TODO.txt

================================================================================
        Infinite Noise TRNG — OpenSSL 3.x Provider: TODO
================================================================================

Deferred work.  Not blocking alpha; worth doing before beta or first
signed release.


Packaging
  [ ] AUR package (infnoise-provider-git and/or versioned)
  [x] examples/python_demo.py — Python cryptography keygen via OpenSSL.
      Tested in a podman container with USB device passthrough; the
      Python script generates a 2048-bit RSA key through libcrypto
      seeded by the Infnoise provider.
  [x] examples/systemd-drop-in.conf — systemd drop-in pattern that
      scopes OPENSSL_CONF to a single service; covers the nginx case
      explicitly and works for any unit.  Tested by installing under
      /etc/systemd/system/<unit>.service.d/, systemd-analyze verify
      passed, the service ran openssl rand through the drop-in
      config.
  [ ] Signed git tags (git tag -s)
  [ ] Signed release tarballs + PGP fingerprint in README
      (signing model documented in docs/Governance.txt §3)


Documentation
  [x] docs/FAQ.txt — Provider vs. ENGINE, vs. /dev/hwrng + rngd, TLS
      speed, daemon coexistence, runtime unplug recovery, kernel
      CSPRNG comparison.
  [x] Drop the INFNOISE_PATCHED compile-time bridge.  Provider now
      hard-requires per-context state and signed-rc readData; a
      #ifndef INFNOISE_KECCAK_STATE_SIZE / #error guards the build.
      Both patches merged into waywardgeek/infnoise master on
      2026-05-15 (#121, #122); any libinfnoise built from upstream
      master onwards satisfies the build.
  [x] docs/Fuzz_Coverage.txt — per-function coverage report (96.1%).
  [x] docs/Security_Review.txt — brief for an external cryptographic
      reviewer covering scope, threat model, and six concrete claims
      to verify.
  [x] docs/Governance.txt — single-maintainer model, authentication
      controls, signing-key plan, key/account-compromise procedure.
  [x] docs/Build_Security.txt §3 — reproducibility status (honest
      "not yet pursued") and §4 — SBOM generation via `make sbom`.
  [x] SECURITY.md — full triage workflow with P0/P1/P2 SLAs,
      safe-harbour clause, no-bug-bounty stance, key-compromise
      pointer.


CI and testing
  [x] GitHub Actions: CodeQL (security-and-quality) on push + PR + weekly
  [x] GitHub Actions: GCC + Clang build matrix
  [x] GitHub Actions: ASan + UBSan sanitizer builds
  [x] GitHub Actions: cppcheck on push/PR
  [x] GitHub Actions: Coverity Scan (weekly cron)
  [x] CIFuzz workflow — runs all 4 libFuzzer targets on every PR
      (60 s/target) and push (120 s/target); replays the regression
      inputs under tests/fuzz/regressions/ before the timed runs so a
      regression of a fixed bug fails fast.  (Was 5 targets; the
      fuzz_params boundary harness was retired as redundant with
      fuzz_dispatch's state-machine sequencer.)
  [x] make test-tsan — ThreadSanitizer concurrency stress.
  [x] make test-alloc — allocator-failure injection (4 sites).
  [x] make sbom — SPDX-2.3 software bill of materials.
  [x] Fuzz corpus persistence (tests/fuzz/corpus/<harness>/, ~505 files).
  [-] OpenSSF Scorecard — intentionally NOT used.  Removed in PR #7;
      structural single-maintainer factors (no co-maintainer, no
      signed releases yet, no published package, single-person
      review) prevent a credible 10/10 score.  Best Practices badge
      already covers what Scorecard credibly checks at this stage.
  [ ] OSS-Fuzz onboarding (continuous fuzzing + MSan-instrumented
      libcrypto; deferred until shortly before first signed release)
  [x] CHANGELOG.md (Keep-a-Changelog 1.1.0).  [Unreleased] section
      tracks all post-v0.0.1-alpha work; will be promoted to a
      version heading at first signed release.


Release discipline
  [ ] First signed Release, gated on:
      [x] 24 h endurance run green (2026-04-24: 14698 generate calls,
          4.21 GiB, 49.9 KiB/s, 0 errors, 95 churn cycles, RSS +1.2 MiB
          peak, ended -1.0 MiB below start; see issue #8 and README)
      [x] libinfnoise dependency resolved upstream.  Per-context
          Keccak/health state and signed-int32_t readData() merged
          into waywardgeek/infnoise master on 2026-05-15 (#121, #122).
          Provider's #ifndef INFNOISE_KECCAK_STATE_SIZE / #error
          guard remains; no fork required.
      [ ] External cryptographic review per docs/Security_Review.txt
          (the only outstanding gate)


================================================================================