Re: Claude AI code audit of GNUstep core stack — 1 50 fixes, 12 perf optimizations, all available for upstream

--00000000000087a626065620d0d5
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

That seems like a reasonable (minimal) bar in any event.

Unless someone unleashes a LLM to write the entire code, presumably the
tools in IDEs like JetBrains, etc. won't violate that test.

But it could cause an interesting discussion because a simple prompt like
"Do a binary search on the ordered array 'tools'" could have very different
impact if you are writing it in a language which has a existing search()
method for an ordered collection, versus if it is in C and your LLM
actually writes the binary search from scratch - in the first instance you
probably need 1-2 lines of code, and in the latter case ~9 lines - that
could be rather unsettling.across an entire code base.

Cheers,

Todd

*Todd White*
Managing Director


177 Huntington Avenue, 17th Floor
Boston, MA 02115
Telephone: +1 617 237-2835 Ext. 101
EIN: 33-2228263

Website <https://www.thalion.global/> | Twitter/X <https://x.com/TTIScience=
> |
YouTube <https://www.youtube.com/@TTIScience>

[image:
https://app.candid.org/profile/16308928/the-thalion-initiative-us-inc-33-22=
28263/?pkId=3D39bf89e9-f544-478c-a3fe-e157e345181d]
<https://app.candid.org/profile/16308928/the-thalion-initiative-us-inc/?pkI=
d=3D39bf89e9-f544-478c-a3fe-e157e345181d&isActive=3Dtrue>


On Wed, Jul 8, 2026 at 5:49=E2=80=AFPM Gregory Casamento <greg.casamento@gm=
ail.com>
wrote:

> To back up what you said, the case in the US that deals with this is:
>
> https://www.wipo.int/wipolex/en/judgments/details/1840 (Thaler v
> Perlmutter)
> There are a few other open cases.
>
> IANAL, but in short, the opinion makes it clear that any work using AI
> must have significant *HUMAN* authorship to be eligible for copyright.
>  This is why we are asking people to disclose any AI involvement in their
> work so we have some way to track this.   It should be noted that no cour=
t
> has yet held that output produced by AI is a derivative work of the
> training data, but there are a number of legal questions associated with
> this.
>
> In general, my understanding is this: as long as YOU wrote the code (that
> is,> 50%), it is copyrightable.   As with anything like this... be carefu=
l.
>
> Yours, GC
>
> On Mon, Apr 13, 2026 at 11:29=E2=80=AFAM David Chisnall <gnustep@theraven=
snest.org>
> wrote:
>
>> Please note also, I will not merge any changes to libobjc2 that come fro=
m
>> LLMs.  LLM-generated code is hard to review, because it comes from a
>> plausible-next-token generator and so is very likely to *look* correct,
>> even if it is correct.  According to the US copyright office and case la=
w,
>> it cannot be copyrighted, but it *may* be a derived work of something in
>> the training set and so is far too high legal risk to merge.
>>
>> David
>>
>> On 13 Apr 2026, at 16:26, David Chisnall <[email protected]>
>> wrote:
>>
>> Hi,
>>
>> Looking at the libobjc2 ones:
>>
>> The issue RB-1 is kind-of real, but the fix is incorrect (we should free
>> the object before calling the unexpected exception handler, because it m=
ay
>> not return), though this is almost unreachable code.  It can basically
>> happen only if there is an internal error in the unwind library.
>>
>> RB-2 is not correct, selectors being null is undefined behaviour and
>> cannot happen in compiler-generated code.  Adding a null check on one of
>> the hottest paths in the runtime would be a regression.
>>
>> TS-7 looks like a fix that we need in a few more places, not sure why
>> it=E2=80=99s only highlighed in the place the code was copied to, not th=
e place it
>> was copied from.
>>
>> I think TS-14 is spurious, this should not be called twice, the first
>> caller nulls out the pointer after the cleanup.  The one corner case whe=
re
>> it can be called twice is if cleanup *reallocates* the TLS, in which cas=
e
>> doing the cleanup twice is correct.  Do you have a test case that
>> demonstrates this?
>>
>> RB-6 looks like the right fix, simple copy-and-paste bug.  Note that thi=
s
>> happens only when memory is exhausted, at which point most Objective-C
>> programs will start failing.
>>
>> RB-7, the null check is in a silly place (after the dereference), but th=
e
>> API contract here is that the argument must not be null, so it=E2=80=99s=
 actually
>> dead code.  This function also should be setting `*outCount =3D 0` in th=
e
>> early returns.
>>
>> PF-6, yes that refactoring would probably be good to do, though note tha=
t
>> we don=E2=80=99t hit the weak lock in most cases, only if an object is m=
arked as
>> having weak refs.  Have you measured slowdown from this on anything that
>> *isn=E2=80=99t* a contrived microbenchmark?  The quoted slowdown looks i=
ncredibly
>> unlikely unless you have a microbenchmark doing nothing but hitting weak
>> references from multiple threads.
>>
>> PF-7, this will generate exactly the same code unless we explicitly use =
a
>> weaker memory order (both are sequentially consistent by default).  We
>> should move this code over to C++11 atomics at some point.
>>
>> TS-3 is incorrect.  This counter grows monotonically.  If a selector is
>> registered *while* this call is happening, then the result is undefined.
>> It=E2=80=99s technically UB, in that there is an unsynchronised read.
>>
>> PF-4 was an intentional design choice.  Method replacements are
>> infrequent.  The proposed change would make things worse.
>>
>> David
>>
>> On 13 Apr 2026, at 04:35, Todd White <[email protected]> wrote:
>>
>> Hi GNUstep Team,
>>
>> As an exercise to test out the latest Claude AI capabilities, we
>> recently completed a comprehensive, bottom-up code audit of the GNUstep
>> core stack =E2=80=94 all seven repositories =E2=80=94 covering libobjc2,=
 libs-base,
>> libs-corebase, libs-opal, libs-quartzcore, libs-gui, and libs-back. The
>> full results, documentation, and all fix commits are publicly available =
at:
>>
>> https://github.com/DTW-Thalion/gnustep-audit
>>
>> I wanted to share what we found and offer to contribute any or all of th=
e
>> changes back upstream.
>>
>> ## What we did
>>
>> We audited the entire stack bottom-up =E2=80=94 runtime through UI layer=
