Project Horizon

We have not yet released a second version of Horizon.

Bugzilla is used, at https://bts.adelielinux.org/buglist.cgi?product=Horizon&resolution=---

No vulnerabilities have ever been reported for Project Horizon.

https://code.foxkit.us/adelie/horizon/blob/master/devel/STYLE.rst

Horizon is built with standard CMake. These variables are tested regularly via our Clang scan-build tests.

CMake has Debug and RelWithDebugInfo build types to preserve debugging information.

CMake generates the Makefiles (or Ninja build files, or others), keeping them updated as the structure of the project changes.

The system is an installation system. CMake-generated Makefiles do support DESTDIR.

The system is an installation system. CMake-generated Makefiles do support DESTDIR.

The Runtime Environment requires no external dependencies. Since the Installation Environment is only meant to be used from Adélie Linux, it is assumed that abuild deps from the Horizon build recipe in our packages repository is sufficient for this, as it will install all the build dependencies for the Horizon Installation Environment.

On systems that support C++17, there are no external dependencies for the Runtime Environment.

The Installation Environment dependencies are listed in the CMakeLists.txt file: https://code.foxkit.us/adelie/horizon/blob/master/CMakeLists.txt#L56 using standard PkgConfig files.

All external dependencies except CLIPP are provided by the system. No other vendored code exists.

All APIs used in the Installation Environment are current and non-deprecated. All APIs used in the Runtime Environment are part of C++14 and are not known to be obsolete or impending deprecation.

Test suite is run on every commit: https://code.foxkit.us/adelie/horizon/pipelines

No bugs have been filed yet. Regression tests are recommended in the contribution guide: https://code.foxkit.us/adelie/horizon/blob/master/CONTRIBUTING.rst

We use LCOV ( http://ltp.sourceforge.net/coverage/lcov.php ) for coverage reports. At the time of this writing, we have 83% coverage: https://horizon.adelielinux.org/coverage/

This is contained in our Contribution Guide: https://code.foxkit.us/adelie/horizon/blob/master/CONTRIBUTING.rst

https://code.foxkit.us/adelie/horizon/blob/master/CONTRIBUTING.rst

-Wall -Wextra with only -Wunused-parameter disabled: https://code.foxkit.us/adelie/horizon/blob/master/CMakeLists.txt#L17

cURL is used to connect to HTTPS, so it is up to the distributor of the cURL library to ensure this is met. The Adélie Linux build utilises OpenSSL and is fully configurable in this manner.

While account passwords must be included in the HorizonScript, LUKS passphrases do not have to be - the user can be prompted for them instead.

Signing keys are only fetchable via HTTPS. Repositories, user avatars, and HorizonScript files prefer HTTPS but support HTTP if the user explicitly requests them.

TLS 1.2 should be supported by any cURL build with TLS support that would be used with Horizon.

ibcurl performs peer SSL certificate verification by default: https://curl.haxx.se/docs/sslcerts.html

Certificate verification is performed during negotiation, before any HTTP headers are sent to the remote system.

Git tags are cryptographically signed. Release tarballs have GPG signatures from our development team. See https://code.foxkit.us/adelie/horizon/-/releases for example.

All Git tags are cryptographically signed: https://code.foxkit.us/adelie/horizon/-/tags

Horizon's parser is strict and heavily tested. We have achieved 100% test coverage in the parsing module. All inputs are fully sanitised and errors are returned if the values are not within parameters.

Stack protector is on by default in Adélie Linux. We additionally have many warning flags enabled and marked -Werror.

CppCheck includes checks to ensure proper API usage. It additionally ensures non-usage of known unsafe APIs (like gets).

Valgrind is run per-commit as part of CI: https://code.foxkit.us/adelie/horizon/pipelines