Security

Report vulnerabilities privately and verify release artifacts before using them. See the security model for runtime credentials, network binding and elevated permissions.

Report a vulnerabilityCopy Anchor Link

Don't report security vulnerabilities through public GitHub issues. Use GitHub Private Vulnerability Reporting instead. You'll get a response within 48 hours.

Include:

• A description of the vulnerability
• Steps to reproduce
• Affected versions
• Potential impact

The maintainers coordinate disclosure timing with reporters and prefer at least 90 days before public disclosure.

Supported versionsCopy Anchor Link

Security fixes target the latest stable release. Update to that release before checking whether a reported vulnerability affects your installation.

Release scanningCopy Anchor Link

Releases are blocked if the scan finds critical or high severity vulnerabilities. The release workflow runs Grype against the kftray SBOM, the kftui SBOM and the kftray-server image before it publishes.

To run the same scan locally, use the mise task:

mise run sbom:scan-all

The task builds the SBOMs for kftray, kftui and kftray-server, scans each one and fails on high or critical findings. It writes vuln-report-*.json and sbom-*.cdx.json files in the repository root. mise run precommit runs it too. See Development for the other tasks.

Renovate opens the dependency updates, including the pinned versions of Syft and Grype in .mise.toml.

Security artifactsCopy Anchor Link

Each release includes an SBOM, a Cosign bundle and a vulnerability report for each artifact. The SBOMs use the CycloneDX format. The mise tasks build them with Syft, cargo-cyclonedx and sbomasm.

Two more files cover all artifacts:

The links point to the latest release. Replace latest/download with download/<tag> for a specific version.

Verify release artifactsCopy Anchor Link

You need the GitHub CLI for attestations and Cosign for SBOMs and VEX.

Build provenanceCopy Anchor Link

The release workflow creates GitHub build provenance attestations for the release artifacts and the container image. Check them with gh attestation verify: Replace <version> with the downloaded AppImage's version.

# Docker image
gh attestation verify oci://ghcr.io/hcavarsan/kftray-server:latest --owner hcavarsan

# CLI binary
gh attestation verify kftui_linux_amd64.tar.gz --owner hcavarsan

# Desktop app
gh attestation verify 'kftray_<version>_amd64.AppImage' --owner hcavarsan

SBOM signaturesCopy Anchor Link

The SBOMs and the VEX document are signed with Cosign keyless signing and the v3 bundle format. This example verifies the kftray SBOM:

curl -LO https://github.com/hcavarsan/kftray/releases/latest/download/sbom-kftray.cdx.json
curl -LO https://github.com/hcavarsan/kftray/releases/latest/download/sbom-kftray.cdx.json.bundle.json

cosign verify-blob \
  --bundle sbom-kftray.cdx.json.bundle.json \
  --certificate-identity-regexp "https://github.com/hcavarsan/kftray" \
  --certificate-oidc-issuer "https://token.actions.githubusercontent.com" \
  sbom-kftray.cdx.json

Replace kftray with kftui or kftray-server to verify the other SBOMs.

VEX signatureCopy Anchor Link

curl -LO https://github.com/hcavarsan/kftray/releases/latest/download/default.vex.openvex.json
curl -LO https://github.com/hcavarsan/kftray/releases/latest/download/default.vex.openvex.json.bundle.json

cosign verify-blob \
  --bundle default.vex.openvex.json.bundle.json \
  --certificate-identity-regexp "https://github.com/hcavarsan/kftray" \
  --certificate-oidc-issuer "https://token.actions.githubusercontent.com" \
  default.vex.openvex.json

Linux packagesCopy Anchor Link

The Debian, Ubuntu, Fedora, openSUSE and Arch Linux packages come from the openSUSE Build Service and are signed with the project key of home:hencavarsan:kftray. The .repo files reference that key, the apt source pins it with signed-by and pacman trusts it after pacman-key --lsign-key. See Installation and Linux packaging.

Container imageCopy Anchor Link

The kftray-server image has these properties:

See Relay Server for the image configuration.

Build integrityCopy Anchor Link

The release workflow builds on GitHub Actions hosted runners and generates provenance with actions/attest-build-provenance. GitHub creates the attestation with its Sigstore-based attestation service. The project documents this setup as meeting SLSA Level 2 build requirements:

AcknowledgmentsCopy Anchor Link

The maintainers acknowledge reporters after coordinated disclosure.