[callebtc]

Enrol projects/nutshell

Enroll Nutshell, an MIT-licensed
Cashu ecash wallet and mint for Bitcoin Lightning, maintained since 2022.

Nutshell provides a network-facing mint and wallet that process untrusted
requests, ecash tokens, and cryptographic proofs. Vulnerabilities could
compromise mint reserves or users’ funds, making it a security-critical
project.

Enrollment setup

• Reports go to cashu-security@pm.me, the security contact published in
  Nutshell’s SECURITY.md.
• A Dockerfile alongside project.yaml installs Python 3.12, Poetry 2.3.2,
  and the project’s locked runtime and development dependencies.
• The offline test environment uses FakeWallet and SQLite, with Tor disabled.
• A project-specific threat model describes trust boundaries, security
  invariants, reproduction guidance, and test-environment limitations.

Verification

Tested against upstream commit a2656a6a on Linux ARM64.

• Enrollment validation passed.
• The project Docker image built successfully.
• The documented baseline passed with networking disabled:
  1,384 passed, 83 skipped, 1 deselected.

Offline test command:

poetry run pytest tests -q --ignore=tests/fuzz \
  --deselect=tests/mint/test_mint_operations.py::test_melt_preserves_change_signatures_order_integration

The deselected integration test requires an external LND regtest Docker
container. The randomized fuzz suite is available in the image but excluded
from the baseline because it exhibited an intermittent failure during
verification. These limitations are documented in threat_model.md.

tools/check nutshell --no-shell successfully built the project image, but
could not finish the scanner-added layer because
https://claude.ai/install.sh returned HTTP 403. The offline test results
above were obtained directly from the successfully built project image.

Checklist

• I am a core maintainer of this project.
• I accept the OSS Scanner terms.
• I confirm that I believe my project meets the inclusion criteria and is an established project that users depend on.
• project.yaml follows the README; enrollment validation passes locally.
• tools/check completes and the tests run in its resulting environment (blocked by the Claude installer HTTP 403 described above).
• primary_contact is the project’s published primary security contact.
• A Dockerfile is provided alongside project.yaml.
• A project-specific threat_model.md is provided alongside project.yaml.

[github-actions]

Thank you for your submission, we really appreciate it. Like many open-source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution. You can sign the CLA by just posting a Pull Request Comment same as the below format.

---

I have read the CLA Document and I hereby sign the CLA

---

_{You can retrigger this bot by commenting recheck in this Pull Request. Posted by the CLA Assistant Lite bot.}

[github-actions]

Enrolment triage: projects/nutshell

Repository: cashubtc/nutshell · opened by callebtc

	Check	Result
✅	Repository	created 4 years ago, last push today
ℹ️	Stars / forks	502 stars · 182 forks · 14 watching
ℹ️	Outside participants	20 people from outside the project opened 43 of the last 100 issues and pull requests
ℹ️	Criticality score	0.55 on the OpenSSF scale of 0 to 1 signals created_since 50, updated_since 0, contributor_count 64, org_count 3, commit_frequency 10.8, recent_releases_count 10, closed_issues_count 147, updated_issues_count 178, comment_frequency 1.4, dependents_count 61
ℹ️	Package rank	by downloads: nothing from this repository found in the top 15,000 on PyPI
✅	License	MIT
✅	Opened by an active maintainer	collaborator on the repository; 68 commits in the last 12 months; #1 contributor
✅	Contact in SECURITY.md	cashu-security@pm.me is in SECURITY.md
ℹ️	OSS-Fuzz	not found in OSS-Fuzz
ℹ️	.oss-scanner/ in the repository	not present; the Dockerfile is in this pull request
✅	Pull request scope	only this project's directory
✅	tools/validate.py	passes
⚠️	Checklist	1 of 8 not ticked: tools/check completes and the tests run in its resulting environment (blocked by…

_{Automated, from public data, to help reviewers. Enrolment is decided case by case against the criteria. If you think we got something wrong, please tell us in a reply.}