Security and supply chain: what you can check, and what is not done yet

What a security or procurement review of Cameleer or simoom needs: the licence, what is in a build, how images are built and attested, how to report a vulnerability, and the honest list of what has not been done.

question	answer
Licence	Apache License 2.0, every project, no closed parts.
Third-party dependencies	None. Cameleer and simoom are written on the Rust standard library only: TLS, X.509, HTTP/2, HTTP/3, the protocol clients and the parsers are their own code. CI fails Cameleer's build if any third-party crate appears in its SBOM.
What is in a build	A CycloneDX 1.5 SBOM of exactly what a build compiles in, generated from `cargo tree` (`scripts/sbom.py`) and checked in CI.
Container images	`cameleering/cameleer` on Docker Hub and `ghcr.io/cameleering/cameleer`: an SBOM, max-mode build provenance and a GitHub attestation on every push. Verify with `gh attestation verify oci://ghcr.io/cameleering/cameleer:latest --owner cameleering` (deployment guide).
TLS	simoom: certificate verification cannot be turned off. Cameleer: TLS 1.3 and 1.2 with X.509 path validation; the policy for its options is in the TLS and security guide.
Unsafe code	simoom: every crate except `simoom-sys` is `#![forbid(unsafe_code)]`.
Reporting a vulnerability	Privately, through GitHub's vulnerability reporting on the affected repository, never in a public issue. The policy is in SECURITY.md.

Not done yet

No independent security audit of the from-scratch cryptography and protocol code (TLS state machine, X.509 path validation, SSH, XML security) has been done. It is planned, along with fuzzing of the parsers.
Signed release archives (each with a SHA-256 checksum, an SBOM and a keyless cosign signature) arrive with the next release; 0.6.0 ships as images and crates only.
Both projects are pre-1.0 and maintained by one person. Fixes go to the main branch.

Confidential computing (attestation of what a Cameleer process runs) is a Cameleer feature: confidential integrations.

Common questions

Has the cryptography been audited?

Not yet. The from-scratch TLS, X.509, SSH and XML security code has had no independent audit; one is planned, along with fuzzing of the parsers. The projects publish this openly so a reviewer can weigh it.

How do I report a vulnerability?

Privately through GitHub's vulnerability reporting on the affected repository, not in a public issue.