landlock-lsm/rust-landlock tiene un índice de salud de 64 sobre 100, lo que lo sitúa en la banda Moderado. Su puntuación más alta es Vitality (73/100) y la más baja, AI Readiness (43/100). Se actualizó por última vez hace 1 día. Una sola persona concentra la mayor parte del trabajo reciente.
64
global / 100
Moderado
Índice de salud del software
Las métricas se agrupan en categorías ponderadas sobre una escala de 1 a 100. El resultado global parte de su media; cuando la evidencia pública activa la Política de Jurisdicciones de Alto Riesgo, la calificación se ajusta y recibe el límite 49 (En riesgo). Preparación para IA queda fuera.
64
Excelente85-100Ejemplar; cumple prácticamente todos los criterios evaluados
Bueno70-84Saludable; carencias menores
Moderado50-69Aceptable con carencias notables; se recomienda revisión
En riesgo30-49Debilidades significativas; su adopción exige cautela
Crítico1-29Problemas graves (proyecto abandonado, un solo mantenedor, sin higiene)
Perfil de puntuación
Cada eje es una categoría. La forma importa más que la media: un proyecto sano llena toda la figura, mientras que un perfil de picos y cráteres indica que la fortaleza en una dimensión enmascara el riesgo en otra.
Dependencias directas libres de avisos conocidos — ninguna dependencia directa tiene un aviso conocido
25/25
Dependencias indirectas libres de avisos conocidos — ninguna dependencia indirecta tiene un aviso conocido
0/40
Sin avisos pendientes — ningún aviso tiene fecha de publicación
Datos de entrada utilizados
source
osv
advisories
0
affected_packages
0
assessed_packages
15
unassessed_packages
0
affected_by_severity
none
direct_affected_packages
0
Excluidos de la puntuación (sin datos o no aplicable): Sin avisos pendientes. Los pesos restantes se han renormalizado. Se cotejó el cierre de dependencias en tiempo de ejecución de crates:landlock@0.4.6 —lo que arrastra la instalación del paquete publicado—: 15 paquetes. No se analiza la alcanzabilidad.
¿Hasta qué punto está el repositorio preparado para desarrollarse y mantenerse con agentes de codificación de IA? Es una insignia independiente y experimental — peso 0,0, de modo que se presenta por separado y no afecta a la puntuación de salud global.
Star history unavailable: GitHub GraphQL error: Resource not accessible by personal access token
Más detalle
Historial de estrellas y forks 0 ★ / 24 ⇿
0Estrellas
24Forks
9Versiones
Cuándo se añadió cada estrella y fork, recopilado de GitHub y agrupado por día. El crecimiento acumulado se sitúa justo encima de las adiciones diarias que lo componen, de modo que ambos se leen en conjunto: la acumulación orgánica sostenida no se parece en nada a un pico abrupto y efímero. Cuando esa diferencia es medible, se informa como autenticidad del crecimiento.
Mayor 0Menor 3Parche 6
Cada punto abarca 5 días.
OpenSSF Scorecard 5.5 / 10
5.5agregado
Evaluación de seguridad independiente y agnóstica en cuanto a herramientas, procedente del proyecto de código abierto OpenSSF Scorecard. Cada comprobación premia una práctica de seguridad, no la herramienta de un proveedor concreto. Las comprobaciones que Scorecard no pudo determinar se marcan como n/d y se excluyen de la puntuación de seguridad (nunca se cuentan como cero).Scorecard v5.5.0 · 2026-07-26 20:45 UTC
Conjunto completo de dependencias resueltas según el grafo de dependencias de GitHub: 3 paquetes directos y 4 indirectos (transitivos). El cierre transitivo es completo cuando el repositorio incluye un lockfile.
Registro
Paquete
Versión
Relación
crates.io
enumflags2
—
directa
crates.io
libc
—
directa
crates.io
thiserror
—
directa
crates.io
anyhow
—
indirecta
crates.io
lazy_static
—
indirecta
crates.io
strum
—
indirecta
crates.io
strum_macros
—
indirecta
Avisos de dependencias 0
Instalar crates:landlock@0.4.6 arrastra 15 paquetes, directos y transitivos: 0 tienen avisos conocidos, de los cuales 0 son dependencias directas.
Ningún aviso conocido afecta a las dependencias evaluadas.
Un aviso significa que la versión registrada en el grafo de dependencias cae dentro del rango afectado de un aviso. No se analiza la alcanzabilidad, y el grafo incluye fijaciones de desarrollo y prueba: un hallazgo puede referirse al utillaje y no al software distribuido.
Informe JSON sin procesar legible por máquina
{
"data": {
"repo": {
"topics": [
"landlock",
"linux",
"sandboxing",
"security"
],
"is_fork": false,
"size_kb": 345,
"has_wiki": false,
"homepage": "https://crates.io/crates/landlock",
"languages": {
"Rust": 227329,
"Shell": 1089
},
"pushed_at": "2026-07-25T14:58:46Z",
"created_at": "2021-04-13T18:34:45Z",
"owner_type": "Organization",
"updated_at": "2026-07-26T09:38:27Z",
"description": "A Rust library for the Linux Landlock sandboxing feature",
"is_archived": false,
"is_disabled": false,
"license_spdx": null,
"default_branch": "main",
"license_spdx_raw": "NOASSERTION",
"primary_language": "Rust",
"significant_languages": [
"Rust"
]
},
"owner": {
"blog": "https://landlock.io",
"name": "Landlock",
"type": "Organization",
"login": "landlock-lsm",
"company": null,
"location": null,
"followers": 91,
"avatar_url": "https://avatars.githubusercontent.com/u/21111839?v=4",
"created_at": "2016-08-18T20:55:26Z",
"is_verified": null,
"public_repos": 12,
"account_age_days": 3628
},
"license": {
"state": "custom",
"spdx_id": null,
"raw_spdx": "NOASSERTION",
"file_present": true,
"scorecard_found": true,
"profile_has_license": true
},
"activity": {
"releases": [
{
"tag": "v0.4.5",
"kind": "patch",
"published_at": "2026-05-22T14:33:37Z"
},
{
"tag": "v0.4.4",
"kind": "patch",
"published_at": "2025-11-20T13:30:20Z"
},
{
"tag": "v0.4.3",
"kind": "patch",
"published_at": "2025-09-14T12:56:13Z"
},
{
"tag": "v0.4.2",
"kind": "patch",
"published_at": "2025-04-29T09:27:37Z"
},
{
"tag": "v0.4.1",
"kind": "patch",
"published_at": "2024-09-13T18:04:56Z"
},
{
"tag": "v0.4.0",
"kind": "minor",
"published_at": "2024-06-19T09:19:02Z"
},
{
"tag": "v0.3.1",
"kind": "patch",
"published_at": "2024-03-26T15:02:46Z"
},
{
"tag": "v0.3.0",
"kind": "minor",
"published_at": "2023-10-10T10:41:17Z"
},
{
"tag": "v0.2.0",
"kind": "minor",
"published_at": "2023-01-30T19:06:29Z"
}
],
"recent_commits": [
{
"oid": "2ff9281776b039fccc6075c46ccabe1acdb7ba6e",
"body": " ./src/uapi/bindgen.sh .../linux-7.1\n\nSigned-off-by: Mickaël Salaün <mic@digikod.net>",
"is_bot": false,
"headline": "uapi: Update to Linux 7.1",
"author_name": "Mickaël Salaün",
