Newsboat

Repository on GitHub, which provides public git repositories with URLs.

Repository on GitHub, which uses git. git can track the changes, who made them, and when they were made.

The repository is our primary means of collaboration, so commits are small(-ish); we sometimes squash small features into a single commit, but never a whole release.

Repository on GitHub, which uses git. git is distributed.

Newsboat releases are identified through signed Git tags: https://github.com/newsboat/newsboat/releases

Non-trivial release notes file in repository: https://github.com/newsboat/newsboat/blob/master/CHANGELOG.md.

Newsboat fixed two vulnerabilities that its parent project had, and identified them in the CHANGELOG: see "Fixed" section in https://github.com/newsboat/newsboat/blob/master/CHANGELOG.md#210---2017-09-20

Bug reports are welcome at https://github.com/newsboat/newsboat/issues. We provide a template to help users gather all the necessary information: https://github.com/newsboat/newsboat/blob/1a71f953905976d50ba816967864eb52080e092c/.github/ISSUE_TEMPLATE

https://github.com/newsboat/newsboat/issues

Newsboat's maintainer, Alexander Batischev, triages new issues within a week of their submission. All issues get labels (bug/enhancement/meta etc.), I try to reproduce them with latest version from Git (and, failing that, with reporter's version), and ask for additional details if I can think of something that can help understand and fix the issue.

The process is the same as with bug reports.

The whole archive is searchable on GitHub: https://github.com/newsboat/newsboat/issues

https://newsboat.org/ says: "If you have found a security vulnerability, please email security@newsboat.org, and use the aforementioned PGP key if at all possible." The same information is also provided in the README: https://github.com/newsboat/newsboat#support

https://newsboat.org/ says: "If you have found a security vulnerability, please email security@newsboat.org, and use the aforementioned PGP key if at all possible." The same information is also provided in the README: https://github.com/newsboat/newsboat#support

As of 2024-11-20, there are no known vulnerabilities in Newsboat. We fixed two vulnerabilities with our site and credited the reporter in our CHANGELOG.

Non-trivial build file in repository: https://github.com/newsboat/newsboat/blob/master/Makefile.

We use GNU Make and Cargo (Rust's build tool and package manager).

All the required libraries, compilers, and other tools are free software or open source: https://github.com/newsboat/newsboat/tree/6522b4d2f551cc086c661aa5b74171118b51ec63#dependencies

The test suite is located under "tests" directory. Rust code includes a copy, split between "rust/libnewsboat/tests", "rust/libnewsboat/proptest-regressions", doctests inside documentation, and tests modules inside the source.

There is a Make target with a commonly-used name check which invokes C++ and Rust test suites in sequence, failing when one of the suites fail.

All the pull requests and merge commits are checked with Cirrus CI and GitHub Actions, which build the code on multitude of platforms using different compilers, and run tests on all of them.

Newsboat's maintainer, Alexander Batischev, asks people to add tests in their pull requests if the modified module already have tests, or if the module is otherwise obviously testeable. We still skip this requirement for modules that we haven't found a way to test yet, like UI.

Here are a few recent PRs that added functionality to testeable modules: https://github.com/newsboat/newsboat/pull/543 https://github.com/newsboat/newsboat/pull/584 https://github.com/newsboat/newsboat/pull/590 https://github.com/newsboat/newsboat/pull/653 https://github.com/newsboat/newsboat/pull/658

Our C++ code is compiled with -Wall -Wextra -Wunreachable-code: https://github.com/newsboat/newsboat/blob/00a7c26d47ea83408f6b69c6a968a2c36d2d6cc9/Makefile#L19

Our Rust code is compiled with default settings, which we believe are strict enough.

Our C++ code is compiled with -Werror: https://github.com/newsboat/newsboat/blob/00a7c26d47ea83408f6b69c6a968a2c36d2d6cc9/Makefile#L19 We compile the code on multiple platforms with different versions of GCC and Clang, and fix all warnings that pop up.

Our Rust code is compiled with default settings, but on CI, we turn warnings into errors: see -D warnings in https://github.com/newsboat/newsboat/blob/1a71f953905976d50ba816967864eb52080e092c/.cirrus.yml. We then fix all warnings that pop up.

This is met by -Werror for C++ code https://github.com/newsboat/newsboat/blob/00a7c26d47ea83408f6b69c6a968a2c36d2d6cc9/Makefile#L19 and -D warnings for Rust code https://github.com/newsboat/newsboat/blob/1a71f953905976d50ba816967864eb52080e092c/.cirrus.yml.

This isn't applicable since Newsboat doesn't implement and doesn't directly control what cryptography is used (e.g. client and server are free to negotiate any algorithm during HTTPS handshake, Newsboat has no say in that).

Newsboat uses cryptography as part of HTTPS, and through programs that users choose to run (e.g. with theoldreader-passwordeval setting). Newsboat does not implement its own cryptography; it relies on Curl (which in turn relies on any of OpenSSL, LibreSSL, or some other backend) and programs chosen by the user (e.g. GPG).

Newsboat only requires Curl, which needs an SSL library. There are at least OpenSSL and GnuTLS that are FLOSS.

This isn't applicable since Newsboat doesn't implement and doesn't directly control what cryptography is used (e.g. client and server are free to negotiate any algorithm during HTTPS handshake, Newsboat has no say in that).

This isn't applicable since Newsboat doesn't implement and doesn't directly control what cryptography is used (e.g. client and server are free to negotiate any algorithm during HTTPS handshake, Newsboat has no say in that).

This isn't applicable since Newsboat doesn't implement and doesn't directly control what cryptography is used (e.g. client and server are free to negotiate any algorithm during HTTPS handshake, Newsboat has no say in that).

This isn't applicable since Newsboat doesn't implement and doesn't directly control what cryptography is used (e.g. client and server are free to negotiate any algorithm during HTTPS handshake, Newsboat has no say in that).

Newsboat doesn't provide authentication to external users.

Newsboat uses cryptography as part of HTTPS, and through programs that users choose to run (e.g. with theoldreader-passwordeval setting). Newsboat does not implement its own cryptography; it relies on Curl (which in turn relies on any of OpenSSL, LibreSSL, or some other backend) and programs chosen by the user (e.g. GPG).

The releases are distributed from newsboat.org over HTTPS (enforced by HTTP Strict Transport Security), and are signed with a PGP key available over HTTPS from newsboat.org and also from the public keyserver network.

Release signatures are retrieved from newsboat.org over HTTPS, enforced by HTTP Strict Transport Security.

There are no publicly known vulnerabilities in Newsboat proper. All the publicly known vulnerabilities of the parent project, Newsbeuter, have been fixed; grep for "CVE" in the CHANGELOG: https://github.com/newsboat/newsboat/blob/00a7c26d47ea83408f6b69c6a968a2c36d2d6cc9/CHANGELOG.md

The last two vulnerabilities to parent project (which are fixed in Newsboat) have been privately disclosed, so it's not possible for me to prove that the fixes were produced rapidly. Take my (Alexander Batischev's) word that they were.

Newsboat's maintainer, Alexander Batischev, manually runs cppcheck every 30 days, i.e. three times per release. The check is not automated because of parse errors (as cppcheck doesn't fully support C++11).

Rust code is not checked (although C++ code that's auto-generated by Rust code is checked).

This could certainly be improved.

Static analysis haven't discovered any such vulnerabilities yet, so we don't have a history of fixing them timely.