1. Project and resources

C-PAT is developed by the Naval Surface Warfare Center Crane Division (NSWC Crane) and released as open source. This page lists where the project lives, how to reach the maintainers, and the terms that apply to contributions. For what C-PAT does, start with the User Guide.

1.1. Resources

Resource

Location

Source code and issues

github.com/NSWC-Crane/C-PAT. Bug reports and feature requests use the issue forms in the repository.

Documentation

c-pat.readthedocs.io, built from the main branch. Every deployed instance also serves its own copy at /docs.

Container image

nswccrane/c-pat on Docker Hub, tagged with the release version and latest.

Demonstration identity provider

nswccrane/c-pat-auth, a Keycloak image with the RMFTools realm, clients, scopes, and roles that C-PAT and STIG Manager expect. Source at NSWC-Crane/C-PAT-AUTH.

Sample orchestration

NSWC-Crane/C-PAT-RMF-ORCHESTRATION holds reverse proxy and orchestration examples. The rmftools-orchestration-cac branch uses CAC authentication; demo-auth-no-cac does not.

STIG Manager

NUWCDIVNPT/stig-manager, the project C-PAT integrates with. This documentation follows the structure of the STIG Manager documentation.

Security advisories

Security advisories on GitHub. See Contributing for how to report a vulnerability privately.

1.2. Support

Only the current release receives fixes. Bug reports are accepted against the current minor version, so update before reporting. The full policy is in SECURITY.md at the repository root.

1.3. Licensing

C-PAT is released under the C-PAT Software Open Source License Agreement in LICENSE.MD at the repository root. It is not an OSI-standard license; read it before redistributing or modifying the software. Two companion files qualify it:

  • INTENT.md explains that work by U.S. Federal Government employees is ineligible for copyright protection in the United States and is released under the license elsewhere.

  • CONTRIBUTORS.md records the Developer Certificate of Origin sign-off of every contributor. See Contributing.

“C-PAT” is a trademark of the U.S. Navy. Modified versions that change the software substantially may not use the name.

1.4. Project metadata

C-PAT/C-PAT.json at the repository root is the federal source code inventory [code.mil] record (a code.json file). It carries the project description, contact, license, version, and labor-hour estimate. The release workflow updates it on every release; do not edit it by hand. See Release process.