DF Storyteller

https://gitlab.com/df_storyteller/df-storyteller

Git commit log

Git is used

Git tags are used https://gitlab.com/df_storyteller/df-storyteller/-/tags

Release notes are in tags https://gitlab.com/df_storyteller/df-storyteller/-/tags And are documented in change-log: https://gitlab.com/df_storyteller/df-storyteller/-/blob/master/CHANGELOG.md For API there is a separate change-log (this includes only the API changes): https://gitlab.com/df_storyteller/df-storyteller/-/blob/master/CHANGELOG_API.md

No public vulnerabilities yet.

GitLab issues: https://gitlab.com/df_storyteller/df-storyteller/-/issues

https://gitlab.com/df_storyteller/df-storyteller/-/issues?scope=all&state=all

https://gitlab.com/df_storyteller/df-storyteller/-/blob/master/docs/security.md#security-in-df-storyteller

Use PGP key via mail https://gitlab.com/df_storyteller/df-storyteller/-/blob/master/docs/security.md#security-in-df-storyteller

Using cargo build --release https://gitlab.com/df_storyteller/df-storyteller/-/blob/master/docs/install.md#compile-from-source

Using cargo like all Rust applications

Cargo: https://github.com/rust-lang/cargo/ Rust: https://github.com/rust-lang/rust/ Postgres: https://www.postgresql.org/ SQLite: https://sqlite.org/index.html

We use the build in cargo test

We use the default cargo test for Rust

We use the GitLab CI/CD Pipeline: https://gitlab.com/df_storyteller/df-storyteller/-/pipelines This is used for testing, style control and linting and general audits.

All workspaces have flags for #![forbid(unsafe_code)] and #![deny(clippy::all)]. This in enforced be CI pipeline.

Warnings are not allowed by clippy. They are enforced by CI.

Warnings are not allowed by clippy. They are enforced by CI.

The primary developer is a security researcher and knows about most security weaknesses and make sure the application and system are safe.

All security risks are taken into account that are applicable to the project. But some should be included in tests (TODO: https://gitlab.com/df_storyteller/df-storyteller/-/issues/112 ).

Only updater uses cryptographic mechanisms (API also uses Sha256 hash for etag generation). Information about updater crypto can be found here: https://gitlab.com/df_storyteller/df-storyteller/-/blob/master/docs/security.md#technical-security-implementations We only use public cryptographic protocols, cypher and algorithms. (as we should) Libraries used are not audited.

https://gitlab.com/df_storyteller/df-storyteller/-/blob/master/docs/security.md#technical-security-implementations

Hash: 256 bits ( Sha256 ) Elliptic curve: 256 bits ( Curve 25519, 128 bits of security ) Key Signing: 256 bits ( Ed25519: Curve 25519, with Sha256 )

There is no encrypted data exchanged.

No passwords used or stored.

We use rand::rngs::OsRng: https://docs.rs/rand/0.7.3/rand/rngs/struct.OsRng.html This is cryptographically secure https://docs.rs/rand/0.7.3/rand/trait.CryptoRng.html It uses the random pool from the OS using https://github.com/rust-random/getrandom

When checking for update it uses https and the verifier is signed by the developer with ed25519. This prevents both the connection and the token to be spoofed.

Hashes (SHA2) are sent over https and signature is verified.

No public vulnerabilities known.

No public vulnerabilities known.

Only public keys are in repo. There are no example passwords. The .gitignore prevents private keys from being committed to the repo.

Could not find any static code analysis tool other then Clippy and Rust compiler itself. Rust compiler already checks a lot of things static code analysis tools do.

Could not find any static code analysis tool other then Clippy and Rust compiler itself. cargo audit https://github.com/RustSec/cargo-audit will be used to check for known vulnerabilities in dependencies.

URL inputs and XML inputs where fuzzed. Tests and reports included in repo.

Rust <3 :D

No vulnerabilities known.