skipper

We provide everything required in release notes https://github.com/zalando/skipper/releases

https://github.com/zalando/skipper/issues

no vulnerabilities reported

Report via E-Mail to security team https://github.com/zalando/skipper/blob/master/SECURITY.md

https://github.com/zalando/skipper/blob/master/CONTRIBUTING.md#code-style

It is documented that gofmt is used and it is enforced via CI pipeline which is required to run and return with exit 0 before merge to master.

We use the normal Go compiler and linker suite and you are free to pass LDFLAGS or compiler flags to it.

We use the normal Go compiler and linker suite and you are free to pass debug flags to it to get DWARF symbols.

We build all packages by passing go files to the build process https://github.com/zalando/skipper/blob/master/Makefile and link to a static library or binaries in the provided Makefile.

Building the software relies on the Go compiler which builds in a repeatable process.

As library user you can use go get, which is common in the Go community and a core feature. As binary user you can use Go build, which is common in the Go community and a core feature. As docker user you can use the provided docker containers listed in our releases: https://github.com/zalando/skipper/releases

go install, which is common in the Go community and a core feature of Go, honors GOBIN, which can be set by users to set the DESTDIR of the binary output.

You can use go get -t, which is common in the Go community and a core feature.

We use Go modules a feature from core Go: https://github.com/zalando/skipper/blob/master/go.mod

We use govulncheck in our build pipeline, that is provided by the Go team. We also use Dependabot alerts and CodeQL code scanning provided by Github.

We met 1. and 2., because we use Go modules a feature from core Go: https://github.com/zalando/skipper/blob/master/go.mod With Go you can list dependencies: GO111MODULE=on go list -m -u all

We use mandatory checks like staticcheck and go vet that will point out deprecated functions

We use travis-ci for all opened PRs and it is mandatory to pass before merge to master

All relevant bug fixes have tests included, that will run for all opened pull requests (PR)

We reached 80% test coverage https://codecov.io/gh/zalando/skipper

Listed at https://github.com/zalando/skipper/blob/master/CONTRIBUTING.md#contribute-code

https://opensource.zalando.com/skipper/reference/development/#writing-tests explains how to write test in the how to develop a filter https://opensource.zalando.com/skipper/reference/development/#how-to-develop-a-filter

Merge to master can not be applied if a warning from one of the tools: Go fmt, Go build, Go vet (https://golang.org/cmd/vet/), staticcheck (https://staticcheck.io/) and Go tests are failing Exceptions from staticcheck that we allow are commented in the Makefile at https://github.com/zalando/skipper/blob/master/Makefile#L96-L101

Default route is do not allow and users need to change that before using this software. Access filters disallow access on all errors

TLS provided by the Go standard library and AES 256 GCM. MD5 is only used to generate time dependent random content in tests.

TLS connection settings can be chosen as Go supports.

Credentials are not bundled in the code and needs to be passed by the user, such that it can be updated or replaced without code changes.

The software uses the defaults of the Go language which comes with sane defaults.

TLS supported by the Go core stdlib and supports TLS version 1.2

TLS is supported by the used Go core stdlib and supports TLS cert verification. Cert validation is enabled by default.

TLS is supported by the used Go core stdlib and it will not send http headers before TLS certs are verified

Parsing data from untrusted sources is done by the Go net/http package and not rebuild

We use a memory safe language and have built-in protection against known DoS vectors of the stdlib.

Go is a memory safe language and the software does not implement features that can be attacked by common vulnerabilities for example SQL injection or XSS. We use go vet and staticcheck https://staticcheck.io/ that checks for coding best practice and finds common errors that could lead to vulnerabilities. We use gosec https://github.com/securego/gosec to check for common security problems in our CI pipeline Both tools are run by our CI pipeline and are mandatory to be successful, before merge is allowed.

Go is in general memory safe and we do not use CGO nor Go standard library unsafe to circumvent memory safety provided by the runtime