Convert more strcpy to strn variant

20 files changed, 88 insertions, 88 deletions

diff --git a/src/lib/core/artifactory.c b/src/lib/core/artifactory.c
index 415986e..918b24e 100644
--- a/src/lib/core/artifactory.c
+++ b/src/lib/core/artifactory.c
@@ -14,31 +14,31 @@ int artifactory_download_cli(char *dest,
     char arch_ident[STASIS_NAME_MAX] = {0};
 
     // convert platform string to lower-case
-    strcpy(os_ident, os);
+    strncpy(os_ident, os, sizeof(os_ident) - 1);
     tolower_s(os_ident);
 
     // translate OS identifier
     if (!strcmp(os_ident, "darwin") || startswith(os_ident, "macos")) {
-        strcpy(os_ident, "mac");
+        strncpy(os_ident, "mac", sizeof(os_ident) - 1);
     } else if (!strcmp(os_ident, "linux")) {
-        strcpy(os_ident, "linux");
+        strncpy(os_ident, "linux", sizeof(os_ident) - 1);
     } else {
         fprintf(stderr, "%s: unknown operating system: %s\n", __FUNCTION__, os_ident);
         return -1;
     }
 
     // translate ARCH identifier
-    strcpy(arch_ident, arch);
+    strncpy(arch_ident, arch, sizeof(arch_ident) - 1);
     if (startswith(arch_ident, "i") && endswith(arch_ident, "86")) {
-        strcpy(arch_ident, "386");
+        strncpy(arch_ident, "386", sizeof(arch_ident) - 1);
     } else if (!strcmp(arch_ident, "amd64") || !strcmp(arch_ident, "x86_64") || !strcmp(arch_ident, "x64")) {
         if (!strcmp(os_ident, "mac")) {
-            strcpy(arch_ident, "386");
+            strncpy(arch_ident, "386", sizeof(arch_ident) - 1);
         } else {
-            strcpy(arch_ident, "amd64");
+            strncpy(arch_ident, "amd64", sizeof(arch_ident) - 1);
         }
     } else if (!strcmp(arch_ident, "arm64") || !strcmp(arch_ident, "aarch64")) {
-        strcpy(arch_ident, "arm64");
+        strncpy(arch_ident, "arm64", sizeof(arch_ident) - 1);
     } else {
         fprintf(stderr, "%s: unknown architecture: %s\n", __FUNCTION__, arch_ident);
         return -1;
@@ -53,7 +53,7 @@ int artifactory_download_cli(char *dest,
              os_ident,                             // ...
              arch_ident,                           // jfrog-cli-linux-x86_64
              remote_filename);                     // jf
-    strcpy(path, dest);
+    strncpy(path, dest, sizeof(path) - 1);
 
     if (mkdirs(path, 0755)) {
         fprintf(stderr, "%s: %s: %s", __FUNCTION__, path, strerror(errno));
@@ -244,8 +244,8 @@ int jfrog_cli(struct JFRT_Auth *auth, const char *subsystem, const char *task, c
     }
 
     if (!globals.verbose) {
-        strcpy(proc.f_stdout, "/dev/null");
-        strcpy(proc.f_stderr, "/dev/null");
+        strncpy(proc.f_stdout, "/dev/null", sizeof(proc.f_stdout) - 1);
+        strncpy(proc.f_stderr, "/dev/null", sizeof(proc.f_stderr) - 1);
     }
     return shell(&proc, cmd);
 }
diff --git a/src/lib/core/conda.c b/src/lib/core/conda.c
index 491eae3..3ef4d62 100644
--- a/src/lib/core/conda.c
+++ b/src/lib/core/conda.c
@@ -10,11 +10,11 @@ int micromamba(const struct MicromambaInfo *info, char *command, ...) {
 
     tolower_s(sys.sysname);
     if (!strcmp(sys.sysname, "darwin")) {
-        strcpy(sys.sysname, "osx");
+        strncpy(sys.sysname, "osx", sizeof(sys.sysname) - 1);
     }
 
     if (!strcmp(sys.machine, "x86_64")) {
-        strcpy(sys.machine, "64");
+        strncpy(sys.machine, "64", sizeof(sys.machine) - 1);
     }
 
