.bestpractices.json

{
  "build_common_tools_justification": "The project uses the standard Go toolchain to build the executable: https://github.com/Ensono/eirctl/blob/main/go.mod",
  "build_common_tools_status": "Met",
  "build_floss_tools_justification": "The project is built and tested with the Go toolchain; see https://github.com/Ensono/eirctl/blob/main/go.mod.",
  "build_floss_tools_status": "Met",
  "build_justification": "The checked-in build pipeline automatically builds the eirctl executable from source with go build: https://github.com/Ensono/eirctl/blob/main/eirctl.yaml",
  "build_status": "Met",
  "code_of_conduct_justification": "Contributor Covenant Code of Conduct: https://github.com/Ensono/eirctl/blob/main/CODE_OF_CONDUCT.md",
  "code_of_conduct_status": "Met",
  "contribution_requirements_justification": "Contribution requirements for validation, testing, documentation, security, and coding standards: https://github.com/Ensono/eirctl/blob/main/CONTRIBUTING.md",
  "contribution_requirements_status": "Met",
  "crypto_call_justification": "Production code delegates cryptographic operations to purpose-built Go standard-library and golang.org/x/crypto packages, including SHA-256 and SSH: https://github.com/Ensono/eirctl/blob/main/internal/config/loader.go and https://github.com/Ensono/eirctl/blob/main/internal/config/loader_git.go",
  "crypto_call_status": "Met",
  "crypto_floss_justification": "The cryptographic functionality used by the project is provided by FLOSS Go standard-library and golang.org/x/crypto packages: https://github.com/Ensono/eirctl/blob/main/go.mod",
  "crypto_floss_status": "Met",
  "crypto_keylength_justification": "The SSH identity loader accepts user-supplied private keys without enforcing a minimum key length or providing a mechanism to disable smaller keys: https://github.com/Ensono/eirctl/blob/main/internal/config/loader_git.go",
  "crypto_keylength_status": "Unmet",
  "crypto_password_storage_justification": "eirctl does not store passwords for authentication of external users; it reads existing container-registry credentials from user-managed Docker or containers configuration files: https://github.com/Ensono/eirctl/blob/main/runner/container_auth.go",
  "crypto_password_storage_status": "N/A",
  "crypto_published_justification": "Production cryptographic functionality uses the publicly documented Go SHA-256 and SSH implementations rather than project-defined algorithms: https://github.com/Ensono/eirctl/blob/main/internal/config/loader.go and https://github.com/Ensono/eirctl/blob/main/internal/config/loader_git.go",
  "crypto_published_status": "Met",
  "crypto_random_justification": "Production code does not implement application-level cryptographic key or nonce generation and does not use an insecure random generator; cryptographic protocol handling is delegated to the Go crypto libraries: https://github.com/Ensono/eirctl/blob/main/internal/config/loader_git.go",
  "crypto_random_status": "Met",
  "delivery_unsigned_justification": "Release binaries and installation instructions are delivered over HTTPS, and repository documentation and workflows do not retrieve an unchecked cryptographic hash over HTTP: https://github.com/Ensono/eirctl/blob/main/docs/installation.adoc and https://github.com/Ensono/eirctl/blob/main/.github/workflows/release.yml",
  "delivery_unsigned_status": "Met",
  "dependency_monitoring_justification": "Dependabot checks Go modules, Dockerfiles, and GitHub Actions dependencies daily: https://github.com/Ensono/eirctl/blob/main/.github/dependabot.yml",
  "dependency_monitoring_status": "Met",
  "description_good_justification": "The README identifies eirctl as a concurrent task and container runner: https://github.com/Ensono/eirctl/blob/main/README.md",
  "description_good_status": "Met",
  "documentation_interface_justification": "The CLI command reference, output-format documentation, and published JSON Schema describe eirctl's external commands, outputs, and configuration input: https://github.com/Ensono/eirctl/blob/main/README.md and https://github.com/Ensono/eirctl/blob/main/schemas/schema_v1.json",
  "documentation_interface_status": "Met",
  "documentation_quick_start_justification": "Getting-started, platform-specific installation, verification, and basic usage instructions: https://github.com/Ensono/eirctl/blob/main/docs/installation.adoc",
  "documentation_quick_start_status": "Met",
  "dynamic_analysis_enable_assertions_justification": "The Go test suite uses standard testing assertions across 38 test files and runs with the Go race detector in CI: https://github.com/Ensono/eirctl/blob/main/shared/build/go/eirctl.yaml",
  "dynamic_analysis_enable_assertions_status": "Met",
