Audit: security hardening and maintenance findings

[Koan-Bot]

Audit Findings — 2026-04-10

Comprehensive maintainability and security audit of the codebase.

Fixed (PR #17)

• String eval qq{} in API.pm and Service.pm replaced with safe eval { require $file }
• Symbolic reference string eval in DataAsYaml.pm replaced with no strict 'refs'
• Removed defunct .travis.yml
• Added .env*, .DS_Store, IDE dirs to .gitignore

Remaining Items

• Bare die statements (medium) — 8 instances across Service.pm, Images.pm, and Specs/Roles/Service.pm use die without error messages. Makes debugging harder for users. (Partially addressed by PR fix: descriptive error messages and dead code removal #11)
• Test coverage gaps (medium) — Routes.pm, API.pm factory, Service.pm internals, Helpers/DataAsYaml.pm, and Roles modules lack direct unit tests. Estimated ~60-70% coverage.
• Version string validation (low) — BUILD_version() regex m{/(v[0-9\.]+)} is permissive. Could restrict to v\d+\.\d+ for robustness.

Notes

• PR ci: fix Perl compat and modernize CI workflow #15 already addresses CI modernization (Perl version alignment, cpm@v2, platform fixes)
• AUTOLOAD dispatch in Routes.pm is well-protected (whitelist from static YAML data block)
• No hardcoded secrets found — credentials properly sourced from environment variables

---

🤖 Created by Kōan from audit session

[Koan-Bot]

Additional finding: delete_server() crashes on multi-homed VMs due to scalar context bug in port iteration. Fixed in PR #19.

[Koan-Bot]

PR #20 addresses the test coverage gaps item: 72 new assertions covering Routes.pm, API.pm factory, Helpers/DataAsYaml.pm, Listable/GetFromId roles, and Specs::Roles::Service.

Remaining items: bare die statements (medium), version string validation (low).

[Koan-Bot]

Status update — 2026-04-16

All three remaining items from this audit are now covered by open PRs:

Item	PR	Status
Bare die statements (8 instances)	#11	All fixed (Images.pm, Service.pm, Specs/Roles/Service.pm); GetFromId.pm dead code removed
Test coverage gaps (Routes/API/DataAsYaml/Roles)	#20	Direct unit tests added for all listed modules
Version string regex hardening (low)	—	Not yet PR'd; very low priority

Once PR #15 (CI Perl matrix fix) merges, the failing CI check across the queue should clear automatically — most subsequent PRs already pass on Perl 5.14+. That makes #15 the unblocking PR for review-merge throughput.

This issue can probably close after #11 and #20 land.

🤖 Status report by Kōan

[Koan-Bot]

Status Update — 2026-04-17

All remaining items from this audit are now addressed by open PRs:

Finding	Severity	Status	PR
String eval qq{} in API.pm and Service.pm	High	✅ Fixed	#17
Symbolic ref eval in DataAsYaml.pm	High	✅ Fixed	#17
Defunct .travis.yml	Low	✅ Removed	#17
.gitignore updates	Low	✅ Fixed	#17
Bare die statements (8 instances)	Medium	✅ Fixed	#11
Test coverage gaps (Routes, API factory, DataAsYaml, Roles)	Medium	✅ Added	#20
Version string validation (BUILD_version() regex)	Low	✅ Fixed	#25 (also fixes root_uri() returning undef for versioned endpoints)

Additional finding from session 33

root_uri() version detection bug (Service.pm:87) — the guard meant to prevent double-versioning of URLs used a regex that never matched real endpoints (:\d/v vs multi-digit ports) and returned undef instead of $uri on match. Fixed in PR #25.

All audit items are now tracked in PRs. This issue can be closed once the PRs are reviewed.

[Koan-Bot]

PR Review Priority Guide (18 open PRs)

All 18 PRs are mergeable with CI passing. Here's a suggested merge order to minimize conflicts:

Tier 1 — Independent, zero-conflict (merge in any order)

• ci: fix Perl compat and modernize CI workflow #15 ci: fix Perl compat and modernize CI workflow
• docs: add CLAUDE.md with project architecture guide #22 docs: add CLAUDE.md with project architecture guide
• test: routing, filtering, and helper method coverage #14 test: routing, filtering, and helper method coverage (new test file only)
• test: unit tests for Routes, API factory, DataAsYaml, and Roles #20 test: unit tests for Routes, API factory, DataAsYaml, and Roles (new test files only)
• feat: paginate _list() across all OpenStack link styles #8 feat: paginate _list() across all OpenStack link styles (Listable.pm only)

Tier 2 — Small, focused fixes

• security: replace string eval with safe module loading #17 security: replace string eval with safe module loading
• fix: root_uri() version detection for real OpenStack endpoints #25 fix: root_uri() version detection
• fix: image_from_name() dies on duplicate names instead of returning wrong type #23 fix: image_from_name() dies on duplicate names
• fix: create_vm() detects ERROR status, fails fast with fault detail #24 fix: create_vm() detects ERROR status

Tier 3 — Broader changes (may need rebase after Tier 1-2)

• fix: descriptive error messages and dead code removal #11 fix: descriptive error messages and dead code removal
• fix: strict RFC 4122 UUID validation in *_from_uid methods #10 fix: strict RFC 4122 UUID validation
• fix: specs correctness and comprehensive test coverage #12 fix: specs correctness and comprehensive test coverage
• fix: Compute v2_0 specs and minor code cleanup #21 fix: Compute v2_0 specs and minor code cleanup

Tier 4 — Feature work (merge last)

• fix: filter ports by network_id for floating IP attachment #7 fix: filter ports by network_id for floating IP
• feat: expose wait_timeout and poll_interval to create_vm() #9 feat: expose wait_timeout and poll_interval to create_vm()
• feat: extend specs with create/update/remove types #13 feat: extend specs with create/update/remove types
• fix: create_vm robustness and cleanup #16 fix: create_vm robustness and cleanup
• fix: delete_server() handles multi-homed VMs #19 fix: delete_server() handles multi-homed VMs

---

🤖 Generated by Kōan — PRs #7-10 rebased today to trigger CI.