Release integrity
Every release is signed and verifiable — not just downloadable.
| Property | How it's enforced |
|---|---|
| Signed binaries | Every platform binary is signed with cosign; the .cosign.bundle ships alongside it in the release. |
| Build provenance | SLSA-style provenance attestation (actions/attest-build-provenance) ties each binary back to the exact workflow run and commit that produced it. |
| SBOM | A software bill of materials (zyrax-guard.spdx.json) ships with every release, itself cosign-signed. |
| Checksums | checksums.txt covers every asset; the install script and Homebrew/Scoop packages verify SHA-256 before use. |
upgrade | Verifies the cosign signature by default before replacing the running binary — opt out explicitly with --require-signature=false. |
| Signed tags | Release tags are signed (SSH) and verified before push — see the current tag for an example. |
Runtime safety invariants
Properties enforced in code, not just policy — a reviewer rejects any PR that regresses these.
Command-injection safety
Every package-manager invocation (npm, pip, cargo, go) uses an argument array via exec.Command — never a shell string. Names and versions are validated against a strict grammar before they can reach an exec call or a URL.
SSRF allowlist
The HTTP client only contacts an explicit per-ecosystem host allowlist (e.g. registry.npmjs.org, proxy.golang.org, api.osv.dev). A new network call must extend the allowlist at the call site — there is no general-purpose client that can reach an arbitrary host.
Fail-closed verdicts
If a check cannot be completed — the registry is unreachable, metadata is missing — Guard returns ERROR and a non-zero exit code. A network failure never silently reads as SAFE.
Archive extraction limits
Deep install-script analysis extracts tarballs/zips under strict per-file, total-size, and entry-count caps, rejecting symlinks, traversal paths, and absolute paths before any content is read.
Zero third-party runtime deps
The Go module is stdlib-only at runtime. A PR that adds an import outside the standard library is rejected — nothing to compromise upstream.
Supply chain hardening
The build pipeline gets the same treatment as the packages it vets.
| Layer | Control |
|---|---|
| GitHub Actions | Every action is pinned to a full commit SHA, not a mutable tag — checked and re-verified against the upstream registry, never trusted from memory. |
| Secret scanning | gitleaks runs on every push and PR in CI. |
| Dependency review | actions/dependency-review-action blocks high-severity and copyleft-incompatible additions on every PR. |
| Signed commits/tags | Release tags are SSH-signed and verified (git tag -v) before the push that triggers a release. |
| Locked dependencies | Go modules are stdlib-only, so there's no third-party dependency tree to lock — the smallest possible supply-chain surface. |
Data handling
Nothing leaves your machine except the public package name you query.
Package checks
Only the public package name you query leaves your machine, for registry / OSV lookups.
Agent-config scanning
Fully local — no network, no telemetry.
Upgrades
zyrax-guard upgrade downloads a release from GitHub and verifies its SHA-256 checksum and cosign signature (required by default) before replacing the binary.
Reporting a vulnerability
Please don't open a public issue for a security report.
Report privately via GitHub's Security Advisory feature (the “Report a vulnerability” button on the repository's Security tab), or by emailing the maintainers directly.
We aim to respond within 48 hours, and to publish a fix and advisory within 14 days.