Skip to content

Mark remediated findings in SECURITY_ANALYSIS.md #6

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
duksh merged 1 commit into from
Jul 24, 2026
Merged

Mark remediated findings in SECURITY_ANALYSIS.md #6

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
36 changes: 22 additions & 14 deletions SECURITY_ANALYSIS.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,6 +5,14 @@ A cybersecurity reinforcement analysis of this repository (a fork of
upstream as of 2026-07-22). Three areas were audited: CI/supply-chain posture, the
code-level cryptographic surface, and testing/fuzzing assurance.

> **Remediation status.** This report is a point-in-time snapshot; findings describe
> the repository *as audited*, before any fixes landed. The P1 items have since been
> remediated in this fork (PR #1): the release pipeline, benchmark, downstream-test,
> and scheduled linkcheck workflows are owner-guarded so they cannot run from a fork,
> and `SECURITY.md` plus `CODEOWNERS` now exist. Upstream-relevant patches for items
> 4–7 of the roadmap are staged on `claude/upstream-*` branches for submission to
> pyca/cryptography. The roadmap table below tracks per-item status.

## Executive summary

The upstream project is one of the best-hardened codebases in the Python ecosystem, and
Expand Down Expand Up @@ -198,20 +206,20 @@ with an ASAN-built OpenSSL) on a scheduled workflow if PR latency is a concern.

## Remediation roadmap

| # | Action | Priority | Effort |
|---|---|---|---|
| 1 | Owner-guard `wheel-builder.yml` + `pypi-publish.yml` (or disable on fork) | P1 | Small |
| 2 | Add `SECURITY.md` (+ `CODEOWNERS`) for the fork | P1 | Small |
| 3 | Owner-gate downstream/benchmark third-party CI jobs | P1 | Small |
| 4 | Hash-pin `ci-constraints-requirements.txt`; fix dead `PUBLISH_REQUIREMENTS_PATH` | P2 | Small |
| 5 | Add `cargo deny check advisories` (+ optional `pip-audit`) workflow | P2 | Small |
| 6 | Add CodeQL + OpenSSF Scorecard workflows | P2 | Small |
| 7 | Workspace `[lints]` with `unsafe_op_in_unsafe_fn = "deny"` | P3 | Small |
| 8 | Deprecation wrappers for CAST5/IDEA/SEED/Blowfish re-exports; DSA/small-RSA warnings | P3 | Medium |
| 9 | Minimum-version gates for LibreSSL/BoringSSL/AWS-LC | P3 | Medium |
| 10 | Adopt `zeroize` for owned secret buffers | P3 | Medium |
| 11 | cargo-fuzz targets + ClusterFuzzLite for the ASN.1/PKCS parsers | P4 | Medium |
| 12 | Scheduled ASAN/UBSAN CI leg | P4 | Medium |
| # | Action | Priority | Effort | Status |
|---|---|---|---|---|
| 1 | Owner-guard `wheel-builder.yml` + `pypi-publish.yml` (or disable on fork) | P1 | Small | ✅ Done (fork, PR #1); staged for upstream |
| 2 | Add `SECURITY.md` (+ `CODEOWNERS`) for the fork | P1 | Small | ✅ Done (fork, PR #1) |
| 3 | Owner-gate downstream/benchmark third-party CI jobs | P1 | Small | ✅ Done (fork, PR #1; scheduled linkcheck also gated) |
| 4 | Hash-pin `ci-constraints-requirements.txt`; fix dead `PUBLISH_REQUIREMENTS_PATH` | P2 | Small | 🔶 Dead env removal staged for upstream; hash-pinning open |
| 5 | Add `cargo deny check advisories` (+ optional `pip-audit`) workflow | P2 | Small | Open |
| 6 | Add CodeQL + OpenSSF Scorecard workflows | P2 | Small | Open |
| 7 | Workspace `[lints]` with `unsafe_op_in_unsafe_fn = "deny"` | P3 | Small | 🔶 Per-crate deny staged for upstream |
| 8 | Deprecation wrappers for CAST5/IDEA/SEED/Blowfish re-exports; DSA/small-RSA warnings | P3 | Medium | Open (upstream) |
| 9 | Minimum-version gates for LibreSSL/BoringSSL/AWS-LC | P3 | Medium | Open (upstream) |
| 10 | Adopt `zeroize` for owned secret buffers | P3 | Medium | Open (upstream) |
| 11 | cargo-fuzz targets + ClusterFuzzLite for the ASN.1/PKCS parsers | P4 | Medium | Open (upstream) |
| 12 | Scheduled ASAN/UBSAN CI leg | P4 | Medium | Open (upstream) |

Items 8–10 change library behavior/internals and are best contributed upstream rather
than carried as fork-only patches.