遵循以下最佳实践的项目将能够自愿的自我认证，并显示他们已经实现了核心基础设施计划（OpenSSF）徽章。 显示详细资料
[](https://www.bestpractices.dev/projects/3332)
<a href="https://www.bestpractices.dev/projects/3332"><img src="https://www.bestpractices.dev/projects/3332/badge"></a>
Next-generation installation system for the Adélie Linux distribution
https://code.foxkit.us/adelie/horizon/blob/master/CONTRIBUTING.rst links to our Code Style Guide at https://code.foxkit.us/adelie/horizon/blob/master/devel/STYLE.rst
As part of the Adélie Linux project, Project Horizon is governed by the Adélie Linux Organisation Charter: https://code.foxkit.us/adelie/docs/blob/master/src/charters/0001-org.rst
https://code.foxkit.us/adelie/horizon/blob/master/CODE-OF-CONDUCT.rst
The README contains key contributors and their roles. https://code.foxkit.us/adelie/horizon
Project Horizon inherits our geographically-diverse Platform Group leadership (as shown at https://code.foxkit.us/adelie/horizon/-/project_members and others) which ensures continuation of the project including issue maintenance, merge requests, and releases.
The Scope section of our Project Vision document ( https://horizon.adelielinux.org/vision/scope.html ) contains a roadmap of desired features for future releases.
https://horizon.adelielinux.org/requirements/nonfunctional.html#security
Documentation is kept in the same repository as the code. The documentation is rebuilt on every commit and immediately live on https://horizon.adelielinux.org/.
Our README ( https://code.foxkit.us/adelie/horizon/blob/master/README.rst ) contains all of our earned badges.
The Horizon UI is written in Qt 5. Translation support is enabled for all user-facing strings.
The Web site and repository are run on a self-hosted GitLab with proper access controls in place.
We have not yet released a second version of Horizon.
Bugzilla is used, at https://bts.adelielinux.org/buglist.cgi?product=Horizon&resolution=---
No vulnerabilities have ever been reported for Project Horizon.
https://code.foxkit.us/adelie/horizon/blob/master/devel/STYLE.rst
Horizon is built with standard CMake. These variables are tested regularly via our Clang scan-build tests.
CMake has Debug and RelWithDebugInfo build types to preserve debugging information.
CMake generates the Makefiles (or Ninja build files, or others), keeping them updated as the structure of the project changes.
The system is an installation system. CMake-generated Makefiles do support DESTDIR.
The Runtime Environment requires no external dependencies. Since the Installation Environment is only meant to be used from Adélie Linux, it is assumed that abuild deps from the Horizon build recipe in our packages repository is sufficient for this, as it will install all the build dependencies for the Horizon Installation Environment.
abuild deps
On systems that support C++17, there are no external dependencies for the Runtime Environment.
The Installation Environment dependencies are listed in the CMakeLists.txt file: https://code.foxkit.us/adelie/horizon/blob/master/CMakeLists.txt#L56 using standard PkgConfig files.
All external dependencies except CLIPP are provided by the system. No other vendored code exists.
All APIs used in the Installation Environment are current and non-deprecated. All APIs used in the Runtime Environment are part of C++14 and are not known to be obsolete or impending deprecation.
Test suite is run on every commit: https://code.foxkit.us/adelie/horizon/pipelines
No bugs have been filed yet. Regression tests are recommended in the contribution guide: https://code.foxkit.us/adelie/horizon/blob/master/CONTRIBUTING.rst
We use LCOV ( http://ltp.sourceforge.net/coverage/lcov.php ) for coverage reports. At the time of this writing, we have 83% coverage: https://horizon.adelielinux.org/coverage/
This is contained in our Contribution Guide: https://code.foxkit.us/adelie/horizon/blob/master/CONTRIBUTING.rst
https://code.foxkit.us/adelie/horizon/blob/master/CONTRIBUTING.rst
-Wall -Wextra with only -Wunused-parameter disabled: https://code.foxkit.us/adelie/horizon/blob/master/CMakeLists.txt#L17
cURL is used to connect to HTTPS, so it is up to the distributor of the cURL library to ensure this is met. The Adélie Linux build utilises OpenSSL and is fully configurable in this manner.
While account passwords must be included in the HorizonScript, LUKS passphrases do not have to be - the user can be prompted for them instead.
Signing keys are only fetchable via HTTPS. Repositories, user avatars, and HorizonScript files prefer HTTPS but support HTTP if the user explicitly requests them.
TLS 1.2 should be supported by any cURL build with TLS support that would be used with Horizon.
ibcurl performs peer SSL certificate verification by default: https://curl.haxx.se/docs/sslcerts.html
Certificate verification is performed during negotiation, before any HTTP headers are sent to the remote system.
Git tags are cryptographically signed. Release tarballs have GPG signatures from our development team. See https://code.foxkit.us/adelie/horizon/-/releases for example.
All Git tags are cryptographically signed: https://code.foxkit.us/adelie/horizon/-/tags
Horizon's parser is strict and heavily tested. We have achieved 100% test coverage in the parsing module. All inputs are fully sanitised and errors are returned if the values are not within parameters.
Stack protector is on by default in Adélie Linux. We additionally have many warning flags enabled and marked -Werror.
CppCheck includes checks to ensure proper API usage. It additionally ensures non-usage of known unsafe APIs (like gets).
Valgrind is run per-commit as part of CI: https://code.foxkit.us/adelie/horizon/pipelines
后退
级别条款。您还可以查看
或
级别条款。