"author_login": "l0kod",
"committed_at": "2026-07-25T14:58:46Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "17d619e72baf27f37ef484d0234ae318fa4a074d",
"body": "Add changelog entry.\n\nSigned-off-by: Mickaël Salaün <mic@digikod.net>",
"is_bot": false,
"headline": "lib: Bump to v0.4.6",
"author_name": "Mickaël Salaün",
"author_login": "l0kod",
"committed_at": "2026-07-24T21:34:29Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "bf64e9e8092af1e501329e6b7b7ba0cdef6ac6f0",
"body": "GitHub CI may run jobs on different machines, with different CPUs, which\ncan trigger a (non-backported) UML kernel bug.\n\nUpdate landlock-test-tools to bring improvements and fixes, especially:\n- landlock-lsm/landlock-test-tools@f644a251231e: reported result fix;\n- landlock-lsm/landlock-test-tools@1dd31a0f7961: UML FP XSTATE fix.\n\nSigned-off-by: Mickaël Salaün <mic@digikod.net>",
"is_bot": false,
"headline": "ci: Fix old UML kernels for newer CPUs",
"author_name": "Mickaël Salaün",
"author_login": "l0kod",
"committed_at": "2026-07-24T21:32:32Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "489b554f2fd286f6143fc61d87aa1ecff96ecb09",
"body": "Bump the sandboxer target to Landlock ABI v8, matching the\nLANDLOCK_ABI_LAST update in the kernel sample for Linux 7.0.\n\nThe kernel sample does not use LANDLOCK_RESTRICT_SELF_TSYNC (it is\nsingle-threaded), so no all_threads() call is added. The existing\nhint logic already reports an outdated kernel for any effective ABI\nbelow the targeted one.\n\nSigned-off-by: Mickaël Salaün <mic@digikod.net>",
"is_bot": false,
"headline": "sandboxer: Sync with kernel's sandboxer.c",
"author_name": "Mickaël Salaün",
"author_login": "l0kod",
"committed_at": "2026-07-23T15:09:43Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "fc151039bf64e9b32e66d9f90014b999dfa96d48",
"body": "Add ABI::V8 for the multithreading support introduced with Linux 7.0.\nThe new LANDLOCK_RESTRICT_SELF_TSYNC flag atomically applies the\nLandlock configuration (domain and logging) to all threads of the\ncalling process instead of only the calling thread.\n\nAppend ABI::V8 to every from_all() match arm f\n[…]\n7.0 to the CI kernel matrix (Landlock ABI v8). Leave the\nMSRV job's LANDLOCK_CRATE_TEST_ABI at 7 to match its runner kernel,\nwhich predates Linux 7.0.\n\nSigned-off-by: Mickaël Salaün <mic@digikod.net>",
"is_bot": false,
"headline": "ci,src: Handle Landlock ABI v8",
"author_name": "Mickaël Salaün",
"author_login": "l0kod",
"committed_at": "2026-07-23T15:09:43Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "2b56d528b1845df2ccfd58b963d53f13c8c07300",
"body": "Newer clippy versions raise the precedence lint on 1 << 63 | 1 in the\nAccessFs unknown-access test, since mixing a bit shift with a bitwise OR\nis easy to misread. The expression already groups as intended, make it\nexplicit.\n\nSee https://rust-lang.github.io/rust-clippy/master/index.html#precedence\n\nSigned-off-by: Mickaël Salaün <mic@digikod.net>",
"is_bot": false,
"headline": "access: Parenthesize the shift in the unknown-access test",
"author_name": "Mickaël Salaün",
"author_login": "l0kod",
"committed_at": "2026-07-23T14:03:40Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "749ed50d5842503b92f398924f59eadc1d393cb9",
"body": " ./src/uapi/bindgen.sh .../linux-7.0\n\nSigned-off-by: Mickaël Salaün <mic@digikod.net>",
"is_bot": false,
"headline": "uapi: Update to Linux 7.0",
"author_name": "Mickaël Salaün",
"author_login": "l0kod",
"committed_at": "2026-06-23T16:00:01Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "6b13cc4f2fb452096cf0c4b6e74341437df8b630",
"body": "Add changelog entry.\n\nSigned-off-by: Mickaël Salaün <mic@digikod.net>",
"is_bot": false,
"headline": "lib: Bump to v0.4.5",
"author_name": "Mickaël Salaün",
"author_login": "l0kod",
"committed_at": "2026-05-22T14:22:37Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "bd31957a447b9ca55a1594f3e42d3de370d67ec3",
"body": "Simplify and add links to the kernel documentation, and add introduciton\nat the crate root.\n\nSigned-off-by: Mickaël Salaün <mic@digikod.net>",
"is_bot": false,
"headline": "src: Update audit documentation",
"author_name": "Mickaël Salaün",
"author_login": "l0kod",
"committed_at": "2026-05-22T14:22:37Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "43128a137577c45085fc8e45a4907fda6d2b6b8b",
"body": "Bump the example to ABI v7 and add LL_FORCE_LOG environment variable\nsupport to enable audit logging of denied accesses after execve(2),\nmatching the kernel's sandboxer example. The setter is wrapped in\nHardRequirement so that LL_FORCE_LOG=1 fails loudly on kernels without\nthe feature.\n\nRemove LL_S\n[…]\nnsetenv() calls.\n\nFix a pre-existing bug: LL_SCOPED was not being removed from the child\nprocess environment, leaking the variable to spawned commands.\n\nSigned-off-by: Mickaël Salaün <mic@digikod.net>",
"is_bot": false,
"headline": "sandboxer: Sync with kernel's sandboxer.c",
"author_name": "Mickaël Salaün",
"author_login": "l0kod",
"committed_at": "2026-05-20T17:35:40Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "5487d8f17bd36667c9375452090aaf38b96244df",
"body": "Add the RestrictSelf builder for calling landlock_restrict_self(-1,\nflags) without creating a Landlock domain. This enables setting\nrestrict_self flags (e.g., muting subdomain audit logs) without creating\na ruleset.\n\nRestrictSelf uses the same RestrictSelfAttr trait as RulesetCreated,\nsharing the l\n[…]\nsupport() helper, generic over the builder and status types,\nfactors out the iteration, thread::spawn, and can_emulate dispatch\nshared by both helpers.\n\nSigned-off-by: Mickaël Salaün <mic@digikod.net>",
"is_bot": false,
"headline": "restrict_self: Add RestrictSelf builder for domain-less flag application",
"author_name": "Mickaël Salaün",
"author_login": "l0kod",
"committed_at": "2026-05-20T17:35:40Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "1ab0f9f1c01d1bf567672b8bc60d763c96c34af5",
"body": "Add ABI::V7 for restrict_self log flags introduced with Linux 6.15.\n\nAdd the syscall flag compatibility framework in a new flags module,\nparallel to but simpler than the Access/TryCompat machinery. Access\ntypes operate on sets of rights with Full/Partial/No compat results;\nsyscall flags are set ind\n[…]\n() and errata_up_to_date test for ABI v7.\n\nRe-add LANDLOCK_CRATE_TEST_ABI=7 to the MSRV CI job (previously\nremoved because ABI v7 was not yet defined).\n\nSigned-off-by: Mickaël Salaün <mic@digikod.net>",
