sonar-project.properties

# SonarCloud configuration for SUNET/vc
# This file configures analysis settings and rule exclusions

# Project identification
sonar.projectKey=SUNET_vc
sonar.organization=sunet

# Source configuration - exclude test files completely from analysis
# Test files contain test credentials that trigger false positive security alerts
sonar.sources=.
sonar.exclusions=vendor/**,**/testdata/**,**/*_test.go,**/config.yaml,bootstrapping/**
sonar.tests=.
sonar.test.inclusions=**/*_test.go

# Exclude test files and config from security hotspot detection
sonar.security.hotspots.exclusions=**/*_test.go,**/config.yaml,bootstrapping/**

# Ignore ALL issues in test files (backup for any files that slip through)
sonar.issue.ignore.allfile=f1,f2,f3
sonar.issue.ignore.allfile.f1.fileRegexp=.*_test\.go$
sonar.issue.ignore.allfile.f2.fileRegexp=config\.yaml$
sonar.issue.ignore.allfile.f3.fileRegexp=bootstrapping/.*

# Exclude test files from duplication detection (CPD - Copy Paste Detection)
# Test code intentionally contains similar patterns for comprehensive coverage
sonar.cpd.exclusions=**/*_test.go

# Increase minimum lines for duplication detection
# Similar patterns in crypto key handling are intentional (type safety for Ed25519/ECDSA/X25519)
sonar.cpd.go.minimumLines=25
sonar.cpd.go.minimumTokens=100

# Go-specific settings
sonar.go.coverage.reportPaths=coverage.out,didcomm_coverage.out

# Rule exclusions for false positives
# =====================================

# S5542 (go:S5542) - "Encryption algorithms should be used with secure mode and padding scheme"
# These are FALSE POSITIVES for JOSE/JWE implementations:
#
# 1. AES-CBC with HMAC (RFC 7518 A256CBC-HS512):
#    - JWE content encryption uses AES-256-CBC with HMAC-SHA-512 for authentication
#    - This is an authenticated encryption mode (Encrypt-then-MAC) per RFC 7518
#    - The HMAC provides integrity protection, making it secure
#
# 2. AES Key Wrap (RFC 3394):
#    - Used for wrapping content encryption keys (CEK)
#    - Raw AES ECB blocks are used intentionally in the key wrap algorithm
#    - This is a key-wrapping primitive, not general-purpose encryption
#
# These patterns are required for standards compliance and interoperability.
sonar.issue.ignore.multicriteria=e1,e2,e3,e4,e5

# Exclude S5542 from JWE crypto implementation (AES-CBC for content encryption, AES Key Wrap)
sonar.issue.ignore.multicriteria.e1.ruleKey=go:S5542
sonar.issue.ignore.multicriteria.e1.resourceKey=**/didcomm/crypto/jwe.go

# Exclude S5542 from PKI signers (RSA-PKCS1v15 SIGNATURE, not encryption)
# SonarCloud incorrectly flags rsa.SignPKCS1v15 as encryption when it's a signature scheme
sonar.issue.ignore.multicriteria.e2.ruleKey=go:S5542
sonar.issue.ignore.multicriteria.e2.resourceKey=**/pki/keymaterial_signer.go

sonar.issue.ignore.multicriteria.e3.ruleKey=go:S5542
sonar.issue.ignore.multicriteria.e3.resourceKey=**/pki/software.go

# Exclude S5659 from verifier trust evaluation handler
# jwt.NewParser(jwt.WithoutClaimsValidation()).Parse() is called with a keyfunc that
# inspects the JWT header (x5c/jwk/kid) to determine which public key to use.
# The keyfunc enforces a strict algorithm allowlist (AllowedSignatureAlgorithms config)
# and always rejects "none" and other weak algorithms before returning the key.
# The actual cryptographic verification is performed by jwt.Parse itself.
sonar.issue.ignore.multicriteria.e4.ruleKey=go:S5659
sonar.issue.ignore.multicriteria.e4.resourceKey=**/verifier/apiv1/handlers_verification.go

# Ignore all code smell rules in test files
# Test code intentionally contains repetition and similar patterns for readability
sonar.issue.ignore.multicriteria.e5.ruleKey=go:*
sonar.issue.ignore.multicriteria.e5.resourceKey=**/*_test.go