{"id":32619966,"url":"https://github.com/sentientsergio/boost-safeprofile","last_synced_at":"2026-05-15T18:32:09.789Z","repository":{"id":319003482,"uuid":"1077170667","full_name":"sentientsergio/boost-safeprofile","owner":"sentientsergio","description":"C++ Safety Profile conformance analysis tool - A Boost candidate library for WG21 Safety Profiles adoption","archived":false,"fork":false,"pushed_at":"2025-10-17T01:20:05.000Z","size":1977,"stargazers_count":0,"open_issues_count":0,"forks_count":0,"subscribers_count":0,"default_branch":"main","last_synced_at":"2025-10-17T03:34:11.206Z","etag":null,"topics":["ast","boost","clang","code-quality","cpp","cpp-core-guidelines","cpp20","llvm","memory-safety","safety","sarif","security","static-analysis","wg21"],"latest_commit_sha":null,"homepage":null,"language":"C++","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"bsl-1.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/sentientsergio.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null,"notice":null,"maintainers":null,"copyright":null,"agents":null,"dco":null,"cla":null}},"created_at":"2025-10-15T22:00:32.000Z","updated_at":"2025-10-17T01:20:08.000Z","dependencies_parsed_at":null,"dependency_job_id":"da067d8b-cb9d-4926-a733-8647746cf4c6","html_url":"https://github.com/sentientsergio/boost-safeprofile","commit_stats":null,"previous_names":["sentientsergio/boost-safeprofile"],"tags_count":1,"template":false,"template_full_name":null,"purl":"pkg:github/sentientsergio/boost-safeprofile","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/sentientsergio%2Fboost-safeprofile","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/sentientsergio%2Fboost-safeprofile/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/sentientsergio%2Fboost-safeprofile/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/sentientsergio%2Fboost-safeprofile/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/sentientsergio","download_url":"https://codeload.github.com/sentientsergio/boost-safeprofile/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/sentientsergio%2Fboost-safeprofile/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":33074840,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-05-15T11:35:32.926Z","status":"ssl_error","status_checked_at":"2026-05-15T11:35:31.362Z","response_time":103,"last_error":"SSL_connect returned=1 errno=0 peeraddr=140.82.121.5:443 state=error: unexpected eof while reading","robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":false,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["ast","boost","clang","code-quality","cpp","cpp-core-guidelines","cpp20","llvm","memory-safety","safety","sarif","security","static-analysis","wg21"],"created_at":"2025-10-30T18:02:21.240Z","updated_at":"2026-05-15T18:32:09.783Z","avatar_url":"https://github.com/sentientsergio.png","language":"C++","funding_links":[],"categories":[],"sub_categories":[],"readme":"# Boost.SafeProfile\n\n![Boost.SafeProfile Banner](docs/assets/banner.png)\n\n\u003e **Status:** *Candidate Boost Tool* (proposed). This repository contains a developer-facing utility intended to support **WG21 Safety Profiles** adoption in C++ projects. See [`Requirements.md`](Requirements.md) for problem framing, audience, and scope.\n\n---\n\n## Overview\n\n**Why**  \nModern C++ teams face sustained pressure to reduce memory-safety defects. WG21 is standardizing **Safety Profiles** (opt-in, tool-checked subsets of C++) so projects can claim stronger guarantees with evidence. Teams need practical help to (1) assess conformance, (2) reduce annotation debt, and (3) produce **auditable evidence packs** for CI and reviews.  \n→ Full context in **[`Requirements.md`](./Requirements.md)**.