presidio-evidence

https://github.com/presidio-v/presidio-evidence/blob/main/SECURITY.md#supported-versions states which lines are supported (0.5.x current; 0.4.x security fixes only while consumers move); https://github.com/presidio-v/presidio-evidence/blob/main/SEMVER.md documents the upgrade path, what counts as a breaking change and the per-schema wire stability rules.

GitHub Issues: https://github.com/presidio-v/presidio-evidence/issues.

https://github.com/presidio-v/presidio-evidence/blob/main/SECURITY.md#reporting-a-vulnerability — reporters are credited in the advisory and the CHANGELOG.md entry for the fix unless they ask not to be. No external report has been received yet.

https://github.com/presidio-v/presidio-evidence/blob/main/SECURITY.md#reporting-a-vulnerability — private GitHub Security Advisory or email intake, acknowledgement within 72 hours, fix target 30 days, fixes to the wire contract coordinated with consumers before disclosure.

https://github.com/presidio-v/presidio-evidence/blob/main/CONTRIBUTING.md#style — ruff (lint and format, configured in pyproject.toml: line length 100, target Python 3.11) and cargo fmt / cargo clippy for the Rust crate.

ruff check, ruff format --check, cargo fmt --check and clippy run in CI on every PR, inside the required checks conformance and conformance-rust.

A pure-Python package built by hatchling; no compiler or linker is invoked. The Rust crate is a non-distributed conformance lane (publish = false) with no build.rs.

No compiled artefacts are distributed; the wheel is pure Python (py3-none-any).

A single PEP 517 build; there is no make or subdirectory build.

The wheel is bit-for-bit reproducible: rebuilding v0.5.0 from the tagged source (git archive v0.5.0, uv build --wheel) on 2026-11-02 gave a wheel whose SHA-256 (81203afc…ddc9a) matches the PyPI file exactly, and two rebuilds matched each other. Release builds use a hash-pinned backend (.github/constraints/release-build.txt, python -m build --no-isolation) and SHA-pinned Actions; the package is pure Python with no runtime dependencies. The sdist was not compared.

pip install presidio-evidence (or pip install 'presidio-evidence[crypto]' for Ed25519) from PyPI.

Installed via pip; DESTDIR-style conventions do not apply.

https://github.com/presidio-v/presidio-evidence/blob/main/CONTRIBUTING.md#local-verification — create a venv, pip install -e ".[dev]", then the ruff and pytest commands; cargo commands for the Rust lane.

https://github.com/presidio-v/presidio-evidence/Listed machine-readably in pyproject.toml (no runtime dependencies; optional crypto = cryptography>=42; dev and fuzz extras) and rust/Cargo.toml; release and CI toolchains are hash-pinned in .github/constraints/*.txt. A CycloneDX SBOM of the installed wheel with its crypto extra is generated, attested and attached to each release by publish.yml.

Dependabot (pip, cargo, GitHub Actions) with security updates enabled; pip-audit on every push and PR (ci.yml); OpenSSF Scorecard weekly.

All reused components are PyPI or crates.io packages installed by the package manager (no vendored copies); Dependabot tracks pip, cargo and GitHub Actions updates.

Dependencies are kept current by Dependabot (pip, cargo, Actions) with security updates enabled; ruff's UP rules flag outdated Python idioms; clippy with -D warnings fails on deprecated Rust APIs.

https://github.com/presidio-v/presidio-evidence/blob/main/.github/workflows/ci.yml runs the full suite on every push and PR (full gate on Python 3.11, tests on 3.12 and 3.13), including tests/test_envelope_end_to_end.py, the consumer vectors (one per conforming family repository, tests/test_consumer_vectors.py) and the vector byte-stability check; ci-rust.yml runs the Rust conformance suite over the same vectors.

Policy requires a regression test with every bug fix. In the last 6 months the product-code defect fixes were the four audit findings fixed in PR #2 (https://github.com/presidio-v/presidio-evidence/pull/2), and all four carry regression tests (tests/test_audit_2026_10_25.py) or vectors (vectors/trust-store/). The only other fix in that period concerned CI configuration (the SBOM command flag).

CI gate: 100% statement coverage ([tool.coverage.report] fail_under = 100 in pyproject.toml, applied by pytest --cov=presidio_evidence in .github/workflows/ci.yml).

