FerroEHR

Actively maintained: multiple releases per week, scheduled dependency/spec/base-image watchers file issues automatically, and the maintenance posture is documented in GOVERNANCE.md.

GitHub Issues is the project's authoritative worklist, not a side-channel: each issue carries a contract with acceptance criteria, work is linked back to it, and milestones are the release spine.

SECURITY.md has a Credit section: reporters are credited in the advisory and release notes unless they ask not to be: https://github.com/rubentalstra/FerroEHR/blob/develop/SECURITY.md

SECURITY.md: private reporting via GitHub Security Advisories, acknowledgement within 5 working days, an assessment within 10 working days, coordinated disclosure agreed with the reporter: https://github.com/rubentalstra/FerroEHR/blob/develop/SECURITY.md

CONTRIBUTING.md documents the standards (rustfmt, clippy at pedantic-deny, comment conventions, test discipline) and the exact gate commands every PR must pass: https://github.com/rubentalstra/FerroEHR/blob/develop/CONTRIBUTING.md

CI enforces them: cargo fmt --check, clippy -D warnings at pedantic tier on every PR and push, plus dedicated style guards (comment-style, default-style, typed-status) that fail the build.

The build is cargo end to end: it honors the standard cargo/rustc environment conventions (RUSTFLAGS, CARGO_*, profile overrides in Cargo.toml) with no bespoke wrapper that would swallow them.

Release profile keeps debug=line-tables-only and strip=none deliberately (a production panic names its file:line); nothing strips by default.

One cargo workspace, one dependency graph; cargo builds it as a single DAG. There is no recursive make and no per-directory build.

CI builds with --locked against the committed Cargo.lock and a rust-toolchain.toml-pinned compiler; container builds pin base images by digest, so a rebuild resolves identical inputs.

Published multi-arch container images + docker compose quickstart + a Helm chart on GHCR OCI + per-arch release binaries: https://ferroehr.eu/docs/latest/ installation chapters.

Deployment configuration follows platform conventions: compose env vars, Helm values, the FERROEHR__ environment grammar over one ferroehr.toml tree; the binary is a single static executable placeable anywhere.

git clone + docker compose up for a full stack, or cargo nextest run against the shared testkit harness (one command, containers provisioned automatically): CONTRIBUTING.md's Setup section.

docs/VERSIONS.md is the pinned version matrix for every platform dependency, and the root Cargo.toml workspace.dependencies table is the authoritative crate set: https://github.com/rubentalstra/FerroEHR/blob/develop/docs/VERSIONS.md

cargo-deny (RustSec advisories) gates every PR; a scheduled latest-deps workflow detects in-range upstream breakage weekly; Dependabot raises bump PRs; scheduled image scans watch published containers.

All Rust dependencies are cargo-managed workspace pins (no vendored copies of convenience); vendored spec/test material is re-fetched by committed scripts, never hand-maintained forks.

The served OpenAPI document is generated from the handler annotations in the same source tree, so the API description cannot lag the code; a CI guard requires wire changes to update the annotations in the same PR.

cargo-nextest runs the full workspace suite (DB-backed against a real PostgreSQL 18) on every PR and push, and the CNF conformance pipeline exercises the composed server end to end over its REST surface.

A hard project rule: every fixed bug lands with a regression test in the same PR (recent examples: the AQL leak, printer escaping and backtracking fixes each carry pinned tests), and tests may never be weakened to pass.

81.3% statement coverage over the hand-written scope, measured by cargo-llvm-cov and published by SonarQube Cloud: https://sonarcloud.io/component_measures?id=rubentalstra_FerroEHR&metric=coverage

CONTRIBUTING.md's hard rules: functionality changes require tests, the exact gate commands are listed, and CI refuses a PR whose suite is not green: https://github.com/rubentalstra/FerroEHR/blob/develop/CONTRIBUTING.md

It is in CONTRIBUTING.md's "Hard rules" section, which is the instructions for change proposals.

clippy::pedantic at deny (not warn) is already beyond common practice, alongside
unsafe_code = "forbid", denied panicking APIs including unwrap/expect/panic!/
indexing/string slicing, a banned-API list enforced at compile time
(SystemTime::now, std::env::var, Uuid::new_v4, chrono), and every suppression
required to carry a reason. Release builds additionally set overflow-checks = true
so integer overflow panics rather than silently wrapping into a wrong clinical
value.

The access layer is deny-by-default and fail-closed at every stage (documented in docs/architecture.md); the published threat model states the trust boundaries: https://ferroehr.eu/docs/latest/threat-model.html

No SHA-1 in any security decision. CBC is not reachable under the TLS 1.3 default. Where SHA-256 is used for a non-signature purpose it is stated as such — for example, a verified-Basic-credential cache keys on a SHA-256 digest of the presented header, never on plaintext.

JWT verification binds a configurable algorithm set to its key source; version signing supports two mechanisms (digest and OpenPGP) selected by configuration; password hashes are PHC strings carrying their own algorithm+parameters, upgradable per credential.

Credentials are Argon2id PHC strings (algorithm and parameters travel with each hash, so they can be re-hashed on policy change); server keys and OIDC secrets arrive via configuration/secret stores, never hard-coded.

All network security uses standard protocols via rustls (TLS for the server, its Postgres client connection, and every outbound HTTPS client); no bespoke transport crypto exists.

The TLS stack is rustls, which implements TLS 1.2 and 1.3 only — older protocol versions are unrepresentable in the library.

rustls with webpki verification is the default on every outbound TLS connection (reqwest/tokio-postgres); no insecure/no-verify escape hatch is exposed in configuration.

Private keys and credentials are never transmitted or logged: the PHI/credential logging ban is a review rule backed by typed config secrecy wrappers, and signing keys stay server-side (detached signatures only).

Every GitHub release ships per-artifact Sigstore bundles, SLSA v1 provenance and SBOM attestations plus sha256 sums, and the release itself is immutable with a release attestation; verification commands: https://ferroehr.eu/docs/latest/verifying-releases.html

Release tags are OpenPGP-signed by the maintainer's key and GitHub shows them as Verified. MAINTAINERS.md records the OpenPGP signing key as a maintained publishing asset; the fingerprint itself is not published in-repo.

The canonical JSON reader is strict by construction (undeclared and duplicate keys refused, typed validated constructors); AQL input is parsed by a grammar-exact parser with typed rejects; every refusal is a pinned negative test.

Distroless non-root images, restricted Pod Security Standards compliance gated in CI, CSP on the console, deny-by-default authorization, and hardening documentation: https://ferroehr.eu/docs/latest/installation/hardening-supply-chain.html

The published threat model (trust boundaries, what each control refuses) plus the security chapter form the case; each claim maps to a machine check via the project's enforcement-register convention (a rule without a failing check is not accepted as a rule): https://ferroehr.eu/docs/latest/threat-model.html

CodeQL's security query suites are exactly this, and the actions language analysis covers workflow-specific classes such as script injection. Alongside it, zizmor audits every workflow for unpinned actions, excessive permissions, template injection and cache poisoning at --min-severity=low, and repository-specific gates fail a pull request that introduces string-built SQL or a 5xx response body carrying an internal error value.

The project produces no code in a memory-unsafe language. It is entirely Rust, and
unsafe_code = "forbid" applies workspace-wide — a forbid that no attribute can
relax, so a compilation unit cannot opt back in. There is no unsafe block to
protect.