init with legal information

CODE_OF_CONDUCT.md

@@ -0,0 +1,52 @@
+# Contributor Code of Conduct
+
+As contributors and maintainers of this project, and in the interest of
+fostering an open and welcoming community, we pledge to respect all people who
+contribute through reporting issues, posting feature requests, updating
+documentation, submitting pull requests or patches, and other activities.
+
+We are committed to making participation in this project a harassment-free
+experience for everyone, regardless of level of experience, gender, gender
+identity and expression, sexual orientation, disability, personal appearance,
+body size, race, ethnicity, age, religion, or nationality.
+
+Examples of unacceptable behavior by participants include:
+
+* The use of sexualized language or imagery
+* Personal attacks
+* Trolling or insulting/derogatory comments
+* Public or private harassment
+* Publishing other's private information, such as physical or electronic
+  addresses, without explicit permission
+* Other unethical or unprofessional conduct
+
+Project maintainers have the right and responsibility to remove, edit, or
+reject comments, commits, code, wiki edits, issues, and other contributions
+that are not aligned to this Code of Conduct, or to ban temporarily or
+permanently any contributor for other behaviors that they deem inappropriate,
+threatening, offensive, or harmful.
+
+By adopting this Code of Conduct, project maintainers commit themselves to
+fairly and consistently applying these principles to every aspect of managing
+this project. Project maintainers who do not follow or enforce the Code of
+Conduct may be permanently removed from the project team.
+
+This Code of Conduct applies both within project spaces and in public spaces
+when an individual is representing the project or its community.
+
+Instances of abusive, harassing, or otherwise unacceptable behavior may be
+reported by contacting the project maintainers at [email protected]. If
+the incident involves a committer, you may report directly to
+[email protected].
+
+All complaints will be reviewed and investigated and will result in a
+response that is deemed necessary and appropriate to the circumstances.
+Maintainers are obligated to maintain confidentiality with regard to the
+reporter of an incident.
+
+This Code of Conduct is adapted from the [Contributor Covenant][homepage],
+version 1.3.0, available at
+[http://contributor-covenant.org/version/1/3/0/][version]
+
+[homepage]: http://contributor-covenant.org
+[version]: http://contributor-covenant.org/version/1/3/0/

LICENSE

@@ -0,0 +1,37 @@
+MIT License
+
+Copyright (c) 2022 ONEKEY GmbH
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.
+
+--
+
+Logic for Unix Compress (unblob/handlers/compression/compress.py) is
+ported from the unlzw project
+(https://github.com/umeat/unlzw/).
+
+Original license:
+
+> Written by Brandon Owen, May 2016, [email protected] Adapted from original work by Mark Adler - orginal copyright notice below
+>
+> Copyright (C) 2014, 2015 Mark Adler This software is provided 'as-is', without any express or implied warranty. In no event will the authors be held liable for any damages arising from the use of this software. Permission is granted to anyone to use this software for any purpose, including commercial applications, and to alter it and redistribute it freely, subject to the following restrictions:
+>
+>     The origin of this software must not be misrepresented; you must not claim that you wrote the original software. If you use this software in a product, an acknowledgment in the product documentation would be appreciated but is not required.
+>     Altered source versions must be plainly marked as such, and must not be misrepresented as being the original software.
+>     This notice may not be removed or altered from any source distribution. Mark Adler [email protected]