 =E2=80=94
>> examining every file for robustness issues, thread safety gaps, security
>> vulnerabilities, correctness bugs, and performance bottlenecks. Each
>> finding was severity-rated, fixed in an atomic commit tagged with a find=
ing
>> ID, and validated with a dedicated regression test. We also wrote 13
>> performance benchmarks with a baseline/compare workflow so improvements =
can
>> be measured reproducibly.
>>
>> ## What we found and fixed
>>
>> Across all seven repos, we identified and fixed 150 findings:
>>
>> - 22 Critical =E2=80=94 including NSSecureCoding bypass (class whitelist
>> completely unimplemented), TLS server verification disabled by default,
>> use-after-free in objc_exception_rethrow, NULL dereferences, data races =
in
>> CFRunLoop and CATransaction, zero thread safety across the entire libs-b=
ack
>> backend (189 files, 0 locks), and a swapped sendto() argument in CFSocke=
t
>> that prevented any data from being sent.
>>
>> - 46 High =E2=80=94 deadlocks in property spinlocks, race conditions, bu=
ffer
>> overflows (CGContext dash buffer allocated in bytes instead of doubles),
>> broken APIs, JSON parser with no recursion depth limit (stack overflow
>> DoS), and integer overflow in binary plist bounds checking.
>>
>> - 61 Medium =E2=80=94 thread safety gaps in GSLayoutManager, NSView, and
>> NSApplication event dispatch; missing input validation; and general
>> robustness issues.
>>
>> - 14 Low + 10 confirmed bugs =E2=80=94 documentation issues, minor optim=
izations,
>> swapped arguments, wrong variables, and inverted conditions (e.g., TIFF
>> destination init was inverted, making TIFF writing 100% broken).
>>
>> We also implemented 12 targeted performance optimizations, including:
>>
>> - 64-way lock striping for weak references (5=E2=80=938=C3=97 concurrent=
 throughput)
>> - O(1) LRU linked list for NSCache (replacing an O(n) implementation tha=
t
>> also never evicted)
>> - Geometric growth for CFArray (O(n) vs O(n=C2=B2) sequential appends)
>> - X11 expose event coalescing, live resize throttling at 60fps, dirty
>> region tracking in NSView, DPSimage conversion caching, and stack buffer
>> allocation in CFRunLoop to eliminate per-iteration malloc
>>
>> Benchmark results on MSYS2/ucrt64 show +29=E2=80=9331% for retain/releas=
e,
>> +12=E2=80=9318% for message dispatch, +46=E2=80=9355% for array operatio=
ns, and +25% for
>> NSCache.
>>
>> ## How the work is organized
>>
>> Each of the seven repos has its own fork under our GitHub org (
>> https://github.com/DTW-Thalion) with fix commits on master. The
>> gnustep-audit repo itself contains:
>>
>> - Per-phase findings reports (docs/phase1 through phase6)
>> - A master audit summary (docs/AUDIT-SUMMARY.md)
>> - 51 regression tests and 13 benchmarks under instrumentation/
>> - A Makefile-driven test and benchmark harness with baseline/compare
>> support
>>
>> All 32 regression tests pass on the patched stack (up from 18/32 on
>> unpatched).
>>
>> ## Offer to contribute upstream
>>
>> We'd be happy to contribute any or all of these changes back into the
>> main GNUstep repositories =E2=80=94 whether as pull requests, individual=
 patches,
>> or in whatever form works best for your workflow. Feel free to help
>> yourself to the repo.
>>
>> The security-critical fixes (NSSecureCoding, TLS defaults, JSON depth
>> limit, binary plist overflow) and the confirmed crash bugs (use-after-fr=
ee,
>> NULL derefs, inverted conditions) are probably the highest-priority
>> candidates for upstream integration.
>>
>> Please feel free to reach out with any questions. We have a lot of
>> respect for the GNUstep project (and a bit nostalgic for heady days of
>> NeXTStep/OpenStep) and would like to see this work benefit the broader
>> community.
>>
>> It's unclear if the codebase is actively maintained or if many people
>> still use it, but we hope that this exercise provides some value.
>>
>> Best regards,
>>
>> Todd
>>
>> *Todd White*
>> Managing Director
>>
>>
>> 177 Huntington Avenue, 17th Floor
>> Boston, MA 02115
>> Telephone: +1 617 237-2835 Ext. 101
>> EIN: 33-2228263
>>
>> Website <https://www.thalion.global/> | Twitter/X
>> <https://x.com/TTIScience> | YouTube
>> <https://www.youtube.com/@TTIScience>
>>
>> [image:
>> https://app.candid.org/profile/16308928/the-thalion-initiative-us-inc-33=
-2228263/?pkId=3D39bf89e9-f544-478c-a3fe-e157e345181d]
>> <https://app.candid.org/profile/16308928/the-thalion-initiative-us-inc/?=
pkId=3D39bf89e9-f544-478c-a3fe-e157e345181d&isActive=3Dtrue>
>>
>>
>>
>>
>
> --
> Gregory Casamento
> GNUstep Lead Developer / Black Lotus, Principal Consultant
> http://www.gnustep.org - http://heronsperch.blogspot.com
> https://www.openhub.net/languages/objective_c
>

