31 lines
2.1 KiB
Markdown
31 lines
2.1 KiB
Markdown
# PHPGuard security assessment readiness
|
|
|
|
## Status: not production-validated
|
|
|
|
The scan collects package inventory and upstream NVD PHP CVE *candidates*. A version match, lack of upgrades, or an available upgrade does not establish exposure or remediation.
|
|
|
|
### Verified statuses
|
|
|
|
- `Unverified` is the default for unsupported distribution/vendor combinations, unknown package provenance, absent advisories, and network failures.
|
|
- Ubuntu's existing advisory adapter is intentionally **fail closed** until installed package provenance is independently proven at the installed-version level. Seeing an Ubuntu repository in APT policy is insufficient: the installed package may be from a PPA or custom build.
|
|
- Docker PHP is not covered by host package advisories.
|
|
- NVD discovery is bounded and may omit CVEs; no-results is not a clean security bill.
|
|
|
|
### Before production release
|
|
|
|
1. Implement per-installed-version repository origin verification and test Ubuntu advisory response parsing against current fixtures.
|
|
2. Implement and test Debian, Red Hat-family, SUSE, Amazon Linux and Alpine advisory adapters using official vendor data and native package version comparison.
|
|
3. Add test fixtures for package manager outputs, package origin edge cases, CVE states, missing metadata, errors, and containers.
|
|
4. Run integration tests on each supported distribution with minimal and restricted SSH permissions.
|
|
5. Run Xcode build, UI checks, signing and notarization on macOS; this archive has not been built in Xcode here.
|
|
|
|
This package is a security-hardening development snapshot, **not a production release**.
|
|
|
|
## Build verification update
|
|
|
|
`Scripts/test.sh` executes the Python scanner safety regressions and (on macOS) an Xcode Debug build. The project does not yet have an XCTest target.
|
|
|
|
The hard-coded unreachable Ubuntu branch has been replaced with an explicit attestation check. **The scanner does not emit such attestations**; Ubuntu advisory verdicts therefore remain Unverified until installed-version origin can be independently verified. Do not manufacture this marker from repository listings.
|
|
|
|
Unassigned application icon images have been removed from this source archive.
|