go-derive

Repository on GitHub, which provides public git repositories with URLs.

Repository on GitHub, which uses git. git can track the changes, who made them, and when they were made.

The master branch contains the active development history, not only release tags.

Development workflow:

• all changes land through pull requests
• pull requests are squash-merged
• merge commits follow Conventional Commits formatting

Repository activity:

• 29 merged pull requests visible in GitHub history
• releases are preceded by multiple development PRs and commits

Example:

• release v0.2.5 was preceded by PRs:
  • #23
  • #25
  • #26
• each merged independently onto master

Review traceability:

• PR descriptions preserved
• review discussions preserved
• file diffs preserved
• CI execution history preserved

Repository on GitHub, which uses git. git is distributed.

Each release uses a unique Semantic Version identifier.

Versioning workflow:

• release-please calculates versions from Conventional Commits
• versions are synchronized across:
  • git tags (e.g. v0.2.7)
  • the Version constant in derive.go
  • .github/.release-please-manifest.json

Release integrity:

• repository ruleset release-tag-protection (id 15981700) prevents:
  • tag reuse
  • tag rewriting

Release history is published through the GitHub Releases page.

Each release is identified by a git tag using the format:

• vX.Y.Z
• example: v0.2.7

Tag management:

• tags are created automatically by release-please
• tags are generated when the auto-generated release PR is merged

Tag protection:

• repository ruleset release-tag-protection (id 15981700) prevents:
  • tag reuse
  • tag deletion
  • tag rewriting

The complete release tag history is available through the GitHub Tags page.

Non-trivial release notes file in repository: https://github.com/amiwrpremium/go-derive/blob/master/CHANGELOG.md.

No publicly known runtime vulnerabilities have been disclosed for go-derive.

Current security status across releases v0.1.0 → v0.2.7:

• no assigned CVEs
• no GitHub Security Advisories
• no reported runtime vulnerabilities

Security scanning performed in CI includes:

• govulncheck
• osv-scanner
• Trivy
• gosec
• Semgrep
• CodeQL

Release notes:

• CHANGELOG.md is generated automatically by release-please
• changelog entries are derived from Conventional Commits
• any future security fixes would appear under "Bug Fixes" and include the relevant CVE reference when applicable

Non-trivial SECURITY[.md] file found file in repository: https://github.com/amiwrpremium/go-derive/blob/master/SECURITY.md. [osps_do_02_01]

GitHub Issues at https://github.com/amiwrpremium/go-derive/issues, with structured templates in .github/ISSUE_TEMPLATE/ (bug_report, feature_request, config).

The project is 2 days old.
First release: v0.1.0 on 2026-05-05.

Issue tracker status:

• 2 total issues
• both are bot-generated

Issues:

• #5 Renovate config notice
  • closed by PR #1
• #7 Renovate Dependency Dashboard
  • intentionally kept open

No user-submitted bug reports have been filed so far.

The maintainer is the sole responder and handles issue triage through GitHub notifications.

No user-submitted enhancement requests have been filed.

Project status:

• first release: v0.1.0 on 2026-05-05
• only 2 issues exist
• both are Renovate-generated meta-issues

Issues:

• #5 closed
• #7 Renovate Dependency Dashboard kept open by design

The "majority responded" requirement is satisfied vacuously.

All issues (open + closed, including full comment threads) are archived and searchable at:
https://github.com/amiwrpremium/go-derive/issues?q=is%3Aissue

GitHub provides:

• full-text search across titles, bodies, and comments
• filtering by:
  • author
  • label
  • state
  • date

SECURITY.md:
https://github.com/amiwrpremium/go-derive/blob/master/SECURITY.md

Security reporting policy:

• reporters must not open public GitHub issues
• vulnerabilities must be submitted through GitHub Private Vulnerability Reporting:
  https://github.com/amiwrpremium/go-derive/security/advisories/new

The policy documents:

• required report fields
• optional report fields
• response SLAs by severity

Response targets:

