presidio-deident

https://github.com/presidio-v/presidio-deident/blob/main/SECURITY.md#supported-versions states the supported line (0.7.x; 0.7.0 is the first published version). https://github.com/presidio-v/presidio-deident/blob/main/SEMVER.md gives the upgrade path: a record that verifies keeps verifying in later 0.x versions, every record format verifies for the life of the project, patch releases fix bugs and security defects only, and users pin a minor version and re-verify the committed sample after each upgrade.

GitHub Issues.

No vulnerability report has been received or resolved in the last 12 months; no security advisory exists for this repository. GOVERNANCE.md#roles-and-responsibilities assigns reporter credit to the security contact.

Intake by private GitHub Security Advisory or security@presidio-group.eu (https://github.com/presidio-v/presidio-deident/blob/main/SECURITY.md#reporting-a-vulnerability); acknowledgement within 5 business days (CONTRIBUTING.md#reporting-a-security-vulnerability); the security contact triages, coordinates the fix, the advisory and reporter credit (GOVERNANCE.md#roles-and-responsibilities); a verification defect ships as a patch release with an advisory (SEMVER.md).

https://github.com/presidio-v/presidio-deident/blob/main/CONTRIBUTING.md#style — ruff lint and format, configured in pyproject.toml (line length 100, target Python 3.11, rule sets listed).

ruff check and ruff format --check run in CI on every PR, in the required check lint.

A pure-Python package built by hatchling; no compiler or linker is invoked.

No compiled artefacts; the wheel is pure Python (py3-none-any).

A single PEP 517 build; there is no make or subdirectory build.

The release is bit-for-bit reproducible: rebuilding v0.7.0 from the tagged source (git archive v0.7.0, uv build --wheel --sdist, macOS) on 2026-11-08 gave a wheel (6b7c2749…5ee6) and an sdist (7be28dac…298b) whose SHA-256 match the PyPI files exactly. The package is pure Python built by hatchling (>=1.31,<2); the release build installs build unpinned, so reproducing a later release assumes a compatible backend version.

pip install presidio-deident (or pip install 'presidio-deident[parquet]' for Parquet) from PyPI.

Installed via pip; DESTDIR-style conventions do not apply.

https://github.com/presidio-v/presidio-deident/blob/main/CONTRIBUTING.md#local-verification — create a venv, pip install -e ".[dev]", then the ruff and pytest commands.

Listed machine-readably in https://github.com/presidio-v/presidio-deident/blob/main/pyproject.toml: one runtime dependency (presidio-evidence[crypto]>=0.5.1,<0.6, which brings cryptography) and the parquet (pyarrow), parity and dev extras. Each release also carries a CycloneDX SBOM, e.g. https://github.com/presidio-v/presidio-deident/releases/download/v0.7.0/sbom.cdx.json.

Dependabot (pip, GitHub Actions) with security updates enabled; pip-audit on every push and PR (ci.yml, required check audit); OpenSSF Scorecard weekly.

Dependencies are PyPI packages installed by pip; Dependabot tracks pip and GitHub Actions updates. The one vendored component, the structural PII detector from presidio-hardened-x402 (ADR-0003), is checked against its upstream by tests/test_detect.py::test_parity_with_x402 in CI, so an upstream change shows up as a failing test; replacing it with a shared package is planned.

Dependencies are kept current by Dependabot (pip, Actions) with security updates enabled; ruff's UP rules flag outdated Python idioms; no deprecated FLOSS interface is used where a current one exists.

https://github.com/presidio-v/presidio-deident/blob/main/.github/workflows/ci.yml runs the full suite on every push and PR on Python 3.11, 3.12 and 3.13 (Ubuntu) with the Parquet and parity extras installed, including end-to-end run-then-verify tests, re-release chains (tests/test_history.py), the committed signed sample release and the shipped pass/fail vectors (tests/test_public_contract.py), the detector parity test against presidio-hardened-x402, and the Atheris fuzz job. All are required checks on main.

Policy requires a regression test with every bug fix. All fixes in the last 6 months were made before publication (0.2.0, 0.3.1 and 0.5.0 in CHANGELOG.md), and each carries a regression test in the public tree: the 0.2.0 and 0.5.0 review fixes in tests/test_review_fixes.py (e.g. test_detector_is_linear_on_long_runs, test_record_fields_are_checked, test_parent_to_another_recipient_is_refused), and the 0.3.1 envelope binding in tests/test_mutation.py and the shipped vector src/presidio_deident/vectors/envelope-mismatch. The PRs are in the private development repository and are not linkable.

CI gate: at least 90% combined line and branch coverage (--cov-branch --cov-fail-under=90 in pyproject.toml, applied by every test job in .github/workflows/ci.yml). Statement coverage measured 99.2% on 2026-11-08 (11 of 1,295 statements missed).

