OpenCloudMesh Go

No GitHub Releases or supported version lines exist yet, so there are no older versions to maintain or upgrade paths to document.

Public issue tracker via GitHub Issues. https://github.com/MahdiBaghbani/opencloudmesh-go/issues

No vulnerability reports have been resolved in the last 12 months, so there are no reporters to credit.

SECURITY.md documents the process for responding to vulnerability reports, including acknowledgement on a best-effort basis and the absence of a hard triage SLA. https://github.com/MahdiBaghbani/opencloudmesh-go/blob/master/SECURITY.md

Coding style guides for Go are identified in docs/lint-policy.md and docs/naming-conventions.md, and contributions must comply. https://github.com/MahdiBaghbani/opencloudmesh-go/blob/master/docs/lint-policy.md

The Go coding style is automatically enforced by golangci-lint as a required CI gate. https://github.com/MahdiBaghbani/opencloudmesh-go/blob/master/.github/workflows/ci-lint-golangci.yml

The software is pure Go with no C/C++ or cgo, so C/C++ compiler and linker variables (CC, CFLAGS, CXX, CXXFLAGS, LDFLAGS) do not apply; Go honors its own GOFLAGS, GOOS, GOARCH, CGO_ENABLED variables.

Pure Go build with no native C/C++ installation step that strips debugging information; Go debug info handling is controlled by -ldflags and -gcflags, not by install -s.

The Go build system (go build / goreleaser) does not use recursive subdirectory Makefile builds with cross-dependencies, so the recursive-build prohibition does not apply.

Release binaries and archives build reproducibly. goreleaser pins mod timestamps to the commit date and archive mtimes via info.mtime; builds use -trimpath, -s -w, and CGO_ENABLED=0 with the Go toolchain pinned by go.mod. The make reproduce target builds twice and asserts bit-for-bit-identical SHA-256. See https://github.com/MahdiBaghbani/opencloudmesh-go/blob/master/docs/reproducible-builds.md

The software is easily installed and run via Docker (docker run) and built via make build / go build. https://github.com/MahdiBaghbani/opencloudmesh-go/blob/master/docs/docker.md

There is no native C/C++ installation step honoring DESTDIR/PREFIX; deployment is via Docker image and a single Go binary, so standard install-location variables do not apply.

Potential developers can quickly install all results and the support environment via docs/development.md and make targets. https://github.com/MahdiBaghbani/opencloudmesh-go/blob/master/docs/development.md

External dependencies are listed in a computer-processable way in go.mod (and the module graph). https://github.com/MahdiBaghbani/opencloudmesh-go/blob/master/go.mod

Dependencies are monitored by Dependabot for known vulnerabilities, with auto-merge policy. https://github.com/MahdiBaghbani/opencloudmesh-go/blob/master/.github/dependabot.yml

Externally-maintained components are identified via go.mod and updated through Dependabot, using standard Go modules rather than vendored convenience copies. https://github.com/MahdiBaghbani/opencloudmesh-go/blob/master/go.mod

The project uses current, non-deprecated Go standard library APIs and avoids obsolete functions where FLOSS alternatives exist. https://github.com/MahdiBaghbani/opencloudmesh-go/blob/master/go.mod

Automated integration tests run on each check-in to shared branches via CI and produce reports. https://github.com/MahdiBaghbani/opencloudmesh-go/blob/master/.github/workflows/ci-test-unit-integration.yml

No bugs have been fixed in the last six months that would require regression tests, so the 50% threshold is not applicable.

Unit-test statement coverage is enforced at an 80 percent floor via the make coverage-check target, which runs in CI after the unit and integration suite and fails the build below the threshold. See https://github.com/MahdiBaghbani/opencloudmesh-go/blob/master/docs/testing.md

The project has a formal written test policy in docs/testing.md mandating that tests MUST be added for new functionality and that bug fixes add regression tests. https://github.com/MahdiBaghbani/opencloudmesh-go/blob/master/docs/testing.md

The test-addition policy is documented in the testing guide and contribution instructions. https://github.com/MahdiBaghbani/opencloudmesh-go/blob/master/docs/testing.md

The project is maximally strict: golangci-lint runs as a required CI gate with many enabled linters. https://github.com/MahdiBaghbani/opencloudmesh-go/blob/master/.github/workflows/ci-lint-golangci.yml

Secure design principles are implemented: TLS/mTLS by default, argon2id password hashing, SSRF allowlist guards, and input validation. https://github.com/MahdiBaghbani/opencloudmesh-go/blob/master/docs/outbound-http-ssrf.md

Default mechanisms avoid cryptographic algorithms with known weaknesses. https://github.com/MahdiBaghbani/opencloudmesh-go/blob/master/internal/platform/http/tls/tls.go

HTTP message-signature algorithms are configurable per deployment and not hard-coded to a single algorithm; TLS minimum version and cipher suites are enforced and updatable, and credential and key storage is swappable. The update process is documented. See https://github.com/MahdiBaghbani/opencloudmesh-go/blob/master/docs/crypto-agility.md

Authentication credentials and keys are stored in configuration files separate from code, so they can be replaced without changing the software. https://github.com/MahdiBaghbani/opencloudmesh-go/blob/master/docs/configuration.md

Network communications use secure protocols (TLS 1.2+ / HTTPS) by default. https://github.com/MahdiBaghbani/opencloudmesh-go/blob/master/internal/platform/http/tls/tls.go

TLS support uses TLS 1.2 or later via the Go crypto/tls stdlib defaults. https://github.com/MahdiBaghbani/opencloudmesh-go/blob/master/internal/platform/http/tls/tls.go

TLS certificate verification is performed by default when using TLS, via Go crypto/tls defaults. https://github.com/MahdiBaghbani/opencloudmesh-go/blob/master/internal/platform/http/tls/tls.go

TLS certificate verification is performed before sending HTTP headers with private information, per Go crypto/tls default behavior. https://github.com/MahdiBaghbani/opencloudmesh-go/blob/master/internal/platform/http/tls/tls.go

Release archives and checksums are cryptographically signed with cosign keyless (Sigstore) during the goreleaser release workflow; signatures are published as .sigstore.json bundles attached to GitHub Releases. Verification is documented. See https://github.com/MahdiBaghbani/opencloudmesh-go/blob/master/docs/verification.md

Release tags are cryptographically signed with gitsign keyless (Sigstore X.509) in the release workflow using git tag -s; tags are verifiable with git tag -v and gitsign verify-tags. See https://github.com/MahdiBaghbani/opencloudmesh-go/blob/master/docs/verification.md

Inputs from untrusted sources are validated with an allowlist and invalid inputs are rejected, e.g. resolve_inputs and validate_inputs. https://github.com/MahdiBaghbani/opencloudmesh-go/blob/master/internal/wiring/resolve_inputs.go

Hardening mechanisms are used: SSRF allowlist guards, strict TLS, and defense-in-depth in the OCM protocol handling. https://github.com/MahdiBaghbani/opencloudmesh-go/blob/master/docs/outbound-http-ssrf.md

An assurance case justifying why the security requirements are met (claims and evidence) is documented in docs/assurance-case.md. https://github.com/MahdiBaghbani/opencloudmesh-go/blob/master/docs/assurance-case.md

gosec and CodeQL detect common vulnerability types. https://github.com/MahdiBaghbani/opencloudmesh-go/blob/master/.github/workflows/ci-security-gosec.yml

Go is memory-safe; no memory-unsafe language code is included, so this criterion is not applicable. https://github.com/MahdiBaghbani/opencloudmesh-go/blob/master/docs/testing.md