--00000000000087a626065620d0d5
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

<div dir=3D"ltr"><div><div class=3D"gmail_default" style=3D"font-family:ari=
al,sans-serif">That seems like a reasonable (minimal) bar in any event.</di=
v><div class=3D"gmail_default" style=3D"font-family:arial,sans-serif"><br><=
/div><div class=3D"gmail_default" style=3D"font-family:arial,sans-serif">Un=
less someone unleashes a LLM to write the entire code, presumably the tools=
 in IDEs like JetBrains, etc. won&#39;t violate that test.=C2=A0</div><div =
class=3D"gmail_default" style=3D"font-family:arial,sans-serif"><br></div><d=
iv class=3D"gmail_default" style=3D"font-family:arial,sans-serif">But it co=
uld cause an interesting discussion because a simple prompt like &quot;Do a=
 binary search on the ordered array &#39;tools&#39;&quot; could have very d=
ifferent impact if you are writing it in a language which has a existing se=
arch() method for an ordered collection, versus if it is in C and your LLM =
actually writes the binary search from scratch - in the first instance you =
probably need 1-2 lines of code, and in the latter case=C2=A0~9 lines - tha=
t could be rather unsettling.across an entire code base.</div><div class=3D=
"gmail_default" style=3D"font-family:arial,sans-serif"><br></div><div class=
=3D"gmail_default" style=3D"font-family:arial,sans-serif">Cheers,</div><div=
 class=3D"gmail_default" style=3D"font-family:arial,sans-serif"><br></div><=
div class=3D"gmail_default" style=3D"font-family:arial,sans-serif">Todd</di=
v><div class=3D"gmail_default" style=3D"font-family:arial,sans-serif"><b st=
yle=3D"font-family:Arial,Helvetica,sans-serif;background-color:transparent"=
><br></b></div><div class=3D"gmail_default" style=3D"font-family:arial,sans=
-serif"><b style=3D"font-family:Arial,Helvetica,sans-serif;background-color=
:transparent">Todd White</b></div></div><div><div dir=3D"ltr" class=3D"gmai=
l_signature" data-smartmail=3D"gmail_signature"><div dir=3D"ltr"><div>Manag=
ing Director</div><div><br></div><div></div><div><img src=3D"https://ci3.go=
ogleusercontent.com/mail-sig/AIorK4xw08RqGgDKsHOD8XqEYb6-GgGIJIf1cRrXVWqgRb=
0R08UESMvMdTT1W33NqQlLRUIicyduuegMbbIF" width=3D"96" height=3D"71"><br></di=
v><div>177 Huntington Avenue, 17th Floor</div><div>Boston, MA 02115</div><d=
iv>Telephone: +1 617 237-2835 Ext. 101</div><div>EIN: 33-2228263</div><div>=
<br></div><div><a href=3D"https://www.thalion.global/" target=3D"_blank">We=
bsite</a>=C2=A0| <a href=3D"https://x.com/TTIScience" target=3D"_blank">Twi=
tter/X</a>=C2=A0| <a href=3D"https://www.youtube.com/@TTIScience" target=3D=
"_blank">YouTube</a></div><div><br></div><div><a href=3D"https://app.candid=
.org/profile/16308928/the-thalion-initiative-us-inc/?pkId=3D39bf89e9-f544-4=
78c-a3fe-e157e345181d&amp;isActive=3Dtrue" target=3D"_blank"><img src=3D"ht=
tps://cdn.candid.org/seals-of-transparency/2026/candid-seal-gold-2026.png" =
width=3D"96" height=3D"96" alt=3D"https://app.candid.org/profile/16308928/t=
he-thalion-initiative-us-inc-33-2228263/?pkId=3D39bf89e9-f544-478c-a3fe-e15=
7e345181d"></a><br></div></div></div></div><br></div><br><div class=3D"gmai=
l_quote gmail_quote_container"><div dir=3D"ltr" class=3D"gmail_attr">On Wed=
, Jul 8, 2026 at 5:49=E2=80=AFPM Gregory Casamento &lt;<a href=3D"mailto:gr=
[email protected]">[email protected]</a>&gt; wrote:<br></div><b=
lockquote class=3D"gmail_quote" style=3D"margin:0px 0px 0px 0.8ex;border-le=
ft:1px solid rgb(204,204,204);padding-left:1ex"><div dir=3D"ltr"><div class=
=3D"gmail_default" style=3D"font-family:monospace,monospace">To back up wha=
t you said, the case in the US that deals with this is:<br><br><a href=3D"h=
ttps://www.wipo.int/wipolex/en/judgments/details/1840" target=3D"_blank">ht=
tps://www.wipo.int/wipolex/en/judgments/details/1840</a> (Thaler v Perlmutt=
er)<br>There are a few other open cases.</div><div class=3D"gmail_default" =
style=3D"font-family:monospace,monospace"><br>IANAL, but in short, the opin=
ion makes it clear that any work using AI must have significant *HUMAN* aut=
horship to be eligible for copyright.=C2=A0 =C2=A0This is why we are asking=