• Critical/High:
  • acknowledgment within 72 hours
  • triage within 7 days
• Medium/Low:
  • acknowledgment within 5 business days
  • triage on a best-effort basis

SECURITY.md §Reporting a vulnerability:
https://github.com/amiwrpremium/go-derive/blob/master/SECURITY.md#reporting-a-vulnerability

Private Vulnerability Reporting:
https://github.com/amiwrpremium/go-derive/security/advisories/new

Policy:

• reporters must not open public issues
• vulnerabilities must be submitted through GitHub Private Vulnerability Reporting

Privacy guarantees:

• reports are visible only to repository maintainers and the reporter
• reports are not indexed in:
  • public issues
  • repository timeline
  • GitHub search

No vulnerability reports have been received.

Project status:

• first release: v0.1.0 on 2026-05-05
• GitHub Security Advisories currently empty

The 14-day initial-response requirement is satisfied vacuously.

SECURITY.md response targets:

• Critical/High:
  • acknowledgment within 72 hours
• Medium/Low:
  • acknowledgment within 5 business days

Both response targets are below the 14-day requirement.

Non-trivial build file in repository: https://github.com/amiwrpremium/go-derive/blob/master/Makefile.

Non-trivial build file in repository: https://github.com/amiwrpremium/go-derive/blob/master/Makefile.

Build command:
go build ./...

Required tooling:

• Go toolchain
• BSD-3-Clause
• FLOSS

Dependency licensing:

• dependencies in go.mod are open-source Go modules
• verified by go-licenses workflow:
  https://github.com/amiwrpremium/go-derive/blob/master/.github/workflows/license-check.yml
• checked against an MIT/BSD/Apache/MPL/LGPL allow-list

No proprietary build tools, IDEs, compilers, SDKs, or licensing servers are required.

CI linters are also FLOSS:

• gofmt
• goimports
• go vet
• golangci-lint
• govulncheck
• staticcheck

Testing framework:

• Go standard testing package
• BSD-3-Clause
• included with the Go toolchain

Test command:
go test -race -count=1 ./...

Documented in:

• CONTRIBUTING.md:
  https://github.com/amiwrpremium/go-derive/blob/master/CONTRIBUTING.md#local-checks-before-pushing
• Makefile:
  • make test
  • make test-race
• CI workflow:
  .github/workflows/ci.yml

CI execution:

• runs on every push and pull request
• test matrix:
  • ubuntu-latest
  • macos-latest
  • windows-latest
• Go versions:
  • 1.25
  • 1.26

Integration tests:

• located under test/
• protected behind an integration build tag
• dispatched manually through:
  .github/workflows/integration.yml

Tests are executed with:

• go test ./...
• go test -race -count=1 ./...

The project uses:

• standard _test.go test files
• Go's built-in testing package

No custom test runner or test harness is required.

Coverage:

• 90.2% statement coverage
• measured with:
  go test -race -coverprofile -coverpkg=...

Test suite size:

• 110 _test.go files
• 7,369 LOC of tests
• 8,378 LOC of source

Coverage reporting:

• Codecov:
  https://codecov.io/gh/amiwrpremium/go-derive
• Codacy:
  https://app.codacy.com/gh/amiwrpremium/go-derive/dashboard

Coverage regressions are flagged on pull requests.

Continuous integration uses GitHub Actions.

CI workflow:

• .github/workflows/ci.yml
• runs on every push and pull request

CI tasks:

• gofmt
• go vet
• go test -race -coverprofile
• govulncheck
• go build

Test matrix:

• ubuntu
• macos
• windows
• Go 1.25
• Go 1.26

Branch protection:

• merging to master requires 14 status checks
• enforced by:
  master-branch-protection ruleset (15981309)

Workflow coverage:

• tests
• linting
• security scanning
• supply-chain verification
• release verification

Security tooling:

• CodeQL
• gosec
• Semgrep
• Trivy
• Codacy
• osv-scanner
• gitleaks
• TruffleHog

Additional checks:

• pin-check
• license-check
• govulncheck

CONTRIBUTING.md §Coverage:
https://github.com/amiwrpremium/go-derive/blob/master/CONTRIBUTING.md#coverage

Policy:
"Patches that meaningfully drop coverage will get flagged on the PR."