"is_bot": false,
"headline": "ci,src: Handle Landlock ABI v7",
"author_name": "Mickaël Salaün",
"author_login": "l0kod",
"committed_at": "2026-05-20T17:35:40Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "a1a8a63e16a144399da46bee7379a1ef3b7b0d29",
"body": "Bump libc and strum.\n\nSigned-off-by: Mickaël Salaün <mic@digikod.net>",
"is_bot": false,
"headline": "cargo: Update dependencies",
"author_name": "Mickaël Salaün",
"author_login": "l0kod",
"committed_at": "2026-05-20T13:41:04Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "1ca46f568d2bb303dde82c8a2bfaa6599a36da31",
"body": "Update to Node 24, see\nhttps://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/\n\nSigned-off-by: Mickaël Salaün <mic@digikod.net>",
"is_bot": false,
"headline": "ci: Bump actions",
"author_name": "Mickaël Salaün",
"author_login": "l0kod",
"committed_at": "2026-05-20T13:34:51Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "f10ab05e9166b9659e20eb1ee99a6d9a7da9f16c",
"body": "Print /proc/version in the errata_up_to_date test so failed CI runs\ninclude the kernel version of the test environment. Helpful when\ndiagnosing whether a mismatch is caused by an unexpected kernel\nbuild.\n\nRefactor not_backported_yet to be keyed by the (major, minor, patch,\nsuffix) kernel version tu\n[…]\non, covered by a parse_kernel_version_cases\nunit test that exercises stable releases, distro-suffixed kernels,\nrelease candidates, and malformed input.\n\nSigned-off-by: Mickaël Salaün <mic@digikod.net>",
"is_bot": false,
"headline": "errata: Improve errata_up_to_date debuggability",
"author_name": "Mickaël Salaün",
"author_login": "l0kod",
"committed_at": "2026-05-20T13:24:08Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "7c90836aa43a7fa1d57e3000827f4e641a163745",
"body": "Wrap bare matches!() expressions with assert!() in ruleset_unsupported\nand unsupported_handled_access tests. Without assert!(), the matches!()\nmacro returns a bool that is silently discarded, making the assertions\nno-ops.\n\nFix the expected error patterns that were previously hidden by the\nno-op assertions: HardRequirement on Unsupported returns\nIncompatible access/scope errors, not MissingHandledAccess.\n\nSigned-off-by: Mickaël Salaün <mic@digikod.net>",
"is_bot": false,
"headline": "tests: Fix bare matches!() assertions",
"author_name": "Mickaël Salaün",
"author_login": "l0kod",
"committed_at": "2026-05-20T09:55:47Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "b6eb422f64b32ac793bcdb579b7e4977b965c675",
"body": "The Rust builder pattern is meant to read as a declarative list of\nconfigurations rather than a sequence of imperative commands, see\nhttps://rust-lang.github.io/api-guidelines/type-safety.html?#builders-enable-construction-of-complex-values-c-builder\nhttps://rust-lang.github.io/rfcs/0344-conventions\n[…]\nps all prctl(2) plumbing into one file\nand prepares the helper for sharing with a future caller (the\nRestrictSelf builder added in a following commit).\n\nSigned-off-by: Mickaël Salaün <mic@digikod.net>",
"is_bot": false,
"headline": "ruleset: Rename set_no_new_privs() and extract NNP helper",
"author_name": "Mickaël Salaün",
"author_login": "l0kod",
"committed_at": "2026-05-20T09:48:06Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "1e3a00440333f7ec1635922d49037c6429e22820",
"body": "Add the Erratum bitflags enum in a new errata.rs module, enabling\nprograms to query which kernel bug fixes have been backported before\nbuilding their Landlock ruleset.\n\nErratum::current() is a standalone method rather than a field on\nLandlockStatus because programs need errata information before bui\n[…]\np_to_date test verifies the crate's From<ABI> mapping\nmatches the running CI kernel's errata, catching both missing backports\nand stale crate mappings.\n\nSigned-off-by: Mickaël Salaün <mic@digikod.net>",
"is_bot": false,
"headline": "errata: Add errata query interface",
"author_name": "Mickaël Salaün",
"author_login": "l0kod",
"committed_at": "2026-04-10T19:56:19Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "e93e5972efbe4f1b54cf8968f37409ddfe927789",
"body": " ./src/uapi/bindgen.sh .../linux-6.15\n\nSigned-off-by: Mickaël Salaün <mic@digikod.net>",
"is_bot": false,
"headline": "uapi: Update to Linux 6.15",
"author_name": "Mickaël Salaün",
"author_login": "l0kod",
"committed_at": "2026-04-10T19:56:19Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "38893a13217827fbac80b8bceabe82835d097a23",
"body": "Add a missing test case for scope() with SoftRequirement on an\nunsupported ABI. Verifies the flag is silently dropped and the\ncompat state transitions to Dummy.\n\nThis complements the existing BestEffort and HardRequirement tests.\n\nSigned-off-by: Mickaël Salaün <mic@digikod.net>",
"is_bot": false,
"headline": "tests: Add SoftRequirement test for scope()",
"author_name": "Mickaël Salaün",
"author_login": "l0kod",
"committed_at": "2026-04-10T19:48:42Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "149e8c21d45f4900e6a9d2299dabf6b6152a39fd",
"body": "Dependencies (quote v1.0.45, unicode-ident v1.0.24) require rustc 1.71\nor newer.\n\nRemove LANDLOCK_CRATE_TEST_ABI from the MSRV CI job because Ubuntu\n24.04.4 bumped to Linux 6.17, a newer Landlock ABI than the crate knows\nabout. The variable will be re-added by a following ABI v7 commit.\n\nSigned-off-by: Mickaël Salaün <mic@digikod.net>",
"is_bot": false,
"headline": "cargo,ci: Bump MSRV to 1.71",
"author_name": "Mickaël Salaün",
"author_login": "l0kod",
"committed_at": "2026-04-10T19:48:42Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "89c56e2db04cf0a4d63e192e7b4371af516a1ccc",
"body": "Add changelog entry.\n\nSigned-off-by: Mickaël Salaün <mic@digikod.net>",
"is_bot": false,
"headline": "lib: Bump to v0.4.4",
"author_name": "Mickaël Salaün",
"author_login": "l0kod",
"committed_at": "2025-11-20T13:21:19Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "4fbfbbc4c7d2e6db2642ec44ef1c8a78e7048479",
"body": "Use named fields for the Available variant: effective_abi and\nkernel_abi, and improve documentation.\n\nSigned-off-by: Mickaël Salaün <mic@digikod.net>",
"is_bot": false,
"headline": "compat: Improve LandlockStatus",
"author_name": "Mickaël Salaün",
"author_login": "l0kod",
"committed_at": "2025-10-22T18:44:24Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "ec5e00b83bd2c6308967174c8910e86853e6b955",
