hostmic

GitHub requires 2FA as of March 2023.

The repository belongs to a personal GitHub account: a collaborator can only be added through an explicit invitation by the owner, which the invitee must accept, so every permission grant is manual. Today the only account with access is the owner's (no collaborators, no pending invitations). Even for a collaborator, the "Protect main" ruleset requires a pull request with code-owner review and passing checks to change main, and the "Protect tags" ruleset forbids moving or deleting v* tags.

The "Protect main" repository ruleset is active on the default branch (main). It requires every change to go through a pull request (squash merge only, code-owner review, review threads resolved) with the required status checks zizmor, secrets and driver passing on an up-to-date branch, and it blocks force pushes and branch deletion. The only bypass is for the admin role, in "pull request" mode: even the owner cannot push directly to main and must merge through a pull request.

The "Protect main" repository ruleset, active on the default branch (main), includes the "Restrict deletions" rule: main cannot be deleted at all, by anyone. Deleting it would first require editing or disabling the ruleset, an administrative action that requires GitHub sudo-mode re-authentication. The same ruleset also blocks force pushes.

No workflow passes untrusted metadata (branch names, tags, commit messages, pull request titles, author information) to a shell or script: the only expressions in run steps are matrix values defined in the workflow itself, and github.event_name comparisons. The only other use of event data is the concurrency group key, which is never executed. zizmor, a static analyzer for GitHub Actions that detects template injection, runs on every pull request, on main and weekly, as a required check; workflows run on pull_request (never pull_request_target or workflow_run) with read-only tokens.

Workflows that build or analyse pull request code run on the pull_request event, never pull_request_target or workflow_run: for pull requests from forks, GitHub gives them a read-only token and no secrets. The workflows use no repository secrets at all; the default GITHUB_TOKEN permission is read-only, each job sets least-privilege permissions, and every checkout uses persist-credentials: false. The only job with an OIDC token (Scorecard) runs only on pushes to main, on a schedule and on branch-protection changes. Workflows from all external contributors need approval before they run; only selected actions are allowed, pinned by full commit SHA.

Project URLs use HTTPS exclusively.

Distribution channels use HTTPS exclusively.

Four layers prevent secrets from being committed:

1. .gitignore excludes keys, certificates and environment files (*.pem, *.key, *.p12, *.pfx, *.cer, *.pvk, .spc, .env, .env.); the driver's test-signing certificate is generated at build time and never committed.
2. A pre-commit hook (.pre-commit-config.yaml) runs betterleaks, pinned by commit, on every commit.
3. The CI job "secrets" (security workflow) scans the full git history with betterleaks (checksum-verified download) on every pull request, on main and weekly; it is a required check to merge.
4. GitHub secret scanning and push protection are enabled on the repository.

No release has been made yet. Current documentation covers installing and testing the experimental driver in a virtual machine (docs/test-vm.md); a user guide will accompany the first release.

No release has been made yet. Defects can already be reported through GitHub issues, with a bug-report form, and vulnerabilities privately as described in SECURITY.md.

GitHub supports public discussions on proposed changes (via pull requests) and usage obstacles (via issues).

CONTRIBUTING.md explains the process: discuss in an issue, fork, open a pull request against main, required checks, review, squash merge by the maintainer; it also states the coding rules. https://github.com/Nopitch/hostmic/blob/main/CONTRIBUTING.md

The driver is under the Microsoft Public License (MS-PL); the bindings, tools and host library are under MIT OR Apache-2.0. All three are OSI-approved.

No release has been made yet; released assets will carry the same OSI-approved licenses as the source (MS-PL for the driver, MIT OR Apache-2.0 for the rest).

The license texts are in the LICENSES/ directory at the repository root, named by their SPDX identifiers (REUSE layout): LICENSES/MS-PL.txt for the driver, LICENSES/MIT.txt and LICENSES/Apache-2.0.txt for the other crates; each crate's Cargo.toml declares its SPDX license expression.

No release has been made yet. A release will be a GitHub release of a v* tag; its source archives contain the whole repository, including the LICENSES/ directory, and the release workflow planned in PLAN.md (M7) will attach the license files next to the binary assets.

Repository is publicly available on GitHub.

Repository git metadata is publicly available on GitHub.

The project is a Cargo workspace: each crate's Cargo.toml lists its direct dependencies, with versions centralized in the workspace manifest, and the committed Cargo.lock pins the full dependency tree. CI builds with --locked. Dependabot watches the Cargo and GitHub Actions dependencies weekly.

The project is a single repository, https://github.com/Nopitch/hostmic, a Cargo workspace (driver, driver-core, hostmic-sys, tools/capture-check). No other repository is compiled into a release.

The repository contains no generated executable artifacts: all tracked files are text. Build outputs are ignored (.gitignore: /target/, *.pdb); the driver package and the test-signing certificate are generated by cargo wdk build, locally and in CI. Tools used in the test VM (devcon, DebugView) are fetched separately, as documented in docs/test-vm.md, and never committed.

The repository contains no binary artifacts at all: all tracked files are text (checked with git's binary detection), so every change is reviewable in a pull request diff. Compiled binaries are produced by the build and CI and ignored by .gitignore; WDK tools and libraries come from the Windows Driver Kit and are never committed.

SECURITY.md, at the repository root, gives the security contact: GitHub private vulnerability reporting for this repository (https://github.com/Nopitch/hostmic/security/advisories/new), which reaches the maintainer privately. It explains what to include, the expected acknowledgement time (within a week) and the scope; the issue forms link to it and ask not to report vulnerabilities publicly.