Formal written policy at https://github.com/presidio-v/presidio-evidence/blob/main/CONTRIBUTING.md#tests: functionality changes ship with tests; bug fixes include a regression test; wire-format changes add vectors. Enforced in review and by the 100% statement-coverage gate.

https://github.com/presidio-v/presidio-evidence/blob/main/CONTRIBUTING.md#tests states the policy that changes adding/modifying functionality ship with tests in the same PR.

ruff with E, F, I, B, UP and S (flake8-bandit), only S101 excused in tests/ and fuzz/; clippy --all-targets -- -D warnings on the Rust crate. CI fails on any finding.

Fail-safe defaults: every verification path returns False or raises EvidenceError; none returns True by default, and optimistic/zk tiers fail closed. Complete mediation: verify_envelope parses the whole envelope before verifying any ref and applies every check to every ref; the CLI uses the same function. Least privilege: no keys held, no state, no network, no logging. Defence in depth: signer binding, @3 subject binding, the @1/@2 reuse floor, the tier check and key-type separation are independent. Economy of mechanism: Ed25519 from cryptography, SHA-256/HMAC from the stdlib, no bespoke crypto. See https://github.com/presidio-v/presidio-evidence/blob/main/ASSURANCE.md#3-secure-design-principles-applied.

Security functions use SHA-256, Ed25519 and HMAC-SHA256 only; no MD5, SHA-1 or DES.

The signature algorithm is a per-signer trust-store field (alg: ed25519 or hmac-sha256, trust-store@1), so an operator moves a signer to another algorithm by configuration, and a new algorithm is an additive schema change. The content-hash function (SHA-256) is fixed by the wire format; replacing it would be a new schema major with new vectors (SEMVER.md#schemawire-stability), not a runtime switch.

No key is in the source tree (the published test fixtures in vectors/ are documented as such). Private keys are supplied at run time from a 0600 file or an environment variable (load_private_key(path) / env=); trust stores are operator-supplied JSON, and each signer may list several keys, so keys rotate by appending to the list without a new release.

The project makes no network calls.

No network communication.

No TLS client.

No network communication.

Wheel, sdist and CycloneDX SBOM carry GitHub build-provenance attestations (gh attestation verify <file> --repo presidio-v/presidio-evidence), PyPI files carry PEP 740 attestations from Trusted Publishing, and release tags are SSH-signed with the public key in https://github.com/presidio-v/presidio-evidence/blob/main/allowed_signers. Documented at https://github.com/presidio-v/presidio-evidence/blob/main/SECURITY.md#verifying-releases-and-obtaining-public-signing-keys. Checked for v0.5.0 and v0.5.1 on 2026-11-02 (wheel, sdist and SBOM attestations and the tag signatures all verify).

Every release tag (v0.2.0 through v0.5.1) is SSH-signed with the organisation release key and shown as Verified on GitHub; git -c gpg.ssh.allowedSignersFile=allowed_signers verify-tag <tag> checks it locally.

Envelopes are untrusted: parse_document (src/presidio_evidence/_refs.py) checks a known schema id, each field as a bounded string (≤ 512 chars, no NUL, valid UTF-8), lowercase-hex hashes and signatures, no control characters in item_id/signer, and the framework pattern under @3, and raises EvidenceError before anything is verified. Trust-store entries are normalised and public_key under hmac-sha256 is rejected; key files are size-bounded. See ARCHITECTURE.md#trust-boundaries.

load_private_key accepts only regular 0600/0400 files checked with fstat on the opened descriptor, reads at most 256 bytes and never echoes key material; write_private_key creates 0600 with O_EXCL; HMAC comparison is constant-time; CLI output is JSON-escaped; the Rust crate forbids unsafe. Supply chain: SHA-pinned GitHub Actions with least-privilege permissions:, hash-pinned release toolchains, Trusted Publishing behind a reviewer-gated environment, secret scanning with push protection.

URL: https://github.com/presidio-v/presidio-evidence/blob/main/ASSURANCE.md. Threat model with out-of-scope assumptions and known limitations, five trust boundaries matching ARCHITECTURE.md#trust-boundaries, the secure-design-principles argument and the common-weakness argument. It states that the pre-publication audit was run by the maintainer and is not an independent review.

CodeQL for Python (https://github.com/presidio-v/presidio-evidence/blob/main/.github/workflows/codeql.yml) on every push/PR and weekly, and ruff's S (flake8-bandit) security rules as a required CI step; OpenSSF Scorecard (scorecard.yml) weekly and on every push to main for supply-chain posture.

Python is memory-safe and the Rust crate is safe Rust (#![forbid(unsafe_code)]). The Atheris harness (fuzz/fuzz_envelope.py, fuzz.yml) runs regardless, seeded from vectors/; its 60 s PR run on 2026-11-02 executed 583,156 inputs with no failure in the library.