Enforcement:

• Codecov posts diff-coverage comments
• Codacy runs:
  • Codacy Coverage Variation
  • Codacy Diff Coverage

Checks run on every pull request and mechanically surface new functionality lacking tests.

Evidence:

• 90.2% coverage existed at v0.1.0 and remained stable across 7 releases
• tests were committed alongside source from the beginning

Examples:

• PR #10 removed Trade.Realized and its dedicated test in the same commit
• PR #17 refactored internal/retry/backoff.go to use crypto/rand
  • existing backoff_test.go validated the new implementation without modification

PR enforcement:

• every PR includes:
  • Codecov delta checks
  • Codacy Diff Coverage checks
• untested new code is flagged automatically

Test expectations are documented in CONTRIBUTING.md through the coverage policy and CI enforcement rules, but there is no explicit standalone "tests must accompany changes" instruction in the change-proposal workflow.

Adding an explicit requirement for contributors to include or update tests alongside behavioral changes is therefore suggested.

The repository uses multiple FLOSS Go linters and analysis tools:

• golangci-lint
• staticcheck
• gosec
• go vet
• gofmt
• goimports

Workflows:

• .github/workflows/lint.yml
• .github/workflows/gosec.yml
• .github/workflows/ci.yml

Git hooks:

• Lefthook runs:
  • gofmt
  • goimports
  • go vet
  • golangci-lint run --new-from-rev=HEAD
• documented in CONTRIBUTING.md §Git hooks

Policy:

• lint warnings fail CI
• required status checks block merges on lint failures

Linter warnings are treated as build failures.

Enforced tooling:

• golangci-lint
• staticcheck
• gosec
• go vet
• gofmt

Policy:

• any finding exits non-zero
• all are required status checks on the master ruleset
• PRs cannot merge with open lint warnings

Example:

• PR #17 triggered gosec G404 on math/rand/v2
• the code was rewritten to use crypto/rand
• the warning was fixed, not suppressed

Code-scanning alerts from:

• gosec
• Semgrep
• CodeQL
• Trivy

are actively triaged and documented in:
docs/known-tool-issues.md

All linters run in strict/default mode with no rule exclusions.

Configuration:

• golangci-lint uses upstream defaults
• staticcheck uses upstream defaults
• gosec scans the full repository and uploads SARIF
• gofmt and goimports fail on unformatted files
• go vet runs without exclusions

Suppression policy:

• zero in-source:
  • nolint
  • nosec
  • noqa
    suppressions

Project policy:

• issues are fixed at source instead of suppressed
• unavoidable tool false positives remain visible and are documented in:
  docs/known-tool-issues.md

Documented examples:

• Codacy deadcode-on-generics parser bug
• remark-lint resolver false positives

Self-attested security evidence in the repository includes:

• correct EIP-712 typed-data signing in pkg/auth
• separate EIP-191 and EIP-712 signing flows
• session-key delegation to avoid keeping owner keys in process memory

Security improvements:

• cryptographic randomness via crypto/rand
  • PR #17
• explicit validation on every workflow_dispatch input
  • PR #18

Supply-chain hardening:

• CycloneDX + SPDX SBOMs
• cosign keyless signatures
• SLSA Level 3 provenance
• SHA-pinned GitHub Actions enforced by:
  .github/workflows/pin-check.yml

CI hardening:

• step-security/harden-runner on every CI job

Security process:

• private vulnerability reporting documented in SECURITY.md
• severity-based response SLAs

Defence-in-depth:

• 9 SAST/secret/dependency scanners
• daily OpenSSF Scorecard scans

Self-attested security mitigations in the repository include:

• weak randomness mitigation:

  • crypto/rand

• integer narrowing protection:

  • explicit & 0xFFFF mask in pkg/auth/nonce.go

• auth-bypass prevention:

  • separate EIP-191 and EIP-712 signing flows
  • session-key delegation keeps owner keys off-host

• input injection protection:

  • regex validation for workflow_dispatch.inputs
  • implemented in PR #18

• race-condition detection:

  • go test -race on every CI build

• secret-leak detection:

  • gitleaks
  • TruffleHog
  • GitGuardian

• dependency vulnerability scanning:

  • govulncheck
  • osv-scanner
  • Trivy
  • Renovate

• supply-chain hardening:

  • SHA-pinned GitHub Actions
  • cosign-signed SBOMs
  • SLSA Level 3 provenance

• static analysis and bug detection:

  • CodeQL
  • gosec
  • Semgrep
  • Codacy
  • golangci-lint
  • staticcheck

All cryptographic operations use publicly-published, expert-reviewed primitives.

Cryptographic standards and primitives:

• EIP-191 personal_sign

  • per-request authentication
  • https://eips.ethereum.org/EIPS/eip-191

• EIP-712 typed structured data signing

  • per-action authorization
  • https://eips.ethereum.org/EIPS/eip-712

Underlying cryptography:

• ECDSA on secp256k1
• keccak-256 hashing
• OS randomness via Go crypto/rand
• TLS via Go crypto/tls
  • TLS 1.2 / 1.3
  • RFC 5246 / RFC 8446

No custom cryptographic primitives are implemented.

go-derive's primary purpose is exchange access, not cryptography.

Cryptographic operations are delegated to established upstream libraries:

• github.com/ethereum/go-ethereum/crypto

  • secp256k1 ECDSA
  • keccak-256 hashing

• signer/core/apitypes

  • EIP-712 typed-data hashing

• common

  • EIP-55 address checksums

• accounts/abi

  • ABI encoding

• Go crypto/rand

  • randomness

• Go crypto/tls

  • transport security

No cryptographic primitives are re-implemented in the repository.
pkg/auth only assembles inputs and calls upstream libraries.

All cryptographic dependencies are FLOSS.

Dependencies:

• Go stdlib crypto/*

  • BSD-3-Clause

• github.com/ethereum/go-ethereum/{crypto,common,accounts/abi,signer/core/apitypes}

  • LGPL-3.0

• gorilla/websocket

  • BSD-2-Clause

License verification:

• .github/workflows/license-check.yml
• runs:
  go-licenses check ./...

Allowed licenses:

• MIT
• BSD
• Apache
• MPL
• LGPL

No proprietary cryptographic modules are required.

Default cryptographic settings meet or exceed NIST SP 800-57 2030+ minimum recommendations.

Defaults:

• secp256k1 ECDSA signing

  • ~128-bit security level
  • required by EIP-191 / EIP-712

• keccak-256 hashing

  • 256-bit output
  • SHA-3 family

• Go stdlib TLS defaults

  • TLS 1.2 / 1.3
  • AES-128-GCM minimum

Restrictions:

• secp256k1 is the only supported signing curve
• no configuration exists to weaken:
  • curve selection
  • key size
  • hashing algorithms

Smaller key lengths are not configurable.

No broken cryptographic algorithms are used in any default code path.

Cryptographic inventory:

• secp256k1 ECDSA
  • signing
• keccak-256
  • hashing
• Go crypto/rand
  • randomness
• TLS 1.2 / 1.3
  • transport security

The following algorithms do not appear in the source tree:

• MD4
• MD5
• SHA-1
• RC2
• RC4
• DES / 3DES
• Dual_EC_DRBG

Verification:
grep -rE "(md4|md5|^sha1|rc4|rc2|des\.|3des|dual_ec)" --include='*.go'

Result:

• empty

No interoperability fallback to legacy cryptography is required.
Derive uses modern EIP-191 and EIP-712 signing exclusively.

No algorithms with known serious weaknesses are used in default code paths.

