of-change), we look at 3 pillars, that being **Knowledge**, **Tech Culture**, and **Tooling** as focus areas to drive this change. The Carbon Aware SDK at its core sits firmly in the **Tooling** pillar, and also supports the other pillars, providing **Knowledge** through emissions data to inform change, and being core enabler for the **Tech Culture** for building carbon aware software.
Within the [Green Software Foundations Theory of Change](https://greensoftware.foundation/articles/theory-of-change), we look at 3 pillars, that being **Knowledge**, **Tech Culture**, and **Tooling** as focus areas to drive this change. The Carbon Aware SDK at its core sits firmly in the **Tooling** pillar, and also supports the other pillars, providing **Knowledge** through emissions data to inform change, and being core enabler for the **Tech Culture** for building carbon aware software.

Companies including UBS and Vestas have already deployed the Carbon Aware SDK to build greener software, and you can too!

Expand All @@ -37,7 +37,7 @@ at different times and in different locations. That is because not all
electricity is produced in the same way. Most is produced through burning fossil
fuels, some is produced using cleaner sources like wind and solar.

When software does more when the electricity is clean and do less when the
When software does more when the electricity is clean and does less when the
electricity is dirty, or runs in a location where the energy is cleaner, we call
this **carbon aware software**.

Expand Down Expand Up @@ -78,13 +78,13 @@ where a command-line can be used. This tends to be common with legacy DevOps
pipelines to drive deployment for integration testing where you can test your
deployment in the greenest location.

![WebApi Screenshot](./images/readme/screenshot_cli.png)
![CLI Screenshot](./images/readme/screenshot_cli.png)

## Who Is Using the Carbon Aware SDK?

The Carbon Aware SDK is being used by large and small companies around the
world. Some of the world’s biggest enterprises and software companies, through
to start-ups. Both UBS and Vestas have used the SDK, with further details over on the [adopters overview](./casdk-docs/docs/overview/adopters.md).
to start-ups. Both UBS and Vestas have used the SDK, with further details over on the [adopters overview](./casdk-docs/docs/overview/adopters.md).

Machine Learning (ML) workloads are a great example of long running compute
intensive workloads, that often are also not time critical. By moving these workloads to a different time, the carbon emissions from the ML training can be reduced by up to 15%, and by moving the location of the training this can be
Expand Down
62 changes: 31 additions & 31 deletions SECURITY.md
Original file line number Diff line number Diff line change
Expand Up @@ -16,70 +16,70 @@ We perform regular reviews inline with the information provided below. All rele
- Explain contribution process - ✅ https://github.com/Green-Software-Foundation/carbon-aware-sdk/blob/dev/CONTRIBUTING.md#collaborating-with-the-opensource-working-group

### FLOSS license
- Must be released as FLOSS - ✅ MIT License https://github.com/Green-Software-Foundation/carbon-aware-sdk/blob/dev/LICENSE
- Must post the license - ✅ https://github.com/Green-Software-Foundation/carbon-aware-sdk/blob/dev/LICENSE
- Also approved by OSI - ✅ https://opensource.org/license/MIT/
- Must be released as FLOSS - ✅ MIT License <https://github.com/Green-Software-Foundation/carbon-aware-sdk/blob/dev/LICENSE>
- Must post the license - ✅ <https://github.com/Green-Software-Foundation/carbon-aware-sdk/blob/dev/LICENSE>
- Also approved by OSI - ✅ <https://opensource.org/license/MIT/>

### Documentation
- Provides basic documentation - ✅ https://github.com/Green-Software-Foundation/carbon-aware-sdk/tree/dev/docs
- Provides documentation for external interface - ✅ https://github.com/Green-Software-Foundation/carbon-aware-sdk/blob/dev/docs/carbon-aware-webapi.md
- Provides basic documentation - ✅ <https://github.com/Green-Software-Foundation/carbon-aware-sdk/tree/dev/docs>
- Provides documentation for external interface - ✅ <https://github.com/Green-Software-Foundation/carbon-aware-sdk/blob/dev/docs/carbon-aware-webapi.md>

### Other
- Project site, downloads etc must support HTTPS with TLS - ✅ using GitHub to host which supports this https://github.com/Green-Software-Foundation/carbon-aware-sdk/
- Have mechanism for discussion - ✅ github issues https://github.com/Green-Software-Foundation/carbon-aware-sdk/issues
- Project must be maintained - ✅ actively maintaned by GSF and its members
- Project site, downloads etc must support HTTPS with TLS - ✅ using GitHub to host which supports this <https://github.com/Green-Software-Foundation/carbon-aware-sdk/>
- Have mechanism for discussion - ✅ github issues <https://github.com/Green-Software-Foundation/carbon-aware-sdk/issues>
- Project must be maintained - ✅ actively maintained by GSF and its members

