soapbar

SECURITY.md states the supported version line and the upgrade path, versioning follows SemVer under STABILITY.md, and every breaking change carries its migration in the CHANGELOG: https://github.com/hitoshyamamoto/soapbar/blob/main/.github/SECURITY.md

GitHub issue tracker: https://github.com/hitoshyamamoto/soapbar/issues

A documented private disclosure process with response targets, published in the standard location and surfaced through GitHub private vulnerability reporting: https://github.com/hitoshyamamoto/soapbar/blob/main/.github/SECURITY.md

CONTRIBUTING.md names PEP 8 as the style guide, enforced through ruff (pycodestyle E/W and PEP 8 naming N), lists the additional rule sets, and states the one deliberate deviation (100-character lines): https://github.com/hitoshyamamoto/soapbar/blob/main/CONTRIBUTING.md#coding-style

ruff runs on every pull request and push to main and fails the build on any violation, alongside mypy --strict; the configuration lives in [tool.ruff] in pyproject.toml.

soapbar is pure Python with no native binaries; there is no compiler or linker invocation for CC/CFLAGS/LDFLAGS to be passed to.

Pure Python: nothing is compiled or stripped, so there is no debugging information to preserve.

A single PEP 517 build (setuptools via uv build) driven by one pyproject.toml; there is no recursive per-directory build and therefore no cross-directory dependency ordering problem.

soapbar is pure Python: the source code is used directly rather than compiled, and the wheel is an archive of those same source files. No information is generated from source at build time.

Installed and uninstalled with the standard Python conventions: pip install soapbar / pip uninstall soapbar, or uv add soapbar. Optional feature sets are standard extras (soapbar[client], [security], [all]).

Installation is handled by pip/uv, which honour the standard Python conventions for install location — the active virtual environment, --prefix, --target and --user.

git clone followed by uv sync --group dev --group lint --group type installs the library, the test suite and the full check environment in one command, documented at the top of CONTRIBUTING.md: https://github.com/hitoshyamamoto/soapbar/blob/main/CONTRIBUTING.md#development-setup

Dependabot checks the uv dependency graph and the GitHub Actions weekly and opens grouped update pull requests, and the OpenSSF Scorecard Vulnerabilities check tracks known advisories: https://github.com/hitoshyamamoto/soapbar/blob/main/.github/dependabot.yml

All reused components are standard packages resolved from PyPI with version ranges in pyproject.toml; there are no vendored or bundled convenience copies, so a fixed upstream version is picked up by a normal dependency update.

The test suite run with warnings enabled emits no DeprecationWarning or PendingDeprecationWarning; no deprecated standard-library or lxml APIs are used. The one deliberate exception is the opt-in RSA-SHA1 signing profile, reachable only when a caller explicitly requests it because SEFAZ NF-e mandates it, and documented as such in SECURITY.md.

The full suite runs on every pull request and every push to main across Python 3.10-3.14 and reports pass/fail as a required status check: https://github.com/hitoshyamamoto/soapbar/blob/main/.github/workflows/pr.yml

Well above 50%: of the fix commits in the project's history, 43 of 64 (67%) added or changed tests in the same commit, and every security fix shipped with regression tests — the trust-anchor fix, authenticated encryption, the signature-coverage check, timestamp freshness and the local-file import restriction.

Statement coverage is 95.7% (3753 of 3922 statements), measured by coverage.py in CI on every pull request.

CONTRIBUTING.md states as a formal requirement that new functionality must add tests in the same pull request and that bug fixes must add a regression test, and the pull request template carries a matching checklist item: https://github.com/hitoshyamamoto/soapbar/blob/main/CONTRIBUTING.md#tests-are-required

CONTRIBUTING.md requires running the suite with its coverage gate before opening a PR, which operationally requires adding tests for new code: https://github.com/hitoshyamamoto/soapbar/blob/main/CONTRIBUTING.md

mypy runs in --strict mode and ruff enforces an extensive rule set (E,F,W,I,N,UP,B,SIM,S,RUF).

Secure design principles are applied and argued explicitly — fail closed, secure by default with named opt-outs, least authority for the parser, complete mediation before expensive operations, and economy of mechanism by delegating all cryptography: https://hitoshyamamoto.github.io/soapbar/assurance-case/

SHA-1 appears only where the OASIS WSS UsernameToken profile mandates it for interoperability, documented in SECURITY.md; all security-relevant defaults are SHA-256: https://github.com/hitoshyamamoto/soapbar/blob/main/SECURITY.md

Signature, digest and canonicalisation algorithms are selectable per call (RSA-SHA256/RSA-SHA1, SHA-256/SHA-1, exclusive/inclusive C14N) with secure defaults and validation of the requested values; body encryption uses AES-256-GCM with legacy AES-256-CBC selectable on decrypt behind an explicit opt-in.

No credential or key is embedded in the source. Private keys and PKCS#12 bundles are supplied by the caller as file paths or in-memory bytes and are never written to disk or logged; server-side password lookup is an abstract validator hook, so the credential store belongs entirely to the deployer.

All network communication is HTTPS. Request URLs are restricted to an http/https allowlist, TLS is delegated to httpx and the standard library ssl module, and the server warns at construction time when configured with a plain-HTTP service URL.

TLS is provided by the Python ssl module through httpx; its defaults negotiate TLS 1.2 or higher, and soapbar sets no option that would lower this.

TLS certificate verification is on by default (verify_ssl=True). Disabling it is an explicit, named opt-out; custom CA bundles are supported for private or government PKI roots and take precedence over the boolean.

Verification is performed by httpx and the ssl module as part of the TLS handshake, which completes before any HTTP request line, header, cookie or WS-Security credential is transmitted.

Every release is signed with Sigstore keyless provenance over the wheel, sdist and SBOM, attached to the GitHub release as a .sigstore.json bundle, and PyPI carries PEP 740 attestations from the same pipeline. There is no long-lived private key to protect: the signing identity is the release workflow via OIDC. The verification process is documented for users with a runnable gh attestation verify example: https://hitoshyamamoto.github.io/soapbar/security/#verifying-a-release

Untrusted input is validated against allowlists before use: request URLs against an http/https scheme allowlist, request bodies against a size limit and a 100-level nesting-depth check performed before the document tree is built, WSDL imports against a no-fetch-by-default policy with a recursion cap, required operation parameters against the operation signature, and optionally the SOAP Body against the WSDL-embedded XSD.

The XML parser is constructed without entity resolution, DTD loading, network access or huge-tree support; message size and nesting depth are capped; unhandled exceptions are scrubbed before reaching a client; WS-Security verification fails closed without a caller-supplied trust anchor; and body encryption is authenticated. Threats and controls are mapped in the assurance case: https://hitoshyamamoto.github.io/soapbar/assurance-case/

A published assurance case with the threat model (assets, adversaries, attack surface), an explicit trust-boundary diagram, an argument that secure design principles were applied, and an argument that common implementation weaknesses are countered by static analysis, fuzzing, property-based testing and the conformance suite — including a residual-risk section: https://hitoshyamamoto.github.io/soapbar/assurance-case/

The CodeQL security-extended query pack specifically targets common vulnerability classes.

Python is a memory-safe language; the memory-unsafe surface lives in widely-vetted FLOSS dependencies (lxml/libxml2).