umoci

Repository on GitHub, which provides public git repositories with URLs.

Repository on GitHub, which uses git. git can track the changes, who made them, and when they were made.

All development is done in the open, which means that all interim versions are visible in the commit log.

Repository on GitHub, which uses git. git is distributed.

This project uses Semantic Versioning.

This project uses Semantic Versioning, with each release being signed and tagged with the project owner's PGP key (including a description of the changes for that release).

Non-trivial release notes file in repository: https://github.com/opencontainers/umoci/blob/master/CHANGELOG.md.

This project does not have any publicly known vulnerabilities, however as stated in https://github.com/opencontainers/umoci/blob/master/CONTRIBUTING.md including such notices will be part of the review process.

Users may submit issues through the GitHub issue tracking system https://github.com/opencontainers/umoci/issues.

Users may submit issues through the GitHub issue tracking system https://github.com/opencontainers/umoci/issues.

This can be seen by the current state of https://github.com/opencontainers/umoci/issues.

This can be seen by the current state of https://github.com/opencontainers/umoci/issues.

Users may submit issues through the GitHub issue tracking system https://github.com/opencontainers/umoci/issues, which includes a full archive of all issues.

This information is included in the project's CONTRIBUTING.md file https://github.com/opencontainers/umoci/blob/master/CONTRIBUTING.md.

This information is included in the project's CONTRIBUTING.md file https://github.com/opencontainers/umoci/blob/master/CONTRIBUTING.md.

There have been no vulnerability reports received in the last 6 months.

Non-trivial build file in repository: https://github.com/opencontainers/umoci/blob/master/Makefile.

Non-trivial build file in repository: https://github.com/opencontainers/umoci/blob/master/Makefile.

This project uses the Go compiler, and various tools such as make and bash scripts that make up part of a normal GNU installation.

This bats uses two test suites. Unit tests are tested using the standard Go language test functionality https://golang.org/pkg/testing/, and integration tests are run through the bats test suite https://github.com/bats-core/bats-core. Both are free software.

The test suite can be invoked from the project's Makefile https://github.com/opencontainers/umoci/blob/master/Makefile which uses the standard go testing tool for unit tests and runs the bats testing tool for integration tests.

As part of our testing, we generate a line coverage profile for the entire project https://www.cyphar.com/blog/post/golang-integration-coverage. The total percentage of tested lines of code is currently >80% https://travis-ci.org/opencontainers/umoci/jobs/221181536#L1846-L2074, with plans to improve this in the future.

In addition, we test against a large variety of images to ensure that our code correctly handles different distribution idiosyncrasies correctly and safely.

This project makes use of the free software CI system Travis https://travis-ci.org/opencontainers/umoci, and the actual test framework is the free software project bats https://github.com/bats-core/bats-core.

This policy is described in the project's CONTRIBUTING.md file https://github.com/opencontainers/umoci/blob/master/CONTRIBUTING.md.

All releases have their test runs publicly visible from our CI system https://travis-ci.org/opencontainers/umoci. All releases and commits to master have their test output publicly accessible at https://travis-ci.org/github/opencontainers/umoci/builds.

This information is included in the project's CONTRIBUTING.md file https://github.com/opencontainers/umoci/blob/master/CONTRIBUTING.md.

The Go compiler does not emit warnings, and we use several linters to further ensure the sanity of our tools https://github.com/opencontainers/umoci/blob/v0.4.0/Makefile#L91. All of the linters (golint, gofmt, govet) we use are free software.

The Go compiler does not emit warnings, and our test suite will automatically fail if any of the linters we use produce warnings https://github.com/opencontainers/umoci/blob/v0.4.0/Makefile#L91.

The Go compiler does not emit warnings, and our test suite will automatically fail if any of the linters we use produce warnings.

One of the primary developers (Aleksa Sarai) has previously engaged in security research and is aware of various design principles necessary in the design of secure software.

One of the primary developers (Aleksa Sarai) has previously engaged in security research and is aware of errors that can result in security vulnerabilities related to umoci, and knows how to mitigate and counter such errors. We provide information on our security design decisions in https://umo.ci/reference/security/.

This tool makes use of the sha256 and several other hashing algorithms, which have all been implemented by Google as part of the Go standard library. Those libraries has been reviewed and tested by third parties.

This tool makes use of the sha256 and several other hashing algorithms, which have all been implemented by Google as part of the Go standard library. Those libraries has been reviewed and tested by third parties.

This tool makes use of the sha256 and several other standard hashing algorithms, which have all been implemented by Google as part of the Go standard library as free software. Those libraries has been reviewed and tested by third parties.

This project does not use public key cryptography.

This tool makes use of the sha256 and several other standard hashing algorithms which are still considered to be secure. In addition, the algorithms used are mandated by the OCI specification.

This tool makes use of the sha256 and several other standard hashing algorithms which are still considered to be secure. In addition, the algorithms used are mandated by the OCI specification.

This project does not use public key cryptography.

This project does not use involve the storage of passwords.

This project does not use public key cryptography.

All project releases are delivered over SSL https://github.com/opencontainers/umoci/releases and have been signed with the main developers PGP key.

All project releases are delivered over SSL https://github.com/opencontainers/umoci/releases and have been signed with the main developers PGP key.

Currently there are no publicly known vulnerabilities in umoci.

Currently there are no publicly known vulnerabilities in umoci.

To this date no credentials have been leaked in the main repository, and we have a policy to immediately invalidate any credentials if they have been leaked.

Every commit in the project has several static analysis tools applied (govet, golint) as part of the CI process. All failures will result in code not being acceptable for merging. In future, we intend to run even more static analysis tools on each commit such as those listed in https://github.com/mre/awesome-static-analysis#go.

govet is specifically written to look for "suspicious constructs" https://golang.org/cmd/vet/. In addition, we use gosec to find potential security issues (such as not checking error values). https://github.com/securego/gosec/.

Every commit in the project has several static analysis tools applied (govet, golint) as part of the CI process. All failures will result in code not being acceptable for merging. In future, we intend to run even more static analysis tools on each commit such as those listed in https://github.com/mre/awesome-static-analysis#go.

Every commit in the project has several static analysis tools applied (govet, golint) as part of the CI process. All failures will result in code not being acceptable for merging. In future, we intend to run even more static analysis tools on each commit such as those listed in https://github.com/mre/awesome-static-analysis#go.

Go is not a memory unsafe language.

We do not run any such tools at this time.