ci: add Forgejo Actions test and security scan workflows

Uses reusable workflows from core/go-devops for Go testing
(with race detector and coverage) and security scanning
(govulncheck, gitleaks, trivy).

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

.forgejo/workflows/security-scan.yml

@@ -0,0 +1,12 @@
+name: Security Scan
+
+on:
+  push:
+    branches: [main, dev, 'feat/*']
+  pull_request:
+    branches: [main]
+
+jobs:
+  security:
+    uses: core/go-devops/.forgejo/workflows/security-scan.yml@main
+    secrets: inherit

.forgejo/workflows/test.yml

@@ -0,0 +1,14 @@
+name: Test
+
+on:
+  push:
+    branches: [main, dev]
+  pull_request:
+    branches: [main]
+
+jobs:
+  test:
+    uses: core/go-devops/.forgejo/workflows/go-test.yml@main
+    with:
+      race: true
+      coverage: true

AUDIT-INPUT-VALIDATION.md

@@ -1,164 +0,0 @@
-# Security Audit: Input Validation
-
-This document outlines the results of a security audit focused on input validation and sanitization within the Enchantrix project.
-
-## 1. Input Entry Points Inventory
-
-Untrusted input can enter the system through the following channels:
-
-### a. Command-Line Interface (`trix` CLI)
-- **Description**: The primary user-facing tool for interacting with the `.trix` format.
-- **Entry Points**:
-  - **Arguments**: Positional arguments are used for sigil names (`trix encode base64`) and the hash algorithm (`trix hash sha256`).
-  - **Flags**: Flags like `--input`, `--output`, and `--magic` provide file paths and configuration values.
-  - **Standard Input (stdin)**: The CLI reads data from stdin when the `--input` flag is omitted or set to `-`.
-
-### b. `.trix` File Format
-- **Description**: A binary container format for storing metadata and a payload.
-- **Entry Points**:
-  - **Magic Number (4 bytes)**: A user-defined identifier.
-  - **Header Length (4 bytes)**: An integer specifying the size of the JSON header.
-  - **JSON Header**: A metadata block that is unmarshaled into a `map[string]interface{}`. This is a significant entry point for structured, untrusted data.
-  - **Payload**: Arbitrary binary data.
-
-### c. Function Parameters in Public APIs
-- **Description**: The public functions in the `pkg/` directories can be consumed by other Go applications, making their parameters an entry point.
-- **Entry Points**:
-  - `trix.Decode(data []byte, ...)`: `data` is the raw, untrusted byte stream of a `.trix` file.
-  - `enchantrix.NewSigil(name string)`: The `name` string determines which sigil is created.
-  - `crypt.Service.Hash(lib HashType, payload string)`: `lib` and `payload` are user-provided.
-  - `crypt.Service` methods for RSA and PGP accept keys and data as byte slices.
-
----
-
-## 2. Validation Gaps Found
-
-The audit identified the following gaps in the current input validation mechanisms.
-
-### Gap 1: Unstructured JSON Header Parsing (DoS/Type Confusion)
-- **Vulnerability**: The `trix.Decode` function parses the JSON header into a `map[string]interface{}`. This provides no structure or type safety. An attacker can craft a header with unexpected data types (e.g., an array instead of a string for `checksum_algo`).
-- **Impact**: Subsequent code that performs type assertions on these map values (e.g., `header["encrypted"].(bool)`) will panic if the type is incorrect, leading to a **Denial of Service (DoS)**.
-
-### Gap 2: Resource Exhaustion via Gzip Decompression (Decompression Bomb)
-- **Vulnerability**: The `enchantrix.GzipSigil.Out` method reads the entire decompressed stream into memory without any limits (`io.ReadAll(r)`).
-- **Impact**: An attacker can create a small, highly-compressed file (a "decompression bomb") that, when decompressed, expands to an extremely large size. This will exhaust all available memory, causing a **Denial of Service (DoS)**.
-
-### Gap 3: Insufficient Validation on File Paths
-- **Vulnerability**: The CLI tool accepts file paths via the `--input` and `--output` flags. There is no validation to prevent path traversal attacks (`../../..`).
-- **Impact**: While the immediate risk is low since the tool is user-run, if it were ever used in an automated or server-side context, an attacker could potentially read or overwrite arbitrary files on the system.
-
-### Gap 4: Information Leak in Error Messages
