Merge pull request #200 from paritytech/chore/opensourcing-fixes

Author: pgherveou

.claude/skills/playground-local-stack/SKILL.md

@@ -45,23 +45,26 @@ configuration, `tmux split-window -c <dir>` only sets a new pane's cwd, and a
 freshly-created pane may swallow the first keys before its shell is ready.
 
 ```bash
+# 0. Resolve the repo root so the commands work on any machine.
+REPO_ROOT=$(git rev-parse --show-toplevel)
+
 # 1. Create the servers window and capture the initial pane id.
 DOTLI_PANE=$(
   tmux new-window -t truapi: -n servers -d -P -F '#{pane_id}' \
-    -c /home/pg/github/truapi
+    -c "$REPO_ROOT"
 )
 
 # 2. Split horizontally for the playground pane and capture its pane id.
 PLAYGROUND_PANE=$(
   tmux split-window -t "$DOTLI_PANE" -h -d -P -F '#{pane_id}' \
-    -c /home/pg/github/truapi/playground
+    -c "$REPO_ROOT/playground"
 )
 
 # 3. Launch each process WITH an explicit cd in the same send-keys.
 tmux send-keys -t "$DOTLI_PANE" \
-  'cd /home/pg/github/truapi/hosts/dotli && bun run preview' Enter
+  "cd $REPO_ROOT/hosts/dotli && bun run preview" Enter
 tmux send-keys -t "$PLAYGROUND_PANE" \
-  'cd /home/pg/github/truapi/playground && yarn dev' Enter
+  "cd $REPO_ROOT/playground && yarn dev" Enter
 ```
 
 Use `bun run preview:debugger` (i.e. `VITE_APP_DEBUG=true`) instead of

.gitignore

@@ -11,6 +11,11 @@ lerna-debug.log*
 node_modules
 target
 
+# Environment / secrets (never commit real env files; keep example templates)
+.env
+.env.*
+!.env.example
+
 # Editor / OS
 .vscode/*
 !.vscode/extensions.json

Cargo.toml

@@ -4,3 +4,4 @@ members = ["rust/crates/*"]
 
 [workspace.package]
 edition = "2024"
+license = "MIT"

SECURITY.md

@@ -0,0 +1,82 @@
+# Security policy
+
+## Security status
+
+This repository contains reference and proof-of-concept code: the TrUAPI protocol
+definitions (Rust traits and types), the codegen toolchain, the generated TypeScript
+client, and an interactive playground. It is intended for reference and
+experimentation, not as a production-ready artefact.
+
+Unless a specific release states otherwise, this repository has **not** received a full
+security audit. Use in production or production-like deployments should only follow an
+independent security review of the relevant code, configuration, generated output, and
+deployment environment.
+
+Even where no Parity-operated production deployment exists today, this code may be used
+by third parties on live networks, or reused in future production contexts once
+published.
+
+## Supported versions
+
+Security fixes are provided only for versions, packages, or branches actively maintained
+by Parity. Experimental, archived, deprecated, or explicitly-unsupported packages,
+examples, or branches may not be triaged unless the issue affects maintained packages,
+Parity-operated infrastructure, user funds, private keys, signing flows, or transaction
+integrity.
+
+## Bug bounty scope
+
+This repository is **not** in scope for Parity's paid bug bounty programme unless
+explicitly listed in the official bounty scope at the time of submission. Reports may
+still be reviewed through responsible disclosure, but bounty eligibility applies only
+where the affected asset or vulnerability class is explicitly in scope.
+
+## What to report
+
+Report an issue only if it demonstrates realistic impact against one or more of:
+
+- Parity-operated production infrastructure or deployed services;
+- maintained SDK packages downstream users are expected to consume;
+- user funds or assets;
+- private keys, seed phrases, signer flows, or key-management boundaries;
+- transaction construction, integrity, or signing intent;
+- remote code execution or credential compromise in a realistic deployment.
+
+## Out of scope (unless shown to cause realistic high-impact harm)
+
+Local-development-only issues; demo/example/testnet-only issues; missing security headers
+on non-production demos; missing rate limiting in local examples; dependency reports
+without a working exploit path or that don't affect shipped packages; hypothetical attack
+paths; "this code is unaudited"; documented known limitations; unsafe SDK use contrary to
+documented warnings; issues requiring access to internal Parity systems not in scope.
+
+## Reporting a qualifying issue
+
+Do **not** open a public issue for a qualifying vulnerability. Email
+**security@parity.io** with:
+
+- the affected repository, package, commit, branch, or release;
+- clear reproduction steps and realistic impact;
+- whether it affects production infrastructure, maintained packages, user funds, keys,
+  signing, or only local/demo/testnet usage;
+- any proof of concept, logs, or generated code involved;
+- assumptions required for exploitation.
+
+## Researcher expectations
+
+Don't access, modify, or delete data that isn't yours; don't disrupt services; don't
+extract keys or secrets beyond what's needed to demonstrate impact safely; don't test
+against production systems not in scope; no social engineering or physical attacks; don't
+disclose publicly until Parity has had a reasonable opportunity to remediate.
+
+## Safe-use guidance
+
+Before any production or production-like deployment, review at minimum: how
+keys/seeds/signers are generated, stored, and destroyed; whether signing prompts display
+transaction intent before approval; whether transactions are built against the intended
+chain/account/network; whether generated apps default to testnet/devnet; whether storage
+assumptions are appropriate; whether any cloud or statement-store data is
+public/private/encrypted; whether examples rely on internal/test/unstable endpoints;
+whether dependencies are pinned and reviewed; whether generated code has been manually
+reviewed before execution; and whether deployment configuration, CORS, auth, admin
+routes, logging, and telemetry suit the intended environment.