Formal written policy at https://github.com/presidio-v/presidio-deident/blob/main/CONTRIBUTING.md#tests: functionality changes ship with tests; bug fixes include a regression test that fails before the fix. Enforced in code-owner review and by the 90% line-and-branch coverage gate.

The policy is stated in the contribution instructions themselves (CONTRIBUTING.md#tests).

ruff selects E, F, W, I, B, UP, S (flake8-bandit security rules) and SIM, well beyond ruff's default E/F subset (pyproject.toml [tool.ruff.lint]). Exclusions are limited to tests/ (S101, S105, S106, S311, E501) and fuzz/ (S101, SIM105, N802); src/ has one noqa (B007, a loop variable read in the except).

Fail-safe defaults: an unknown policy key, an unmapped or missing column, input that cannot be written back faithfully, unjustified PII in a kept column or a leftover .partial stops the run; every verify check must pass and malformed input is a failed check. Complete mediation: every listed file is re-hashed on every verify; nothing is cached. Least privilege: no network, no hosted mode, no values in any output; files 0600 in a 0700 directory. Defence in depth: signature over the record, record over the files, unsigned envelope fields bound to the record, history binding releases into one chain. Economy of mechanism: Ed25519 and SHA-256 via presidio-evidence/cryptography and the stdlib, no bespoke crypto, one runtime dependency. See https://github.com/presidio-v/presidio-deident/blob/main/ASSURANCE.md#3-secure-design-principles-applied.

No SHA-1 and no CBC mode; the project does no encryption. The unkeyed SHA-256 suppression-list format is guessable for low-entropy values; this is a documented limit (SECURITY.md#known-limits, ADR-0006), not a security function.

The signature algorithm is a per-signer trust-store field (alg, presidio-evidence trust-store@1), and the pseudonym scheme is recorded in each record (hmac-sha256-128/v1), so a new algorithm is a new identifier rather than a silent change. The file-hash function (SHA-256) is fixed by dataset-release@1; replacing it would be a new format (@2) verified side by side with @1 (SEMVER.md), not a runtime switch.

No key is in the source tree (only public trust stores for the sample and the test vectors). Keys are files supplied at run time (--sign-key, --pseudonym-key); trust stores are supplied by the buyer, and a signer may list several public keys, so a signing key rotates without a new release (docs/KEYS.md, tested in tests/test_history.py). Rotating the pseudonym key is possible but changes every pseudonym, as documented.

The project makes no network calls.

No network communication.

No TLS client.

No network communication.

The wheel and sdist carry GitHub build-provenance attestations (gh attestation verify <file> --repo presidio-v/presidio-deident, bundle attached as provenance.intoto.jsonl), PyPI files carry PEP 740 attestations from Trusted Publishing, and release tags are SSH-signed with the public key in https://github.com/presidio-v/presidio-deident/blob/main/allowed_signers. Documented at https://github.com/presidio-v/presidio-deident/blob/main/SECURITY.md#verifying-releases-and-obtaining-public-signing-keys. Checked for v0.7.0 on 2026-11-08 (wheel and sdist attestations and the tag signature verify).

The release tag v0.7.0 is SSH-signed with the organisation release key and shown as Verified on GitHub; git -c gpg.ssh.allowedSignersFile=allowed_signers verify-tag v0.7.0 checks it locally.

Input data, policies, lists and received releases are untrusted. policy.py rejects unknown keys, unmapped columns and PII in free text (bounded to 512 characters); tables.py refuses non-UTF-8, lone surrogates, NaN/Infinity, nested, binary and decimal values and malformed CSV, naming row and column but never the value; verify.py accepts only plain-basename file names, refuses symlinks, size-bounds JSON and matches identifiers and timestamps in full before use. See ARCHITECTURE.md#trust-boundaries.

Key files are written 0600, never overwritten, and refused if group- or world-readable; outputs are 0600 in a 0700 directory, written to <out>.partial and renamed only after signing; symlinks and oversized JSON are refused; detector patterns are linear-time; errors never echo values. Supply chain: SHA-pinned GitHub Actions with least-privilege permissions:, Trusted Publishing behind a reviewer-gated release environment limited to v* tags, branch protection on main (code-owner review, last-push approval, admins included, linear history, 8 required checks), secret scanning with push protection.

URL: https://github.com/presidio-v/presidio-deident/blob/main/ASSURANCE.md. Threat table with out-of-scope assumptions, the five trust boundaries of ARCHITECTURE.md#trust-boundaries, the secure-design-principles argument and the common-weakness argument (CWE-mapped). It states that two internal review passes were done and that there has been no external review or security audit.

CodeQL's Python security queries, Bandit, and ruff's S rules (injection, unsafe deserialization, weak hashes, insecure randomness, hard-coded secrets and similar) as required CI checks.

The project is pure Python, which is memory-safe; it ships no native code.