opnDossier

The project maintains the two most recent minor versions (1.2.x, 1.1.x) per the supported versions table in SECURITY.md. Older versions (1.0.x and below) are documented as unsupported with a clear upgrade path to the latest release.

URL: https://github.com/EvilBit-Labs/opnDossier/blob/main/SECURITY.md

The project uses GitHub Issues to allow users to submit and track issue reports.

URL: https://github.com/EvilBit-Labs/opnDossier/issues

No vulnerability reports have been received in the last 12 months. SECURITY.md documents the credit policy: "We will credit you in the security advisory (if you want to be credited)."

URL: https://github.com/EvilBit-Labs/opnDossier/blob/main/SECURITY.md

The project has a documented vulnerability response process in SECURITY.md with defined timelines: acknowledge within 1 week, initial assessment within 2 weeks, fix target within 90 days. Disclosure is coordinated via GitHub Security Advisory. The process includes scope definition and safe harbor provisions.

URL: https://github.com/EvilBit-Labs/opnDossier/blob/main/SECURITY.md

The project identifies specific coding style guides in AGENTS.md (section 5: "Go Development Standards") covering naming conventions, error handling, logging, documentation, import organization, and 10+ common linter patterns with fixes. CONTRIBUTING.md references these standards for all contributions.

URL: https://github.com/EvilBit-Labs/opnDossier/blob/main/AGENTS.md

Coding standards are automatically enforced by golangci-lint v2.8 with 38 active linters in CI. gofumpt enforces formatting stricter than gofmt. goimports enforces import organization. The CI build fails if any linter issue is found. Pre-commit hooks (just check) run the same checks locally.

URL: https://github.com/EvilBit-Labs/opnDossier/blob/main/.golangci.yml

Go does not use C/C++ compiler environment variables (CC, CFLAGS, CXX, CXXFLAGS, LDFLAGS). The Go toolchain manages compilation internally. The build does honor CGO_ENABLED, GOOS, and GOARCH which are the standard Go build variables.

The default development build (go build) preserves full debug information. Only release builds strip debug info via -ldflags="-s -w" in GoReleaser. Developers can always build with debug info using standard go build without flags.

Go's build system does not use recursive make or subdirectory builds. go build ./... resolves all dependencies through the module system in a single pass. There are no cross-directory build dependencies that require ordering.

The project is configured for reproducible builds:

• CGO_ENABLED=0 for static, portable binaries
• -trimpath removes local filesystem paths from binaries
• mod_timestamp: "{{ .CommitTimestamp }}" ensures module timestamps match the commit
• go.sum is committed, pinning all dependency hashes
• GoReleaser uses CommitDate for all date stamps

URL: https://github.com/EvilBit-Labs/opnDossier/blob/main/.goreleaser.yaml

Multiple standard installation methods are provided:

• go install github.com/EvilBit-Labs/opnDossier@latest
• Pre-built binaries for Linux, macOS (Intel/Silicon), Windows, FreeBSD
• Linux packages: deb, rpm, apk, archlinux (via NFPM)
• Homebrew cask (via tap repository)
• Docker: ghcr.io/evilbit-labs/opndossier
• Build from source: just build

Go binaries are statically compiled and do not use DESTDIR or other POSIX installation conventions. Installation is via go install (which uses $GOPATH/bin) or by copying the pre-built binary. Linux packages (deb/rpm/apk) follow FHS conventions via NFPM configuration.

CONTRIBUTING.md provides a complete developer setup guide: prerequisites (Go 1.21+, Just, git, golangci-lint), clone instructions, and verification commands (just check). A new developer can be running tests within minutes. The project also uses mise-en-place to manage development tool versions and includes a devcontainer configuration.

URL: https://github.com/EvilBit-Labs/opnDossier/blob/main/CONTRIBUTING.md

All external dependencies are declared in go.mod and go.sum, which are computer-processable. CycloneDX SBOMs are generated per release in JSON format, listing all transitive dependencies with version and license information.

URL: https://github.com/EvilBit-Labs/opnDossier/blob/main/go.mod

Dependencies are monitored through multiple channels:

• Dependabot: Weekly automated PRs for Go modules, GitHub Actions, Docker, and devcontainers
• Grype: Vulnerability scanning in CI on every push
• Snyk: Additional dependency and code scanning
• CodeQL: Semantic security analysis
• OSSF Scorecard: Supply chain security assessment (weekly)

URL: https://github.com/EvilBit-Labs/opnDossier/blob/main/.github/dependabot.yml

All external components are managed through Go modules with pinned versions in go.mod. Dependabot creates automated PRs for updates. No vendored copies or convenience copies exist; all dependencies are fetched from their canonical sources.

The project uses current, non-deprecated APIs. Go modules ensure the latest compatible versions are used. The golangci-lint configuration includes staticcheck which warns about deprecated stdlib usage. No deprecated API calls exist in the codebase.

GitHub Actions CI runs the full automated test suite on every push to main and on every pull request. The pipeline includes unit tests, integration tests (with -tags=integration), and linting. All must pass before merge.