 people to disclose any AI involvement in their work so we have some way to=
 track this.=C2=A0 =C2=A0It should be noted that no court has yet held that=
 output produced by AI is a derivative work of the training data, but there=
 are a number of legal questions associated with this.<br></div><div class=
=3D"gmail_default" style=3D"font-family:monospace,monospace"><br></div><div=
 class=3D"gmail_default" style=3D"font-family:monospace,monospace">In gener=
al, my understanding is this: as long as YOU wrote the code (that is,&gt; 5=
0%), it is copyrightable.=C2=A0 =C2=A0As with anything like this... be care=
ful.</div><div class=3D"gmail_default" style=3D"font-family:monospace,monos=
pace"><br></div><div class=3D"gmail_default" style=3D"font-family:monospace=
,monospace">Yours, GC</div></div><br><div class=3D"gmail_quote"><div dir=3D=
"ltr" class=3D"gmail_attr">On Mon, Apr 13, 2026 at 11:29=E2=80=AFAM David C=
hisnall &lt;<a href=3D"mailto:[email protected]" target=3D"_blank">=
[email protected]</a>&gt; wrote:<br></div><blockquote class=3D"gmai=
l_quote" style=3D"margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,20=
4,204);padding-left:1ex"><div>Please note also, I will not merge any change=
s to libobjc2 that come from LLMs.=C2=A0 LLM-generated code is hard to revi=
ew, because it comes from a plausible-next-token generator and so is very l=
ikely to *look* correct, even if it is correct.=C2=A0 According to the US c=
opyright office and case law, it cannot be copyrighted, but it *may* be a d=
erived work of something in the training set and so is far too high legal r=
isk to merge.<div><div><br></div><div>David<br id=3D"m_-1961485693620059550=
m_1314357830971397727lineBreakAtBeginningOfMessage"><div><br><blockquote ty=
pe=3D"cite"><div>On 13 Apr 2026, at 16:26, David Chisnall &lt;<a href=3D"ma=
ilto:[email protected]" target=3D"_blank">[email protected]=
</a>&gt; wrote:</div><br><div><div>Hi,<div><br></div><div>Looking at the li=
bobjc2 ones:</div><div><br></div><div>The issue RB-1 is kind-of real, but t=
he fix is incorrect (we should free the object before calling the unexpecte=
d exception handler, because it may not return), though this is almost unre=
achable code.=C2=A0 It can basically happen only if there is an internal er=
ror in the unwind library.</div><div><br></div><div>RB-2 is not correct, se=
lectors being null is undefined behaviour and cannot happen in compiler-gen=
erated code.=C2=A0 Adding a null check on one of the hottest paths in the r=
untime would be a regression.</div><div><br></div><div>TS-7 looks like a fi=
x that we need in a few more places, not sure why it=E2=80=99s only highlig=
hed in the place the code was copied to, not the place it was copied from.<=
/div><div><br></div><div>I think TS-14 is spurious, this should not be call=
ed twice, the first caller nulls out the pointer after the cleanup.=C2=A0 T=
he one corner case where it can be called twice is if cleanup *reallocates*=
 the TLS, in which case doing the cleanup twice is correct.=C2=A0 Do you ha=
ve a test case that demonstrates this?</div><div><br></div><div>RB-6 looks =
like the right fix, simple copy-and-paste bug.=C2=A0 Note that this happens=
 only when memory is exhausted, at which point most Objective-C programs wi=
ll start failing.</div><div><br></div><div>RB-7, the null check is in a sil=
ly place (after the dereference), but the API contract here is that the arg=
ument must not be null, so it=E2=80=99s actually dead code.=C2=A0 This func=
tion also should be setting `*outCount =3D 0` in the early returns.</div><d=
iv><br></div><div>PF-6, yes that refactoring would probably be good to do, =
though note that we don=E2=80=99t hit the weak lock in most cases, only if =
an object is marked as having weak refs.=C2=A0 Have you measured slowdown f=
rom this on anything that *isn=E2=80=99t* a contrived microbenchmark?=C2=A0=
 The quoted slowdown looks incredibly unlikely unless you have a microbench=
mark doing nothing but hitting weak references from multiple threads.</div>=
<div><br></div><div>PF-7, this will generate exactly the same code unless w=
e explicitly use a weaker memory order (both are sequentially consistent by=
