r9cam

Each release lists upgrade steps first in the CHANGELOG, and INSTALL.md has an "Upgrading From 0.6" section for the rename. URL: https://github.com/CMLPlatform/r9cam/blob/main/INSTALL.md#upgrading-from-06

GitHub issues. URL: https://github.com/CMLPlatform/r9cam/issues

No vulnerability reports were resolved in the last 12 months. SECURITY.md promises credit unless the reporter asks not to be named. URL: https://github.com/CMLPlatform/r9cam/blob/main/SECURITY.md#fixes-and-disclosure

SECURITY.md says how reports are acknowledged (5 business days), reproduced, fixed in a release and disclosed as an advisory with a CVE where one applies. URL: https://github.com/CMLPlatform/r9cam/blob/main/SECURITY.md

The style is PEP 8 as ruff's formatter and linter apply it (all rules on, line length 120), with type hints checked by ty; CONTRIBUTING.md requires just check to pass. URL: https://github.com/CMLPlatform/r9cam/blob/main/CONTRIBUTING.md#code-quality

ruff check, ruff format and ty run as prek hooks and in CI, and mdformat formats the Markdown. URL: https://github.com/CMLPlatform/r9cam/blob/main/.pre-commit-config.yaml

No native binaries are built; r9cam is pure Python. URL: https://github.com/CMLPlatform/r9cam/blob/main/pyproject.toml

No native binaries; Python wheels carry their source. URL: https://github.com/CMLPlatform/r9cam/blob/main/pyproject.toml

One uv build per package (the plugin, and r9cam_models on its own); no recursive builds. URL: https://github.com/CMLPlatform/r9cam/blob/main/justfile

uv build gives bit-for-bit identical wheel and sdist when run twice (checked on 0.6.2: same SHA-256), and dependencies are pinned in uv.lock. URL: https://github.com/CMLPlatform/r9cam/blob/main/uv.lock

Install is docker compose up -d and removal is docker compose down, as INSTALL.md describes; a direct uv run is also documented. URL: https://github.com/CMLPlatform/r9cam/blob/main/INSTALL.md

r9cam installs as a Compose project or a uv environment, not into system paths, so DESTDIR-style conventions do not apply. URL: https://github.com/CMLPlatform/r9cam/blob/main/INSTALL.md

./scripts/local_setup.sh --dev (or just install, which runs uv sync --all-groups) installs everything needed to change and test the code. URL: https://github.com/CMLPlatform/r9cam/blob/main/CONTRIBUTING.md#local-development

Dependencies are declared in pyproject.toml and locked with hashes in uv.lock; image pins are in the Dockerfile and compose.yml. URL: https://github.com/CMLPlatform/r9cam/blob/main/pyproject.toml

uv audit runs on every pull request and weekly, Trivy scans the image, and Renovate opens update pull requests. URL: https://github.com/CMLPlatform/r9cam/blob/main/.github/workflows/security.yml

No vendored code: every component is a pinned PyPI package or image digest that Renovate updates. URL: https://github.com/CMLPlatform/r9cam/blob/main/.github/renovate.json

ruff's pyupgrade and deprecation rules are on, the code targets Python 3.13, and Renovate keeps libraries current. URL: https://github.com/CMLPlatform/r9cam/blob/main/pyproject.toml

CI runs lint, type checks and the full suite on every pull request to main and reports pass or fail on it. URL: https://github.com/CMLPlatform/r9cam/blob/main/.github/workflows/ci.yml

Four of the five code bug fixes merged in the last six months added tests (#31, #46, #61, #24); the fifth fixed an install script (#68). URL: https://github.com/CMLPlatform/r9cam/pulls?q=is%3Apr+is%3Amerged+fix

95% statement coverage, and CI fails below 80% (fail_under = 80). URL: https://codecov.io/gh/CMLPlatform/r9cam