-- **Vulnerability**: The error message for an invalid magic number in `trix.Decode` reveals both the expected and received values (`fmt.Errorf("%w: expected %s, got %s", ...)`).
-- **Impact**: This provides minor but unnecessary information to an attacker about the file format's internal structure.
-
----
-
-## 3. Injection Vectors Discovered
-
-Based on the identified gaps, the following injection vectors exist:
-
-- **DoS via Malformed Header**: Craft a `.trix` file with a JSON header containing invalid value types for keys like `encrypted` or `checksum_algo`. When the `trix` CLI or any service using `trix.Decode` attempts to process this file, it will crash.
-- **DoS via Decompression Bomb**: Craft a compressed `.trix` file using the `gzip` sigil. Feed this file to the `trix decode gzip` command. The process will consume excessive memory and crash.
-- **Path Traversal**: While not an "injection" in the traditional sense, providing an output path like `/etc/passwd` to the `trix encode` command on a system with improper permissions could lead to file corruption.
-
----
-
-## 4. Remediation Recommendations
-
-The following actions are recommended to close the identified validation gaps.
-
-### a. Remediate Unstructured JSON Header
-- **Recommendation**: Replace the `map[string]interface{}` with a strictly-typed `Header` struct. Use this struct as the target for `json.Unmarshal`. This enforces schema validation at the parsing stage.
-- **Code Example (`pkg/trix/trix.go`)**:
-
-```go
-// Create a new Header struct
-type Header struct {
-    Checksum     string `json:"checksum,omitempty"`
-    ChecksumAlgo string `json:"checksum_algo,omitempty"`
-    Encrypted    bool   `json:"encrypted,omitempty"`
-    // Add other expected header fields here...
-}
-
-// Update the Trix struct
-type Trix struct {
-    Header  Header // Use the struct instead of map
-    Payload []byte
-    // ... rest of the struct
-}
-
-// In trix.Decode function:
-// ...
-var header Header // Use the new struct type
-if err := json.Unmarshal(headerBytes, &header); err != nil {
-    return nil, err // Let the JSON parser handle validation
-}
-// ...
-```
-
-### b. Remediate Gzip Decompression Bomb
-- **Recommendation**: Use an `io.LimitedReader` to restrict the amount of data that can be read from the gzip stream, preventing memory exhaustion.
-- **Code Example (`pkg/enchantrix/sigils.go`)**:
-
-```go
-// In GzipSigil.Out method:
-func (s *GzipSigil) Out(data []byte) ([]byte, error) {
-    if data == nil {
-        return nil, nil
-    }
-    r, err := gzip.NewReader(bytes.NewReader(data))
-    if err != nil {
-        return nil, err
-    }
-    defer r.Close()
-
-    // Limit the output to a reasonable size, e.g., 32MB
-    const maxDecompressedSize = 32 * 1024 * 1024
-    limitedReader := &io.LimitedReader{R: r, N: maxDecompressedSize}
-
-    decompressedData, err := io.ReadAll(limitedReader)
-    if err != nil {
-        return nil, err
-    }
-
-    // Check if the limit was reached
-    if limitedReader.N == 0 {
-        return nil, errors.New("enchantrix: decompressed data exceeds size limit")
-    }
-
-    return decompressedData, nil
-}
-```
-
-### c. Remediate Path Traversal
-- **Recommendation**: Before using file paths from user input, they should be cleaned and validated to ensure they are not malicious. At a minimum, use `filepath.Clean`. For stronger security, ensure the resolved path is within an expected base directory.
-- **Code Example (`cmd/trix/main.go`)**:
-
-```go
-import "path/filepath"
-
-func handleEncode(cmd *cobra.Command, inputFile, outputFile, ...
-    // ...
-    // Clean the output path
-    safeOutputFile := filepath.Clean(outputFile)
-    if outputFile != "" && safeOutputFile != outputFile {
-        return fmt.Errorf("invalid output path")
-    }
-    // Use safeOutputFile for writing
-    return ioutil.WriteFile(safeOutputFile, encoded, 0644)
-}
-```
-*(Apply similar logic to all file handling functions)*
-
-### d. Remediate Leaky Error Messages
-- **Recommendation**: Make error messages less specific to external users.
-- **Code Example (`pkg/trix/trix.go`)**:
-
-```go
-// In trix.Decode function
-if string(magic) != magicNumber {
-    // OLD: return nil, fmt.Errorf("%w: expected %s, got %s", ErrInvalidMagicNumber, magicNumber, string(magic))
-    // NEW:
-    return nil, ErrInvalidMagicNumber
-}
-```

cmd/trix/main.go

@@ -5,9 +5,9 @@ import (
 	"io/ioutil"
 	"os"
 
