[Spomky]

Enrol projects/cbor-php

I have verified each of the following before submitting this project (tick each box by changing [ ] to [x]):

• I am a core maintainer of this project.
• I accept the OSS Scanner terms.
• I confirm that I believe my project meets the inclusion criteria and is an established project that users depend on.
• project.yaml follows the README (one project per PR; tools/validate.py passes locally).
• tools/check cbor-php builds the project, and its tests run in the shell that follows.
• primary_contact must be the email address of the primary security contact.
• There is a Dockerfile that builds the project (required) in one of two places: in the project's repository at the path dockerfile: names, or next to project.yaml in this repo.
• threat_model.md is written for this project (recommended but optional), placed in the same way: in the repository at the path threat_model: names, or next to project.yaml in this repo.

To sign the CLA, post a comment on this pull request that contains only this line: I have read the CLA Document and I hereby sign the CLA

To change an enrolment, edit project.yaml; to pause reports, set disabled: true; to withdraw the project, remove projects/<name>/.

Context (optional): if you believe it is not obvious why your project qualifies for our inclusion criteria, you may write a brief note here to explain why you feel it does.

cbor-php is a CBOR (RFC 8949) encoder and decoder for PHP, with the RFC 8746 typed arrays and the common tags (since 2018, about 33 million installs on Packagist, 46 dependent packages). It decodes attacker-controlled bytes in webauthn-lib (attestation objects, COSE keys, authenticator extensions) and in COSE and CWT consumers. Findings located in dependencies are dropped when webauthn-framework is scanned, hence its own enrolment.

I am the author and lead maintainer, and I already enrolled webauthn-framework (#1255) and otphp (#1256) with the same contact and key. The Dockerfile and threat_model.md live in the repository under .oss-scanner/ on 3.5.x, the default branch (added in Spomky-Labs/cbor-php#180). primary_contact is the address SECURITY.md gives for reports. Email reports are encrypted to its key (fingerprint 8B8D 93A9 7A2B 90D8 E107 C0B7 3CDF 5772 4C47 D90E, also on keys.openpgp.org), and GitHub private vulnerability reporting, enabled on the repository, receives high and critical findings.

The image built from .oss-scanner/Dockerfile runs the suite with --network none: PHPUnit OK (1183 tests, 2541 assertions).

[github-actions]

All contributors have signed the CLA ✍️ ✅
_{Posted by the CLA Assistant Lite bot.}

[github-actions]

Enrolment triage: projects/cbor-php

Repository: Spomky-Labs/cbor-php · opened by Spomky

	Check	Result
✅	Repository	created 8 years ago, last push today
ℹ️	Stars / forks	61 stars · 14 forks · 2 watching
ℹ️	Outside participants	15 people from outside the project opened 16 of the last 75 issues and pull requests
ℹ️	Criticality score	0.47 on the OpenSSF scale of 0 to 1 signals created_since 105, updated_since 0, contributor_count 7, org_count 5, commit_frequency 2.3, recent_releases_count 13, closed_issues_count 40, updated_issues_count 40, comment_frequency 0.4, dependents_count 95
ℹ️	Package rank	no Python, JavaScript or Rust in the repository, so not looked for on PyPI, npm or crates.io
✅	License	MIT
✅	Opened by an active maintainer	member of the owning organisation; 91 commits in the last 12 months; #1 contributor
✅	Contact in SECURITY.md	security@spomky-labs.com is in SECURITY.md
ℹ️	OSS-Fuzz	not found in OSS-Fuzz
✅	.oss-scanner/ in the repository	present (Dockerfile, threat_model.md); Dockerfile at .oss-scanner/Dockerfile
✅	Pull request scope	only this project's directory
✅	tools/validate.py	passes
✅	Checklist	all 8 ticked

_{Automated, from public data, to help reviewers. Enrolment is decided case by case against the criteria. If you think we got something wrong, please tell us in a reply.}

[Spomky]

I have read the CLA Document and I hereby sign the CLA