bitmath

GitHub requires 2FA as of March 2023.

▎ The project relies on GitHub's default permission model, which assigns new ▎ collaborators read access only; any elevated permission requires an explicit ▎ manual grant by the repo owner.

▎ Branch protection on master enforces 17 required status checks (full Python
▎ 3.9–3.13 × {macOS, Ubuntu, Windows} matrix + CodeQL + Bandit) with
▎ enforce_admins: true and required_linear_history: true. Direct pushes that fail
▎ any check are rejected, including pushes by administrators.

▎ Branch protection on master has allow_deletions: false and enforce_admins: true,
▎ so the branch cannot be deleted by any account including the owner.

▎ An audit of every ${{ }} interpolation across all 5 workflows (bandit.yml,
▎ codeql.yml, publish.yml, python.yml, scorecard.yml) shows the only interpolated
▎ values are ${{ matrix.os }} and ${{ matrix.python-version }}, both
▎ workflow-defined constants. There is zero use of github.event.*,
▎ github.head_ref, github.ref_name, commit messages, PR titles, or branch names in
▎ shell contexts. Workflows:
▎ https://github.com/timlnx/bitmath/tree/master/.github/workflows

▎ All PR-triggered workflows use pull_request (not pull_request_target), so PRs
▎ from forks execute in the fork's read-only context without access to repository
▎ secrets. The only workflow that holds secrets is publish.yml, which fires solely
▎ on release: published and uses PyPI Trusted Publishing (OIDC), so no long-lived
▎ credentials exist for untrusted code to exfiltrate.

Project URLs use HTTPS exclusively.

▎ bitmath is distributed exclusively via PyPI over HTTPS using PyPI's Trusted
▎ Publisher (OIDC) flow with sigstore-backed provenance, and via GitHub Releases
▎ at https://github.com/timlnx/bitmath/releases. Both channels provide
▎ cryptographic integrity protection.

▎ .gitignore excludes generated artifacts and common secret-bearing files. GitHub ▎ secret scanning and Dependabot security updates are enabled at the repository ▎ level. Bandit runs in CI (.github/workflows/bandit.yml) on every push and PR and ▎ weekly on a schedule, with zero open findings.

▎ Comprehensive user documentation is published at https://bitmath.readthedocs.io/
▎ covering installation, every public unit type, parsing, formatting, arithmetic,
▎ capacity queries, and real-life examples. The README at
▎ https://github.com/timlnx/bitmath also includes a quick-start.

▎ GitHub Issues is enabled and is the canonical bug tracker:
▎ https://github.com/timlnx/bitmath/issues. The contribution guide at
▎ https://github.com/timlnx/bitmath/blob/master/.github/CONTRIBUTING.md describes
▎ how to file reports.

▎ Public discussion happens on GitHub Issues and Pull Requests, both publicly
▎ readable. Issues: https://github.com/timlnx/bitmath/issues. PRs:
▎ https://github.com/timlnx/bitmath/pulls.

▎ A contribution guide is published at
▎ https://github.com/timlnx/bitmath/blob/master/.github/CONTRIBUTING.md (GitHub
▎ auto-surfaces this on the Issues/PR creation pages) and is also rendered into
▎ the docsite at https://bitmath.readthedocs.io/en/latest/contributing.html.

▎ bitmath is licensed under the MIT License, an OSI-approved and FSF-approved
▎ license. https://github.com/timlnx/bitmath/blob/master/LICENSE

▎ The released wheel and sdist on PyPI are distributed under the same MIT License
▎ as the source. https://pypi.org/project/bitmath/

▎ The license text lives at https://github.com/timlnx/bitmath/blob/master/LICENSE
▎ in the repository root.

▎ The Hatchling build backend (pyproject.toml) packages the LICENSE file into both ▎ the wheel and sdist published to PyPI.

▎ The source repository is publicly readable at the stable URL
▎ https://github.com/timlnx/bitmath. It has lived at this URL for over a decade
▎ and has no mirrors with conflicting authority.

▎ The full commit history is publicly readable at
▎ https://github.com/timlnx/bitmath/commits/master. Commits preserve author,
▎ committer, and timestamp; squash-merging that would obscure authorship is not
▎ used.

▎ Runtime: bitmath has zero runtime dependencies (declared in pyproject.toml:
▎ https://github.com/timlnx/bitmath/blob/master/pyproject.toml). Development/test
▎ dependencies are listed in requirements.txt:
▎ https://github.com/timlnx/bitmath/blob/master/requirements.txt.

▎ bitmath is a single-repository project. No additional sub-project repositories ▎ exist.

▎ git ls-files returns no .exe, .dll, .so, .dylib, .jar, .whl, .pyc, or other ▎ generated executable artifacts. Build outputs are excluded via .gitignore.

▎ Security contact and vulnerability disclosure process are published in
▎ https://github.com/timlnx/bitmath/blob/master/SECURITY.md, which GitHub surfaces
▎ in the repository's Security tab.

Security policy published in github standard way https://github.com/timlnx/bitmath/security/policy which pulls from the file in source control https://github.com/timlnx/bitmath/blob/master/SECURITY.md [vulnerability_report_process]

▎ Marked obsolete in the OSPS criteria; superseded by OSPS-BR-01.01, which the ▎ project meets (see #5).