Cryptography:

• signing uses keccak-256
• SHA-1 is not used

TLS:

• handled by Go crypto/tls
• defaults to AEAD ciphers:
  • AES-GCM
  • ChaCha20-Poly1305
• TLS 1.2 and TLS 1.3 only
• CBC suites disabled
• static RSA key exchange disabled

Absent from the source tree:

• RC4
• RC2
• DES
• 3DES
• MD-family hashes

Verified via grep across *.go files.

Perfect forward secrecy is provided by the TLS layer.

Transport security:

• implemented through Go crypto/tls
• ECDHE-based key exchange by default:
  • X25519
  • P-256
  • P-384

TLS behavior:

• TLS 1.2 uses ephemeral ECDHE key exchange
• TLS 1.3 requires ephemeral key exchange
• static RSA key exchange disabled
• static DH key exchange disabled

Security property:

• compromise of long-term certificate keys cannot decrypt previously captured traffic

The SDK does not implement its own application-level key agreement.

N/A — go-derive does not implement password-based authentication.

Authentication model:

• secp256k1 signatures
• EIP-191
• EIP-712

The codebase contains:

• no login flow
• no credential database
• no password hashing
• no password storage

Private keys:

• provided by the calling application
• held only in memory for signing
• never serialized or persisted by the SDK

All randomness uses Go crypto/rand, backed by the OS CSPRNG:

• Linux: getrandom
• macOS: arc4random_buf
• Windows: BCryptGenRandom

Security hardening:

• PR #17 replaced:
  • math/rand
  • math/rand/v2
• rewritten to use:
  • crypto/rand

ECDSA signing:

• signing nonces (k values) come from crypto/rand
• provided through go-ethereum crypto.Sign

Verification:
grep -rE "math/rand" --include='*.go'

Result:

• zero matches

No insecure RNG is reachable from any code path producing keys, nonces, or signatures.

Distribution channels use HTTPS exclusively. [osps_br_03_02]

No cryptographic hash is retrieved over plain HTTP and trusted without signature verification.

Release verification:

• .github/workflows/verify-release.yml
• downloads occur over HTTPS
• verification uses:
  • cosign verify-blob
  • slsa-verifier verify-artifact

Verification checks:

• Sigstore certificate identity validation
• SLSA Level 3 provenance validation

Security hardening:

• PR #26 removed the last curl | bash pattern from CI
• replaced with SHA-pinned:
  • codacy/codacy-coverage-reporter-action

Dependency integrity:

• go install uses HTTPS module transport
• go.sum integrity verification enabled

GitHub Actions:

• all third-party Actions are SHA-pinned
• enforced by:
  .github/workflows/pin-check.yml

No unpatched medium-or-higher vulnerabilities are currently known.

Current status:

• zero GitHub Security Advisories
• zero Dependabot alerts

CI security scanning:

• govulncheck
• osv-scanner
• Trivy filesystem scanning
  • severity threshold: MEDIUM+
• CodeQL
• gosec
• Semgrep
• Codacy SAST

All security checks are currently green on master HEAD.

Relevant workflows:

• .github/workflows/ci.yml
• .github/workflows/osv-scanner.yml
• .github/workflows/trivy.yml
• .github/workflows/codeql.yml
• .github/workflows/gosec.yml
• .github/workflows/semgrep.yml
• .github/workflows/codacy.yml

No critical vulnerabilities have been reported against go-derive.

Current status:

• GitHub Security Advisories empty
• project age: 2 days

The "rapid fix" requirement is currently satisfied vacuously.

Security response policy:
https://github.com/amiwrpremium/go-derive/blob/master/SECURITY.md

Response targets:

• Critical/High:

  • acknowledgment within 72 hours
  • triage update within 7 days
  • coordinated disclosure with the reporter

• Medium/Low:

  • acknowledgment within 5 business days
  • best-effort triage thereafter

No valid private credentials exist in the repository.

