PHPGuard/docs/SECURITY-READINESS.md

PHPGuard security assessment readiness

Status: not production-validated

The scan collects package inventory and upstream NVD PHP CVE candidates. A version match, lack of upgrades, or an available upgrade does not establish exposure or remediation.

Verified statuses

• Unverified is the default for unsupported distribution/vendor combinations, unknown package provenance, absent advisories, and network failures.
• Ubuntu's existing advisory adapter is intentionally fail closed until installed package provenance is independently proven at the installed-version level. Seeing an Ubuntu repository in APT policy is insufficient: the installed package may be from a PPA or custom build.
• Docker PHP is not covered by host package advisories.
• NVD discovery is bounded and may omit CVEs; no-results is not a clean security bill.

Before production release

1. Implement per-installed-version repository origin verification and test Ubuntu advisory response parsing against current fixtures.
2. Implement and test Debian, Red Hat-family, SUSE, Amazon Linux and Alpine advisory adapters using official vendor data and native package version comparison.
3. Add test fixtures for package manager outputs, package origin edge cases, CVE states, missing metadata, errors, and containers.
4. Run integration tests on each supported distribution with minimal and restricted SSH permissions.
5. Run Xcode build, UI checks, signing and notarization on macOS; this archive has not been built in Xcode here.

This package is a security-hardening development snapshot, not a production release.

Build verification update

Scripts/test.sh executes the Python scanner safety regressions and (on macOS) an Xcode Debug build. The project does not yet have an XCTest target.

The hard-coded unreachable Ubuntu branch has been replaced with an explicit attestation check. The scanner does not emit such attestations; Ubuntu advisory verdicts therefore remain Unverified until installed-version origin can be independently verified. Do not manufacture this marker from repository listings.

Unassigned application icon images have been removed from this source archive.