Skip to content

Repository navigation

Security: 192d-Wing/usg-pygitversion

Security

SECURITY.md

Security policy

Supported versions

Only the latest minor release line receives security fixes. Fixes ship as patch releases on PyPI (NIST SP 800-53 SI-2).

Reporting a vulnerability

Please do not open a public issue for a security problem. Use GitHub's private vulnerability reporting on this repository ("Security" tab, "Report a vulnerability"). You will receive an acknowledgement within five business days and a remediation plan or a request for more information within ten.

What is in scope

usg-pygitversion is a command-line tool and library that reads a local git repository and prints version variables. Relevant issue classes include:

  • Code execution or file access outside the repository triggered by repository content (branch names, tags, commit messages, GitVersion.yml).
  • Regular-expression denial of service through configuration.
  • Information disclosure through logs, cache files or error messages.
  • Supply-chain issues in the release pipeline or published artefacts.

Verifying releases

Wheels published to PyPI carry PEP 740 attestations generated by the release workflow through Trusted Publishing. Verify with:

pip install pypi-attestations
pypi-attestations verify pypi --repository https://github.com/192d-Wing/usg-pygitversion pypi:usg_pygitversion-<version>-py3-none-any.whl

Each GitHub release also attaches a CycloneDX SBOM and a SHA256SUMS file.

There aren't any published security advisories