"body": "Add LandlockStatus type to query the running kernel and display\ninformation about the available Landlock features.\n\nReplace ABI in Compatibility with LandlockStatus to be able to return\nthis information with RestrictionStatus.\n\nImplement Display for ABI.\n\nUpdate the sandboxer to print hints about th\n[…]\nd version, similar to the C example.\n\nReplace ABI::new_current() with LandlockStatus::current().into().\n\nAdd a new test_current_landlock_status() test.\n\nSigned-off-by: Mickaël Salaün <mic@digikod.net>",
"is_bot": false,
"headline": "compat,sandboxer: Add LandlockStatus and print hints",
"author_name": "Mickaël Salaün",
"author_login": "l0kod",
"committed_at": "2025-10-22T15:34:46Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "f79da1808500110fd71f2b80e7ca81770b6bf2df",
"body": "Until now, we only used the x86_64 architecture, but here are the\nchanges to use this crate on any architecture.\n\nAdd the bindgen.sh script to make update simple:\n\n ./src/uapi/bindgen.sh .../linux-6.12\n\nThis call creates three binding files:\n- landlock_x86_64.rs\n- landlock_i686.rs\n- landlock_all.rs\n[…]\nindgen_test_layout_landlock_net_port_attr().\n\nExtend the CI to build and test on i686.\n\nCloses: https://github.com/landlock-lsm/rust-landlock/issues/110\nSigned-off-by: Mickaël Salaün <mic@digikod.net>",
"is_bot": false,
"headline": "uapi: Generate bindings for all architectures",
"author_name": "Mickaël Salaün",
"author_login": "l0kod",
"committed_at": "2025-10-21T09:53:27Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "d29be586a50b0278822aee84a420b0cd22607a5b",
"body": "syn v2.0.107 requires rustc 1.68 or newer:\nhttps://github.com/dtolnay/syn/commit/9dbb5b7b99711db4958d5087e75da0e99eed6462\n\nFYI, Rust 1.85 is packaged in Debian 13 Trixie (current stable release).\n\nSigned-off-by: Mickaël Salaün <mic@digikod.net>",
"is_bot": false,
"headline": "cargo: Bump MSRV to 1.68",
"author_name": "Mickaël Salaün",
"author_login": "l0kod",
"committed_at": "2025-10-21T09:53:27Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "229f152d86c37e8881ea37dd6e29668f298d9056",
"body": "Add changelog entry.\n\nBump libc.\n\nSigned-off-by: Mickaël Salaün <mic@digikod.net>",
"is_bot": false,
"headline": "lib: Bump to v0.4.3",
"author_name": "Mickaël Salaün",
"author_login": "l0kod",
"committed_at": "2025-09-14T12:43:12Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "19f01a99752607e0f6b1872edf86690982c0e920",
"body": "Implement Debug for ABI, Ruleset, RulesetCreated, PathBeneath, PathFd,\nand NetPort (and other non-public dependencies). Derived Debug formats\nare not stable:\nhttps://doc.rust-lang.org/stable/std/fmt/trait.Debug.html#stability\n\nImplement PartialEq, Eq, PartialOrd, and Ord for ABI.\n\nThis might be needed when these types are wrapped (see LandlockConfig).\n\nCloses: https://github.com/landlock-lsm/rust-landlock/issues/82\nSigned-off-by: Mickaël Salaün <mic@digikod.net>",
"is_bot": false,
"headline": "compat: Implement common traits for public types",
"author_name": "Mickaël Salaün",
"author_login": "l0kod",
"committed_at": "2025-09-10T15:29:28Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "cb60a12f9b3d7fe55839863e8746ede6c3c77290",
"body": "- Improve structure of 'Testing vs kernel ABI section'\n- Add URL to compat.rs:current_kernel_abi() reference\n- Add new 'Licensing & DCO' section.\n\nSigned-off-by: Panagiotis \"Ivory\" Vasilopoulos <git@n0toose.net>",
"is_bot": false,
"headline": "contributing: Extend documentation",
"author_name": "Panagiotis \"Ivory\" Vasilopoulos",
"author_login": "n0toose",
"committed_at": "2025-05-30T12:49:04Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "aa4029d129f5db8519027f15a1618c9d79c2e19b",
"body": "This example is shown at the homepage of rust-landlock's documentation,\nand essentially serves as some sort of an introduction to implementers.\nSince this example serves as some sort of a \"first impression\", it is\nquite easy for the reader to make a false generalization.\n\nTo fix this, some additiona\n[…]\ne the role\nof file descriptors and paths, as well as add a subtle separation between\nLandlock (the LSM) and rust-landlock (the crate).\n\nSigned-off-by: Panagiotis \"Ivory\" Vasilopoulos <git@n0toose.net>",
"is_bot": false,
"headline": "fs: Add more background to path_beneath_rules() doc",
"author_name": "Panagiotis \"Ivory\" Vasilopoulos",
"author_login": "n0toose",
"committed_at": "2025-05-19T17:59:08Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "a7c2b3fe37f2d35f2359c4b1b5152258a474dbb1",
"body": "Signed-off-by: Panagiotis \"Ivory\" Vasilopoulos <git@n0toose.net>",
"is_bot": false,
"headline": "fs: Add test case for AccessFs::from_file",
"author_name": "Panagiotis \"Ivory\" Vasilopoulos",
"author_login": "n0toose",
"committed_at": "2025-05-19T17:50:28Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "83763eb749bcbcb8f68fbdd366a007a039ebb018",
"body": "Add missing link.\n\nSigned-off-by: Mickaël Salaün <mic@digikod.net>",
"is_bot": false,
"headline": "readme: Update for v0.4.2",
"author_name": "Mickaël Salaün",
"author_login": "l0kod",
"committed_at": "2025-04-29T09:15:21Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "86051ba1de2f2fee67be7d6325da34cd1e650d03",
"body": "Add changelog entry.\n\nSigned-off-by: Mickaël Salaün <mic@digikod.net>",
"is_bot": false,
"headline": "lib: Bump to v0.4.2",
"author_name": "Mickaël Salaün",
"author_login": "l0kod",
"committed_at": "2025-04-29T08:53:03Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "c9834cfcbff6ddf0f0c66d55c20de51e179a12f5",
"body": "Improve consistency by delegating lifetime management to OwnedFd. The\nonly visible change would be that with latest Rust versions, the\nduplicated file descriptor will be greater than 2 (not with Rust 1.63).\nSee https://doc.rust-lang.org/1.63.0/std/os/unix/io/struct.OwnedFd.html\n\nRemove the explicit\n[…]\nfor OwnedFd. This is not a\nbreaking change because the IntoRawFd implementation was never released.\n\nAdd tests leveraging RulesetCreated::try_clone().\n\nSigned-off-by: Mickaël Salaün <mic@digikod.net>",
"is_bot": false,
"headline": "ruleset: Use OwnedFd instead of RawFd",
"author_name": "Mickaël Salaün",
"author_login": "l0kod",
"committed_at": "2025-04-28T16:00:38Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "fb7850f89d58e50d2b530c696b003eecc315b7ff",
"body": "It makes more sense and it makes it easier to dereference the inner\nvalue.\n\nImport c_int to lighten code.\n\nRemove use of private field in tests.\n\nSigned-off-by: Mickaël Salaün <mic@digikod.net>",
"is_bot": false,
"headline": "ruleset: Implement Deref instead of AsRef for Errno",
"author_name": "Mickaël Salaün",
"author_login": "l0kod",
"committed_at": "2025-04-24T14:36:02Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "8b8de51204d0390458f26604627b247a54923fd5",
"body": "See https://github.com/landlock-lsm/linux/commit/53b9d789df983790015ef04b0283ac5a33917cad\n\nSigned-off-by: Mickaël Salaün <mic@digikod.net>",
"is_bot": false,
"headline": "sandboxer: Synchronize help",
"author_name": "Mickaël Salaün",
"author_login": "l0kod",
"committed_at": "2025-04-24T14:13:14Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "fe68bf24751f43527837b01652f18daa10d32172",
"body": "See https://github.com/landlock-lsm/linux/commit/a17c60e533f5cd832e77e0d194e2e0bb663371b6\n\nTested with:\n LL_FS_RO=/usr LL_FS_RW=/tmp:/foo \\\n cargo run --example=sandboxer bash -i\n\nSigned-off-by: Mickaël Salaün <mic@digikod.net>",
"is_bot": false,
"headline": "sandboxer: Don't error out if a file path cannot be opened",
"author_name": "Mickaël Salaün",
"author_login": "l0kod",
"committed_at": "2025-04-24T14:13:14Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "1f55adc26239435a347cc6766b7be42d30a1fd13",
"body": "Synchronize SPDX-License-Identifier headers across all source files.\n\nSigned-off-by: Mickaël Salaün <mic@digikod.net>",
"is_bot": false,
"headline": "src: Add missing SPDX headers",
"author_name": "Mickaël Salaün",
"author_login": "l0kod",
"committed_at": "2025-04-24T14:12:17Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "f92b178c43757e16ccc6c2bc048c8212661f1a85",
"body": "With a generic HandledAccess implementation for all PrivateHandledAccess\nimplementations, the documentations does not show the actual types.\nMake these implementations explicit to improve the documentation.\n\nSigned-off-by: Mickaël Salaün <mic@digikod.net>",
"is_bot": false,
"headline": "access: Make HandledAccess implementations explicit",
"author_name": "Mickaël Salaün",
"author_login": "l0kod",
"committed_at": "2025-04-24T13:54:41Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "5ad403880ee751513bd13496a4b00ba7d93f885e",
"body": "With commit 554217dda0b7 (\"access: Make Access independant from\nHandledAccess\"), the documentation about RulesetCreated::handle_access()\nlists HandledAccess as an argument's requirement, but because this trait\nis private, there is no list of types implementing this trait, which is\nconfusing.\n\nMove p\n[…]\nivate methods to a new PrivateHandledAccess trait and use\nHandledAccess as a way to document the argument's requirement.\n\nFix AddRuleError requirement.\n\nSigned-off-by: Mickaël Salaün <mic@digikod.net>",
"is_bot": false,
"headline": "access: Document HandledAccess",
"author_name": "Mickaël Salaün",
"author_login": "l0kod",
"committed_at": "2025-04-24T13:37:38Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "41e3198e00c5983ceca98ee84a783f926bdedd37",
"body": "Bump to Landlock ABI v6.\n\nTested that we can send signals and connect to abstract UNIX sockets if\nthe related LL_SCOPED's action is not specified.\n\nTested that signal scoping works:\n LL_FS_RO=/ LL_FS_RW=/ LL_SCOPED=\"s\" \\\n cargo run --example=sandboxer kill $$\n [...]\n kill: sending signal to [.\n[…]\nRW=/ LL_SCOPED=\"a\" \\\n cargo run --example=sandboxer socat stdio abstract-connect:test\n [...] E connect(, AF=1 \"\\0test\", 7): Operation not permitted\n\nSigned-off-by: Mickaël Salaün <mic@digikod.net>",
"is_bot": false,
"headline": "sandboxer: Add abstract UNIX socket and signal scoping support",
"author_name": "Mickaël Salaün",
"author_login": "l0kod",
"committed_at": "2025-04-24T13:14:35Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "80419ff0c97517e094eddb9baacf68f9a35ee1a4",
"body": "Add ABI::V6 and the RulesetCreated::scope() method taking a Scope enum\nas argument:\n- Scope::AbstractUnixSocket\n- Scope::Signal\n\nAdd a related ScopeError and extend RulesetError with it.\n\nCreateRulesetError::MissingHandledAccess is now used either for missing\nhandled access rights or missing scope r\n[…]\nd_handle_access_fs() and\nruleset_created_handle_access_net_tcp() tests to improve coverage of\nhandled access composition.\n\nRun tests against Linux 6.12\n\nSigned-off-by: Mickaël Salaün <mic@digikod.net>",
"is_bot": false,
"headline": "ci,src: Handle Landlock ABI v6",
"author_name": "Mickaël Salaün",
"author_login": "l0kod",
"committed_at": "2025-04-24T13:14:35Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "554217dda0b775756e38db71f471dd414b199234",
"body": "Rename PrivateAccess to HandledAccess, and inverse dependency to be able\nto support access rights which are not handled by rules.\n\nThis new light Access trait will be usable as a scope, which does not\nhave related rule.\n\nMake Access independant from HandledAccess but explicitly sealed it:\nhttps://rust-lang.github.io/api-guidelines/future-proofing.html#sealed-traits-protect-against-downstream-implementations-c-sealed\n\nSigned-off-by: Mickaël Salaün <mic@digikod.net>",
"is_bot": false,
"headline": "access: Make Access independant from HandledAccess",
"author_name": "Mickaël Salaün",
"author_login": "l0kod",
"committed_at": "2025-04-23T14:42:29Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "97fc19edefd9ec4397b24372aed2acf0d93f8f91",
"body": "bindgen --rust-target 1.63 -o src/uapi/landlock.rs .../linux-6.12/include/uapi/linux/landlock.h\n\nUpdate Ruleset::create() accordingly.\n\nSigned-off-by: Mickaël Salaün <mic@digikod.net>",
"is_bot": false,
"headline": "uapi: Update to Linux 6.12",
"author_name": "Mickaël Salaün",
"author_login": "l0kod",
"committed_at": "2025-04-23T14:42:17Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "111999a18c3ed1b567bdefd2ad48135e7657201d",
"body": "Ubuntu 24.04 switched to Linux version 6.11.0-1012-azure which supports\nLandlock ABI v5.\n\nSee https://ubuntu.com/kernel/lifecycle\n\nSigned-off-by: Mickaël Salaün <mic@digikod.net>",
"is_bot": false,
"headline": "ci: Bump Landlock ABI version for Ubuntu 24",
"author_name": "Mickaël Salaün",
"author_login": "l0kod",
"committed_at": "2025-04-23T14:34:57Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "ebf5d055d245452cf68647d2ed232f65f2acf5c9",
"body": "This is useful to debug the tested $LANDLOCK_CRATE_TEST_ABI value.\n\nSigned-off-by: Mickaël Salaün <mic@digikod.net>",
"is_bot": false,
"headline": "compat: Print current kernel version and Landlock ABI on test failure",
"author_name": "Mickaël Salaün",
"author_login": "l0kod",
"committed_at": "2025-04-23T14:29:40Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "07f2a9a7ee145884e58a8abaf315c90c5ffcca84",
"body": "Use GitHub Pages with Actions and split jobs with fine-grained\npermissions. Remove dependency on peaceiris/actions-gh-pages\n\nSee https://github.blog/news-insights/product-news/github-pages-now-uses-actions-by-default/\n\nAdd workflow_dispatch to be able to manually run this action.\n\nUpdate Ubuntu to 24.04.\n\nSigned-off-by: Mickaël Salaün <mic@digikod.net>",
"is_bot": false,
"headline": "ci: Use GitHub Pages with Actions",
"author_name": "Mickaël Salaün",
"author_login": "l0kod",
"committed_at": "2025-04-10T10:22:37Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "11d4ef1a89db09304ecc1da0dbf99c5fd27da51e",
"body": "Remove an unsafe block.\n\nSigned-off-by: Mickaël Salaün <mic@digikod.net>",
"is_bot": false,
"headline": "compat: Clean up get_errno_from_landlock_status()",
"author_name": "Mickaël Salaün",
"author_login": "l0kod",
"committed_at": "2025-04-10T09:17:38Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "0f4246a54e17eb57ee938e67c5d85a07d1f977a5",
"body": "This should fix the systemd issue on Ubuntu 24.\n\nSee https://github.com/landlock-lsm/landlock-test-tools/commit/fad769c39b42183fb2a2e1263fe00dfa5b9f2bda\n\nSigned-off-by: Mickaël Salaün <mic@digikod.net>",
"is_bot": false,
"headline": "ci: Use newer landlock-test-tools",
"author_name": "Mickaël Salaün",
"author_login": "l0kod",
"committed_at": "2025-04-09T17:15:41Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "fca3950a638efae20c1379d8cbd38e7f3306e3bb",
"body": "This is useful to test Landlock outside of this crate e.g., in\nlandlockconfig.\n\nSigned-off-by: Mickaël Salaün <mic@digikod.net>",
"is_bot": false,
"headline": "compat: Expose From<i32> for ABI",
"author_name": "Mickaël Salaün",
"author_login": "l0kod",
"committed_at": "2025-04-09T15:49:43Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "beecdf819b85f3401b057d3872d97dc8b0710904",
"body": "This helper is useful for FFI to easily translate a Landlock error into\nan errno value.\n\nExtend check_ruleset_support() with errno translation tests.\n\nAdd the unsupported_handled_access_errno() test.\n\nSigned-off-by: Mickaël Salaün <mic@digikod.net>",
"is_bot": false,
"headline": "ruleset: Add the Errno helper",
"author_name": "Mickaël Salaün",
"author_login": "l0kod",
"committed_at": "2025-04-08T13:51:55Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "6d18345d7f798178fa3537bedd7bb8c13902ae2c",
"body": "Switch from Ubuntu 20.04 to 22.04, and from 22.04 to 24.04\n\nSee https://github.com/actions/runner-images/issues/11101\n\nSigned-off-by: Mickaël Salaün <mic@digikod.net>",
"is_bot": false,
"headline": "ci: Bump Ubuntu",
"author_name": "Mickaël Salaün",
"author_login": "l0kod",
"committed_at": "2025-04-08T13:49:42Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "de9a167ffe62a22c7f1aaa619f88405d540feb33",
"body": "This helps low-level and FFI use cases, especially landlockconfig.\n\nSigned-off-by: Mickaël Salaün <mic@digikod.net>",
"is_bot": false,
"headline": "ruleset: Implement IntoRawFd for RulesetCreated",
"author_name": "Mickaël Salaün",
"author_login": "l0kod",
"committed_at": "2025-04-05T17:45:09Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "fd46eafba889e004eacbb5e0eb6db406382b0408",
"body": "Ubuntu 22.04 switched to Linux 6.8 which supports Landlock ABI v4.\n\nhttps: //ubuntu.com/kernel/lifecycle\nSigned-off-by: Mickaël Salaün <mic@digikod.net>",
"is_bot": false,
"headline": "ci: Bump Landlock ABI version for Ubuntu 22",
"author_name": "Mickaël Salaün",
"author_login": "l0kod",
"committed_at": "2025-04-05T17:45:07Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "8f5af24d167f9f2fc6a10896112e9d369f54fc60",
"body": "This may be required to avoid this issue:\n error: no such command: `fmt`\n\nSee https://rust-lang.github.io/rustup/basics.html#keeping-rustup-up-to-date\n\nSigned-off-by: Mickaël Salaün <mic@digikod.net>",
"is_bot": false,
"headline": "ci: Update rustup",
"author_name": "Mickaël Salaün",
"author_login": "l0kod",
"committed_at": "2025-04-05T17:19:55Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "aaccff53ecb0fb3c4d2e8125bc9e8913fbf92424",
"body": "Explain LANDLOCK_CRATE_TEST_ABI and how it affects local and CI testing\nscenarios.\n\nSigned-off-by: Daniel Burgener <Daniel.Burgener@microsoft.com>",
"is_bot": false,
"headline": "contributing: Add CONTRIBUTING.md doc",
"author_name": "Daniel Burgener",
"author_login": "dburgener",
"committed_at": "2025-02-11T10:37:50Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "50240ff03b2b929644872654fd2b237b085a8e37",
"body": "…nel.\n\nIf the user doesn't specify a version, run the tests applicable to their\nactual kernel rather than defaulting to the latest version available.\nThis makes local smoke testing easier.\n\nSigned-off-by: Daniel Burgener <Daniel.Burgener@microsoft.com>",
"is_bot": false,
"headline": "compat: Change the default LANDLOCK_CRATE_TEST_ABI to the current ker…",
"author_name": "Daniel Burgener",
"author_login": "dburgener",
"committed_at": "2025-02-11T10:37:50Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "a751123a4fc7c3bf69147a2c27699072a52321c4",
"body": "Signed-off-by: Marcin S. <marcin@realemail.net>",
"is_bot": false,
"headline": "docs: Add clarifying notes: AccessFs::WriteFile, path_beneath_rules",
"author_name": "Marcin S.",
"author_login": "mrcnski",
"committed_at": "2025-01-17T21:39:14Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "049ef733186d7e131ae151849e4f5a24cb4ba9d7",
"body": "The breaking changes between version 1 and 2 do not affect\nrust-landlock's usage of thiserror.\n\nSigned-off-by: Daniel Burgener <Daniel.Burgener@microsoft.com>",
"is_bot": false,
"headline": "cargo: Update to thiserror version 2",
"author_name": "Daniel Burgener",
"author_login": "dburgener",
"committed_at": "2024-12-17T16:39:53Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "94721d26b2fd1151e71bd7a3aa5a43c463a22347",
"body": "Add changelog entry.\n\nSigned-off-by: Mickaël Salaün <mic@digikod.net>",
"is_bot": false,
"headline": "lib: Bump to v0.4.1",
"author_name": "Mickaël Salaün",
"author_login": "l0kod",
"committed_at": "2024-09-13T17:56:50Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "c8f1a29617298c6b47f7d31d24ba8edbdee15f3c",
"body": "Add the AccessFs::IoctlDev right.\n\nAdd Linux 6.10 for Landlock ABI v5 and automatically create a config.\n\nSigned-off-by: Mickaël Salaün <mic@digikod.net>",
"is_bot": false,
"headline": "ci,src: Handle Landlock ABI v5",
"author_name": "Mickaël Salaün",
"author_login": "l0kod",
"committed_at": "2024-09-10T18:56:05Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "1b195e910423eb3b756279dc16344b08dae17b43",
"body": "bindgen -o src/uapi/landlock.rs .../linux/include/uapi/linux/landlock.h\n\nSigned-off-by: Mickaël Salaün <mic@digikod.net>",
"is_bot": false,
"headline": "uapi: Update to Linux 6.10",
"author_name": "Mickaël Salaün",
"author_login": "l0kod",
"committed_at": "2024-09-10T18:46:38Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "e51ba0b695c20ea5dce7dc629b887a5af8efe314",
"body": "Instead of using the pre-defined configuration from landlock-test-tools,\ncreate a dynamic configuration with the new make-uml.sh tool.\n\nInclude landlock-test-tools commit in the cache key to take into account\nrelated tool and configuration changes.\n\nSigned-off-by: Mickaël Salaün <mic@digikod.net>",
"is_bot": false,
"headline": "ci: Use dynamic kernel configurations",
"author_name": "Mickaël Salaün",
"author_login": "l0kod",
"committed_at": "2024-09-10T18:20:02Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "922d6c91d3dc48c9d14a08614dce5c42d2b8070f",
"body": "Signed-off-by: rusty-snake <41237666+rusty-snake@users.noreply.github.com>",
"is_bot": false,
"headline": "net: Fix typo in doc-comment",
"author_name": "rusty-snake",
"author_login": "rusty-snake",
"committed_at": "2024-09-05T13:59:58Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "4936d52e55b9bb6277960fb37bd89fd10cb4a838",
"body": "Use anyhow's context() and inline variables with eprintln!().\n\nSigned-off-by: Björn Roy Baron <bjorn3_gh@protonmail.com>",
"is_bot": false,
"headline": "sandboxer: Slightly rework the error handling",
"author_name": "Björn Roy Baron",
"author_login": "bjorn3",
"committed_at": "2024-09-05T13:39:43Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "57006aeaaafb81a5d0b7c121afd520f3bffec813",
"body": "Cargo already builds the Landlock crate as library before compiling any\nexamples or tests.\n\nSigned-off-by: Björn Roy Baron <bjorn3_gh@protonmail.com>",
"is_bot": false,
"headline": "cargo: Remove unnecessary dev-dependency on our own crate",
"author_name": "Björn Roy Baron",
"author_login": "bjorn3",
"committed_at": "2024-09-05T13:39:43Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "e95e9f8b8125f803b09fb62923ddc657de843bcf",
"body": "Ease maintenance of landlock-test-tools and avoid adding new built\nartifacts for each major kernel release.\n\nWe now use the latest versions according to landlock-lsm/linux branches\nfor each meaningful kernel.\n\nTo simplify the new ubuntu_22_rust_stable, don't run tests against the\nlocal kernel, which is already done with ubuntu_22_rust_msrv.\n\nReorder install, clone and build steps in ubuntu_22_rust_stable to clean\nup the working directory.\n\nSigned-off-by: Mickaël Salaün <mic@digikod.net>",
"is_bot": false,
"headline": "ci: Build and add kernels to cache",
"author_name": "Mickaël Salaün",
"author_login": "l0kod",
"committed_at": "2024-09-04T18:44:48Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "3c0665c829c8efe826adc4464c4cfc0bd3422fc7",
"body": "Use action/checkout@v4 and fix fetch-depth for landlock-test-tools. See\nhttps://github.blog/changelog/2024-03-07-github-actions-all-actions-will-run-on-node20-instead-of-node16-by-default/\n\nSigned-off-by: Mickaël Salaün <mic@digikod.net>",
"is_bot": false,
"headline": "ci: Bump actions/checkout to v4",
"author_name": "Mickaël Salaün",
"author_login": "l0kod",
"committed_at": "2024-09-03T07:01:29Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "537d293e782bfdcd9a72f49ee4b0287b4fb5784c",
"body": "Add changelog entry.\n\nSigned-off-by: Mickaël Salaün <mic@digikod.net>",
"is_bot": false,
"headline": "lib: Bump to v0.4.0",
"author_name": "Mickaël Salaün",
"author_login": "l0kod",
"committed_at": "2024-06-19T09:02:49Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "6deec9d10b3e2af615aff116c6fc7a1c5fe53aaf",
"body": "Signed-off-by: Mickaël Salaün <mic@digikod.net>",
"is_bot": false,
"headline": "cargo: Bump strum to v0.26",
"author_name": "Mickaël Salaün",
"author_login": "l0kod",
"committed_at": "2024-06-19T08:52:10Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "d645052d3279a3224a1e3bbab9ecdb3b62382b70",
"body": "Bump to Landlock ABI v4.\n\nTested that this sandbox doesn't restrict TCP:\n LL_FS_RO=/ LL_FS_RW=/ \\\n cargo run --example=sandboxer bash -i\n\nTested that this sandbox restrict bind and connect ports:\n LL_FS_RO=/ LL_FS_RW=/ LL_TCP_BIND=\"2000\" LL_TCP_CONNECT=\"3000:4000\" \\\n cargo run --example=sandboxer bash -i\n\nTest commands (with different ports):\n socat tcp-listen:2000 stdio\n date | socat stdio tcp-connect:127.1:2000\n\nSigned-off-by: Mickaël Salaün <mic@digikod.net>",
"is_bot": false,
"headline": "sandboxer: Add TCP bind and connect support",
"author_name": "Mickaël Salaün",
"author_login": "l0kod",
"committed_at": "2024-06-12T07:43:48Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "f112bf8f006519a7f3d3b6c496640ef0716b4efe",
"body": "The NetPort type enables us to create network port rules leveraging\nLandlock ABI 4.\n\nOnly 16-bit ports are allowed by the type system, which remove the need\nfor overflow check and error.\n\nAdd related tests, and handle E2BIG when the handled_access_net field is\nset and the running kernel does not support it.\n\nSigned-off-by: Mickaël Salaün <mic@digikod.net>",
"is_bot": false,
"headline": "net: Add NetPort rule",
"author_name": "Mickaël Salaün",
"author_login": "l0kod",
"committed_at": "2024-06-11T17:43:06Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "5e8b4a40572d393832c59c49c49e3962d9a62c6e",
"body": "Add the AccessNet::BindTcp and AccessNet::ConnectTcp rights.\n\nAdd ruleset_created_handle_access_net test to check that handled and\nactual access rights are consistent according to the Landlock ABI.\n\nRename the ruleset_created_handle_access_or test to\nruleset_created_handle_access_fs.\n\nIt should be noted that handle_access(AccessNet::from_all(ABI::V3))\nreturns an error because of the empty access bitflags.\n\nSigned-off-by: Mickaël Salaün <mic@digikod.net>",
