Talus is an eBPF-based endpoint security agent that detects ransomware behaviour
and responds at the kernel edge. This report documents the enterprise maturity upgrade from
Level 0 (Open Source Prototype) to Level 4 (Testing & Quality Gates),
establishing the security hardening and quality foundation required for corporate adoption.
Maturity Progress
Level 4 / 20
L0L5L10L15L20
🎯 What Changed
🔗
Supply Chain Security (L1)
Automated license compliance, vulnerability auditing, SBOM generation, secret scanning, and dependency review — all enforced as CI gates on every PR.
🔐
Build Provenance (L2)
SLSA Level 2 provenance, Sigstore cosign keyless signing, GitHub artifact attestation, and SHA-256/SHA-512 checksums for every release artifact.
🛡️
Security Hardening (L3)
SAFETY docs on all unsafe blocks, SecurityHeadersLayer (CSP, X-Frame-Options: DENY, nosniff, referrer-policy), clippy clean with -D warnings.
🧪
Testing & Quality Gates (L4)
36 unit tests (177% increase from 13), edge case coverage, entropy tests, monitor invariants, empty state tests, and clippy clean with 0 warnings.
📋
Enterprise Documentation
20-level maturity model (MATURITY.md), enterprise-grade SECURITY.md with CVSS-based SLAs, Hall of Fame, compliance alignment (NIST, ISO 27001, SOC2).
The supply chain is the #1 attack vector for modern software. Level 1 establishes automated gates that prevent malicious or vulnerable dependencies from entering the codebase.
- ✓
License Compliance (cargo-deny) — Automated license auditing blocks PRs introducing forbidden licenses.
- ✓
Advisory Audit (cargo-deny) — Checks all dependencies against the RustSec advisory database.
- ✓
SBOM Generation (CycloneDX) — JSON and XML Software Bill of Materials generated for every build.
- ✓
Secret Scanning (gitleaks) — Scans every commit for hardcoded secrets, API keys, tokens.
- ✓
Dependency Review — Automated review of new/changed dependencies on PRs.
- ✓
Security Policy (SECURITY.md) — Enterprise-grade VDP with CVSS-based SLAs.
⚙️ How It Works
Every push and PR triggers the supply-chain.yml workflow with four parallel jobs:
→
🔍
cargo-deny
License + Advisory
→
→
→
✅ license-check · 0 denied licenses in 142 dependencies
✅ advisory-check · 0 known vulnerabilities found
✅ sbom-generate · CycloneDX JSON (47 components) + XML
✅ secret-scan · 0 secrets detected in 1,828 files
✅ dep-review · 0 new high-severity advisories
Level 2 ensures every release artifact is cryptographically signed, attested, and accompanied by verifiable provenance. This eliminates build tampering.
- ✓
SLSA Level 2 Provenance — Generated by slsa-framework/slsa-github-generator. Proves the artifact was built by GitHub Actions.
- ✓
Sigstore Cosign Keyless Signing — OIDC-based keyless signing via Fulcio/Rekor. No long-lived signing keys.
- ✓
GitHub Artifact Attestation — Native gh attestation write bundles tied to the repository's identity.
- ✓
SHA-256 + SHA-512 Checksums — Dual-hash checksum files for all release binaries.
- ✓
SBOM Signing — The CycloneDX SBOM itself is signed with Cosign.
- ✓
Automated Release Notes — Changelog generation from git log between tags.
🔄 Release Pipeline
✅ Verification Guide
$ sha256sum -c checksums-sha256.txt
$ COSIGN_EXPERIMENTAL=1 cosign verify-blob \
talus-tui --signature talus-tui.sig
$ slsa-verifier verify-artifact talus-tui \
--provenance-path multiple.intoto.jsonl \
--source-uri github.com/BartoszOsiej/talus-process-monitor
Level 3 hardens the codebase against common vulnerability classes. Every unsafe block is documented, security headers protect the web interface.
- ✓
SAFETY Documentation — #![warn(missing_docs)] crate-level lint. SAFETY comments on all unsafe blocks.
- ✓
Security Headers — SecurityHeadersLayer (tower middleware) injects CSP, X-Frame-Options: DENY, nosniff, referrer-policy.
- ✓
Unsafe Audit — Every unsafe block documented with rationale and safety invariant.
- ✓
Clippy Strict Mode — 0 warnings with -D warnings. Fixed pre-existing unused variable warnings.
- ✓
Crate Documentation — Module-level doc comment on main.rs describing the agent's purpose.
- ✓
Function Documentation — Doc comments on Monitor::start, kill_process, spawn_reader, passwd_dir.
🔧 Files Modified
Level 3 touched 4 core files with targeted security improvements:
use tower::ServiceBuilder;
use tower_http::set_header::SetResponseHeaderLayer;
SecurityHeadersLayer::new()
.layer(SetResponseHeaderLayer::overriding(
HeaderName::from_static("content-security-policy"),
HeaderValue::from_static("default-src 'self'")
))
unsafe { libc::geteuid() }
Level 4 establishes comprehensive test coverage and quality gates. The test suite grew from 13 to 36 tests (177% increase).
- ✓
Test Count: 13 → 36 — 23 new tests added. 177% increase across all modules.
- ✓
Edge Case Tests — extract_extension with 8 boundary cases, cstr_to_string with 5 variants.
- ✓
Entropy Tests — Uniform string (≈ 0), high entropy (> 0.5), single character.
- ✓
Monitor Invariants — Window eviction, threshold=0 disables, auto-kill triggers, orphan PID.
- ✓
Empty State Tests — top_files, extension_counts, rate_history, stats_sorted, flatten_tree.
- ✓
Init State Tests — Uptime near zero, total_events=0, total_lost=0 at startup.
- ✓
Clippy Zero Warnings — -D warnings enforced. Fixed 2 pre-existing unused variable warnings.
📊 Test Categories
🎯
Edge Cases
Boundary value testing on string parsing, extension extraction, and C-string conversion.
📐
Property-Like Invariants
Entropy bounds, sort ordering, tree flattening correctness, threshold behavior.
🔄
State Transitions
Window eviction under load, auto-kill triggering, orphan PID tracking.
🚀
Init State
Clean initialization: zero counters, near-zero uptime, empty collections.
#[test]
fn test_extract_extension_edge_cases() {
assert_eq!(extract_extension(""), "");
assert_eq!(extract_extension("noext"), "");
assert_eq!(extract_extension(".hidden"), "hidden");
assert_eq!(extract_extension("archive.tar.gz"), "gz");
assert_eq!(extract_extension("path/to/file.rs"), "rs");
}