From 7deca2d467b2064a81d245b4885ab2d126105c80 Mon Sep 17 00:00:00 2001 From: Claude Date: Fri, 24 Jul 2026 09:17:20 +0000 Subject: [PATCH] Mark remediated findings in SECURITY_ANALYSIS.md The P1 findings were fixed by the same PR that introduced the report, leaving it describing an outdated posture. Label the report as a point-in-time snapshot and track per-item status in the roadmap table. Co-Authored-By: Claude Fable 5 Claude-Session: https://claude.ai/code/session_01DWoMomNAcBM3e8duJrb2do --- SECURITY_ANALYSIS.md | 36 ++++++++++++++++++++++-------------- 1 file changed, 22 insertions(+), 14 deletions(-) diff --git a/SECURITY_ANALYSIS.md b/SECURITY_ANALYSIS.md index 023be953492b..ecd9ca245688 100644 --- a/SECURITY_ANALYSIS.md +++ b/SECURITY_ANALYSIS.md @@ -5,6 +5,14 @@ A cybersecurity reinforcement analysis of this repository (a fork of upstream as of 2026-07-22). Three areas were audited: CI/supply-chain posture, the code-level cryptographic surface, and testing/fuzzing assurance. +> **Remediation status.** This report is a point-in-time snapshot; findings describe +> the repository *as audited*, before any fixes landed. The P1 items have since been +> remediated in this fork (PR #1): the release pipeline, benchmark, downstream-test, +> and scheduled linkcheck workflows are owner-guarded so they cannot run from a fork, +> and `SECURITY.md` plus `CODEOWNERS` now exist. Upstream-relevant patches for items +> 4–7 of the roadmap are staged on `claude/upstream-*` branches for submission to +> pyca/cryptography. The roadmap table below tracks per-item status. + ## Executive summary The upstream project is one of the best-hardened codebases in the Python ecosystem, and @@ -198,20 +206,20 @@ with an ASAN-built OpenSSL) on a scheduled workflow if PR latency is a concern. ## Remediation roadmap -| # | Action | Priority | Effort | -|---|---|---|---| -| 1 | Owner-guard `wheel-builder.yml` + `pypi-publish.yml` (or disable on fork) | P1 | Small | -| 2 | Add `SECURITY.md` (+ `CODEOWNERS`) for the fork | P1 | Small | -| 3 | Owner-gate downstream/benchmark third-party CI jobs | P1 | Small | -| 4 | Hash-pin `ci-constraints-requirements.txt`; fix dead `PUBLISH_REQUIREMENTS_PATH` | P2 | Small | -| 5 | Add `cargo deny check advisories` (+ optional `pip-audit`) workflow | P2 | Small | -| 6 | Add CodeQL + OpenSSF Scorecard workflows | P2 | Small | -| 7 | Workspace `[lints]` with `unsafe_op_in_unsafe_fn = "deny"` | P3 | Small | -| 8 | Deprecation wrappers for CAST5/IDEA/SEED/Blowfish re-exports; DSA/small-RSA warnings | P3 | Medium | -| 9 | Minimum-version gates for LibreSSL/BoringSSL/AWS-LC | P3 | Medium | -| 10 | Adopt `zeroize` for owned secret buffers | P3 | Medium | -| 11 | cargo-fuzz targets + ClusterFuzzLite for the ASN.1/PKCS parsers | P4 | Medium | -| 12 | Scheduled ASAN/UBSAN CI leg | P4 | Medium | +| # | Action | Priority | Effort | Status | +|---|---|---|---|---| +| 1 | Owner-guard `wheel-builder.yml` + `pypi-publish.yml` (or disable on fork) | P1 | Small | ✅ Done (fork, PR #1); staged for upstream | +| 2 | Add `SECURITY.md` (+ `CODEOWNERS`) for the fork | P1 | Small | ✅ Done (fork, PR #1) | +| 3 | Owner-gate downstream/benchmark third-party CI jobs | P1 | Small | ✅ Done (fork, PR #1; scheduled linkcheck also gated) | +| 4 | Hash-pin `ci-constraints-requirements.txt`; fix dead `PUBLISH_REQUIREMENTS_PATH` | P2 | Small | 🔶 Dead env removal staged for upstream; hash-pinning open | +| 5 | Add `cargo deny check advisories` (+ optional `pip-audit`) workflow | P2 | Small | Open | +| 6 | Add CodeQL + OpenSSF Scorecard workflows | P2 | Small | Open | +| 7 | Workspace `[lints]` with `unsafe_op_in_unsafe_fn = "deny"` | P3 | Small | 🔶 Per-crate deny staged for upstream | +| 8 | Deprecation wrappers for CAST5/IDEA/SEED/Blowfish re-exports; DSA/small-RSA warnings | P3 | Medium | Open (upstream) | +| 9 | Minimum-version gates for LibreSSL/BoringSSL/AWS-LC | P3 | Medium | Open (upstream) | +| 10 | Adopt `zeroize` for owned secret buffers | P3 | Medium | Open (upstream) | +| 11 | cargo-fuzz targets + ClusterFuzzLite for the ASN.1/PKCS parsers | P4 | Medium | Open (upstream) | +| 12 | Scheduled ASAN/UBSAN CI leg | P4 | Medium | Open (upstream) | Items 8–10 change library behavior/internals and are best contributed upstream rather than carried as fork-only patches.