Viua Virtual Machine

Repository on GitHub, which provides public git repositories with URLs.

Repository on GitHub, which uses git. git can track the changes, who made them, and when they were made.

Repository on GitHub, which uses git. git is distributed.

Non-trivial release notes file in repository: https://github.com/marekjm/viuavm/blob/devel/Changelog.markdown.

Release notes include a list of all fixes that are included in each release. Viua is not popular enough to attract attention of either security community, or the cracker crowd, so the only "security" related vulnerabilities that are found are ordinary bugs.

Bugs are submitted using GitHub's issue mechanism.

https://github.com/marekjm/viuavm/issues

GitHub's issue tracked is used.

Bugs reported through the GitHub's issue tracker are addressed quickly (usually in a matter or days).

Bugs are submitted using GitHub's issue mechanism is used for this purpose.

https://github.com/marekjm/viuavm/issues?q=is%3Aissue+is%3Aclosed can be browsed to access past issues.

Vulnerability reporting process is described in contributor guidelines: http://git.savannah.nongnu.org/cgit/viuavm.git/tree/CONTRIBUTING.markdown?h=devel

All vulnerabilities are reported publicly, as bugs.

No vulnerabilities were reported in last 6 months.

Non-trivial build file in repository: https://github.com/marekjm/viuavm/blob/devel/Makefile.

Non-trivial build file in repository: https://github.com/marekjm/viuavm/blob/devel/Makefile.

At the extreme minimum, Viua requires only a C++ compiler to be built (both GCC and Clang work).

Viua provides a set of about 400 tests in a "quick" and "heavy" (i.e. run under Valgrind, with double runs for dis- and reassembled code) modes.

Use "make test" to launch test suite.

Test suite covers most instructions available to the software running on the VM.

TravisCI is used for CI.

Described in README.

Described in README.

Viua uses an almost painful set of compiler flags (which sometimes results in Voodoo dancing to satisfy the compilers), and is compilable under GCC and Clang to get feedback from different compilers.

Viua compiles without a single warning under GCC.

The code includes Voodoo dancing to satisfy the compilers, but compiles under excruciating set of warning flags.

The VM abstracts the platform way to some extent (so provides a layer of separation) and verifies actions performed by the software for errors, but inevitably must allow everything the software would like to do. It is not the VM's responsibility to prevent the user running the software from deleting files of other users, or from writing files larger than 1TB to disk - it is operating system's responsibility. The VM is not in a position to judge the actions of the software it is running.

Thus, this requirement is met, but on a slightly different basis - the VM is "secure" because of rigorous testing, warning-free compilation, and the fact that ASan, LSan, and UBSan do not report errors for it.

See above.

Packed archives can be downloaded over HTTPS, Git repositories can be cloned using SSH.

Release tarballs are available over HTTPS: https://release.viuavm.org/

There are no reported vulnerabilities for Viua VM, as it is not a widely-used piece of software. The code is expected to have low number of open vulnerabilities due to heavy use of testing and instrumentation during the development process.

See above.

Viua public repositories do not contain any credentials.

Clang static analyser.

Clang static analyser is used.

Clang static analyser is used did not find any bugs in Viua VM's code.

Test suite is run under Valgrind, and with ASan, LSan, and UBSan enabled.

Viua VM does not produce warnings under ASan, LSan, UBSan, and Valgrind.

AddressSanitizer, LeakSanitizer, and Undefined-BehaviourSanitizer are used in the default test build.

Viua compiles and tests without a single warning from ASan, LSan, UBSan, and Valgrind. Code is not allowed to be merged into devel or master branches if it raises even a single warning.