Contribution Guidelines
Help build and harden the GhostMesh codebase by coordinating commits and GPG signings.
1. Code Integrity & Signing
To protect GhostMesh from state-sponsored backdoors or code injection, all commits must be signed using a verifiable GPG or SSH key registered on GitHub:
# Configure signed commits globally
git config --global commit.gpgsign true
git config --global commit.gpgsign true
2. Submitting Pull Requests
When submitting patches, please follow our pull request lifecycle:
- File an Issue detailing the bug or feature enhancement scope.
- Branch from the `develop` line and keep pull requests isolated to single files/features.
- Pass all unit and fuzzing checks (`cargo test` and `cargo +nightly fuzz run`).
3. Cryptographic Checklist
Every PR touching `crypto/` undergoes a strict triple-reviewer protocol. Code must not contain custom random generation functions (only pre-approved system entropy primitives are allowed) and must exhibit strict constant-time performance to avoid side-channel timing attacks.