OpenSSF Best Practices (passing): Heimdall's answers

Heimdall is a defensive sandbox. This page holds the answers to paste into a new project on https://www.bestpractices.dev, one line per "passing" criterion: the status to pick, then the justification and the URL. The wording follows Holger's and Gunnar's answers (bestpractices.dev projects 16086 and 16084). The criteria list is the current criteria/criteria.yml of coreinfrastructure/best-practices-badge (level 0, 67 criteria, fetched 2026-10-30).

Key: Met, Unmet, N/A, ? (Unclear: pick the suggested answer, or leave it unanswered).

Before you submit

• The repository must be public first. On 2026-10-30, https://gunnar.rs/nordisk/heimdall answers 401 signed out, and git ls-remote ssh://anonymous@git.gunnar.rs:2222/nordisk/heimdall.git says "repository not found, or you do not have access". The repository owner (account admin) makes it public on gunnar.rs. Until then repo_public, discussion, report_tracker and report_archive are Unmet, and none of the URLs below opens for the badge reviewers. Every other answer below assumes the repository is public.
• The file URLs use the gunnar.rs public-site form https://gunnar.rs/nordisk/heimdall/blob/<path> (as for Holger and Gunnar). Open each one signed out before you submit; if a file does not show, use the repository page and name the file in the justification.
• The form's fields: project URL and repository URL https://gunnar.rs/nordisk/heimdall; the anonymous clone URL is ssh://anonymous@git.gunnar.rs:2222/nordisk/heimdall.git. Licence: AGPL-3.0-only. Language: Rust.
• After registering, add the badge: un-comment the placeholder at the top of README.md, put the project id in it, and add badges/openssf-heimdall.svg to nordisk/ci-status as for Holger and Gunnar.

H = https://gunnar.rs/nordisk/heimdall (the repository page), files as H/blob/<path>.

Basics

• description_good: Met. "Heimdall is a defensive sandbox in Rust for inspecting untrusted content: parsers, verifiers and scanners run in an isolated job (container, seccomp, wasm host), and the caller trusts only Heimdall's signed verdict." H/blob/README.md
• interact: Met. H/blob/README.md (sections "Get the code" and "Contributing, security and changes") links CONTRIBUTING.md, SECURITY.md and CHANGELOG.md.
• contribution: Met. H/blob/CONTRIBUTING.md
• contribution_requirements: Met. H/blob/CONTRIBUTING.md (sections "Test first: RED, then GREEN" and "Coding rules": scripts/ci.sh green, rustfmt, clippy -D warnings, cargo deny, a test with every change; section "Licence of contributions": the CLA in H/blob/CLA.md, version 1.1, accepted by a line in H/blob/CLA-SIGNATURES.md).
• floss_license: Met. AGPL-3.0-only (Cargo.toml license), plus a commercial licence. H/blob/LICENSE
• floss_license_osi: Met. AGPL-3.0 is OSI-approved; the commercial licence is an extra option (dual licensing).
• license_location: Met. H/blob/LICENSE (and LICENSES/AGPL-3.0-only.txt, NOTICE).
• documentation_basics: Met. H/blob/README.md (what it is, the layers, usage) and H/blob/docs/SPEC.md.
• documentation_interface: Met. The job API H/blob/docs/API.md, the CLI H/blob/docs/CLI.md, the policy file H/blob/docs/POLICY.md, the run rules H/blob/docs/RUN.md, and the guest interface H/blob/crates/heimdall-wasm/wit/heimdall.wit.
• sites_https: Met. gunnar.rs serves HTTPS only (http answers 308 to https, HSTS max-age=31536000).
• discussion: Unmet until the repository is public; then Met. https://gunnar.rs/nordisk/heimdall/issues (public, searchable with ?q=, one URL per issue; filing needs a sign-in).
• english: Met. All documentation is in English.
• maintained: Met. Over 30 commits in October 2026; release v0.1.0 on 2026-10-30.

Change control

• repo_public: Unmet until the repository is public; then Met. git clone ssh://anonymous@git.gunnar.rs:2222/nordisk/heimdall.git with any SSH key; H/blob/CONTRIBUTING.md shows it.
• repo_track: Met. git.
• repo_interim: Met. Every change is merged to main from a branch, between releases (for example the lane branches m1/core, m1/wasm, m1/run).
• repo_distributed: Met. git.
• version_unique: Met. Each release is a unique SemVer tag (v0.1.0). The crates are not on crates.io yet; consumers depend on the tag (H/blob/docs/API.md).
• version_semver: Met. Semantic Versioning (H/blob/CHANGELOG.md says so; from v0.1.0 the job API changes by additions only).
• version_tags: Met. Annotated tag v0.1.0 at 386a67f.
• release_notes: Met. H/blob/CHANGELOG.md
• release_notes_vulns: N/A. "No publicly known vulnerability has been fixed in any release. CHANGELOG.md lists fixed vulnerabilities under Security in each release."

Reporting

• report_process: Met. H/blob/CONTRIBUTING.md (section "Report a bug or ask for a feature": issues on gunnar.rs, or e-mail gunnar@gunnar.rs).
• report_tracker: Unmet until the repository is public; then Met. https://gunnar.rs/nordisk/heimdall/issues
• report_responses: ? Suggested answer: Met. "No bug reports were filed by others in the last 12 months (the repository was created on 2026-10-30); CONTRIBUTING.md documents how reports are received."
• enhancement_responses: ? Suggested answer: Met, with the same justification.
• report_archive: Unmet until the repository is public; then Met. https://gunnar.rs/nordisk/heimdall/issues (searchable), the whole archive at https://gunnar.rs/nordisk/heimdall/issues.md
• vulnerability_report_process: Met. H/blob/SECURITY.md
• vulnerability_report_private: Met. H/blob/SECURITY.md (private reports to gunnar@gunnar.rs, subject SECURITY:).
• vulnerability_report_response: N/A. "No vulnerability report was received in the last 6 months. SECURITY.md commits to an acknowledgement within 14 days."