 default).=C2=A0 We should move this code over to C++11 atomics at some poi=
nt.</div><div><br></div><div>TS-3 is incorrect.=C2=A0 This counter grows mo=
notonically.=C2=A0 If a selector is registered *while* this call is happeni=
ng, then the result is undefined.=C2=A0 It=E2=80=99s technically UB, in tha=
t there is an unsynchronised read.</div><div><br></div><div>PF-4 was an int=
entional design choice.=C2=A0 Method replacements are infrequent.=C2=A0 The=
 proposed change would make things worse.</div><div><br></div><div>David</d=
iv><div><div><br><blockquote type=3D"cite"><div>On 13 Apr 2026, at 04:35, T=
odd White &lt;[email protected]&gt; wrote:</div><br><div><div dir=
=3D"ltr"><div><div class=3D"gmail_default" style=3D"font-family:arial,sans-=
serif"><span style=3D"font-family:Arial,Helvetica,sans-serif">Hi GNUstep Te=
am,</span></div><br><span class=3D"gmail_default" style=3D"font-family:aria=
l,sans-serif">As an exercise to test out the latest Claude AI capabilities,=
 w</span>e recently completed a comprehensive, bottom-up code audit of the =
GNUstep core stack =E2=80=94 <span class=3D"gmail_default" style=3D"font-fa=
mily:arial,sans-serif">all=C2=A0</span>seven repositories =E2=80=94 coverin=
g libobjc2, libs-base, libs-corebase, libs-opal, libs-quartzcore, libs-gui,=
 and libs-back. The full results, documentation, and all fix commits are pu=
blicly available at:<br><br><a href=3D"https://github.com/DTW-Thalion/gnust=
ep-audit" target=3D"_blank">https://github.com/DTW-Thalion/gnustep-audit</a=
><br><br>I wanted to share what we found and offer to contribute any or all=
 of the changes back upstream.<br><br>## What we did<br><br>We audited the =
entire stack bottom-up =E2=80=94 runtime through UI layer =E2=80=94 examini=
ng every file for robustness issues, thread safety gaps, security vulnerabi=
lities, correctness bugs, and performance bottlenecks. Each finding was sev=
erity-rated, fixed in an atomic commit tagged with a finding ID, and valida=
ted with a dedicated regression test. We also wrote 13 performance benchmar=
ks with a baseline/compare workflow so improvements can be measured reprodu=
cibly.<br><br>## What we found and fixed<br><br>Across all seven repos, we =
identified and fixed 150 findings:<br><br>- 22 Critical =E2=80=94 including=
 NSSecureCoding bypass (class whitelist completely unimplemented), TLS serv=
er verification disabled by default, use-after-free in objc_exception_rethr=
ow, NULL dereferences, data races in CFRunLoop and CATransaction, zero thre=
ad safety across the entire libs-back backend (189 files, 0 locks), and a s=
wapped sendto() argument in CFSocket that prevented any data from being sen=
t.<br><br>- 46 High =E2=80=94 deadlocks in property spinlocks, race conditi=
ons, buffer overflows (CGContext dash buffer allocated in bytes instead of =
doubles), broken APIs, JSON parser with no recursion depth limit (stack ove=
rflow DoS), and integer overflow in binary plist bounds checking.<br><br>- =
61 Medium =E2=80=94 thread safety gaps in GSLayoutManager, NSView, and NSAp=
plication event dispatch; missing input validation; and general robustness =
issues.<br><br>- 14 Low + 10 confirmed bugs =E2=80=94 documentation issues,=
 minor optimizations, swapped arguments, wrong variables, and inverted cond=
itions (e.g., TIFF destination init was inverted, making TIFF writing 100% =
broken).<br><br>We also implemented 12 targeted performance optimizations, =
including:<br><br>- 64-way lock striping for weak references (5=E2=80=938=
=C3=97 concurrent throughput)<br>- O(1) LRU linked list for NSCache (replac=
ing an O(n) implementation that also never evicted)<br>- Geometric growth f=
or CFArray (O(n) vs O(n=C2=B2) sequential appends)<br>- X11 expose event co=
alescing, live resize throttling at 60fps, dirty region tracking in NSView,=
 DPSimage conversion caching, and stack buffer allocation in CFRunLoop to e=
liminate per-iteration malloc<br><br>Benchmark results on MSYS2/ucrt64 show=
 +29=E2=80=9331% for retain/release, +12=E2=80=9318% for message dispatch, =
+46=E2=80=9355% for array operations, and +25% for NSCache.<br><br>## How t=