URL: https://github.com/EvilBit-Labs/opnDossier/blob/main/.github/workflows/ci.yml

Recent bug-fix PRs include regression tests or are covered by existing test suites. Examples from the last 6 months:

• PR #256 (fix: sort map iterations) — added deterministic output tests
• PR #254 (fix: Dest Port column) — added field handling tests
• PR #252 (security overhaul) — added fuzz tests
• PR #167 (fix: replace panic error handling) — added error path tests

The PR template and AGENTS.md mandate tests for all changes. CI enforces test passage.

URL: https://github.com/EvilBit-Labs/opnDossier/pulls?q=is%3Apr+is%3Amerged+fix

Yes, the project meets this criterion. The project uses Go's built-in go test -cover tooling (FLOSS) which measures statement coverage. Current total statement coverage is 81.9%, exceeding the 80% threshold. Coverage is also tracked via Codecov in CI with every PR.

AGENTS.md section 12.1 mandates: "Write comprehensive tests for new functionality." CONTRIBUTING.md requires ">80% coverage" for all PRs. The PR template checklist includes an explicit test requirement. These constitute a formal written policy.

URL: https://github.com/EvilBit-Labs/opnDossier/blob/main/CONTRIBUTING.md

Documented in CONTRIBUTING.md under the Quality Standards section: "Tests required for new functionality (>80% coverage)." The PR template checklist explicitly includes test requirements. AGENTS.md section 7 provides detailed test organization guidance and section 12.1 mandates writing comprehensive tests.

URL: https://github.com/EvilBit-Labs/opnDossier/blob/main/CONTRIBUTING.md

The project uses 38 active linters including strict options. gofumpt (stricter than gofmt) is enforced. gosec checks for security issues. gocritic with performance and diagnostic tags. The project has documented rationale for each disabled linter in .golangci.yml.

URL: https://github.com/EvilBit-Labs/opnDossier/blob/main/.golangci.yml

The project implements secure design principles documented in the security assurance case (docs/security/security-assurance.md):

• Economy of mechanism: Pure Go, minimal dependencies
• Fail-safe defaults: XXE-safe by default, overwrite protection, offline-first
• Complete mediation: All XML elements → typed structs, all CLI args validated by Cobra, all output paths checked
• Open design: Fully open source, no security by obscurity
• Separation of privilege: Parser, schema, audit, export are separate modules
• Least privilege: Reads config files, writes reports, no modifications, no commands, no network
• Least common mechanism: No shared mutable state

URL: https://github.com/EvilBit-Labs/opnDossier/blob/main/docs/security/security-assurance.md

All releases are cryptographically signed with Cosign v3 keyless signatures via Sigstore transparency log. Each release includes:

• SHA256 checksums (opnDossier_checksums.txt)
• Cosign signature bundle (opnDossier_checksums.txt.sigstore.json)
• SLSA Level 3 provenance attestations via actions/attest-build-provenance

The release notes include verification instructions with the exact cosign verify-blob command.

URL: https://github.com/EvilBit-Labs/opnDossier/blob/main/.goreleaser.yaml

Git tag signing is enabled via git config (tag.gpgSign = true), so all future version tags will be GPG-signed automatically. Prior releases (v1.0.0-rc1, v1.1.0) used unsigned annotated tags. Release artifacts are independently signed via Cosign, and tags with associated releases are set to immutable for the repo.

All inputs from potentially untrusted sources are validated:

• CLI arguments validated by Cobra with type checking and allowed values
• XML configuration files parsed into strictly typed Go structs (allowlist approach — unknown elements are ignored, not executed)
• Output file paths checked for overwrite protection
• internal/validator/ provides configuration validation
• internal/config/validation.go validates application configuration
• Security assurance case documents "Complete mediation" principle

URL: https://github.com/EvilBit-Labs/opnDossier/blob/main/internal/validator/

Multiple hardening mechanisms are in place:

• Memory safety: Pure Go with garbage collection, no unsafe package
• XXE protection: Go's encoding/xml does not support external entities or DTD processing
• Bounds checking: Go runtime bounds-checks all array/slice access
• No shell execution: No os/exec calls in application code
• Static compilation: CGO_ENABLED=0 eliminates C library attack surface
• GitHub Actions pinning: All Actions pinned to SHA hashes for supply chain security
• Dependency scanning: Grype, Snyk, CodeQL in CI

The project provides a comprehensive security assurance case in docs/security/security-assurance.md following NIST IR 7608 structure:

• Threat model: Three threat actors (malicious config author, insider with report access, supply chain attacker), seven attack vectors mapped to security requirements
• Trust boundaries: Clearly identified (untrusted input → parser → typed model → report generator → output)
• Secure design principles: Saltzer & Schroeder principles applied and documented for each
• Common vulnerabilities countered: CWE/SANS Top 25 mapped with status and countermeasures; OWASP Top 10 addressed where applicable

URL: https://github.com/EvilBit-Labs/opnDossier/blob/main/docs/security/security-assurance.md

CodeQL specifically targets common vulnerabilities (injection, buffer overflows, insecure data handling). gosec checks for Go-specific security issues. Grype checks dependencies against the National Vulnerability Database for known CVEs.

URL: https://github.com/EvilBit-Labs/opnDossier/blob/main/.github/workflows/ci.yml

The project is pure Go, which is a memory-safe language. Go uses garbage collection and bounds-checked arrays. The project does not use the unsafe package. No memory-unsafe languages are used.