gittuf

Repository on GitHub, which provides public git repositories with URLs.

Repository on GitHub, which uses git. git can track the changes, who made them, and when they were made.

All development happens on the "main" branch, and releases are created from this branch using Git tags.

Repository on GitHub, which uses git. git is distributed.

The project's releases follow semantic versioning, combining the gittuf design document and the implementation.

gittuf repository includes a changelog that tracks changes between releases. https://github.com/gittuf/gittuf/blob/main/CHANGELOG.md

gittuf is in an early state and currently has not been audited. No known CVEs are present, but advisories will be issued on the repository when the time comes.

gittuf uses an issue tracker: https://github.com/gittuf/gittuf/issues

gittuf uses an issue tracker: https://github.com/gittuf/gittuf/issues

The project is actively maintained and maintainers respond / track issues in the tracker.

Feature requests in the specified time frame are tracked in the issue tracker and are under active development.

All bug reports and feature requests are tracked publicly and can be searched: https://github.com/gittuf/gittuf/issues

The repository includes a security policy file: https://github.com/gittuf/gittuf/blob/main/SECURITY.md

https://github.com/gittuf/gittuf/blob/main/README.md details how to use GitHub's disclosure form and provides encrypted emails as an alternative.

No vulnerability reports have been reported so far.

gittuf provides a Makefile that uses Go's toolchain to build and install the project.

Non-trivial build file in repository: https://github.com/gittuf/gittuf/blob/main/Makefile.

The project's build tool chain uses Make and Go.

The contributing guide discusses automated testing. gittuf also uses GitHub Actions CI to run automated tests for all new changes. Finally, the project Makefile also runs all unit tests prior to installation.

The test suite is invoked using standard go tooling: go test ./...

https://github.com/gittuf/gittuf/blob/main/Makefile#L8

GitHub Actions is used as a CI system for all new changes.

https://github.com/gittuf/gittuf/tree/main/.github/workflows

All new features must be accompanied by tests.

Recent major feature additions include corresponding tests. These chanegsets were not merged into the main branch until tests passed.

The contributing guide includes this requirement.

gittuf uses golangci-lint.

Issues flagged by the linter block changesets from being merged. All changesets are merged once the linter execution detects no issues. The Go compiler is strict and typically does not issue warnings as a language policy.

The Go compiler is strict and typically does not issue warnings as a language policy.

The core developers have experience building software in security critical domains. Some developers are also security researchers. As gittuf is first and foremost a security tool, we take great care to ensure it is inherently designed to be secure.

gittuf has not created new cryptographic primitives.

gittuf uses standard libraries and other widely used dependencies for cryptographic functions like hashing and signing.

gittuf does not create new keys, rather it uses keys created by other systems like GPG, Sigstore, etc.

Where gittuf can choose cryptographic algorithms, strong options are chosen.

gittuf explicitly does not depend on SHA-1 for security. However, Git uses SHA-1 extensively and gittuf uses some Git semantics but hardens them using signatures created with stronger underlying hash algorithms.

gittuf does not implement key agreement protocols.

gittuf does not store passwords.

gittuf does not generate cryptographic keys.

gittuf is distributed over HTTPS.

gittuf releases are signed using Git tag signing. These are also distributed with the repository over HTTPS.

No known vulnerabilities exist.

gittuf is a security project and employs a policy of fixing security vulnerabilities as soon as possible when discovered.

gittuf does not embed any credentials or access tokens.

golangci-lint is used in addition to the Go compiler's results to gate gittuf releases.

golangci-lint is used to flag common issues in Go code.

gittuf's security policy is to fix vulnerabilities as soon as possible when they are discovered.

All changesets undergo linting. In addition, we have automated dependency updates for the linter itself, ensuring that the linter runs from time to time and with the latest rules.

gittuf is written in Go, a memory safe language.

Currently, no dynamic analysis tools are currently used. When they are employed, the vulnerabilities they unearth will be handled like other reported vulnerabilities in a timely manner.