-	"github.com/Snider/Enchantrix/pkg/crypt"
-	"github.com/Snider/Enchantrix/pkg/enchantrix"
-	"github.com/Snider/Enchantrix/pkg/trix"
+	"forge.lthn.ai/Snider/Enchantrix/pkg/crypt"
+	"forge.lthn.ai/Snider/Enchantrix/pkg/enchantrix"
+	"forge.lthn.ai/Snider/Enchantrix/pkg/trix"
 	"github.com/spf13/cobra"
 )
 

examples/checksums/main.go

@@ -9,7 +9,7 @@ package main
 import (
 	"fmt"
 
-	"github.com/Snider/Enchantrix/pkg/crypt"
+	"forge.lthn.ai/Snider/Enchantrix/pkg/crypt"
 )
 
 func main() {

examples/hash/main.go

@@ -9,7 +9,7 @@ package main
 import (
 	"fmt"
 
-	"github.com/Snider/Enchantrix/pkg/crypt"
+	"forge.lthn.ai/Snider/Enchantrix/pkg/crypt"
 )
 
 func main() {

examples/pgp_encrypt_decrypt/main.go

@@ -11,7 +11,7 @@ import (
 	"fmt"
 	"log"
 
-	"github.com/Snider/Enchantrix/pkg/crypt"
+	"forge.lthn.ai/Snider/Enchantrix/pkg/crypt"
 )
 
 func main() {

examples/pgp_generate_keys/main.go

@@ -11,7 +11,7 @@ import (
 	"fmt"
 	"log"
 
-	"github.com/Snider/Enchantrix/pkg/crypt"
+	"forge.lthn.ai/Snider/Enchantrix/pkg/crypt"
 )
 
 func main() {

examples/pgp_sign_verify/main.go

@@ -11,7 +11,7 @@ import (
 	"fmt"
 	"log"
 
-	"github.com/Snider/Enchantrix/pkg/crypt"
+	"forge.lthn.ai/Snider/Enchantrix/pkg/crypt"
 )
 
 func main() {

examples/pgp_symmetric_encrypt/main.go

@@ -11,7 +11,7 @@ import (
 	"fmt"
 	"log"
 
-	"github.com/Snider/Enchantrix/pkg/crypt"
+	"forge.lthn.ai/Snider/Enchantrix/pkg/crypt"
 )
 
 func main() {

examples/rsa/main.go

@@ -12,7 +12,7 @@ import (
 	"fmt"
 	"log"
 
-	"github.com/Snider/Enchantrix/pkg/crypt"
+	"forge.lthn.ai/Snider/Enchantrix/pkg/crypt"
 )
 
 func main() {

examples/sigils/main.go

@@ -11,7 +11,7 @@ import (
 	"fmt"
 	"log"
 
-	"github.com/Snider/Enchantrix/pkg/enchantrix"
+	"forge.lthn.ai/Snider/Enchantrix/pkg/enchantrix"
 )
 
 func main() {

examples/trix_container/main.go

@@ -12,8 +12,8 @@ import (
 	"log"
 	"time"
 
-	"github.com/Snider/Enchantrix/pkg/crypt"
-	"github.com/Snider/Enchantrix/pkg/trix"
+	"forge.lthn.ai/Snider/Enchantrix/pkg/crypt"
+	"forge.lthn.ai/Snider/Enchantrix/pkg/trix"
 )
 
 func main() {

go.mod

@@ -1,20 +1,23 @@
-module github.com/Snider/Enchantrix
+module forge.lthn.ai/Snider/Enchantrix
 
 go 1.25
 
 require (
 	github.com/ProtonMail/go-crypto v1.3.0
-	github.com/spf13/cobra v1.10.1
+	github.com/spf13/cobra v1.10.2
 	github.com/stretchr/testify v1.11.1
-	golang.org/x/crypto v0.43.0
+	golang.org/x/crypto v0.48.0
 )
 
 require (
-	github.com/cloudflare/circl v1.6.0 // indirect
-	github.com/davecgh/go-spew v1.1.1 // indirect
+	github.com/cloudflare/circl v1.6.3 // indirect
+	github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc // indirect
 	github.com/inconshreveable/mousetrap v1.1.0 // indirect
-	github.com/pmezard/go-difflib v1.0.0 // indirect
-	github.com/spf13/pflag v1.0.9 // indirect
-	golang.org/x/sys v0.37.0 // indirect
+	github.com/kr/pretty v0.3.1 // indirect
+	github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 // indirect
+	github.com/rogpeppe/go-internal v1.14.1 // indirect
+	github.com/spf13/pflag v1.0.10 // indirect
+	golang.org/x/sys v0.41.0 // indirect
+	gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c // indirect
 	gopkg.in/yaml.v3 v3.0.1 // indirect
 )

go.sum

@@ -1,26 +1,23 @@
 github.com/ProtonMail/go-crypto v1.3.0 h1:ILq8+Sf5If5DCpHQp4PbZdS1J7HDFRXz/+xKBiRGFrw=
 github.com/ProtonMail/go-crypto v1.3.0/go.mod h1:9whxjD8Rbs29b4XWbB8irEcE8KHMqaR2e7GWU1R+/PE=
-github.com/cloudflare/circl v1.6.0 h1:cr5JKic4HI+LkINy2lg3W2jF8sHCVTBncJr5gIIq7qk=
-github.com/cloudflare/circl v1.6.0/go.mod h1:uddAzsPgqdMAYatqJ0lsjX1oECcQLIlRpzZh3pJrofs=
+github.com/cloudflare/circl v1.6.3 h1:9GPOhQGF9MCYUeXyMYlqTR6a5gTrgR/fBLXvUgtVcg8=
 github.com/cpuguy83/go-md2man/v2 v2.0.6/go.mod h1:oOW0eioCTA6cOiMLiUPZOpcVxMig6NIQQ7OS05n1F4g=
-github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
-github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
+github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc h1:U9qPSI2PIWSS1VwoXQT9A3Wy9MM3WgvqSxFWenqJduM=
 github.com/inconshreveable/mousetrap v1.1.0 h1:wN+x4NVGpMsO7ErUn/mUI3vEoE6Jt13X2s0bqwp9tc8=
 github.com/inconshreveable/mousetrap v1.1.0/go.mod h1:vpF70FUmC8bwa3OWnCshd2FqLfsEA9PFc4w1p2J65bw=
-github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
-github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
+github.com/kr/pretty v0.3.1 h1:flRD4NNwYAUpkphVc1HcthR4KEIFJ65n8Mw5qdRn3LE=
+github.com/kr/text v0.2.0 h1:5Nx0Ya0ZqY2ygV366QzturHI13Jq95ApcVaJBhpS+AY=
+github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 h1:Jamvg5psRIccs7FGNTlIRMkT8wgtp5eCXdBlqhYGL6U=
+github.com/rogpeppe/go-internal v1.14.1 h1:UQB4HGPB6osV0SQTLymcB4TgvyWu6ZyliaW0tI/otEQ=
 github.com/russross/blackfriday/v2 v2.1.0/go.mod h1:+Rmxgy9KzJVeS9/2gXHxylqXiyQDYRxCVz55jmeOWTM=
-github.com/spf13/cobra v1.10.1 h1:lJeBwCfmrnXthfAupyUTzJ/J4Nc1RsHC/mSRU2dll/s=
-github.com/spf13/cobra v1.10.1/go.mod h1:7SmJGaTHFVBY0jW4NXGluQoLvhqFQM+6XSKD+P4XaB0=
-github.com/spf13/pflag v1.0.9 h1:9exaQaMOCwffKiiiYk6/BndUBv+iRViNW+4lEMi0PvY=
+github.com/spf13/cobra v1.10.2 h1:DMTTonx5m65Ic0GOoRY2c16WCbHxOOw6xxezuLaBpcU=
 github.com/spf13/pflag v1.0.9/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
+github.com/spf13/pflag v1.0.10 h1:4EBh2KAYBwaONj6b2Ye1GiHfwjqyROoF4RwYO+vPwFk=
 github.com/stretchr/testify v1.11.1 h1:7s2iGBzp5EwR7/aIZr8ao5+dra3wiQyKjjFuvgVKu7U=
 github.com/stretchr/testify v1.11.1/go.mod h1:wZwfW3scLgRK+23gO65QZefKpKQRnfz6sD981Nm4B6U=
-golang.org/x/crypto v0.43.0 h1:dduJYIi3A3KOfdGOHX8AVZ/jGiyPa3IbBozJ5kNuE04=
-golang.org/x/crypto v0.43.0/go.mod h1:BFbav4mRNlXJL4wNeejLpWxB7wMbc79PdRGhWKncxR0=
-golang.org/x/sys v0.37.0 h1:fdNQudmxPjkdUTPnLn5mdQv7Zwvbvpaxqs831goi9kQ=
-golang.org/x/sys v0.37.0/go.mod h1:OgkHotnGiDImocRcuBABYBEXf8A9a87e/uXjp9XT3ks=
-gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405 h1:yhCVgyC4o1eVCa2tZl7eS0r+SDo693bJlVdllGtEeKM=
+golang.org/x/crypto v0.48.0 h1:/VRzVqiRSggnhY7gNRxPauEQ5Drw9haKdM0jqfcCFts=
+golang.org/x/sys v0.41.0 h1:Ivj+2Cp/ylzLiEU89QhWblYnOE9zerudt9Ftecq2C6k=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
+gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c h1:Hei/4ADfdWqJk1ZMxUNpqntNwaWcugrBjAiHlqqRiVk=
 gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
 gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=

pkg/crypt/crypt.go

@@ -11,9 +11,9 @@ import (
 	"strconv"
 	"strings"
 