Continuous secret scanning:

• gitleaks
• TruffleHog
• GitGuardian Security Checks
• Codacy security scan

Scanning scope:

• every push
• full git history

Relevant workflows:

• .github/workflows/gitleaks.yml
• .github/workflows/trufflehog.yml

Test vectors:

• pkg/auth/*_test.go
• use publicly-known Ethereum test keys
• not usable credentials

Repository contents:

• no .env files
• no credentials.json files

The repository runs nine FLOSS static-analysis tools on every pull request and push to master:

• CodeQL
• gosec
• Semgrep
• staticcheck
• golangci-lint
• Trivy
• osv-scanner
• govulncheck
• Codacy analyzers

Codacy analyzers include:

• Revive
• Markdownlint
• Remark-lint
• Checkov

Release process:

• releases are created through release-please PRs
• release PRs pass through the same CI and analysis gates
• every release is preceded by a complete static-analysis run

Workflow definitions:
https://github.com/amiwrpremium/go-derive/tree/master/.github/workflows

Three static-analysis tools specifically target common Go vulnerability classes.

gosec:

• runs the full Go security ruleset
• includes checks such as:
  • G101 hardcoded credentials
  • G201–G204 injection risks
  • G302–G306 file permissions
  • G401–G404 weak cryptography
  • G115 integer overflow
• workflow:
  .github/workflows/gosec.yml

Semgrep:

• runs security-focused rule packs:
  • p/security-audit
  • p/golang
  • p/secrets
• workflow:
  .github/workflows/semgrep.yml

CodeQL:

• uses the security-and-quality query pack
• workflow:
  .github/workflows/codeql.yml

All analysis runs execute on every push and pull request.

All medium-or-higher severity findings from the static-analysis stack have been fixed at source.

Examples:

• gosec G115 integer narrowing

  • fixed in PR #17
  • explicit & 0xFFFF mask added

• Semgrep / Opengrep math-random-used

  • fixed in PR #17
  • switched from non-CSPRNG randomness to crypto/rand

Response time:

• both fixes shipped within ~30 minutes of alert discovery

Remaining open alerts:

• low/info-severity false positives only

Documented examples:

• Codacy deadcode parser limitations with Go generics
• remark-lint reference-resolution issues in Contributor Covenant templates

Tracking document:
https://github.com/amiwrpremium/go-derive/blob/master/docs/known-tool-issues.md

All static analysis runs on every push and pull request:

• gosec
• Semgrep
• CodeQL
• Trivy
• Codacy
• osv-scanner
• govulncheck
• staticcheck
• golangci-lint

Analysis frequency:

• every commit triggers fresh analysis

Scheduled backstop scans:

• daily:
  • Trivy
  • OpenSSF Scorecard
• weekly:
  • CodeQL
  • Semgrep
  • osv-scanner
  • Codacy

Purpose:

• catches findings introduced by updated vulnerability datasets or rulesets

Workflow definitions:
https://github.com/amiwrpremium/go-derive/tree/master/.github/workflows

Two FLOSS dynamic-analysis mechanisms run on every push and pull request, and therefore before every release.

1. Go race detector

• executed via:
  go test -race -coverprofile -covermode=atomic
• configured in:
  .github/workflows/ci.yml
• instruments runtime memory access to detect data races

2. Native Go fuzzing

• 10 fuzz functions across:
  • pkg/auth
  • pkg/types
  • pkg/errors
  • internal/jsonrpc

Fuzz targets include:

• signer handling
• address parsing
• txhash parsing
• decimal parsing
• orderbook parsing
• millistime parsing
• API error JSON decoding
• JSON-RPC decode and notification detection

Fuzz seed corpora:

• committed into the repository
• executed as ordinary tests during CI

N/A — the project is written entirely in Go, a memory-safe language.

Memory-safety properties:

• no C code
• no C++
• no cgo usage
• no unsafe package usage

Verification:

• grep -rn '"unsafe"' --include='*.go'
• grep -rn 'import "C"' --include='*.go'

Results:

• both return empty

Dependencies:

• all modules in go.sum are pure Go