\n\n**Who**  \n- Library authors (Boost and beyond) aiming for profile-clean libraries  \n- Product teams needing a certifiable safety story without rewrites  \n- Security/QA engineers verifying conformance  \n- Tooling \u0026 standards contributors gathering empirical feedback\n\n---\n\n## What this tool does (short)\n\n- **Analyze** a C++ codebase against a selected **Safety Profile** (WG21-aligned drafts or custom overlays)\n- **Report** precise findings (rule id, severity, locations) + **human-readable explanations**\n- **Suggest** minimal, non-destructive fixes (annotations, safer APIs)\n- **Emit** a reproducible **Evidence Pack** (machine + human reports, tool fingerprints, optional sanitizer/fuzzer artifacts)\n- **Gate** CI merges with deterministic exit codes and baselines\n- **Ingest** repositories directly (local or remote) for a one-command start\n\n\u003e The tool itself adheres to a documented Safe C++ subset and ships its **own** conformance evidence (see “Self-Conformance”).\n\n---\n\n## Quickstart\n\n**Current Status:** Tier 1 rules implemented (Ownership, Bounds, Type, Lifetime). See [Known Limitations](#known-limitations) below.\n\nAnalyze a local project:\n\n```bash\nbuild/boost-safeprofile ./path/to/project\n```\n\nGenerate SARIF output for CI/IDE integration:\n\n```bash\nbuild/boost-safeprofile --sarif output.sarif ./path/to/project\n```\n\nUse a specific profile:\n\n```bash\nbuild/boost-safeprofile --profile memory-safety ./path/to/project\n```\n\n**For projects with system includes:** Generate and provide a `compile_commands.json`:\n\n```bash\n# In your project directory\ncmake -DCMAKE_EXPORT_COMPILE_COMMANDS=ON -B build\ncp build/compile_commands.json .\n\n# Then analyze\nboost-safeprofile ./path/to/project\n```\n\n**Self-test** (verify tool's own code is safe):\n\n```bash\nbuild/boost-safeprofile --sarif self-test.sarif src/\n# Exit code 0 = clean, 1 = violations, 2 = compilation errors\n```\n\n---\n\n## Typical Workflow\n\n1. **Baseline:** run on main branch, archive evidence pack\n2. **Harden:** apply low-risk suggestions (e.g., `std::span`, `not_null`, RAII)\n3. **Gate:** add CI step with thresholds (e.g., \"no blocker findings\")\n4. **Prove:** attach evidence packs to releases or audits\n\n---\n\n## Architecture\n\nBoost.SafeProfile follows a modular pipeline architecture:\n\n```mermaid\ngraph TB\n    CLI[\"CLI / SDK / API\"]\n\n    subgraph IntakePhase[\"(A) Project Intake\"]\n        RepoResolver[\"Repo Resolver\u003cbr/\u003e+ Build Discovery\"]\n        CompDB[\"Compilation DB\u003cbr/\u003e(compile_commands.json)\"]\n    end\n\n    subgraph ProfilePhase[\"(B) Profile Manager\"]\n        ProfileLoader[\"Profile Loader / DSL\u003cbr/\u003e(built-in + user)\"]\n        RuleGraph[\"Rule Graph\u003cbr/\u003e(facts → detectors → actions)\"]\n    end\n\n    subgraph AnalysisCore[\"Analysis Core\"]\n        FactsEngine[\"Static Facts Engine\u003cbr/\u003e(Clang AST/CFG/Dataflow)\"]\n        RuleEngine[\"Rule Engine\u003cbr/\u003e(match/severity/fix)\"]\n    end\n\n    subgraph AILayers[\"AI-Assisted Layers (Optional)\"]\n        Explainer[\"Explainer\u003cbr/\u003e(NL rationale + context)\"]\n        SuggestionSynth[\"Suggestion Synthesizer\u003cbr/\u003e(patches / annotation diffs)\"]\n    end\n\n    subgraph OutputPhase[\"Output \u0026 Evidence\"]\n        Emitters[\"Reports/Emitters\u003cbr/\u003e(SARIF/JSON/HTML/MD)\"]\n        EvidencePacker[\"Evidence Packer\u003cbr/\u003e(logs, configs, hashes)\"]\n    end\n\n    subgraph Targets[\"Deployment Targets\"]\n        CIGate[\"CI Gate / Baselines\"]\n        Archive[\"Archive / Auditor\"]\n    end\n\n    CLI --\u003e RepoResolver\n    CLI --\u003e ProfileLoader\n\n    RepoResolver --\u003e CompDB\n    ProfileLoader --\u003e RuleGraph\n\n    CompDB --\u003e FactsEngine\n    RuleGraph --\u003e RuleEngine\n\n    FactsEngine \u003c--\u003e |facts| RuleEngine\n\n    FactsEngine --\u003e |findings| Explainer\n    RuleEngine --\u003e |hints| SuggestionSynth\n\n    Explainer --\u003e Emitters\n    SuggestionSynth --\u003e EvidencePacker\n\n    Emitters --\u003e CIGate\n    EvidencePacker --\u003e Archive\n\n    style IntakePhase fill:#e1f5ff\n    style ProfilePhase fill:#fff4e1\n    style AnalysisCore fill:#ffe1f5\n    style AILayers fill:#f0ffe1\n    style OutputPhase fill:#ffe1e1\n    style Targets fill:#e1e1ff\n```\n\n**Key Principles:**\n- **Static-analysis-led** with optional AI assist (never AI-dependent)\n- **Offline-first** design (no network access by default)\n- **Deterministic** pipeline (same inputs → same outputs)\n- **Modular** architecture with clear separation of concerns\n\nFor detailed component descriptions and design rationale, see **[`Design.md`](Design.md)**.