THIRD_PARTY_NOTICES.md

@@ -0,0 +1,59 @@
+# Third-party notices
+
+This project (outbound licence: MIT) depends on third-party software listed below.
+All bundled dependencies are under permissive licences compatible with MIT. The
+summaries are generated with `cargo deny check licenses` (Rust) and
+`license-checker-rseidelsohn` (npm); regenerate after dependency changes.
+
+## Rust crates (`truapi`, `truapi-codegen`, `truapi-macros`)
+
+73 transitive dependencies, all permissive:
+
+| Licence | Notes |
+|---------|-------|
+| `MIT OR Apache-2.0`, `MIT`, `Apache-2.0` | Permissive, MIT-compatible |
+| `Zlib` | Permissive |
+| `Unicode-3.0` | Permissive (Unicode data tables) |
+| `Unlicense OR MIT` | Permissive (MIT selected) |
+
+`cargo deny check licenses` passes against the allowlist in `deny.toml`. No copyleft
+(GPL/LGPL/AGPL/MPL) dependencies are present.
+
+Regenerate:
+
+```bash
+cargo deny check licenses
+```
+
+## Published npm package (`@parity/truapi`)
+
+The published client has no third-party runtime dependencies bundled into its
+distribution beyond peer/dev tooling. Its own licence is MIT.
+
+Regenerate:
+
+```bash
+( cd js/packages/truapi && npx license-checker-rseidelsohn --production --summary )
+```
+
+## Applications (`playground`, `explorer`)
+
+These are not published as libraries; they are built and deployed as static sites.
+Their dependency trees are overwhelmingly permissive (MIT, Apache-2.0, ISC, BSD,
+0BSD, CC0-1.0, MPL-2.0). One weak-copyleft dependency is present:
+
+- `@img/sharp-libvips-*` — **LGPL-3.0-or-later**. Pulled in transitively by Next.js
+  image optimization. It is dynamically loaded and not modified or statically linked;
+  the LGPL notice is preserved here. It is not part of the published `@parity/truapi`
+  library.
+
+The `UNLICENSED` entries reported by the licence checker are the repository's own
+private, unpublished workspace packages (`truapi-playground`, `truapi-explorer`), not
+third-party code.
+
+Regenerate:
+
+```bash
+( cd playground && npx license-checker-rseidelsohn --summary )
+( cd explorer   && npx license-checker-rseidelsohn --summary )
+```

deny.toml

@@ -0,0 +1,12 @@
+# cargo-deny configuration. Run `cargo deny check licenses`.
+# Outbound licence is MIT; only permissive inbound licences are allowed.
+
+[licenses]
+allow = [
+    "MIT",
+    "Apache-2.0",
+    "Unicode-3.0",
+    "Unlicense",
+    "Zlib",
+]
+confidence-threshold = 0.8

rust/crates/truapi-codegen/Cargo.toml

@@ -2,6 +2,7 @@
 name = "truapi-codegen"
 version = "0.1.0"
 edition.workspace = true
+license.workspace = true
 description = "TrUAPI code generator: rustdoc JSON to TS client + Rust glue"
 
 [[bin]]

rust/crates/truapi-macros/Cargo.toml

@@ -2,6 +2,7 @@
 name = "truapi-macros"
 version = "0.1.0"
 edition.workspace = true
+license.workspace = true
 description = "Proc-macros for TrUAPI trait annotations (wire ids)"
 
 [lib]

rust/crates/truapi/Cargo.toml

@@ -2,6 +2,7 @@
 name = "truapi"
 version = "0.3.0"
 edition.workspace = true
+license.workspace = true
 description = "TrUAPI trait and type definitions"
 
 [dependencies]