-	"github.com/Snider/Enchantrix/pkg/crypt/std/lthn"
-	"github.com/Snider/Enchantrix/pkg/crypt/std/pgp"
-	"github.com/Snider/Enchantrix/pkg/crypt/std/rsa"
+	"forge.lthn.ai/Snider/Enchantrix/pkg/crypt/std/lthn"
+	"forge.lthn.ai/Snider/Enchantrix/pkg/crypt/std/pgp"
+	"forge.lthn.ai/Snider/Enchantrix/pkg/crypt/std/rsa"
 )
 
 // Service is the main struct for the crypt service.

pkg/crypt/crypt_test.go

@@ -4,7 +4,7 @@ import (
 	"strings"
 	"testing"
 
-	"github.com/Snider/Enchantrix/pkg/crypt"
+	"forge.lthn.ai/Snider/Enchantrix/pkg/crypt"
 	"github.com/stretchr/testify/assert"
 )
 

pkg/crypt/examples_test.go

@@ -4,7 +4,7 @@ import (
 	"fmt"
 	"log"
 
-	"github.com/Snider/Enchantrix/pkg/crypt"
+	"forge.lthn.ai/Snider/Enchantrix/pkg/crypt"
 )
 
 func ExampleService_Hash() {

pkg/enchantrix/enchantrix_test.go

@@ -4,7 +4,7 @@ import (
 	"errors"
 	"testing"
 
-	"github.com/Snider/Enchantrix/pkg/enchantrix"
+	"forge.lthn.ai/Snider/Enchantrix/pkg/enchantrix"
 	"github.com/stretchr/testify/assert"
 )
 

pkg/enchantrix/examples_test.go

@@ -4,7 +4,7 @@ import (
 	"fmt"
 	"log"
 
-	"github.com/Snider/Enchantrix/pkg/enchantrix"
+	"forge.lthn.ai/Snider/Enchantrix/pkg/enchantrix"
 )
 
 func ExampleTransmute() {

pkg/trix/crypto.go

@@ -4,7 +4,7 @@ import (
 	"errors"
 	"time"
 
-	"github.com/Snider/Enchantrix/pkg/enchantrix"
+	"forge.lthn.ai/Snider/Enchantrix/pkg/enchantrix"
 )
 
 var (

pkg/trix/crypto_test.go

@@ -4,7 +4,7 @@ import (
 	"bytes"
 	"testing"
 
-	"github.com/Snider/Enchantrix/pkg/trix"
+	"forge.lthn.ai/Snider/Enchantrix/pkg/trix"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 )

pkg/trix/examples_test.go

@@ -4,8 +4,8 @@ import (
 	"fmt"
 	"log"
 
-	"github.com/Snider/Enchantrix/pkg/crypt"
-	"github.com/Snider/Enchantrix/pkg/trix"
+	"forge.lthn.ai/Snider/Enchantrix/pkg/crypt"
+	"forge.lthn.ai/Snider/Enchantrix/pkg/trix"
 )
 
 func ExampleEncode() {

pkg/trix/trix.go

@@ -28,8 +28,8 @@ import (
 	"fmt"
 	"io"
 
-	"github.com/Snider/Enchantrix/pkg/crypt"
-	"github.com/Snider/Enchantrix/pkg/enchantrix"
+	"forge.lthn.ai/Snider/Enchantrix/pkg/crypt"
+	"forge.lthn.ai/Snider/Enchantrix/pkg/enchantrix"
 )
 
 const (

pkg/trix/trix_test.go

@@ -8,8 +8,8 @@ import (
 	"reflect"
 	"testing"
 
-	"github.com/Snider/Enchantrix/pkg/crypt"
-	"github.com/Snider/Enchantrix/pkg/trix"
+	"forge.lthn.ai/Snider/Enchantrix/pkg/crypt"
+	"forge.lthn.ai/Snider/Enchantrix/pkg/trix"
 	"github.com/stretchr/testify/assert"
 )