CONTRIBUTING.md's PR checklist requires tests for behaviour changes. URL: https://github.com/CMLPlatform/r9cam/blob/main/CONTRIBUTING.md#pr-checklist

Same checklist, in the instructions for pull requests. URL: https://github.com/CMLPlatform/r9cam/blob/main/CONTRIBUTING.md#pr-checklist

All ruff rules are on, and CI fails on any finding. URL: https://github.com/CMLPlatform/r9cam/blob/main/pyproject.toml

(assurance case merged in r9cam#89) The assurance case shows how the design applies fail-safe defaults, least privilege, complete mediation, economy of mechanism and open design. URL: https://github.com/CMLPlatform/r9cam/blob/main/ARCHITECTURE.md#assurance-case

No SHA-1 or weak modes: ES256 tokens and TLS 1.2 or later. URL: https://github.com/CMLPlatform/r9cam/blob/main/app/relay/device_jwt.py

The device key, key ID and local API keys live in their own file (~/.config/r9cam/relay_credentials.json, mode 0600), apart from config and logs; unpairing deletes it and pairing writes a new one. S3 keys come from environment variables, which can be kept in a separate env file. URL: https://github.com/CMLPlatform/r9cam/blob/main/ARCHITECTURE.md#cryptography

Every outbound connection uses TLS (wss:// and HTTPS are required outside development), and the local REST API serves HTTPS when the operator sets TLS_CERT_FILE and TLS_KEY_FILE; without them startup warns that the LAN traffic is unencrypted. URL: https://github.com/CMLPlatform/r9cam/blob/main/INSTALL.md#serve-the-local-api-over-https

Outbound TLS uses Python 3.13's default context, which requires TLS 1.2 or later. URL: https://github.com/CMLPlatform/r9cam/blob/main/pyproject.toml

httpx and websockets verify certificates by default, and the code never turns that off. URL: https://github.com/CMLPlatform/r9cam/blob/main/app/backend/client.py

The device token goes in the WebSocket upgrade request, which is sent only after the TLS handshake has verified the server's certificate. URL: https://github.com/CMLPlatform/r9cam/blob/main/app/relay/service.py

v0.7.0 and v0.7.1 carry attested assets, the 0.7.1 image is attested, and INSTALL.md explains gh attestation verify Release assets (wheel, sdist, CycloneDX SBOM) get Sigstore-signed build provenance and SBOM attestations from the release workflow; the signing key is GitHub's OIDC identity, not on the download site. r9cam-models on PyPI already carries PEP 740 attestations from trusted publishing. URL: https://github.com/CMLPlatform/r9cam/blob/main/.github/workflows/release.yml

Release tags are signed: just release-publish creates a signed annotated tag with the maintainer's SSH key and pushes it before drafting the release, and the release assets are attested as well. URL: https://github.com/CMLPlatform/r9cam/tags

Every input passes a pydantic schema with bounds (camera controls, upload metadata, stream keys, relay envelopes), and relay commands must match an allowlist of method and path. URL: https://github.com/CMLPlatform/r9cam/blob/main/r9cam_models/src/r9cam_models/device_seam.py

Containers run as a non-root user, read-only, with all capabilities dropped and no-new-privileges; responses carry a strict Content-Security-Policy, nosniff and no-store; production disables the API docs and TRACE. URL: https://github.com/CMLPlatform/r9cam/blob/main/compose.yml

https://github.com/CMLPlatform/r9cam/blob/main/ARCHITECTURE.md#assurance-case (r9cam#89) ARCHITECTURE.md's "Assurance Case" states the threat model, the six trust boundaries and their controls, the secure design principles applied, and how common weaknesses are countered, each pointing at the code. URL: https://github.com/CMLPlatform/r9cam/blob/main/ARCHITECTURE.md#assurance-case

CodeQL default setup and ruff's S rules. URL: https://github.com/CMLPlatform/r9cam/security/code-scanning

Python only. URL: https://github.com/CMLPlatform/r9cam