  "dynamic_analysis_justification": "The release workflow runs only after the Lint and Test workflow succeeds; the test pipeline executes go test with the Go race detector: https://github.com/Ensono/eirctl/blob/main/.github/workflows/release.yml and https://github.com/Ensono/eirctl/blob/main/shared/build/go/eirctl.yaml",
  "dynamic_analysis_status": "Met",
  "english_justification": "The project documentation and contributor guidance are written in English, and the contribution guide accepts bug reports and enhancement requests through GitHub Issues: https://github.com/Ensono/eirctl/blob/main/README.md and https://github.com/Ensono/eirctl/blob/main/CONTRIBUTING.md",
  "english_status": "Met",
  "enhancement_responses_justification": "Maintainer confirmation: enhancement requests are normally acknowledged within a few days, and sometimes within a week; closures without follow-up in the assessed history were erroneous creations rather than unanswered requests.",
  "enhancement_responses_status": "Met",
  "installation_common_justification": "Platform-specific installation instructions are provided for Linux, macOS, and Windows: https://github.com/Ensono/eirctl/blob/main/docs/installation.adoc",
  "installation_common_status": "Met",
  "interact_justification": "Instructions for obtaining eirctl, providing feedback through GitHub Issues, and submitting pull requests: https://github.com/Ensono/eirctl/blob/main/CONTRIBUTING.md",
  "interact_status": "Met",
  "know_common_errors_justification": "Maintainer confirmation: project maintainers complete annual cybersecurity-awareness and OWASP Top 10 training, covering common vulnerability classes (including supply-chain risks) and mitigations.",
  "know_common_errors_status": "Met",
  "know_secure_design_justification": "Maintainer confirmation: project maintainers complete annual cybersecurity-awareness and OWASP Top 10 training, and the organisation operates a global security operations centre that supports secure development practices.",
  "know_secure_design_status": "Met",
  "maintained_justification": "The public repository has recent commits and releases; see the commit history and releases: https://github.com/Ensono/eirctl/commits/main and https://github.com/Ensono/eirctl/releases",
  "maintained_status": "Met",
  "no_leaked_credentials_justification": "Maintainer confirmation: GitHub Secret Scanning is enabled for the repository and has found no secrets. A repository-scoped, pinned Gitleaks pre-commit hook prevents newly committed credentials: https://github.com/Ensono/eirctl/blob/main/.pre-commit-config.yaml",
  "no_leaked_credentials_status": "Met",
  "release_notes_justification": "All published GitHub releases provide generated, human-readable change summaries rather than raw version-control logs; for example: https://github.com/Ensono/eirctl/releases/tag/v0.11.8. The release workflow enforces generated notes for future releases: https://github.com/Ensono/eirctl/blob/main/.github/workflows/release.yml",
  "release_notes_status": "Met",
  "release_notes_vulns_justification": "Maintainer confirmation: the project has not had any publicly known runtime vulnerabilities (CVE or equivalent) and has not released a fix for one; therefore there is no vulnerability disclosure to include in release notes.",
  "release_notes_vulns_status": "N/A",
  "repo_interim_justification": "The public Git history includes commits made after the latest release tag, providing interim versions for review: https://github.com/Ensono/eirctl/commits/main",
  "repo_interim_status": "Met",
  "report_archive_justification": "GitHub Issues provides a publicly accessible, searchable archive of reports and responses with stable URLs; the issue and comment APIs are readable without authentication: https://github.com/Ensono/eirctl/issues",
  "report_archive_status": "Met",
  "report_responses_justification": "Maintainer confirmation: bug reports are normally acknowledged within a few days, and sometimes within a week; closures without follow-up in the assessed history were erroneous creations rather than unacknowledged reports.",
  "report_responses_status": "Met",
  "report_tracker_justification": "The project uses GitHub Issues as a publicly searchable issue tracker for bug reports and enhancement requests: https://github.com/Ensono/eirctl/issues",
  "report_tracker_status": "Met",
  "static_analysis_common_vulnerabilities_justification": "Maintainer confirmation: CodeQL runs on every commit. The checked-in lint pipeline also runs govulncheck and SonarCloud analysis: https://github.com/Ensono/eirctl/blob/main/eirctl.yaml and https://github.com/Ensono/eirctl/blob/main/.github/workflows/pr.yml",
  "static_analysis_common_vulnerabilities_status": "Met",
