Upload the Trail of Bits public security assessment report

[ESultanik]

Adds a copy of the public report published at https://github.com/trailofbits/publications/blob/master/reviews/Microsoft-go-cose.pdf

[codecov]

Codecov Report

Merging #94 (535a715) into main (689f87f) will increase coverage by 0.29%.
The diff coverage is n/a.

❗ Current head 535a715 differs from pull request most recent head 6db24d3. Consider uploading reports for the commit 6db24d3 to get more accurate results

@@            Coverage Diff             @@
##             main      #94      +/-   ##
==========================================
+ Coverage   89.48%   89.78%   +0.29%     
==========================================
  Files          10       10              
  Lines        1018     1018              
==========================================
+ Hits          911      914       +3     
+ Misses         72       69       -3     
  Partials       35       35              

Impacted Files	Coverage Δ
headers.go	93.05% <0.00%> (+0.90%)	⬆️

Help us with your feedback. Take ten seconds to tell us how you rate us.

[qmuntal]

Great!

[yogeshbdeshpande]

LGTM!

[SteveLasker]

Thanks @ESultanik,
The report looks great, and appreciate the links in the doc to the mitigated high and low issues that were identified.
One minor formating, ownership request:
While Microsoft commissioned the report and is supporting the veraison project, the report should reflect the veraison/go-cose project maintainers to properly give credit to the folks at ARM that initiated the effort.

Page 11
s/go-cose: Microsoft’s COSE implementation in Go.
r/The veraison project, go-cose implementation in Go.

Page 19
s/The Microsoft go-cose library is a work in progress with continuous development. Trail of Bits recommends that Microsoft address the findings detailed in this report and take the following additional steps prior to deployment:

r/The veraison/go-cose library is a work in progress with continuous development. Trail of Bits recommends the veraison project address the findings detailed in this report and take the following additional steps prior to deployment:

[ESultanik]

No problem, we will update the report and tag you here when it's ready.

[ESultanik]

@SteveLasker I just pushed an updated version of the report. I didn't rebase this branch, so the old version is still in the git history. Let me know if you'd rather I do a rebase.

[SteveLasker]

Thanks, @ESultanik for the updates and to the Trail of Bits team for the thorough review.