he work is organized<br><br>Each of the seven repos has its own fork under =
our GitHub org (<a href=3D"https://github.com/DTW-Thalion" target=3D"_blank=
">https://github.com/DTW-Thalion</a>) with fix commits on master. The gnust=
ep-audit repo itself contains:<br><br>- Per-phase findings reports (docs/ph=
ase1 through phase6)<br>- A master audit summary (docs/AUDIT-SUMMARY.md)<br=
>- 51 regression tests and 13 benchmarks under instrumentation/<br>- A Make=
file-driven test and benchmark harness with baseline/compare support<br><br=
>All 32 regression tests pass on the patched stack (up from 18/32 on unpatc=
hed).<br><br>## Offer to contribute upstream<br><br>We&#39;d be happy to co=
ntribute any or all of these changes back into the main GNUstep repositorie=
s =E2=80=94 whether as pull requests, individual patches, or in whatever fo=
rm works best for your workflow.=C2=A0<span class=3D"gmail_default" style=
=3D"font-family:arial,sans-serif">Feel free to help yourself to the repo.</=
span><br><br>The security-critical fixes (NSSecureCoding, TLS defaults, JSO=
N depth limit, binary plist overflow) and the confirmed crash bugs (use-aft=
er-free, NULL derefs, inverted conditions) are probably the highest-priorit=
y candidates for upstream integration<span class=3D"gmail_default" style=3D=
"font-family:arial,sans-serif">.</span><br><br>Please feel free to reach ou=
t with any questions. We have a lot of respect for the GNUstep project <spa=
n class=3D"gmail_default" style=3D"font-family:arial,sans-serif">(and a bit=
 nostalgic for heady days of NeXTStep/OpenStep)=C2=A0</span>and would like =
to see this work benefit the broader community.</div><div><br></div><div><d=
iv class=3D"gmail_default" style=3D"font-family:arial,sans-serif">It&#39;s =
unclear if the codebase is actively maintained or if many people still use =
it, but we hope that this exercise provides some value.</div><br>Best regar=
ds,</div><div><br></div><div><div class=3D"gmail_default" style=3D"font-fam=
ily:arial,sans-serif">Todd</div><br clear=3D"all"></div><div><div dir=3D"lt=
r" class=3D"gmail_signature"><div dir=3D"ltr"><b>Todd White</b><div>Managin=
g Director</div><div><br></div><div></div><div><img src=3D"https://ci3.goog=
leusercontent.com/mail-sig/AIorK4xw08RqGgDKsHOD8XqEYb6-GgGIJIf1cRrXVWqgRb0R=
08UESMvMdTT1W33NqQlLRUIicyduuegMbbIF" width=3D"96" height=3D"71"><br></div>=
<div>177 Huntington Avenue, 17th Floor</div><div>Boston, MA 02115</div><div=
>Telephone: +1 617 237-2835 Ext. 101</div><div>EIN: 33-2228263</div><div><b=
r></div><div><a href=3D"https://www.thalion.global/" target=3D"_blank">Webs=
ite</a>=C2=A0| <a href=3D"https://x.com/TTIScience" target=3D"_blank">Twitt=
er/X</a>=C2=A0| <a href=3D"https://www.youtube.com/@TTIScience" target=3D"_=
blank">YouTube</a></div><div><br></div><div><a href=3D"https://app.candid.o=
rg/profile/16308928/the-thalion-initiative-us-inc/?pkId=3D39bf89e9-f544-478=
c-a3fe-e157e345181d&amp;isActive=3Dtrue" target=3D"_blank"><img src=3D"http=
s://cdn.candid.org/seals-of-transparency/2026/candid-seal-gold-2026.png" wi=
dth=3D"96" height=3D"96" alt=3D"https://app.candid.org/profile/16308928/the=
-thalion-initiative-us-inc-33-2228263/?pkId=3D39bf89e9-f544-478c-a3fe-e157e=
345181d"></a><br></div></div></div></div></div>
</div></blockquote></div><br></div></div></div></blockquote></div><br></div=
></div></div></blockquote></div><div><br clear=3D"all"></div><div><br></div=
><span class=3D"gmail_signature_prefix">-- </span><br><div dir=3D"ltr" clas=
s=3D"gmail_signature"><div dir=3D"ltr"><div dir=3D"ltr"><div><div dir=3D"lt=
r"><font face=3D"monospace">Gregory Casamento<br>GNUstep Lead Developer / B=
lack Lotus, Principal Consultant<br><a href=3D"http://www.gnustep.org" targ=
et=3D"_blank">http://www.gnustep.org</a> - <a href=3D"http://heronsperch.bl=
ogspot.com" target=3D"_blank">http://heronsperch.blogspot.com</a><br></font=
></div></div><div dir=3D"ltr"><font color=3D"#888888" face=3D"monospace"><a=
 href=3D"https://www.openhub.net/languages/objective_c" style=3D"color:rgb(=
17,85,204)" target=3D"_blank">https://www.openhub.net/languages/objective_c=
</a></font></div></div></div></div>
</blockquote></div>

--00000000000087a626065620d0d5--