## Change control
### Public VCS repo
- Readable public VCS repo - ✅ yes, Github https://github.com/Green-Software-Foundation/carbon-aware-sdk/
- Track changes - ✅ yes, Git https://github.com/Green-Software-Foundation/carbon-aware-sdk/commits/dev/
- Interim versions between releases available for review - ✅ yes, interim versions actively developed and availble on the `dev` branch https://github.com/Green-Software-Foundation/carbon-aware-sdk
- Readable public VCS repo - ✅ yes, Github <https://github.com/Green-Software-Foundation/carbon-aware-sdk/>
- Track changes - ✅ yes, Git <https://github.com/Green-Software-Foundation/carbon-aware-sdk/commits/dev/>
- Interim versions between releases available for review - ✅ yes, interim versions actively developed and available on the `dev` branch <https://github.com/Green-Software-Foundation/carbon-aware-sdk>

### Unique versioning numbering
- Unique indentifier for each release - ✅ https://github.com/Green-Software-Foundation/carbon-aware-sdk/releases
- Unique identifier for each release - ✅ <https://github.com/Green-Software-Foundation/carbon-aware-sdk/releases>

### Release notes
- Human readable release notes for each release (not git log) - ✅ https://github.com/Green-Software-Foundation/carbon-aware-sdk/releases
- Human readable release notes for each release (not git log) - ✅ <https://github.com/Green-Software-Foundation/carbon-aware-sdk/releases>
- Address each publicly known vulnerability - ✅ N/A, no vulnerability reported yet

## Reporting
### Bug reporting process
- Process to submit bugs - ✅ https://github.com/Green-Software-Foundation/carbon-aware-sdk/issues/new/choose
- Must acknowledge bugs (reply) submitted between 2-12 months - ✅ each bug has at least an acknowledgement or was opened by a maintainer (so acknowledged by a maintainer): https://github.com/Green-Software-Foundation/carbon-aware-sdk/issues?q=is%3Aopen+is%3Aissue+label%3Abug
- Publicly available archive for reports and responses - ✅ github issues: https://github.com/Green-Software-Foundation/carbon-aware-sdk/issues?q=is%3Aopen+is%3Aissue+label%3Abug
- Process to submit bugs - ✅ <https://github.com/Green-Software-Foundation/carbon-aware-sdk/issues/new/choose>
- Must acknowledge bugs (reply) submitted between 2-12 months - ✅ each bug has at least an acknowledgement or was opened by a maintainer (so acknowledged by a maintainer): <https://github.com/Green-Software-Foundation/carbon-aware-sdk/issues?q=is%3Aopen+is%3Aissue+label%3Abug>
- Publicly available archive for reports and responses - ✅ github issues: <https://github.com/Green-Software-Foundation/carbon-aware-sdk/issues?q=is%3Aopen+is%3Aissue+label%3Abug>

## Vulnerability report process
- Have a vulnerability report process - ✅ Added in this PR: #464
- Have a vulnerability report process - ✅ Added in this PR: #464
- Private vulnerability if supported must include info how to send - ✅ N/A (allowed) - no private vulnerability reporting set up but proposed
- Initial response time for vulnerability submitted in last 6 months must be <= 14 days - ✅ N/A (allowed) - project run by volunteers, does not provide response time guarantee as stated in SECURITY.md (this pr)

## Quality
### Working build system
- Must provide a working build system - ✅ https://github.com/Green-Software-Foundation/carbon-aware-sdk/blob/dev/docs/carbon-aware-cli.md#build-and-install https://github.com/Green-Software-Foundation/carbon-aware-sdk/blob/dev/docs/containerization.md
- Must provide a working build system - ✅ <https://github.com/Green-Software-Foundation/carbon-aware-sdk/blob/dev/docs/carbon-aware-cli.md#build-and-install> <https://github.com/Green-Software-Foundation/carbon-aware-sdk/blob/dev/docs/containerization.md>

### Automated test suite
- Have at least one automated test suite and documentation hwo to run it - ✅ https://github.com/Green-Software-Foundation/carbon-aware-sdk/blob/dev/.github/workflows/1-pr.yaml as automated CI during PRs
- Have at least one automated test suite and documentation how to run it - ✅ <https://github.com/Green-Software-Foundation/carbon-aware-sdk/blob/dev/.github/workflows/1-pr.yaml> as automated CI during PRs

