WOPR

Only the latest release is supported, and upgrading is replacing the program with the new one: the packages and the Windows installer upgrade in place, and the Go install, archives and Mac app are one file or bundle to replace. There is no data or configuration to migrate. https://ghostofgoes.github.io/WOPR/install/

GitHub Issues: https://github.com/GhostofGoes/WOPR/issues

No vulnerability reports from other people have been resolved in the last 12 months. SECURITY.md commits to crediting reporters who want credit.

SECURITY.md describes how reports are handled: acknowledgement within 14 days, assessment, a private fix, a patch release, a GitHub Security Advisory, and credit for the reporter. https://github.com/GhostofGoes/WOPR/blob/main/SECURITY.md#how-reports-are-handled

Go code follows Effective Go and the Go Code Review Comments (https://go.dev/wiki/CodeReviewComments), formatted with gofmt, goimports and gofumpt; the project's own rules are in AGENTS.md. CONTRIBUTING.md requires contributions to follow them. https://github.com/GhostofGoes/WOPR/blob/main/CONTRIBUTING.md#making-a-change

golangci-lint (with gofmt, goimports, gofumpt, revive, gocritic and the project's custom rules) runs in the pre-commit hook and in CI, and a pull request cannot merge with a finding. https://github.com/GhostofGoes/WOPR/blob/main/.golangci.yml

wopr is pure Go built with CGO_ENABLED=0, so no C compiler or linker is invoked and CC, CFLAGS and LDFLAGS do not apply. The Go build honours the Go toolchain's own variables (GOFLAGS, GOOS, GOARCH).

go build and go install keep debug information unless asked otherwise. Only the release configuration strips symbols (-s -w) to keep the downloads small, and it adds no strip step of its own to anyone else's build.

The Go toolchain builds from the package import graph; there is no recursive make.

Release builds are reproducible: release.yml builds every file twice, on two architectures, and fails if any checksum differs (the repro job). The build uses -trimpath and dates every file from the tagged commit. https://github.com/GhostofGoes/WOPR/blob/main/.github/workflows/release.yml

Install and uninstall use each system's usual way: .deb and .rpm packages (apt, dnf, zypper), a per-user Windows installer with an uninstaller in Settings, a Mac app in a .dmg, and go install. The install page gives the uninstall steps for each. https://ghostofgoes.github.io/WOPR/install/

The packages install through the system's package manager, which sets the locations, and go install honours GOBIN and GOPATH. The command-line installer for macOS and Linux installs to ~/.local/bin (the XDG convention) without root.

git clone, then go test ./... and go run ./cmd/wopr. Go fetches the pinned toolchain and every tool on first use; the linters and other tools are pinned Go tools run with go tool. https://github.com/GhostofGoes/WOPR/blob/main/CONTRIBUTING.md#set-up

Go modules: go.mod and go.sum, plus the tool modules in tools/ and the docs theme in site/go.mod. The two vendored JavaScript files for the docs site are listed with versions and hashes in site/hugo.yaml. https://github.com/GhostofGoes/WOPR/blob/main/go.mod

govulncheck runs on every CI push, in the pre-push hook, and in the weekly scheduled.yml report, which also lists available updates. SECURITY.md's response rule requires a patch release within 14 days for a reachable finding. https://github.com/GhostofGoes/WOPR/blob/main/.github/workflows/scheduled.yml

Every dependency is a Go module, updated with go get; there are no copied-in libraries in the program. The docs site's two vendored scripts are unmodified npm releases, and AGENTS.md's milestone checklist gives the steps to update them. https://github.com/GhostofGoes/WOPR/blob/main/AGENTS.md#milestone-checklist

golangci-lint's staticcheck reports deprecated Go APIs (SA1019) and CI fails on any finding; Hugo builds with --panicOnWarning, which fails on deprecated settings.

CI runs the full test suite on every push to every branch and on pull requests from forks, on Linux, macOS and Windows; GitHub shows the pass or fail report on each commit and pull request. https://github.com/GhostofGoes/WOPR/actions

Bug fixes come with regression tests; for example, the chess move-parsing panic, the typed-count overflow and the debug-log symlink fixes from the October 2026 security review each added a test.

Statement coverage is 87.8% over all packages, and 94.7% over the packages that ship in the program (go test -coverprofile, measured 2026-10-11).

CONTRIBUTING.md: "New functionality MUST come with automated tests, and a bug fix MUST come with a regression test." https://github.com/GhostofGoes/WOPR/blob/main/CONTRIBUTING.md#making-a-change

https://github.com/GhostofGoes/WOPR/blob/main/CONTRIBUTING.md#making-a-change and https://github.com/GhostofGoes/WOPR/blob/main/AGENTS.md#adding-a-game

Beyond the defaults, the config enables revive and gocritic, custom forbidigo and depguard rules for the project's architecture, and reports unused exclusions; a self-test checks that every custom rule still fires.

wopr applies secure design principles: least privilege (no network code, no exec, only its own debug log written, created 0600 without following symlinks), economy of mechanism (one static binary), fail-safe defaults (environment variables allow-listed, invalid values rejected), input sanitisation (escape sequences and control characters stripped), and a least-privilege, SHA-pinned CI with reproducible, attested, signed releases.

wopr has no security mechanisms and does not use cryptography: it has no network code, no accounts and stores no passwords. (It reads crypto/rand only to pick a random game seed, which is not a security use.)

wopr has no network communication, no TLS, no security mechanisms and no credentials or keys; it does not use cryptography.

wopr has no network communication, no TLS, no security mechanisms and no credentials or keys; it does not use cryptography.

wopr has no network communication, no TLS, no security mechanisms and no credentials or keys; it does not use cryptography.

wopr has no network communication, no TLS, no security mechanisms and no credentials or keys; it does not use cryptography.

wopr has no network communication, no TLS, no security mechanisms and no credentials or keys; it does not use cryptography.

wopr has no network communication, no TLS, no security mechanisms and no credentials or keys; it does not use cryptography.

Every release file is covered by checksums.txt, which is signed with the project's OpenPGP key (checksums.txt.asc); each .rpm carries a signature and each .deb has a detached .asc. Every file also has a Sigstore build-provenance attestation. SECURITY.md and the install page explain how to get the public key (committed in the repository and published on the docs site) and verify signatures. The private key is not stored with the release files: it is a secret available only to the signing job, in a GitHub environment limited to release tags, with an offline backup. https://github.com/GhostofGoes/WOPR/blob/main/SECURITY.md#how-releases-are-protected

The project also supports GitHub Attestations, and provides documentation on the Install page for how users can verify builds.

Release tags are signed by the maintainer (git tag -s) and show as Verified on GitHub. https://github.com/GhostofGoes/WOPR/tags

All untrusted input is checked against allowlists: command-line flags and environment variables are parsed strictly (WOPR_THEME from a fixed list, WOPR_SEED as a number, booleans from a fixed set), typed and pasted text has escape sequences and control characters stripped, and each game accepts only its own commands, with numbers capped. Fuzz tests cover the parsers.

hardening: Met

URL: https://github.com/GhostofGoes/WOPR/blob/main/docs/ASSURANCE.md

wopr is written in Go, which is memory safe: bounds checks on every slice and string, no pointer arithmetic, and garbage collection. Input passes through sanitizers that remove escape sequences and control characters. A watchdog restores the terminal and exits if the UI hangs. The debug log uses O_NOFOLLOW, owner checks and 0600 permissions. The binary is static, with no cgo. gosec, go vet and staticcheck run in CI and fail the build on any finding.

docs/ASSURANCE.md is the assurance case: the threat model, the trust boundaries, how secure design principles are applied, and how common weaknesses (terminal escape injection, crashes and resource exhaustion from input, symlink attacks, supply-chain attacks) are countered, with the tests and checks that show each. https://github.com/GhostofGoes/WOPR/blob/main/docs/ASSURANCE.md

govulncheck checks the code and its dependencies against the Go vulnerability database, staticcheck and go vet catch common Go bug patterns, zizmor checks the workflows for known CI vulnerabilities, and gitleaks looks for leaked secrets.

wopr is written in Go, a memory-safe language, with no cgo.