23 lines
1.6 KiB
Markdown
23 lines
1.6 KiB
Markdown
# PHPGuard security assessment readiness
|
|
|
|
## Status: not production-validated
|
|
|
|
The scan collects package inventory and upstream NVD PHP CVE *candidates*. A version match, lack of upgrades, or an available upgrade does not establish exposure or remediation.
|
|
|
|
### Verified statuses
|
|
|
|
- `Unverified` is the default for unsupported distribution/vendor combinations, unknown package provenance, absent advisories, and network failures.
|
|
- Ubuntu's existing advisory adapter is intentionally **fail closed** until installed package provenance is independently proven at the installed-version level. Seeing an Ubuntu repository in APT policy is insufficient: the installed package may be from a PPA or custom build.
|
|
- Docker PHP is not covered by host package advisories.
|
|
- NVD discovery is bounded and may omit CVEs; no-results is not a clean security bill.
|
|
|
|
### Before production release
|
|
|
|
1. Implement per-installed-version repository origin verification and test Ubuntu advisory response parsing against current fixtures.
|
|
2. Implement and test Debian, Red Hat-family, SUSE, Amazon Linux and Alpine advisory adapters using official vendor data and native package version comparison.
|
|
3. Add test fixtures for package manager outputs, package origin edge cases, CVE states, missing metadata, errors, and containers.
|
|
4. Run integration tests on each supported distribution with minimal and restricted SSH permissions.
|
|
5. Run Xcode build, UI checks, signing and notarization on macOS; this archive has not been built in Xcode here.
|
|
|
|
This package is a security-hardening development snapshot, **not a production release**.
|