## New functionaility testing
- Formal/informal policy for adding tests for new features - ✅ PR template requires stating if a breaking feature added, maintainers ensure tests are in place: https://github.com/Green-Software-Foundation/carbon-aware-sdk/blob/dev/.github/pull_request_template.md
- Evidence of policy being adhered to - ✅ on release code coverage increase (new code added did not decrease test coverage): https://github.com/Green-Software-Foundation/carbon-aware-sdk/pull/437#issuecomment-1862346606
## New functionality testing
- Formal/informal policy for adding tests for new features - ✅ PR template requires stating if a breaking feature added, maintainers ensure tests are in place: <https://github.com/Green-Software-Foundation/carbon-aware-sdk/blob/dev/.github/pull_request_template.md>
- Evidence of policy being adhered to - ✅ on release code coverage increase (new code added did not decrease test coverage): <https://github.com/Green-Software-Foundation/carbon-aware-sdk/pull/437#issuecomment-1862346606>

### Warning flags
- Compiler warning flags or linter tools for code quality/errors - ✅ CodeQL analysis in automated CI : https://github.com/Green-Software-Foundation/carbon-aware-sdk/blob/dev/.github/workflows/1-pr.yaml#L82
- Compiler warning flags or linter tools for code quality/errors - ✅ CodeQL analysis in automated CI : <https://github.com/Green-Software-Foundation/carbon-aware-sdk/blob/dev/.github/workflows/1-pr.yaml#L82>
- Address warnings from these tools - ✅ blocking PRs on fail

## Security
### Secure development knowledge
- At least one primary developer who knows how to design secure software - ✅ @vaughanknight is at least one of them :)
- At least one of the project's primary developers MUST know of common kinds of errors that lead to vulnerabilities in this kind of software, as well as at least one method to counter or mitigate each of them - ✅
- At least one of the project's primary developers MUST know of common kinds of errors that lead to vulnerabilities in this kind of software, as well as at least one method to counter or mitigate each of them - ✅

### Use basic good cryptographic practices
- https://www.bestpractices.dev/en/criteria/0#0.crypto_published - ✅ uses HTTPS for WebAPI, N/A for CLI
- https://www.bestpractices.dev/en/criteria/0#0.crypto_floss - ✅ uses dotnet 8.0 implementations
- https://www.bestpractices.dev/en/criteria/0#0.crypto_keylength - ✅ uses dotnet 8.0 implementations
- https://www.bestpractices.dev/en/criteria/0#0.crypto_working - ✅ uses dotnet 8.0 implementations
- https://www.bestpractices.dev/en/criteria/0#0.crypto_password_storage - ✅ ⚠️ uses dotnet 8.0 implementations
- https://www.bestpractices.dev/en/criteria/0#0.crypto_random - ✅ uses dotnet 8.0 implementatons for HTTPS
- <https://www.bestpractices.dev/en/criteria/0#0.crypto_published> - ✅ uses HTTPS for WebAPI, N/A for CLI
- <https://www.bestpractices.dev/en/criteria/0#0.crypto_floss> - ✅ uses dotnet 8.0 implementations
- <https://www.bestpractices.dev/en/criteria/0#0.crypto_keylength> - ✅ uses dotnet 8.0 implementations
- <https://www.bestpractices.dev/en/criteria/0#0.crypto_working> - ✅ uses dotnet 8.0 implementations
- <https://www.bestpractices.dev/en/criteria/0#0.crypto_password_storage> - ✅ ⚠️ uses dotnet 8.0 implementations
- <https://www.bestpractices.dev/en/criteria/0#0.crypto_random> - ✅ uses dotnet 8.0 implementations for HTTPS

### Secured delivery against man-in-the-middle (MITM) attacks
- Delivery mechanisms that counters MITM - ✅ uses HTTPS
Expand All @@ -94,7 +94,7 @@ We perform regular reviews inline with the information provided below. All rele
## Analysis
### Static code analysis
- At least one FLOSS static code analysis tool - ✅ uses CodeQL https://codeql.github.com/ - https://github.com/Green-Software-Foundation/carbon-aware-sdk/blob/dev/.github/workflows/1-pr.yaml#L82
- All medium and higher severity exploitable vulnerabilities discovered with static code analysis MUST be fixed in a timely way after they are confirmed - ✅ ⚠️ NOTE: Medium vulnerabilities are identified but these are **by design** due to relating to geolocation data being transmitted, and geolocation is required for the CA SDK. The code will be annotated to ignore this: https://github.com/Green-Software-Foundation/carbon-aware-sdk/issues/415#issuecomment-1882622776
- All medium and higher severity exploitable vulnerabilities discovered with static code analysis MUST be fixed in a timely way after they are confirmed - ✅ ⚠️ NOTE: Medium vulnerabilities are identified but these are **by design** due to relating to geolocation data being transmitted, and geolocation is required for the CA SDK. The code will be annotated to ignore this: https://github.com/Green-Software-Foundation/carbon-aware-sdk/issues/415#issuecomment-1882622776

### Dynamic code analysis
- All medium and higher severity exploitable vulnerabilities discovered with dynamic code analysis MUST be fixed in a timely way after they are confirmed. - ✅ N/A (allowed, no Dynamic code analysis in place).
Expand Down
Loading