     char url[PATH_MAX];
@@ -149,7 +149,7 @@ int pkg_index_provides(int mode, const char *index, const char *spec) {
     int status = 0;
     struct Process proc = {0};
     proc.redirect_stderr = 1;
-    strcpy(proc.f_stdout, logfile);
+    strncpy(proc.f_stdout, logfile, sizeof(proc.f_stdout) - 1);
 
     if (mode == PKG_USE_PIP) {
         // Do an installation in dry-run mode to see if the package exists in the given index.
@@ -226,12 +226,12 @@ int conda_exec(const char *args) {
             "deactivate",
             NULL
     };
-    char conda_as[6] = {0};
+    char conda_as[10] = {0};
 
-    strcpy(conda_as, "conda");
+    strncpy(conda_as, "conda", sizeof(conda_as) - 1);
     for (size_t i = 0; mamba_commands[i] != NULL; i++) {
         if (startswith(args, mamba_commands[i])) {
-            strcpy(conda_as, "mamba");
+            strncpy(conda_as, "mamba", sizeof(conda_as) - 1);
             break;
         }
     }
@@ -483,7 +483,7 @@ int conda_setup_headless() {
     const char *cmd_fmt = "'%s'";
     if (globals.conda_packages && strlist_count(globals.conda_packages)) {
         memset(cmd, 0, sizeof(cmd));
-        strcpy(cmd, "install ");
+        strncpy(cmd, "install ", sizeof(cmd) - 1);
 
         total = strlist_count(globals.conda_packages);
         for (size_t i = 0; i < total; i++) {
@@ -506,7 +506,7 @@ int conda_setup_headless() {
 
     if (globals.pip_packages && strlist_count(globals.pip_packages)) {
         memset(cmd, 0, sizeof(cmd));
-        strcpy(cmd, "install ");
+        strncpy(cmd, "install ", sizeof(cmd) - 1);
 
         total = strlist_count(globals.pip_packages);
         for (size_t i = 0; i < total; i++) {
diff --git a/src/lib/core/copy.c b/src/lib/core/copy.c
index 25eede3..ba52507 100644
--- a/src/lib/core/copy.c
+++ b/src/lib/core/copy.c
@@ -14,7 +14,7 @@ int copy2(const char *src, const char *dest, unsigned int op) {
     }
 
     char dname[1024] = {0};
-    strcpy(dname, dest);
+    strncpy(dname, dest, sizeof(dname) - 1);
 
     char *dname_endptr = strrchr(dname, '/');
     if (dname_endptr != NULL) {
diff --git a/src/lib/core/docker.c b/src/lib/core/docker.c
index fd0a2e2..37ef48d 100644
--- a/src/lib/core/docker.c
+++ b/src/lib/core/docker.c
@@ -18,10 +18,10 @@ int docker_exec(const char *args, const unsigned flags) {
     }
 
     if (final_flags & STASIS_DOCKER_QUIET_STDOUT) {
-        strcpy(proc.f_stdout, "/dev/null");
+        strncpy(proc.f_stdout, "/dev/null", sizeof(proc.f_stdout) - 1);
     }
     if (final_flags & STASIS_DOCKER_QUIET_STDERR) {
-        strcpy(proc.f_stderr, "/dev/null");
+        strncpy(proc.f_stderr, "/dev/null", sizeof(proc.f_stderr) - 1);
     }
 
     if (!final_flags) {
@@ -68,12 +68,12 @@ int docker_build(const char *dirpath, const char *args, int engine) {
     memset(cmd, 0, sizeof(cmd));
 
     if (engine & STASIS_DOCKER_BUILD) {
-        strcpy(build, "build");
+        strncpy(build, "build", sizeof(build) - 1);
     }
     if (engine & STASIS_DOCKER_BUILD_X) {
-        strcpy(build, "buildx build");
+        strncpy(build, "buildx build", sizeof(build) - 1);
     }
-    snprintf(cmd, sizeof(cmd) - 1, "%s %s %s", build, args, dirpath);
+    snprintf(cmd, sizeof(cmd), "%s %s %s", build, args, dirpath);
     return docker_exec(cmd, 0);
 }
 
@@ -83,13 +83,13 @@ int docker_save(const char *image, const char *destdir, const char *compression_
     if (compression_program && strlen(compression_program)) {
         char ext[255] = {0};
         if (startswith(compression_program, "zstd")) {
-            strcpy(ext, "zst");
+            strncpy(ext, "zst", sizeof(ext) - 1);
         } else if (startswith(compression_program, "xz")) {
-            strcpy(ext, "xz");
+            strncpy(ext, "xz", sizeof(ext) - 1);
         } else if (startswith(compression_program, "gzip")) {
-            strcpy(ext, "gz");
+            strncpy(ext, "gz", sizeof(ext) - 1);
         } else if (startswith(compression_program, "bzip2")) {
-            strcpy(ext, "bz2");
+            strncpy(ext, "bz2", sizeof(ext) - 1);
         } else {
             strncpy(ext, compression_program, sizeof(ext) - 1);
         }
@@ -120,8 +120,8 @@ static char *docker_ident() {
     }
 
     memset(&proc, 0, sizeof(proc));
-    strcpy(proc.f_stdout, tempfile);
-    strcpy(proc.f_stderr, "/dev/null");
+    strncpy(proc.f_stdout, tempfile, sizeof(proc.f_stdout) - 1);
+    strncpy(proc.f_stderr, "/dev/null", sizeof(proc.f_stderr) - 1);
     shell(&proc, "docker --version");
 
     if (!freopen(tempfile, "r", fp)) {
diff --git a/src/lib/core/environment.c b/src/lib/core/environment.c
index 7ece5e6..3c94d33 100644
--- a/src/lib/core/environment.c
+++ b/src/lib/core/environment.c
@@ -70,7 +70,7 @@ void runtime_export(RuntimeEnv *env, char **keys) {
             NULL,
     };
 
-    char export_command[7]; // export=6 and setenv=6... convenient
+    char export_command[10]; // export=6 and setenv=6... convenient
     char *_sh = getenv("SHELL");
     char *sh = path_basename(_sh);
     if (sh == NULL) {
@@ -80,13 +80,13 @@ void runtime_export(RuntimeEnv *env, char **keys) {
 
     for (size_t i = 0; borne[i] != NULL; i++) {
         if (strcmp(sh, borne[i]) == 0) {
-            strcpy(export_command, "export");
+            strncpy(export_command, "export", sizeof(export_command) - 1);
             break;
         }
     }
     for (size_t i = 0; unborne[i] != NULL; i++) {
         if (strcmp(sh, unborne[i]) == 0) {
-            strcpy(export_command, "setenv");
+            strncpy(export_command, "setenv", sizeof(export_command) - 1);
             break;
         }
     }
diff --git a/src/lib/core/include/utils.h b/src/lib/core/include/utils.h
index 8b657e4..c1ee513 100644
--- a/src/lib/core/include/utils.h
+++ b/src/lib/core/include/utils.h
@@ -293,9 +293,10 @@ int xml_pretty_print_in_place(const char *filename, const char *pretty_print_pro
  * Applies STASIS fixups to a tox ini config
  * @param filename path to tox.ini
  * @param result path to processed configuration
+ * @param maxlen
  * @return 0 on success, -1 on error
  */
-int fix_tox_conf(const char *filename, char **result);
+int fix_tox_conf(const char *filename, char **result, size_t maxlen);
 
 char *collapse_whitespace(char **s);
 
diff --git a/src/lib/core/ini.c b/src/lib/core/ini.c
index 6081678..ca87de5 100644
--- a/src/lib/core/ini.c
+++ b/src/lib/core/ini.c
@@ -177,7 +177,7 @@ int ini_getval(struct INIFILE *ini, char *section_name, char *key, int type, int
             }
             break;
         case INIVAL_TYPE_STR_ARRAY:
-            strcpy(tbufp, data_copy);
+            strncpy(tbufp, data_copy, sizeof(tbuf) - 1);
             guard_free(data_copy);
             data_copy = calloc(STASIS_BUFSIZ, sizeof(*data_copy));
             if (!data_copy) {
@@ -522,7 +522,7 @@ struct INIFILE *ini_open(const char *filename) {
 
     // Create an implicit section. [default] does not need to be present in the INI config
     ini_section_create(&ini, "default");
-    strcpy(current_section, "default");
+    strncpy(current_section, "default", sizeof(current_section) - 1);
 
     // Open the configuration file for reading
     FILE *fp = fopen(filename, "r");
@@ -596,7 +596,7 @@ struct INIFILE *ini_open(const char *filename) {
 
             // Record the name of the section. This is used until another section is found.
             memset(current_section, 0, sizeof(current_section));
-            strcpy(current_section, section_name);
+            strncpy(current_section, section_name, sizeof(current_section) - 1);
             guard_free(section_name);
             memset(line, 0, sizeof(line));
             continue;
@@ -621,12 +621,12 @@ struct INIFILE *ini_open(const char *filename) {
             lstrip(key);
             strip(key);
             memset(key_last, 0, sizeof(inikey[1]));
-            strcpy(key_last, key);
+            strncpy(key_last, key, sizeof(inikey[1]) - 1);
             reading_value = 1;
             if (strlen(operator) > 1) {
-                strcpy(value, &operator[1]);
+                strncpy(value, &operator[1], sizeof(value) - 1);
             } else {
-                strcpy(value, "");
+                strncpy(value, "", sizeof(value) - 1);
             }
             if (isempty(value)) {
                 //printf("%s is probably long raw data\n", key);
@@ -640,8 +640,8 @@ struct INIFILE *ini_open(const char *filename) {
             }
             strip(value);
         } else {
-            strcpy(key, key_last);
-            strcpy(value, line);
+            strncpy(key, key_last, sizeof(inikey[0]) - 1);
+            strncpy(value, line, sizeof(value) - 1);
         }
         memset(line, 0, sizeof(line));
 
diff --git a/src/lib/core/multiprocessing.c b/src/lib/core/multiprocessing.c
index 09f81de..2bf33dd 100644
--- a/src/lib/core/multiprocessing.c
+++ b/src/lib/core/multiprocessing.c
@@ -236,14 +236,13 @@ void mp_pool_show_summary(struct MultiProcessingPool *pool) {
         if (task->status == MP_POOL_TASK_STATUS_INITIAL && task->pid == MP_POOL_PID_UNUSED) {
             // You will only see this label if the task pool is killed by
             // MP_POOL_FAIL_FAST and tasks are still queued for execution
-            strcpy(status_str, "HOLD");
+            strncpy(status_str, "HOLD", sizeof(status_str) - 1);
         } else if (!task->status && !task->signaled_by) {
-
-            strcpy(status_str, "DONE");
+            strncpy(status_str, "DONE", sizeof(status_str) - 1);
         } else if (task->signaled_by) {
-            strcpy(status_str, "TERM");
+            strncpy(status_str, "TERM", sizeof(status_str) - 1);
         } else {
-            strcpy(status_str, "FAIL");
+            strncpy(status_str, "FAIL", sizeof(status_str) - 1);
         }
 
         char duration[255] = {0};
diff --git a/src/lib/core/relocation.c b/src/lib/core/relocation.c
index fce74b6..bd5504b 100644
--- a/src/lib/core/relocation.c
+++ b/src/lib/core/relocation.c
@@ -84,7 +84,7 @@ int replace_text(char *original, const char *target, const char *replacement, un
         memset(original + buffer_len, 0, original_len - buffer_len);
     }
     // replace original with contents of buffer
-    strcpy(original, buffer);
+    strncpy(original, buffer, buffer_len + 1);
     return 0;
 }
 
diff --git a/src/lib/core/str.c b/src/lib/core/str.c
index c8f9c7e..368ab49 100644
--- a/src/lib/core/str.c
+++ b/src/lib/core/str.c
@@ -119,7 +119,7 @@ char** split(char *_sptr, const char* delim, size_t max)
         if (!result[i]) {
             return NULL;
         }
-        strcpy(result[i], token);
+        strncpy(result[i], token, STASIS_BUFSIZ - 1);
     }
 
     // pos is non-zero when maximum split is reached
@@ -129,7 +129,7 @@ char** split(char *_sptr, const char* delim, size_t max)
         if (!result[i]) {
             return NULL;
         }
-        strcpy(result[i], &orig[pos]);
+        strncpy(result[i], &orig[pos], STASIS_BUFSIZ - 1);
     }
 
     guard_free(sptr);
@@ -562,7 +562,7 @@ char *normalize_space(char *s) {
     }
 
     // Rewrite the input string
-    strcpy(result, tmp_orig);
+    strncpy(result, tmp_orig, strlen(result) + 1);
     guard_free(tmp_orig);
     return result;
 }
diff --git a/src/lib/core/strlist.c b/src/lib/core/strlist.c
index f3754c3..ff9c098 100644
--- a/src/lib/core/strlist.c
+++ b/src/lib/core/strlist.c
@@ -84,7 +84,7 @@ int strlist_append_file(struct StrList *pStrList, char *_path, ReaderFn *readerF
     if (is_url) {
         int fd;
         char tempfile[PATH_MAX] = {0};
-        strcpy(tempfile, "/tmp/.remote_file.XXXXXX");
+        strncpy(tempfile, "/tmp/.remote_file.XXXXXX", sizeof(tempfile) - 1);
         if ((fd = mkstemp(tempfile)) < 0) {
             retval = -1;
             goto fatal;
@@ -421,7 +421,7 @@ void strlist_set(struct StrList **pStrList, size_t index, char *value) {
         }
 
         memset((*pStrList)->data[index], '\0', strlen(value) + 1);
-        strcpy((*pStrList)->data[index], value);
+        strncpy((*pStrList)->data[index], value, strlen(value));
     }
 }
 
diff --git a/src/lib/core/template.c b/src/lib/core/template.c
index 67e2e03..623b811 100644
--- a/src/lib/core/template.c
+++ b/src/lib/core/template.c
@@ -218,7 +218,7 @@ char *tpl_render(char *str) {
                 value = strdup(env_val ? env_val : "");
             } else if (do_func) { // {{ func:NAME(a, ...) }}
                 char func_name_temp[STASIS_NAME_MAX] = {0};
-                strcpy(func_name_temp, type_stop + 1);
+                strncpy(func_name_temp, type_stop + 1, sizeof(func_name_temp) - 1);
                 char *param_begin = strchr(func_name_temp, '(');
                 if (!param_begin) {
                     fprintf(stderr, "At position %zu in %s\nfunction name must be followed by a '('\n", off, key);
diff --git a/src/lib/core/template_func_proto.c b/src/lib/core/template_func_proto.c
index d344933..fc58e33 100644
--- a/src/lib/core/template_func_proto.c
+++ b/src/lib/core/template_func_proto.c
@@ -80,7 +80,7 @@ int get_junitxml_file_entrypoint(void *frame, void *data_out) {
         return -1;
     }
     char nametmp[PATH_MAX] = {0};
-    strcpy(nametmp, cwd);
+    strncpy(nametmp, cwd, sizeof(nametmp) - 1);
     char *name = path_basename(nametmp);
 
     *output = calloc(PATH_MAX, sizeof(**output));
@@ -105,7 +105,7 @@ int get_basetemp_dir_entrypoint(void *frame, void *data_out) {
         return -1;
     }
     char nametmp[PATH_MAX] = {0};
-    strcpy(nametmp, cwd);
+    strncpy(nametmp, cwd, sizeof(nametmp) - 1);
     char *name = path_basename(nametmp);
 
     *output = calloc(PATH_MAX, sizeof(**output));
@@ -126,7 +126,7 @@ int tox_run_entrypoint(void *frame, void *data_out) {
     // Apply workaround for tox positional arguments
     char *toxconf = NULL;
     if (!access("tox.ini", F_OK)) {
-        if (!fix_tox_conf("tox.ini", &toxconf)) {
+        if (!fix_tox_conf("tox.ini", &toxconf, PATH_MAX)) {
             msg(STASIS_MSG_L3, "Fixing tox positional arguments\n");
             *output = calloc(STASIS_BUFSIZ, sizeof(**output));
             if (!*output) {
diff --git a/src/lib/core/utils.c b/src/lib/core/utils.c
index f478205..6795931 100644
--- a/src/lib/core/utils.c
+++ b/src/lib/core/utils.c
@@ -444,14 +444,14 @@ void msg(unsigned type, char *fmt, ...) {
         // for error output
         stream = stderr;
         fprintf(stream, "%s", STASIS_COLOR_RED);
-        strcpy(status, " ERROR: ");
+        strncpy(status, " ERROR: ", sizeof(status) - 1);
     } else if (type & STASIS_MSG_WARN) {
         stream = stderr;
         fprintf(stream, "%s", STASIS_COLOR_YELLOW);
-        strcpy(status, " WARNING: ");
+        strncpy(status, " WARNING: ", sizeof(status) - 1);
     } else {
         fprintf(stream, "%s", STASIS_COLOR_GREEN);
-        strcpy(status, " ");
+        strncpy(status, " ", sizeof(status) - 1);
     }
 
     if (type & STASIS_MSG_L1) {
@@ -484,9 +484,9 @@ char *xmkstemp(FILE **fp, const char *mode) {
     char t_name[PATH_MAX * 2];
 
     if (globals.tmpdir) {
-        strcpy(tmpdir, globals.tmpdir);
+        strncpy(tmpdir, globals.tmpdir, sizeof(tmpdir) - 1);
     } else {
-        strcpy(tmpdir, "/tmp");
+        strncpy(tmpdir, "/tmp", sizeof(tmpdir) - 1);
     }
     memset(t_name, 0, sizeof(t_name));
     snprintf(t_name, sizeof(t_name), "%s/%s", tmpdir, "STASIS.XXXXXX");
@@ -638,9 +638,10 @@ int xml_pretty_print_in_place(const char *filename, const char *pretty_print_pro
  *
  * @param filename /path/to/tox.ini
  * @param result path of replacement tox.ini configuration
+ * @param maxlen
  * @return 0 on success, -1 on error
  */
-int fix_tox_conf(const char *filename, char **result) {
+int fix_tox_conf(const char *filename, char **result, size_t maxlen) {
     struct INIFILE *toxini;
     FILE *fptemp;
 
@@ -652,7 +653,7 @@ int fix_tox_conf(const char *filename, char **result) {
 
     // If the result pointer is NULL, allocate enough to store a filesystem path
     if (!*result) {
-        *result = calloc(PATH_MAX, sizeof(**result));
+        *result = calloc(maxlen, sizeof(**result));
         if (!*result) {
             guard_free(tempfile);
             return -1;
@@ -709,7 +710,7 @@ int fix_tox_conf(const char *filename, char **result) {
     fclose(fptemp);
 
     // Store path to modified config
-    strcpy(*result, tempfile);
+    strncpy(*result, tempfile, maxlen - 1);
     guard_free(tempfile);
 
     ini_free(&toxini);
@@ -758,7 +759,7 @@ int redact_sensitive(const char **to_redact, size_t to_redact_size, char *src, c
     if (!tmp) {
         return -1;
     }
-    strcpy(tmp, src);
+    strncpy(tmp, src, strlen(redacted) + strlen(src));
 
     for (size_t i = 0; i < to_redact_size; i++) {
         if (to_redact[i] && strstr(tmp, to_redact[i])) {
@@ -821,9 +822,8 @@ long get_cpu_count() {
 int mkdirs(const char *_path, mode_t mode) {
     char *token;
     char pathbuf[PATH_MAX] = {0};
-    char *path;
-    path = pathbuf;
-    strcpy(path, _path);
+    strncpy(pathbuf, _path, sizeof(pathbuf) - 1);
+    char *path = pathbuf;
     errno = 0;
 
     char result[PATH_MAX] = {0};
diff --git a/src/lib/core/wheelinfo.c b/src/lib/core/wheelinfo.c
index 86b71cf..ce8ea74 100644
--- a/src/lib/core/wheelinfo.c
+++ b/src/lib/core/wheelinfo.c
@@ -6,7 +6,7 @@ struct WheelInfo *wheelinfo_get(const char *basepath, const char *name, char *to
     char package_path[PATH_MAX];
     char package_name[NAME_MAX];
 
-    strcpy(package_name, name);
+    strncpy(package_name, name, sizeof(package_name) - 1);
     tolower_s(package_name);
     snprintf(package_path, sizeof(package_path), "%s/%s", basepath, package_name);
 
@@ -20,7 +20,7 @@ struct WheelInfo *wheelinfo_get(const char *basepath, const char *name, char *to
             continue;
         }
         char filename[NAME_MAX];
-        strcpy(filename, rec->d_name);
+        strncpy(filename, rec->d_name, sizeof(filename) - 1);
         char *ext = strstr(filename, ".whl");
         if (ext) {
             *ext = '\0';
diff --git a/src/lib/delivery/delivery.c b/src/lib/delivery/delivery.c
index bb96dc3..7d78878 100644
--- a/src/lib/delivery/delivery.c
+++ b/src/lib/delivery/delivery.c
@@ -338,11 +338,11 @@ void delivery_defer_packages(struct Delivery *ctx, int type) {
     if (DEFER_CONDA == type) {
         dataptr = ctx->conda.conda_packages;
         deferred = ctx->conda.conda_packages_defer;
-        strcpy(mode, "conda");
+        strncpy(mode, "conda", sizeof(mode) - 1);
     } else if (DEFER_PIP == type) {
         dataptr = ctx->conda.pip_packages;
         deferred = ctx->conda.pip_packages_defer;
-        strcpy(mode, "pip");
+        strncpy(mode, "pip", sizeof(mode) - 1);
     } else {
         SYSERROR("BUG: type %d does not map to a supported package manager!\n", type);
         exit(1);
diff --git a/src/lib/delivery/delivery_build.c b/src/lib/delivery/delivery_build.c
index f3e9630..3ff5df7 100644
--- a/src/lib/delivery/delivery_build.c
+++ b/src/lib/delivery/delivery_build.c
@@ -37,7 +37,7 @@ int delivery_build_recipes(struct Delivery *ctx) {
                         tag[strlen(ctx->tests->test[i]->repository_info_tag)] = '\0';
                     }
                 } else {
-                    strcpy(tag, ctx->tests->test[i]->version);
+                    strncpy(tag, ctx->tests->test[i]->version, sizeof(tag) - 1);
                 }
 
                 //sprintf(recipe_version, "{%% set version = GIT_DESCRIBE_TAG ~ \".dev\" ~ GIT_DESCRIBE_NUMBER ~ \"+\" ~ GIT_DESCRIBE_HASH %%}");
@@ -434,7 +434,7 @@ struct StrList *delivery_build_wheels(struct Delivery *ctx) {
                         COE_CHECK_ABORT(dep_status, "Unreproducible delivery");
                     }
 
-                    strcpy(dname, ctx->tests->test[i]->name);
+                    strncpy(dname, ctx->tests->test[i]->name, sizeof(dname) - 1);
                     tolower_s(dname);
                     snprintf(outdir, sizeof(outdir), "%s/%s", ctx->storage.wheel_artifact_dir, dname);
                     if (mkdirs(outdir, 0755)) {
diff --git a/src/lib/delivery/delivery_init.c b/src/lib/delivery/delivery_init.c
index 2f8b21a..ff877f0 100644
--- a/src/lib/delivery/delivery_init.c
+++ b/src/lib/delivery/delivery_init.c
@@ -174,13 +174,13 @@ int delivery_init_platform(struct Delivery *ctx) {
     }
 
     if (!strcmp(ctx->system.arch, "x86_64")) {
-        strcpy(archsuffix, "64");
+        strncpy(archsuffix, "64", sizeof(archsuffix) - 1);
     } else {
-        strcpy(archsuffix, ctx->system.arch);
+        strncpy(archsuffix, ctx->system.arch, sizeof(archsuffix) - 1);
     }
 
     SYSDEBUG("%s", "Setting platform");
-    strcpy(ctx->system.platform[DELIVERY_PLATFORM], uts.sysname);
+    strncpy(ctx->system.platform[DELIVERY_PLATFORM], uts.sysname, DELIVERY_PLATFORM_MAXLEN - 1);
     if (!strcmp(ctx->system.platform[DELIVERY_PLATFORM], "Darwin")) {
         snprintf(ctx->system.platform[DELIVERY_PLATFORM_CONDA_SUBDIR], DELIVERY_PLATFORM_MAXLEN, "osx-%s", archsuffix);
         strncpy(ctx->system.platform[DELIVERY_PLATFORM_CONDA_INSTALLER], "MacOSX", DELIVERY_PLATFORM_MAXLEN - 1);
diff --git a/src/lib/delivery/delivery_install.c b/src/lib/delivery/delivery_install.c
index 4970749..1e2b82c 100644
--- a/src/lib/delivery/delivery_install.c
+++ b/src/lib/delivery/delivery_install.c
@@ -145,16 +145,16 @@ int delivery_purge_packages(struct Delivery *ctx, const char *env_name, int use_
         case PKG_USE_CONDA:
             fn = conda_exec;
             list = ctx->conda.conda_packages_purge;
-            strcpy(package_manager, "conda");
+            strncpy(package_manager, "conda", sizeof(package_manager) - 1);
             // conda is already configured for "always_yes"
-            strcpy(subcommand, "remove");
+            strncpy(subcommand, "remove", sizeof(subcommand) - 1);
             break;
         case PKG_USE_PIP:
             fn = pip_exec;
             list = ctx->conda.pip_packages_purge;
-            strcpy(package_manager, "pip");
+            strncpy(package_manager, "pip", sizeof(package_manager) - 1);
             // avoid user prompt to remove packages
-            strcpy(subcommand, "uninstall -y");
+            strncpy(subcommand, "uninstall -y", sizeof(subcommand) - 1);
             break;
         default:
             SYSERROR("Unknown package manager: %d", use_pkg_manager);
@@ -289,9 +289,9 @@ int delivery_install_packages(struct Delivery *ctx, char *conda_install_dir, cha
 
                     char req[255] = {0};
                     if (!strcmp(name, info->name)) {
-                        strcpy(req, info->name);
+                        strncpy(req, info->name, sizeof(req) - 1);
                     } else {
-                        strcpy(req, name);
+                        strncpy(req, name, sizeof(req) - 1);
                         char *spec = find_version_spec(req);
                         if (spec) {
                             *spec = 0;
diff --git a/src/lib/delivery/delivery_test.c b/src/lib/delivery/delivery_test.c
index a116479..a088cd7 100644
--- a/src/lib/delivery/delivery_test.c
+++ b/src/lib/delivery/delivery_test.c
@@ -200,11 +200,11 @@ void delivery_tests_run(struct Delivery *ctx) {
                 msg(STASIS_MSG_L3, "Queuing task for %s\n", test->name);
                 memset(&proc, 0, sizeof(proc));
 
-                strcpy(cmd, test->script);
+                strncpy(cmd, test->script, strlen(test->script) + STASIS_BUFSIZ - 1);
                 char *cmd_rendered = tpl_render(cmd);
                 if (cmd_rendered) {
                     if (strcmp(cmd_rendered, cmd) != 0) {
-                        strcpy(cmd, cmd_rendered);
+                        strncpy(cmd, cmd_rendered, strlen(test->script) + STASIS_BUFSIZ - 1);
                         cmd[strlen(cmd_rendered) ? strlen(cmd_rendered) - 1 : 0] = 0;
                     }
                     guard_free(cmd_rendered);
@@ -229,7 +229,7 @@ void delivery_tests_run(struct Delivery *ctx) {
                 if (!globals.enable_parallel || !test->parallel) {
                     selected = SERIAL;
                     memset(pool_name, 0, sizeof(pool_name));
-                    strcpy(pool_name, "serial");
+                    strncpy(pool_name, "serial", sizeof(pool_name) - 1);
                 }
 
                 if (asprintf(&runner_cmd, runner_cmd_fmt, cmd) < 0) {