Quality

• build: Met. cargo build --release from a lone clone (H/blob/CONTRIBUTING.md, "Get the code").
• build_common_tools: Met. cargo.
• build_floss_tools: Met. The Rust toolchain; libseccomp for the optional heimdall-plain shim (all FLOSS).
• test: Met. cargo test --workspace --locked and scripts/ci.sh; documented in H/blob/CONTRIBUTING.md.
• test_invocation: Met. cargo test.
• test_most: ? No coverage is measured. About 650 test functions and 7 property-test blocks across the five crates, plus 8 cargo-fuzz targets. Suggested: leave Unclear, or Unmet (SUGGESTED, no justification needed).
• test_continuous_integration: Unmet (SUGGESTED). scripts/ci.sh runs in the CI image (ci/ci.Containerfile) before every merge, by hand on the build host; Heimdall is not yet in the dwarves forge that publishes https://gunnar.rs/nordisk/ci-status for Gunnar and Holger.
• test_policy: Met. H/blob/CONTRIBUTING.md: "Every change comes with a test. A bug fix starts with a failing test."
• tests_are_added: Met. RED-then-GREEN commits in every merge, for example RED 2cf6c45 / GREEN 46cb44e (heimdall-core signed result) and RED d55408e / GREEN 386a67f (heimdall-plain).
• tests_documented_added: Met. H/blob/CONTRIBUTING.md (section "Test first: RED, then GREEN").
• warnings: Met. cargo clippy --workspace --all-targets --locked -- -D warnings in H/blob/scripts/ci.sh.
• warnings_fixed: Met. Clippy is clean under -D warnings on main (for example the clippy fix in 65c0d0e).
• warnings_strict: Met. Warnings are errors (-D warnings).

Security

• know_secure_design: Met. H/blob/docs/SPEC.md (the stacked layers: container, seccomp allowlist, Landlock, syscall broker, wasm host, signed result; "all content is untrusted until verified, signatures included"; the caller never parses untrusted bytes) and H/blob/docs/API.md (the signed bytes: canonical, domain-separated binary wire).
• know_common_errors: Met. Path traversal and bad names in outputs (check_outputs, O_EXCL and O_NOFOLLOW in the output dir), resource exhaustion (fuel, epoch timeout, memory, table, instance, stack and output limits, cgroup kills), replay (nonce, job ticket, replay guard), parser bugs (property tests and cargo-fuzz targets for every parser); adversarial guest tests (infinite loop, memory bomb, deep recursion, huge output, traversal in emit-file names).
• crypto_published: Met. Ed25519 (RFC 8032, strict verification), SHA-256 (FIPS 180-4), BLAKE3, and X.509/CMS for guest signatures.
• crypto_call: Met. Heimdall calls ed25519-dalek, sha2, blake3 and the guest-host / znippy-common CMS verifier (the one Holger uses); it implements no primitive itself.
• crypto_floss: Met. All cryptography libraries are FLOSS.
• crypto_keylength: Met. Ed25519 (128-bit security level) for the per-boot result key; guest signatures are checked by the same verifier as Holger's wasm plugins.
• crypto_working: Met. Heimdall's own code uses no MD5, SHA-1, DES or RC4.
• crypto_weaknesses: Met. Same justification as crypto_working.
• crypto_pfs: N/A. "Heimdall has no network protocol of its own: jobs run locally and results are signed, not sent over a channel Heimdall provides."
• crypto_password_storage: N/A. "Heimdall stores no passwords and has no user accounts."
• crypto_random: Met. The per-boot key and the nonces come from the operating system (getrandom) only.
• delivery_mitm: Met. Heimdall is delivered by git over SSH with a pinned host key (git.gunnar.rs); no crates.io release yet.
• delivery_unsigned: Met. No hash is fetched over plain HTTP.
• vulnerabilities_fixed_60_days: Met. cargo deny --locked check advisories is ok on main; deny.toml ignores no advisory (H/blob/deny.toml).
• vulnerabilities_critical_fixed: Met. No critical advisory is open.
• no_leaked_credentials: Met. The repository holds no private key, token or password; tests make keys at run time or use fixed test seeds named as such (crates/heimdall-core/tests).

Analysis

• static_analysis: Met. "clippy -D warnings and cargo-deny (advisories, bans, licences, sources) in scripts/ci.sh."
• static_analysis_common_vulnerabilities: Met. cargo-deny advisories against the RustSec database (H/blob/deny.toml).
• static_analysis_fixed: Met. Findings are fixed before merge (clippy -D warnings blocks the merge).
• static_analysis_often: Met. clippy -D warnings and cargo deny run in scripts/ci.sh before every merge to main.
• dynamic_analysis: Met. 8 cargo-fuzz targets (fuzz/fuzz_targets: signed_result_wire, result_encoding, pinned_key_text, policy_file, output_name, verify_result_file, wasm_guest_load, wasm_emit_file), smoke-run in scripts/ci.sh and run for longer by scripts/fuzz.sh; proptest property tests.
• dynamic_analysis_unsafe: Met. "Heimdall is written in Rust; heimdall-core and heimdall-plain forbid unsafe code, and the other crates have none outside one test. The fuzz targets run under cargo-fuzz's default AddressSanitizer."
• dynamic_analysis_enable_assertions: Met. cargo test and the fuzz builds run with debug assertions and overflow checks.
• dynamic_analysis_fixed: N/A. "No dynamic-analysis finding of medium or higher severity is open."

Still Unmet, and what would meet it

Only the first four block the badge; the two SUGGESTED rows do not.