go-cvss

Repository on GitHub, which provides public git repositories with URLs.

Repository on GitHub, which uses git. git can track the changes, who made them, and when they were made.

The project is trusted lightweight enough such that interim versions are commits between each releases. Any issue and pull request are welcome as part of this process thus could be included as part of releases.

Repository on GitHub, which uses git. git is distributed.

Each release uses a git tag matching SemVer specification.

Release notes are now supported through Goreleaser and Github releases available at https://github.com/pandatix/go-cvss/releases.

Security commits refers directly to the CVE it fixes (commit message) to ensure traceability of our security strategy.

The Gitub issue tracker is available and monitored (https://github.com/pandatix/go-cvss/issues)

The Github issue tracker is used to track individual issues, with tags for filtering and statistics.

There are not so many bugs reported as long as it implements specifications that are released ~4 years appart. A recent issue was resolved under 2 hours, thanks to the notifications from Github.

Recent example (https://github.com/pandatix/go-cvss/issues/4) shows the enhancements requests are handled as soon as possible.

This feature is included in the Github issue tracker (https://github.com/pandatix/go-cvss/issues?q=is%3Aissue+is%3Aclosed)

There is no website, but the project's Security Policy (https://github.com/pandatix/go-cvss/blob/main/SECURITY.md) provides information on how to report vulnerabilities by mail. We also accept private vulnerability report through Github.

The SECURITY.md (https://github.com/pandatix/go-cvss/blob/main/SECURITY.md) describes the process : send an email (could be GPG-signed) to lucastesson@protonmail.com

No vulnerabilities reported in the last 6 months. Last security advisory (https://github.com/pandatix/go-cvss/security/advisories/GHSA-xhmf-mmv2-4hhx) fixed and published under 24 hours.

The repository is not built but is a Go dependency exposing an API. It makes use of a Makefile for common tasks such as running unit tests or benchmarks.

The project is entirely buildable using only Golang.

The test suite is automatically run on each push/PR through Github Actions.

Using the go test ./... you could trigger all the existing unit tests as described by the Golang documentation

Every exposed API functionnality is unit tests and coverage is monitored using both Go's coverage and unit tests coverage reports

Github Action "CI" fills this goal

The governance of this repository defines that the only major modifications could be requested by the FIRST ORG CVSS SIG as it implements their work. For instance, a new release of a standard requires its integration in the repository thus its unit tests, coverage monitoring, benchmark and differential fuzzing when applicable.

Contribution guidelines are provided : https://github.com/pandatix/go-cvss/blob/main/CONTRIBUTNG.md

Delivery is through Go's dependency resolution which uses HTTPS

Delivery is through Go's dependency resolution which uses HTTPS, the checksum is checked using go.sum content

CodeQL in Github Action workflow, triggered on push/pr/cron

Dependabot and Snyk are used to monitor vulnerabilities and fix them as soon as possible

Continuous fuzzing runs daily using ClusterFuzzLite as Github Actions, and runs on each PR.

No assertions are introduced in the library during testing/fuzzing, hence are not enabled in production builds.

As for CVE-2022-39213, the fuzzing crashers crashes the Actions. Github sends a notification such that we could provide a fix and an advisory as soon as soon as possible.