Zero-Dependency Verification
Technical audit and verification of zero third-party runtime dependencies in MayFly.
Philosophy & Threat Model
Most modern developer utilities pull in hundreds of transitive dependencies. If any upstream package in the dependency graph is compromised, typo-squatted, or modified through account takeovers, developers inherit those vulnerabilities directly into their build environments.
Security tools, in particular, should not introduce supply-chain attack vectors. MayFly was designed and implemented from first principles to operate with zero third-party Go dependencies (go.mod contains 0 require directives).
Dependency Manifest (go.mod)
Inspection of MayFly's go.mod:
module mayfly
go 1.22There are zero external module requirements, zero indirect dependencies, and zero vendored third-party source packages.
Standard Library Substitution Matrix (STDLIB.md)
MayFly implements 13 distinct subsystems using exclusively Go standard library primitives:
| # | Subsystem Replaced | External Packages Replaced | Go Stdlib Replacement Primitives | Architectural Details |
|---|---|---|---|---|
| 1 | Terminal Raw Mode | golang.org/x/term, termenv | syscall.SYS_IOCTL, TCGETS, TCSETS, syscall.Termios | Direct OS syscalls manipulate terminal line discipline into raw non-canonical mode, disabling ECHO and ICANON. |
| 2 | Terminal UI Engine | bubbletea, tview, termbox-go | bytes.Buffer, io.Writer, Custom 2D Cell Grid, ANSI SGR | Double-buffered 2D character canvas, responsive Project Card Grid, scrollable lists, and masked inputs. |
| 3 | Streaming Key Parser | bubbletea/key, go-tty | unicode/utf8, Streaming FSM | Streaming state machine parses multi-byte ANSI sequences (arrows, Esc, Tab, Enter, UTF-8 runes). |
| 4 | Key Derivation (KDF) | golang.org/x/crypto/pbkdf2 | crypto/hmac, crypto/sha256, encoding/binary | Hand-rolled RFC 8018 PBKDF2-HMAC-SHA256 with 600,000 rounds deriving 256-bit AES master key. |
| 5 | Encrypted Vault Storage | mattn/go-sqlite3, bbolt, go-keyring | crypto/aes, crypto/cipher (AES-GCM), crypto/rand | Authenticated binary container with 15-byte header, AES-256-GCM AEAD encryption, and atomic tmp -> fsync -> rename. |
| 6 | In-Memory Injection | joho/godotenv, gotenv | os.Environ, os/exec.CommandContext, Buffer zeroing | Decrypted secrets overlay directly into volatile child process RAM; buffers immediately zeroed upon process exit. |
| 7 | Audit Trail | logrus, zap, SIEM databases | crypto/sha256, encoding/hex, encoding/json | SHA-256 hash-chained JSON log (~/.mayfly/audit.log) mathematically proving entries cannot be modified or deleted. |
| 8 | Filesystem Project ID | google/uuid, go-git | syscall.Stat_t (Dev, Ino), filepath.EvalSymlinks | Deterministic SHA-256 project identity derived from storage (Device, Inode) preventing path collision leaks. |
| 9 | Credential Scanner | trufflehog, gitleaks | path/filepath.WalkDir, regexp, bufio.Scanner | Recursive bounded filesystem crawler detecting unencrypted .env files and API key patterns with .mayflyignore. |
| 10 | ANSI Styling & Colors | fatih/color, mgutz/ansi, chalk | Hand-crafted ANSI SGR sequence builder, NO_COLOR | 16-color ANSI builder with attribute masking (bold, dim, underline, reverse) respecting the NO_COLOR spec. |
| 11 | Unicode Rune Widths | mattn/go-runewidth | unicode/utf8, East Asian width range checks | Computes exact terminal cell column widths for East Asian, wide characters, and emojis for double-buffered alignment. |
| 12 | Clipboard Controller | atotto/clipboard, x/clipboard | encoding/base64, ANSI OSC 52 escape sequences | Emits pure ANSI OSC 52 clipboard sequences directly to terminal stdout with graceful fallback to OS utilities. |
| 13 | Self-Updating Engine | go-selfupdate, go-github-selfupdate | net/http, crypto/sha256, os.Rename | Checks GitHub releases, verifies SHA-256 checksums, and performs atomic binary swap without curl or external scripts. |
Replaced External Dependencies
MayFly eliminates reliance on popular external packages commonly pulled into Go toolchains:
godotenv/dotenv(10M+ weekly downloads): Replaced by in-memory volatile execution overlay inpkg/executor.golang.org/x/crypto/pbkdf2(5M+ weekly downloads): Replaced by hand-rolled RFC 8018 PBKDF2-HMAC-SHA256 inpkg/vault.bubbletea/tview(1M+ weekly downloads): Replaced by double-buffered 2D TUI engine inpkg/tui.fatih/color/chalk: Replaced by custom ANSI SGR generator inpkg/tui/terminal.atotto/clipboard: Replaced by ANSI OSC 52 escape sequences inpkg/tui/terminal.trufflehog/gitleaks: Replaced by bounded filesystem crawler inpkg/scanner.
Cryptographic Build Determinism
To ensure supply-chain integrity, MayFly compiles deterministically across independent builds. Compiling with -trimpath -ldflags="-s -w -buildid=" produces bit-for-bit identical binary hashes:
make reproducibleVerification Output:
Verifying bit-for-bit reproducible build...
CGO_ENABLED=0 go build -trimpath -ldflags="-s -w -buildid=" -o bin/repro1/mayfly ./cmd/mayfly
CGO_ENABLED=0 go build -trimpath -ldflags="-s -w -buildid=" -o bin/repro2/mayfly ./cmd/mayfly
a1c3e47019f2a41d9836dc369b6e5321a29f9d8d60ebe7d7e72151191dcfe6f0 bin/repro1/mayfly
a1c3e47019f2a41d9836dc369b6e5321a29f9d8d60ebe7d7e72151191dcfe6f0 bin/repro2/mayfly
[OK] REPRODUCIBLE BUILD VERIFIED: Byte-identical outputs!Formal Manifest Verification
To audit the codebase and generate a formal zero-dependency proof manifest:
make deps-proofTo list modules directly:
go list -m allExpected output:
mayflyTo inspect all package imports across the entire tree:
go list -f '{{.ImportPath}}: {{.Imports}}' ./...Next Steps
- Security Model & Cryptography: AES-256-GCM and PBKDF2 encryption details.
- Terminal UI Engine: Architecture of the double-buffered 2D canvas.
- CLI Reference: All CLI commands, flags, and options.