SECURITY.md

@@ -0,0 +1,60 @@
+# Security Policy
+
+## Reporting
+As a security company, ONEKEY commits to all of its open source products having sound and secure implementations.
+
+All security bugs in ONEKEY products should be reported by email to [email protected]. We strongly suggest that you encrypt your email content using our PGP public key (see below). Security bugs must not  be reported through public Github issues.
+
+In accordance with the [Responsible Full Disclosure Policy (RFPolicy) v2.0](https://dl.packetstormsecurity.net/papers/general/rfpolicy-2.0.txt), your email will be acknowledged within five days. The security team will then keep you informed of the progress being made towards a fix and full announcement at least every five days.
+
+## Disclosure policy
+ONEKEY has a 5 step disclosure process.
+
+1. The security report is received and is assigned a primary handler. This person will coordinate the fix and release process.
+
+1. The problem is confirmed and a list of all affected versions is determined.
+
+1. Code is audited to find any potential similar problems.
+
+1. Fixes are prepared and applied to the latest version. These fixes are not committed to the public repository but rather held locally pending the announcement.
+
+1. On the embargo date, the advisory is pushed to the affected repository’s wiki, the changes are pushed to the public repository and new builds are deployed to package repositories. A copy of the advisory is then published in the release notes.
+
+This process can take some time, especially when coordination is required with maintainers of other projects. Every effort will be made to handle the bug in an as timely a manner as possible, however it’s important that we follow the release process above to ensure that the disclosure is handled in a consistent manner.
+
+We will never push silent fixes of reported security issues to our code bases. Our security fixes commit will always contain explicit commit messages describing the issue and fix in details and reference a CVE if applicable. Our security advisories will always credit the reporter either by name, handle, or email address. If the reporter wishes to stay anonymous, we will credit them as “anonymous researcher”.
+
+## PGP Key
+
+```
+-----BEGIN PGP PUBLIC KEY BLOCK-----
+
+mQENBGJWa+gBCADwVEuade39t7qC2L997zAbHg5MvmqgL/mgAz0wc+SnB60lKP1S
+ALAedVVs68ODrNIy5Ob542oXvKVaiAGPDjpD76TTHUaONKCtAWQMjd1FG/zi7U7F
+wtzON22xc9pOlbf7Vind1bV6eF8rSRt8xIvhYIs6wl6cqHOAqMfOzQp/FqA9LVkd
+KZwHTwcIeXm2simpNk6GkjVVjy6QRc3tO0KpLyfUGNLrUBhA9tNtzjbZ5nUESIuE
+FNgCai0pX89h8PuXiRABDQq4SVxq9+Wl3xkdX0gck444fQLLRxpYVpl4mBodY79/
+Hl1MuYFzm4xgBHD5LEeZ9wgqFSRlklXGI+URABEBAAG0GnJlc2VhcmNoQGlvdC1p
+bnNwZWN0b3IuY29tiQFOBBMBCAA4FiEE7X8jOwd94T3HaMCoSogMvqTieacFAmJW
+a+gCGwMFCwkIBwIGFQoJCAsCBBYCAwECHgECF4AACgkQSogMvqTieaePPAf/XRO3
+SZppFI+d9FLwzL4in8dMFAsGWOS+HzifCisNJ4ERHyyD1UK1ZlS0FyXfoylUIINl
+62MjzGVrUj6p6i3qTuOjymOJYhR3I3CKLGUh5JA+DPQxJ9+kHTQbUpxvXJQ8P2BS
+x3Cz11zu9EDMzEC2hbchANhJ8pUnQhAeuSbAwAxzGEvXqwm789IvuXFkGZkAR60J
+eQnbvgT1Ij2Awq7oOBmOEQ79MzvB7m+Bd8uQQCOxqNCX+2TTH+PKC/2x0RwlyYG9
+yjnUyyPttyCc8dkjUiirchhE9g5kYCUNmprWw7Pr5pO+5Wuwk+1DwYGXie81aJkZ
+jWqTE90EvmMbatGf4LkBDQRiVmvoAQgA0d546TrhcBPh3nbiE++kFz+Pne9fdorv
+3ln2zMmFxtn6f4eNdwPlnu1vyTqTr0F/Sb39FU1t7c1UHfxbqvYHfExEKjI9Vzzy
+74/rRK2RCO1PoUM4X+ngy13V4FH0EZNy0srXHZsD2TqWLCtsA34k87wBUizFaFUa
+tI1Dg8ambo9i/7flovC1y3oX/hK+Ct6ey5r/SZ0gZ4esZSRb8ogddumZRFcakR6o
+Vz91rHjAvvE4bxC1ioCiX0YXhst/GawwshZeq26Ju96QZQ/kSb4vwGQ1ThtSEsD4
+rypZopdv4U+JqwBlLpsL71iF+/wiEXIgja1zQc06cI9YMPKcAZSA+QARAQABiQE2
+BBgBCAAgFiEE7X8jOwd94T3HaMCoSogMvqTieacFAmJWa+gCGwwACgkQSogMvqTi
+eaf7qwgAwN20J6wCUZmBD/sh27fmmpmsKGi86S8dN8Dt6QP9et5L9yMwGuxUuiLU
+SByuBVCs6MvJGtyg5r1ZUbzevb3Ge7I4PPWGqnSiydxgCo8psmM7T2vpruKayfCb
+FkYlwaoTAR9vD4rmftJO+X0fxwOvNtS6Xv4JNugUfeSEk4hIm5GPabSBWFd4imfy
+QnTDT/JvV/HOf6LC1Nonz9aiwr6+F6MXQihZKGiK/tDoWrB5404p6JToLpeFcVaT
+vylQcgCz/sFGLc4uV7XEobCDZpfP5UC+hjXpIorrTmKMSLotq8s5vx84W3qeZzgt
+Gh7fzoVy9KKksJH0j1eFpBa+FgJM8g==
+=obzE
+-----END PGP PUBLIC KEY BLOCK-----
+```