GNU Astronomy Utilities (Gnuastro)

http://git.savannah.gnu.org/cgit/gnuastro.git

All Git repositories do this.

Every commit is given a unique version (based on `git describe'). Before major releases, we release tar-balls in this address: http://alpha.gnu.org/gnu/gnuastro/ . Once this tarball has been sufficiently tested and major bugs fixed do we make an official release. The full versioning of Gnuastro is discussed here: https://www.gnu.org/software/gnuastro/manual/html_node/Version-numbering.html

Gnuastro is version controlled with Git: http://git.savannah.gnu.org/cgit/gnuastro.git

Gnuastro does have a unique identifier for every commit (based on Git's `describe') and also major releases get a unique tag. For more, please see https://www.gnu.org/software/gnuastro/manual/html_node/Version-numbering.html

Gnuastro uses Git tags for major releases, see under the "Tag" title in this link: http://git.savannah.gnu.org/cgit/gnuastro.git

The Tag is then used for minor releases, as fully described here: https://www.gnu.org/software/gnuastro/manual/html_node/Version-numbering.html

Every major and alpha release of Gnuastro is announced in the `info-gnuastro' mailing list: http://lists.gnu.org/archive/html/info-gnuastro/

As you can see in each, the announcement comes with a full copy of this release's section in the NEWS file (which is human readable file, even for someone who doesn't know programming or Git). Also, the hashes for the tarballs so users can be sure that what they get is what we distributed.

The NEWS file in each release announcement describes all the important known vulnerabilities (bugs) that have been fixed: http://lists.gnu.org/archive/html/info-gnuastro/

Any anonymous user can post an issue on our "Support tracker": http://savannah.gnu.org/support/?func=additem&group=gnuastro . They can also send mails to bug-gnuastro:a:t:gnu.org or help-gnuastro:a:t:gnu.org.

For bugs: http://savannah.gnu.org/bugs/?group=gnuastro For tasks: http://savannah.gnu.org/task/?group=gnuastro

The full list of solved and unsolved bugs are available in the main project management webpage: http://savannah.gnu.org/bugs/?group=gnuastro

All the enhancements and their discussions are listed in our task tracker: http://savannah.gnu.org/task/?group=gnuastro

All the development discussions from all our trackers are distributed and archived through the gnuastro-devel mailing list: http://lists.gnu.org/archive/html/gnuastro-devel/

There is a "Report a Bug" section in out top webpage: https://www.gnu.org/software/gnuastro/#bug which discusses the process to inform us of any vulnerability.

Gnuastro is not a security software. If private issues must be discussed, users are encouraged to contact the maintainer directory (maintainer information is given on main webpage: https://www.gnu.org/software/gnuastro/

From the main project management webpage (https://savannah.gnu.org/projects/gnuastro/), it is visible that many bugs (all the important ones) are fixed almost immediately (as of mid May 2017: only 13 open from a total of 59). The rest are minor and will be fixed when the developers have time.

Gnuastro uses the GNU Build System (./configure',make', make check',make install'): https://www.gnu.org/software/gnuastro/manual/html_node/Quick-start.html

Gnuastro uses the GNU Build System (./configure',make', make check',make install'): https://www.gnu.org/software/gnuastro/manual/html_node/Quick-start.html

Gnuastro uses the GNU Build System (./configure',make', make check',make install'): https://www.gnu.org/software/gnuastro/manual/html_node/Quick-start.html

Gnuastro currently has 51 tests that are executed when the user runs `make check'.

Gnuastro uses `make check'.

It covers most of the basic operations, it would be ideal to cover all, but the developers don't have enough resources to invest in them, so we have designed it based on the major features.

Before each commit is pushed to the main repo a `make distcheck' is done and everything is checked. On major releases, it is tested as part of GNU Guix: http://hydra.gnu.org/job/gnu/master/gnuastro-0.2.x86_64-linux and Debian: https://packages.debian.org/sid/science/gnuastro . We do plan to include automatic continuous integration in the future.

With every major features, a test is added in the tests/' directory and thus tomake check'.

In the "Developing" chapter of the Gnuastro book, we try to discuss this with the developers or those interested: https://www.gnu.org/software/gnuastro/manual/html_node/Test-scripts.html

Gnuastro is built with the -Wall' flag: see AM_INIT_AUTOMAKE in ourconfigure.ac': http://git.savannah.gnu.org/cgit/gnuastro.git/tree/configure.ac

We fix any compiler warnings that we see or are reported to us to have a clean build.

That is correct, For example this commit: http://git.savannah.gnu.org/cgit/gnuastro.git/commit/?id=195fae5be4f3 where several compiler warning were reported to us and we immediately addressed them.

While the primary developer is an astronomer (not a security expert), Gnuastro has been designed with all the issues in this list in mind and actually applies all of them. Generally, in no time does Gnuastro need special privileges.

We use Valgrind for checking the dynamic memory allocations in Gnuastro.

We check every allocation and it is only used if a non-NULL pointer is returned by malloc' orcalloc'.

We fix such issues immediately.