\n\n---\n\n## CLI (high level)\n\n```\nboost-safeprofile analyze [REPO|PATH]\n  --profile \u003cname[@version]\u003e     # select a Safety Profile (built-in or custom)\n  --config  boostsafe.yaml       # project config (excludes, waivers, profile overlay)\n  --offline | --online           # network policy (offline is default)\n  --ai-explain --ai-suggest      # optional AI assistance layers\n  --report  out/report.{html,md} # human-readable summary\n  --sarif   out/findings.sarif   # machine-readable diagnostics\n  --jsonl   out/findings.jsonl   # stream for pipelines\n  --evidence out/evidence        # bundle for audits (zip directory)\n  --baseline out/baseline.json   # establish/compare a baseline\n  --fail-on blocker|major|any    # CI exit threshold\n  --jobs    N                    # parallel analysis\n```\n\nSee **`Requirements.md`** for intake, reporting, and evidence details.\n\n---\n\n## Profiles\n\n- **Built-in drafts:** e.g., `core-safety`, `memory-safety` (WG21-aligned)  \n- **Overlays:** add MISRA/AUTOSAR/CERT or org policies via YAML  \n- **Pinned:** evidence packs include a `profile.lock.json` so audits are reproducible\n\nExample overlay snippet (YAML):\n\n```yaml\nprofiles:\n  use: memory-safety@1.0.0\n  disable:\n    - SP-CAST-REINTERPRET\n  enable:\n    - SP-BOUNDS-CHECK-RECOMMENDED\n```\n\n---\n\n## Outputs\n\n- **SARIF / JSONL:** for code scanning and pipelines  \n- **HTML / Markdown:** for human review (with code excerpts \u0026 explanations)  \n- **Evidence Pack:** manifests, profile lock, tool fingerprints, findings, optional sanitizer/fuzzer logs, and reproducibility notes\n\nDirectory sketch:\n\n```\nout/\n  findings.sarif\n  findings.jsonl\n  report.html\n  evidence/\n    manifest.json\n    profile.lock.json\n    toolchain.json\n    findings.{sarif,jsonl}\n    sanitizer/...\n    fuzz/...\n    configs/...\n    reproducibility/{repro.md, cli.txt, env.txt}\n```\n\n---\n\n## CI Integration\n\nMinimal GitHub Actions step:\n\n```yaml\n- name: Safety Profile analysis\n  run: |\n    boost-safeprofile analyze --profile memory-safety \\\n      --sarif findings.sarif --evidence evidence \\\n      --fail-on blocker .\n- name: Upload SARIF\n  uses: github/codeql-action/upload-sarif@v3\n  with:\n    sarif_file: findings.sarif\n```\n\n**Exit codes:** `0` (clean or below threshold), non-zero otherwise.  \n**Baselines:** pin a baseline file and compare deltas per PR.\n\n---\n\n## Configuration\n\nCreate `boostsafe.yaml` in repo root to keep commands short:\n\n```yaml\nproject:\n  root: .\n  excludes: [ \"build/**\", \"third_party/**\" ]\nintake:\n  respect_gitignore: true\nprofiles:\n  use: core-safety@1.0.0\nci:\n  fail_on: blocker\n  offline: true\nreports:\n  sarif: out/findings.sarif\n  html:  out/report.html\n  evidence_dir: out/evidence\n```\n\nRun:\n\n```bash\nboost-safeprofile analyze --config boostsafe.yaml\n```\n\n---\n\n## Self-Conformance\n\nThis tool “eats its own cooking”:\n\n- Built under a documented **Safe C++** subset (no owning raw pointers, RAII, bounds-checked access, safe concurrency)\n- Release artifacts include the tool’s **own evidence pack** (`evidence/self/…`)\n- CI runs **ASan/UBSan/TSan** and **coverage-guided fuzzing** on input handlers\n- Static analysis and warnings-as-errors are release blockers\n\n---\n\n## Project Scope \u0026 Positioning\n\n- Distributed under the **Boost Software License**  \n- Lives alongside other **Boost developer tools** (not a runtime library you link)  \n- Aims to **support** WG21 Safety Profiles adoption with analysis, guidance, and auditable evidence  \n- **AI-assisted**, not AI-dependent: runs fully offline with deterministic fallbacks\n\n---\n\n## Real-World Validation\n\n**Boost.JSON Analysis (October 2025)** - See [CASE-STUDY-BOOST-JSON.md](CASE-STUDY-BOOST-JSON.md)\n\nWe validated the tool on **Boost.JSON 1.89.0** (97 header files, ~30k LOC):\n- **Coverage:** 75% (73/97 files analyzed successfully)\n- **Findings:** 175 violations across 4 safety categories\n  - 141 C-style casts (type safety)\n  - 16 C-style arrays (bounds safety)\n  - 13 potential lifetime issues (requires manual review)\n  - 5 manual memory management instances (ownership)\n- **Analysis time:** ~2-3 minutes\n- **False positives:** Zero in analyzed code (some lifetime findings need review)\n\n**Key Achievement:** Proved **atomic library analysis** - analyzed a single Boost library without analyzing all its dependencies. Dependencies provide parsing context only; violations are reported only in target library code.\n\n## Known Limitations\n\n**Current Version:** Tier 1 rules implemented (v0.4.0-dev)\n\n### What Works ✅\n- **Real-world Boost libraries** (validated on Boost.JSON 1.89.0)\n- Header-only library analysis without full build\n- Detects 5 core safety violations:\n  - SP-OWN-001: Naked new expression\n  - SP-OWN-002: Naked delete expression\n  - SP-BOUNDS-001: C-style array declaration\n  - SP-TYPE-001: C-style cast\n  - SP-LIFE-003: Return reference to local variable\n- AST-based semantic analysis (zero false positives in comments/strings)\n- SARIF 2.1.0 output for GitHub Code Scanning\n- Explicit compilation error reporting (no silent failures)\n- Automatic Boost header detection\n- Atomic library analysis (analyze single library in isolation)\n\n### Known Gaps ⚠️\n1. **System Include Resolution:** Files with `#include \u003cmemory\u003e` may fail to compile even with compile_commands.json\n   - **Workaround:** Use compilation databases from actual CMake projects\n   - **Status:** Infrastructure complete, refinement needed\n\n2. **Limited Rule Coverage:** Only 5 rules implemented (18+ planned)\n   - See [RULES-ROADMAP.md](RULES-ROADMAP.md) for expansion plan\n\n3. **No Git/Remote Repository Support:** Local directories only (planned for Phase 1.x)\n\n4. **No HTML Reports:** SARIF output only (HTML generator planned)\n\n5. **No AI Assistance:** Deterministic analysis only (AI layers planned for v1.x)\n\n6. **No Evidence Packs:** SARIF only (full evidence bundles planned)\n\n### Not Tested Yet 🔍\n- Template metaprogramming edge cases\n- Heavy macro usage\n- Cross-compilation scenarios\n- Windows platform (macOS/Linux only so far)\n\n**See [RED-TEAM-SPRINT-1.md](RED-TEAM-SPRINT-1.md) for detailed test results.**\n\n---\n\n## Roadmap\n\n### Completed\n- ✅ v0.1.0: AST-based detection, SP-OWN-001 (naked new)\n- ✅ v0.2.0: SP-OWN-002 (naked delete)\n- ✅ v0.3.0: SP-BOUNDS-001 (C-style arrays)\n- ✅ v0.4.0: SP-TYPE-001 (C-style casts), SP-LIFE-003 (dangling refs)\n\n### Next (v0.5.0+)\n- Tier 2 rules expansion (ownership, bounds, type safety)\n- CI/CD integration (GitHub Actions)\n- Real-world project testing\n- HTML report generation\n\n### Future (v1.0+)\n- Complete WG21 Safety Profile coverage\n- Git repository support\n- Evidence pack generation\n- Optional AI assistance layers\n- Editor/IDE integration\n\n(Exact milestones tracked in issue tracker.)\n\n---\n\n## Contributing\n\nContributions welcome—especially on:\n- Rule detectors \u0026 profile packs  \n- Emitters (reports, dashboards)  \n- Large-repo performance \u0026 incremental analysis  \n- Documentation and examples\n\nPlease see `CONTRIBUTING.md` (to be added) and discuss proposals via issues before large PRs.\n\n---\n\n## License\n\nBoost Software License 1.0. See `LICENSE` for details.\n\n---\n\n## Acknowledgments\n\nThis candidate tool builds on community work around **WG21 Safety Profiles**, the **C++ Core Guidelines**, and long-standing Boost practices that encourage safer C++.\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fsentientsergio%2Fboost-safeprofile","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fsentientsergio%2Fboost-safeprofile","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fsentientsergio%2Fboost-safeprofile/lists"}