Audit: security hardening and maintenance findings

Audit Findings — 2026-04-10

Comprehensive maintainability and security audit of the codebase.

Fixed (PR #17)

String eval qq{} in API.pm and Service.pm replaced with safe eval { require $file }
Symbolic reference string eval in DataAsYaml.pm replaced with no strict 'refs'
Removed defunct .travis.yml
Added .env*, .DS_Store, IDE dirs to .gitignore

Remaining Items

Bare die statements (medium) — 8 instances across Service.pm, Images.pm, and Specs/Roles/Service.pm use die without error messages. Makes debugging harder for users. (Partially addressed by PR fix: descriptive error messages and dead code removal #11)
Test coverage gaps (medium) — Routes.pm, API.pm factory, Service.pm internals, Helpers/DataAsYaml.pm, and Roles modules lack direct unit tests. Estimated ~60-70% coverage.
Version string validation (low) — BUILD_version() regex m{/(v[0-9\.]+)} is permissive. Could restrict to v\d+\.\d+ for robustness.

Notes

PR ci: fix Perl compat and modernize CI workflow #15 already addresses CI modernization (Perl version alignment, cpm@v2, platform fixes)
AUTOLOAD dispatch in Routes.pm is well-protected (whitelist from static YAML data block)
No hardcoded secrets found — credentials properly sourced from environment variables

🤖 Created by Kōan from audit session

Additional finding: delete_server() crashes on multi-homed VMs due to scalar context bug in port iteration. Fixed in PR #19.

test: add coverage for Routes, API factory, DataAsYaml, and Roles

PR #20 addresses the test coverage gaps item: 72 new assertions covering Routes.pm, API.pm factory, Helpers/DataAsYaml.pm, Listable/GetFromId roles, and Specs::Roles::Service.

Remaining items: bare die statements (medium), version string validation (low).

Status update — 2026-04-16

All three remaining items from this audit are now covered by open PRs:

Item	PR	Status
Bare `die` statements (8 instances)	#11	All fixed (Images.pm, Service.pm, Specs/Roles/Service.pm); GetFromId.pm dead code removed
Test coverage gaps (Routes/API/DataAsYaml/Roles)	#20	Direct unit tests added for all listed modules
Version string regex hardening (low)	—	Not yet PR'd; very low priority

Once PR #15 (CI Perl matrix fix) merges, the failing CI check across the queue should clear automatically — most subsequent PRs already pass on Perl 5.14+. That makes #15 the unblocking PR for review-merge throughput.

This issue can probably close after #11 and #20 land.

🤖 Status report by Kōan

Status Update — 2026-04-17

All remaining items from this audit are now addressed by open PRs:

Finding	Severity	Status	PR
String `eval qq{}` in API.pm and Service.pm	High	✅ Fixed	#17
Symbolic ref eval in DataAsYaml.pm	High	✅ Fixed	#17
Defunct `.travis.yml`	Low	✅ Removed	#17
`.gitignore` updates	Low	✅ Fixed	#17
Bare `die` statements (8 instances)	Medium	✅ Fixed	#11
Test coverage gaps (Routes, API factory, DataAsYaml, Roles)	Medium	✅ Added	#20
Version string validation (`BUILD_version()` regex)	Low	✅ Fixed	#25 (also fixes `root_uri()` returning undef for versioned endpoints)

Additional finding from session 33

root_uri() version detection bug (Service.pm:87) — the guard meant to prevent double-versioning of URLs used a regex that never matched real endpoints (:\d/v vs multi-digit ports) and returned undef instead of $uri on match. Fixed in PR #25.

All audit items are now tracked in PRs. This issue can be closed once the PRs are reviewed.

PR Review Priority Guide (18 open PRs)

All 18 PRs are mergeable with CI passing. Here's a suggested merge order to minimize conflicts:

Tier 1 — Independent, zero-conflict (merge in any order)

ci: fix Perl compat and modernize CI workflow #15 ci: fix Perl compat and modernize CI workflow
docs: add CLAUDE.md with project architecture guide #22 docs: add CLAUDE.md with project architecture guide
test: routing, filtering, and helper method coverage #14 test: routing, filtering, and helper method coverage (new test file only)
test: unit tests for Routes, API factory, DataAsYaml, and Roles #20 test: unit tests for Routes, API factory, DataAsYaml, and Roles (new test files only)
feat: paginate _list() across all OpenStack link styles #8 feat: paginate _list() across all OpenStack link styles (Listable.pm only)

Tier 2 — Small, focused fixes

security: replace string eval with safe module loading #17 security: replace string eval with safe module loading
fix: root_uri() version detection for real OpenStack endpoints #25 fix: root_uri() version detection
fix: image_from_name() dies on duplicate names instead of returning wrong type #23 fix: image_from_name() dies on duplicate names
fix: create_vm() detects ERROR status, fails fast with fault detail #24 fix: create_vm() detects ERROR status

Tier 3 — Broader changes (may need rebase after Tier 1-2)

fix: descriptive error messages and dead code removal #11 fix: descriptive error messages and dead code removal
fix: strict RFC 4122 UUID validation in *_from_uid methods #10 fix: strict RFC 4122 UUID validation
fix: specs correctness and comprehensive test coverage #12 fix: specs correctness and comprehensive test coverage
fix: Compute v2_0 specs and minor code cleanup #21 fix: Compute v2_0 specs and minor code cleanup

Tier 4 — Feature work (merge last)

fix: filter ports by network_id for floating IP attachment #7 fix: filter ports by network_id for floating IP
feat: expose wait_timeout and poll_interval to create_vm() #9 feat: expose wait_timeout and poll_interval to create_vm()
feat: extend specs with create/update/remove types #13 feat: extend specs with create/update/remove types
fix: create_vm robustness and cleanup #16 fix: create_vm robustness and cleanup
fix: delete_server() handles multi-homed VMs #19 fix: delete_server() handles multi-homed VMs

🤖 Generated by Kōan — PRs #7-10 rebased today to trigger CI.

fix: correct spec typos and remove dead data

Navigation Menu

Repository navigation

Audit: security hardening and maintenance findings #18

Audit Findings — 2026-04-10

Fixed (PR #17)

Remaining Items

Notes

Status update — 2026-04-16

Status Update — 2026-04-17

Additional finding from session 33

PR Review Priority Guide (18 open PRs)

Tier 1 — Independent, zero-conflict (merge in any order)

Tier 2 — Small, focused fixes

Tier 3 — Broader changes (may need rebase after Tier 1-2)

Tier 4 — Feature work (merge last)

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Audit: security hardening and maintenance findings #18

Description

Audit Findings — 2026-04-10

Fixed (PR #17)

Remaining Items

Notes

Activity

Koan-Bot commented on Apr 11, 2026

Koan-Bot commented on Apr 11, 2026

Koan-Bot commented on Apr 16, 2026

Status update — 2026-04-16

Koan-Bot commented on Apr 17, 2026

Status Update — 2026-04-17

Additional finding from session 33

Koan-Bot commented on Apr 20, 2026

PR Review Priority Guide (18 open PRs)

Tier 1 — Independent, zero-conflict (merge in any order)

Tier 2 — Small, focused fixes

Tier 3 — Broader changes (may need rebase after Tier 1-2)

Tier 4 — Feature work (merge last)

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions