cronstable

SECURITY.md: there is one release line, only the latest release is supported, and security fixes ship as new releases. Upgrades are drop-in, HISTORY.md documents every change, the state store has a migrate-schema command, and advisories name the first fixed version and link the fix so users can backport it. https://github.com/ptweezy/cronstable/blob/main/SECURITY.md

GitHub Issues tracks individual issues. https://github.com/ptweezy/cronstable/issues

No vulnerability reports have been received or resolved in the last 12 months (cronstable's first release was 2026-06-19). SECURITY.md commits to crediting reporters in the advisory. https://github.com/ptweezy/cronstable/blob/main/SECURITY.md

SECURITY.md documents the response process: a private report through a GitHub advisory, an acknowledgment, a scope and severity assessment, a fix in a new release, and a published GitHub Security Advisory (with a CVE where warranted) that credits the reporter. https://github.com/ptweezy/cronstable/blob/main/SECURITY.md#what-to-expect

Python code follows PEP 8 as enforced by ruff (pycodestyle, pyflakes, bugbear, and complexity rules) and is formatted with ruff format. Documentation follows the Google developer documentation style guide. https://github.com/ptweezy/cronstable/blob/main/pyproject.toml https://github.com/ptweezy/cronstable/blob/main/CONTRIBUTING.md#documentation

The CI tox-static job runs ruff check, ruff format --check, mypy, and actionlint on every push and pull request, and a failure blocks the merge. https://github.com/ptweezy/cronstable/blob/main/tox.ini

cronstable is pure Python and compiles no native code of its own, so compiler and linker variables do not apply.

cronstable is pure Python and compiles no native code of its own, so there are no debugging symbols to preserve.

The build is not recursive: it uses PEP 517 (setuptools) and tox. The only Makefile (pyinstaller/Makefile) is a single-level wrapper around a Docker build.

cronstable is a pure-Python package: the wheel and sdist contain the source, which runs directly with no compilation step. (The PyInstaller convenience binaries are not yet verified to be bit-for-bit reproducible.)

Install and uninstall with standard tools: pip install and pip uninstall, Homebrew, WinGet, Scoop, .deb, .rpm, and .apk packages, the Windows MSI, and Docker images. https://github.com/ptweezy/cronstable/wiki/Installation

pip honors the standard install-location options (--prefix, --root, --target, --user, and virtual environments), and the Linux packages install to FHS paths.

CONTRIBUTING.md sets up a full development environment in a few commands: clone, uv venv, uv pip install -e ".[dev]", then tox. https://github.com/ptweezy/cronstable/blob/main/CONTRIBUTING.md#development-setup

Runtime and optional dependencies are declared in pyproject.toml (dependencies and extras), with generated pinned lists under requirements/. https://github.com/ptweezy/cronstable/blob/main/pyproject.toml

Dependabot checks pip, GitHub Actions, Docker, and Nix dependencies daily, with security updates enabled. Trivy scans the container images, a license check gates dependencies, and OpenSSF Scorecard also runs. https://github.com/ptweezy/cronstable/blob/main/.github/dependabot.yml

Reused components are ordinary pip dependencies declared in pyproject.toml, not vendored copies, so updating one means changing a version and regenerating the derived files. Dependabot proposes updates. Base images and GitHub Actions are pinned by digest and updated by Dependabot.

pytest treats DeprecationWarning, like every warning, as an error, so a call to a deprecated API fails the tests. ruff's pyupgrade rules flag obsolete typing APIs, and the suite runs on Python 3.10 through 3.15.

GitHub Actions runs the full suite (unit, integration, live etcd and Kubernetes, cgroup, browser, and binary acceptance tests) on every push to any branch and on every pull request, and reports pass or fail. https://github.com/ptweezy/cronstable/actions

In the last six months, about 60% of fix commits (106 of 172, counting documentation-only fixes) changed tests. CONTRIBUTING.md requires a test that fails without the fix for every bug fix.

Statement and branch coverage is about 96%, and tox fails any run below 95% (POSIX) or 94% (Windows). https://codecov.io/gh/ptweezy/cronstable

CONTRIBUTING.md is the written policy: new or changed behavior needs tests, a bug fix needs a test that fails without the fix, and the coverage floor enforces it. https://github.com/ptweezy/cronstable/blob/main/CONTRIBUTING.md#tests

The test policy is documented in CONTRIBUTING.md under "Making a change > Tests". https://github.com/ptweezy/cronstable/blob/main/CONTRIBUTING.md#tests

Warnings are as strict as practical: pytest turns every warning into an error, mypy runs with strict_optional, warn_return_any, and warn_no_return, and ruff enables the bugbear and blind-except checks.

The design applies least privilege (a dedicated non-root user in the systemd unit and container image, and read-only CI tokens by default), keeps network features opt-in (the web API, MCP, and clustering are off unless configured), checks every request against scoped bearer tokens in constant time, fails safe (for example, etcd credentials are refused over plaintext endpoints), and keeps mechanisms small (the state store uses only the standard library).

cronstable does not depend on known-weak algorithms such as SHA-1. Security-relevant hashing uses SHA-256 or BLAKE2b, and TLS uses ssl.create_default_context.

Push encryption supports two suites, the X-Wing hybrid post-quantum KEM and the X25519 sealed box, chosen per device pairing. TLS negotiates algorithms through OpenSSL, so users can switch algorithms without code changes.

TLS certificates, keys, and CAs are separate files referenced by path, and they rotate without a restart. API tokens and other secrets can come from environment variables instead of the config file, and replacing a token takes only a config reload. https://github.com/ptweezy/cronstable/wiki/Listener-TLS https://github.com/ptweezy/cronstable/wiki/Environment-Variable-Interpolation

Every network interface supports TLS 1.2 or later: the HTTP API and dashboard, MCP, cluster peers (mutual TLS), etcd and Kubernetes, SMTP with STARTTLS, and HTTPS webhooks. Nothing listens by default. Plaintext HTTP is used only when the user configures an http:// listener, etcd credentials are refused over plaintext, and statsd metrics are opt-in plain UDP by that protocol's design.

TLS contexts come from ssl.create_default_context on Python 3.10 or later, which requires TLS 1.2 or later.

Client TLS connections verify certificates and hostnames by default (ssl.create_default_context with CERT_REQUIRED). Only the explicit --insecure CLI flag turns verification off.

Certificates are verified during the TLS handshake, before any HTTP request, bearer token, or secret is sent.

Configuration is validated against a strict schema (strictyaml) before use. HTTP API and MCP inputs are parsed and checked for allowed fields, types, and existing job names before cronstable acts on them, and invalid input is rejected.

The dashboard sends Content-Security-Policy, X-Frame-Options: DENY, X-Content-Type-Options: nosniff, and Referrer-Policy: no-referrer. The container runs as an unprivileged user (65534), the systemd unit runs as a dedicated cronstable user, macOS binaries use the hardened runtime, and CI rejects binaries with an executable stack.

bandit (security lint at medium severity and above) and CodeQL's security queries look for common Python vulnerabilities.

cronstable is written in Python, a memory-safe language, and has no C or C++ code of its own.