php-legal-licenses

Repository on GitHub, which provides public git repositories with URLs.

Repository on GitHub, which uses git. git can track the changes, who made them, and when they were made.

Internal work (from maintainers) is done in branches and pulled into master with a pull request. External work is merged via pull requests. Both paths have opportunity for review before being released.

Repository on GitHub, which uses git. git is distributed.

As a PHP package primarily consumed by the PHP dependency manager Composer (getcomposer.org), this package follows the versioning standards specified on Packagist (the repository for Composer packages): https://packagist.org/about#managing-package-versions. Composer (the utility) is to packagist.org, as npm (the utility) is to npmjs.org.

This PHP package follows the recommendations of packagist.org, and publishes changes using git tags and GitHub releases.

Release objects are created from tags on Github, with descriptive titles, extra descriptions when required, and credit to the author(s). https://github.com/Comcast/php-legal-licenses/releases

As of yet, no CVE vulnerabilities have been identified.

https://github.com/Comcast/php-legal-licenses/issues

Using the Issues feature on github.com, Issues can be assigned to a contributor, tagged with labels, assigned to a project or milestone, etc. They can also link to other Issues or Pull Requests.

At the time of answering this question, this project has had only one bug report that was acknowledged (and fixed) on the same day: https://github.com/Comcast/php-legal-licenses/issues/1

None submitted as of yet.

Github maintains a list of all open and closed issues for public perusal: https://github.com/Comcast/php-legal-licenses/issues

Reporting process detailed in the readme: https://github.com/Comcast/php-legal-licenses/blob/master/README.md

Process for reporting sensitive information included in readme: https://github.com/Comcast/php-legal-licenses/blob/master/README.md

No vulnerability reports received to date.

This utility is downloaded and "installed" through a dependency manager, Composer. It functions similarly to NPM packages.

No build required as per [build].

No build required as per [build].

Uses phpunit unit tests and are run automatically in GitLab CI/CD.

phpunit is the standard unit test suite for PHP applications.

Unit tests, dependency scanning, and SAST is run every push to the code base, and upon every merge.

A line in the CONTRIBUTING.md file indicated that new unit tests should be added or existing tests be modified, as applicable, for any new code changes.

Policy on tests is new, and no major functionality has yet been added.

Policy is documented in the CONTRIBUTING.md file, which is to be followed for every content change.

StyleCI analyzes the code upon every push and will automatically submit a PR with style/syntax changes to fit the configuration I set.

No cryptographic functionality in this package.

This utility does not implement cryptography.

This utility does not depend on cryptography (except for referencing git commit hash strings, but those are generated by git itself, and not part of this package).

This utility does not implement or depend on cryptography.

This utility does not implement or depend on cryptography (the hashes referenced by the package are generated by git directly, and only used as any other string).

This utility does not implement or depend on cryptography.

This utility does not implement or depend on cryptography.

This utility does not implement or depend on cryptography.

This utility does not implement or depend on cryptography.

N/A within this utility.

N/A within this utility.

No known vulnerabilities have yet been discovered/announced.

No known vulnerabilities have yet been discovered/announced.

No credentials are involved with this utility.

This project uses Gitlab CI, and uses some of their built-in security testing. For SAST, it uses both phpcs-security-audit and a plugin called "secrets" (that checks for passwords in the code repo).

Using Gitlab CI, we have enabled a number of different SAST tools, most of which check for PHP-specific vulnerabilities or anti-patterns.

No vulnerabilities identified as of yet.

Gitlab CI is configured to run the various analyzers for every commit on every branch.

Project not implemented using a memory-unsafe language.

This project does not include any web accessible inputs (is not a web app at all) and does not directly consume user input, other than a command name to process. The "input" is a composer.lock file, a json file generated by the PHP dependency manager Composer. Additional validation on the generated lock file will be implemented in the future.

None identified as of yet.