diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md new file mode 100644 index 0000000..dbcc916 --- /dev/null +++ b/CONTRIBUTING.md @@ -0,0 +1,38 @@ +# Contributing to Crypt::OpenSSL::RSA + +Thank you for your interest in contributing! + +## Getting Started + +```bash +# Install build dependencies +cpanm --notest Crypt::OpenSSL::Guess Crypt::OpenSSL::Random + +# Build and test +perl Makefile.PL && make && make test +``` + +## Reporting Bugs + +Please open an issue at https://github.com/cpan-authors/Crypt-OpenSSL-RSA/issues with: +- Your Perl version (`perl -v`) +- Your OpenSSL version (`openssl version`) +- A minimal reproducing script + +## Submitting Changes + +1. Fork the repository +2. Create a feature branch +3. Write tests for your changes +4. Run the full test suite (`make test`) +5. Submit a pull request + +## Code Style + +- Follow existing conventions in the codebase +- XS changes must compile cleanly on OpenSSL 1.0.x, 1.1.x, 3.x, and LibreSSL +- Use preprocessor conditionals to handle version differences (see `RSA.xs`) + +## Security Issues + +For security vulnerabilities, please see [SECURITY.md](SECURITY.md) instead of opening a public issue. diff --git a/MANIFEST b/MANIFEST index e02a384..bae4102 100644 --- a/MANIFEST +++ b/MANIFEST @@ -1,5 +1,6 @@ AI_POLICY.md Changes +CONTRIBUTING.md hints/MSWin32.pl LICENSE Makefile.PL @@ -9,6 +10,7 @@ README README.md RSA.pm RSA.xs +SECURITY.md t/bignum.t t/check_param.t t/crypto.t diff --git a/Makefile.PL b/Makefile.PL index 7fb2978..ac5159f 100644 --- a/Makefile.PL +++ b/Makefile.PL @@ -40,6 +40,12 @@ WriteMakefile( 'dist' => { COMPRESS => 'gzip -9f', SUFFIX => 'gz', }, 'clean' => { FILES => 'Crypt-OpenSSL-RSA-*' }, 'META_MERGE' => { + provides => { + 'Crypt::OpenSSL::RSA' => { + file => 'RSA.pm', + version => MM->parse_version('RSA.pm'), + }, + }, recommends => { 'Crypt::OpenSSL::Bignum' => 0, }, diff --git a/SECURITY.md b/SECURITY.md new file mode 100644 index 0000000..344e82f --- /dev/null +++ b/SECURITY.md @@ -0,0 +1,24 @@ +# Security Policy + +## Reporting a Vulnerability + +If you discover a security vulnerability in Crypt::OpenSSL::RSA, please report it responsibly. + +**Preferred:** Use [GitHub's private vulnerability reporting](https://github.com/cpan-authors/Crypt-OpenSSL-RSA/security/advisories/new) to submit a report directly on GitHub. + +**Alternative:** Email Todd Rinaldo + +Please include: +- A description of the vulnerability +- Steps to reproduce the issue +- Any relevant version or platform details + +We will acknowledge receipt within 48 hours and aim to provide an initial assessment within one week. + +## Supported Versions + +Security fixes are applied to the latest release. Users are encouraged to keep their installation up to date. + +## Scope + +This module is a Perl XS wrapper around OpenSSL's RSA implementation. Vulnerabilities in OpenSSL itself should be reported to the [OpenSSL security team](https://www.openssl.org/policies/secpolicy.html).