matrix-org / matrix-org/gomatrixserverlib
gosec failures
Nobody has claimed this yet.
- Dominant language
- Go
- Stars
- 67
- Forks
- 60
- PR merge metrics
- No merged PRs in 30d
Description
From a comment from @arsh-7 in `.golangci.yml` (see https://github.com/matrix-org/gomatrixserverlib/pull/147):
> complains about weak cryptographic primitive sha1 and TLS InsecureSkipVerify set true in getTransport
We probably want to at least investigate whether we can fix these.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Review the gosec report referenced in .golangci.yml and the context from pull request #147. Trace getTransport and the sha1 usage to determine whether the weak primitive and TLS InsecureSkipVerify setting can be safely changed. Done means the findings are fixed or their security impact and required follow-up are clearly established.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- go
- Domain
- security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 35/100