  "static_analysis_fixed_justification": "Maintainer confirmation from the GitHub code-quality dashboard: there are no overdue unresolved confirmed medium-or-higher static-analysis findings; mean remediation time is 20 days and mean remediation time for critical vulnerabilities is 16 days.",
  "static_analysis_fixed_status": "Met",
  "static_analysis_justification": "Pull-request CI runs golangci-lint; the checked-in task defines it as golangci-lint run: https://github.com/Ensono/eirctl/blob/main/.github/workflows/pr.yml and https://github.com/Ensono/eirctl/blob/main/shared/build/go/eirctl.yaml",
  "static_analysis_often_justification": "Static analysis runs in the Lint job for pull requests and pushes to main: https://github.com/Ensono/eirctl/blob/main/.github/workflows/pr.yml",
  "static_analysis_often_status": "Met",
  "static_analysis_status": "Met",
  "test_continuous_integration_justification": "The Lint and Test workflow runs unit tests for pull requests and pushes to main: https://github.com/Ensono/eirctl/blob/main/.github/workflows/pr.yml",
  "test_continuous_integration_status": "Met",
  "test_invocation_justification": "The documented standard Go command go test ./... runs the test suite: https://github.com/Ensono/eirctl/blob/main/CONTRIBUTING.md",
  "test_invocation_status": "Met",
  "test_justification": "The project has a publicly released Go test suite, and CONTRIBUTING.md documents how to run it: https://github.com/Ensono/eirctl/blob/main/CONTRIBUTING.md",
  "test_policy_justification": "The contributor guide requires tests to be added or updated for behaviour changes, or an explanation when tests are not applicable: https://github.com/Ensono/eirctl/blob/main/CONTRIBUTING.md",
  "test_policy_status": "Met",
  "test_status": "Met",
  "tests_are_added_justification": "The recent YAML parser feature added internal/utils/utils_test.go alongside implementation changes: https://github.com/Ensono/eirctl/commit/1476f9b",
  "tests_are_added_status": "Met",
  "tests_documented_added_justification": "The contributor guide and pull-request template document the expectation to add or update tests: https://github.com/Ensono/eirctl/blob/main/CONTRIBUTING.md and https://github.com/Ensono/eirctl/blob/main/.github/PULL_REQUEST_TEMPLATE.md",
  "tests_documented_added_status": "Met",
  "version_semver_justification": "Release CI derives and validates a semantic version before publishing: https://github.com/Ensono/eirctl/blob/main/.github/workflows/release.yml",
  "version_semver_status": "Met",
  "version_tags_justification": "Release CI creates an annotated version tag for each release: https://github.com/Ensono/eirctl/blob/main/.github/workflows/release.yml",
  "version_tags_status": "Met",
  "version_unique_justification": "Release CI derives a semantic version and creates a versioned release tag for each release: https://github.com/Ensono/eirctl/blob/main/.github/workflows/release.yml",
  "version_unique_status": "Met",
  "vulnerabilities_critical_fixed_justification": "Maintainer confirmation: all Dependabot alerts are actioned within a week, with critical alerts actioned sooner; the project has not received a vulnerability report.",
  "vulnerabilities_critical_fixed_status": "Met",
  "vulnerabilities_fixed_60_days_justification": "Maintainer confirmation: all Dependabot alerts are actioned within a week, so no publicly known medium-or-higher dependency vulnerability remains unpatched for more than 60 days; the project has not identified a vulnerability in its own results.",
  "vulnerabilities_fixed_60_days_status": "Met",
  "vulnerability_report_private_justification": "Private vulnerability-reporting instructions direct reporters to the enabled GitHub Private Vulnerability Reporting form, with an email fallback: https://github.com/Ensono/eirctl/blob/main/SECURITY.md",
  "vulnerability_report_private_status": "Met",
  "vulnerability_report_process_justification": "The published security policy defines the private vulnerability-reporting process: https://github.com/Ensono/eirctl/blob/main/SECURITY.md",
  "vulnerability_report_process_status": "Met",
  "vulnerability_report_response_justification": "Maintainer confirmation: the project has not received a vulnerability report in the last six months, or previously; no initial response-time measurement applies.",
  "vulnerability_report_response_status": "N/A",
  "warnings_fixed_justification": "The required lint task fails on findings, and recent public Lint and Test workflow runs completed successfully: https://github.com/Ensono/eirctl/actions/runs/31382510657",
  "warnings_fixed_status": "Met",
  "warnings_justification": "Pull-request CI runs golangci-lint, a FLOSS linter for Go, and fails the lint task on findings: https://github.com/Ensono/eirctl/blob/main/.github/workflows/pr.yml and https://github.com/Ensono/eirctl/blob/main/shared/build/go/eirctl.yaml",
  "warnings_status": "Met"
}