"is_bot": false,
"headline": "net: Handle TCP bind and connect access rights",
"author_name": "Mickaël Salaün",
"author_login": "l0kod",
"committed_at": "2024-06-11T15:21:47Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "c1fef294217cdef52f4102d76d1c5ece1b8e0cf6",
"body": "Prepare crate for networking support, and run all tests against Linux\n6.7.1 that supports Landlock ABI 4\n\nSigned-off-by: Mickaël Salaün <mic@digikod.net>",
"is_bot": false,
"headline": "src,ci: Handle Landlock ABI v4",
"author_name": "Mickaël Salaün",
"author_login": "l0kod",
"committed_at": "2024-06-11T15:01:01Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "d8c4cadc9d9693088485da6b84906225e459e332",
"body": "We should never try to add real rules to a ruleset that wasn't really\ncreated (i.e. with a -1 file descriptor).\n\nFix the From implementation for Compatibilty to always use\nCompatState::Init as an initial state. This is now possible because of\nthe changes in create(), especially the new handling of \n[…]\nnd the abi_v3_truncate() test to check with a new rule which may be\nincompatible.\n\nFixes: ccb5a588a99c (\"compat: Prioritize error over incompatibility\")\nSigned-off-by: Mickaël Salaün <mic@digikod.net>",
"is_bot": false,
"headline": "lib: Fix and test unsupported rule",
"author_name": "Mickaël Salaün",
"author_login": "l0kod",
"committed_at": "2024-06-11T14:07:40Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "ccb5a588a99c732050ad146276de86b0ec0ad95e",
"body": "Reorder TryCompat::try_compat() checks to first call try_compat_inner()\nand then also always call try_compat_children(). This ensures that\ninner and children potential errors are always returned even if the\ncurrent object is incompatible.\n\nFor instance, this makes NetPort (see a following commit) a\n[…]\nd then\n try_compat_children().\n\nThis is now more consistent because the inner error is always returned\nwhatever there is a compatibility error or not.\n\nSigned-off-by: Mickaël Salaün <mic@digikod.net>",
"is_bot": false,
"headline": "compat: Prioritize error over incompatibility",
"author_name": "Mickaël Salaün",
"author_login": "l0kod",
"committed_at": "2024-06-03T12:43:22Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "f0e55e2eb2e2c7619f765b8603c8bfc801562b29",
"body": "Add path_beneath_try_compat_children() tests to check error ordering\nwith both children and inner errors. This enables us to identify the\nbehavior change introduced with the upcoming error priority change.\n\nSigned-off-by: Mickaël Salaün <mic@digikod.net>",
"is_bot": false,
"headline": "fs: Test try_compat_children()",
"author_name": "Mickaël Salaün",
"author_login": "l0kod",
"committed_at": "2024-06-03T12:43:22Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "d99f75155bec2040cf4ce1532007cd3b8a23e2fb",
"body": "When adding a rule to a ruleset created with ABI::Unsupported, its\ncompatibility state could change from CompatLevel::No to\nCompatLevel::Partial, which is wrong and could lead to an unexpected\nerror when trying to restrict the caller with -1 as a ruleset file\ndescriptor. This is especially visible \n[…]\ne\nexecution, and no error should be returned by the kernel.\n\nAdd tests to check theses changes, and change some existing tests\nto follow the new logic.\n\nSigned-off-by: Mickaël Salaün <mic@digikod.net>",
"is_bot": false,
"headline": "ruleset: Fix compatibility inconsistency",
"author_name": "Mickaël Salaün",
"author_login": "l0kod",
"committed_at": "2024-06-03T12:43:07Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "68f066eba571c1f9212f5a07016aac9ffb0d1c27",
"body": "The from_read() and from_write() methods make sense for AccessFs but not\nfor the upcoming AccessNet.\n\nThis is a breaking change because the Access trait's signature is\nmodified. In practice, it should not be an issue for most users. Only\nthose implementing helpers explicitly using Access::from_read() or\nAccess::from_write() should be concerned. In this case, they should\njust use AccessFs instead.\n\nFix a typo in the from_all() comment.\n\nSigned-off-by: Mickaël Salaün <mic@digikod.net>",
"is_bot": false,
"headline": "access: Move from_read() and from_write() into AccessFs",
"author_name": "Mickaël Salaün",
"author_login": "l0kod",
"committed_at": "2024-05-31T15:51:30Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "3abd779890bc4da99b4d7fb6f02a41156babde80",
"body": "This is simpler and more idiomatic.\n\nSigned-off-by: Mickaël Salaün <mic@digikod.net>",
"is_bot": false,
"headline": "rulelet: Use constant attribute for rule's type ID",
"author_name": "Mickaël Salaün",
"author_login": "l0kod",
"committed_at": "2024-05-31T15:11:14Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "158ac6eb7fd2c5d5d1449ed6c0bea429662d16f5",
"body": "Flags are not used for now.\n\nSigned-off-by: Mickaël Salaün <mic@digikod.net>",
"is_bot": false,
"headline": "ruleset: Remove PrivateRule::get_flags()",
"author_name": "Mickaël Salaün",
"author_login": "l0kod",
"committed_at": "2024-05-31T15:11:14Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "443817029567c46b92b17621f5a6284718be9b16",
"body": "Move PathBeneath::sync_attr() in the PathBenath::as_ptr() to avoid\npotential inconsistencies or race conditions.\n\nSigned-off-by: Mickaël Salaün <mic@digikod.net>",
"is_bot": false,
"headline": "fs: Improve inner attr buffer synchronization",
"author_name": "Mickaël Salaün",
"author_login": "l0kod",
"committed_at": "2024-05-31T15:11:14Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "8d473dff02c02c47fd2a61f2608f782714a564ab",
"body": "Add changelog entry for v0.3.1\n\nSigned-off-by: Mickaël Salaün <mic@digikod.net>",
"is_bot": false,
"headline": "lib: Bump to v0.3.1",
"author_name": "Mickaël Salaün",
"author_login": "l0kod",
"committed_at": "2024-03-22T10:08:44Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "34752a25fe05159cc0fc41b0159da4d84a5d0860",
"body": "This enables the sharing of a parent ruleset that can be passed to\nmultiple processes/threads without the need to reconstruct the ruleset.\n\nSigned-off-by: Carl Petty <carlpetty@microsoft.com>",
"is_bot": false,
"headline": "ruleset: Add RulsetCreated::try_clone()",
"author_name": "Carl Petty",
"author_login": null,
"committed_at": "2024-03-22T10:01:56Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "89797a0b4353315938d0cc0dcab6dc9922198349",
"body": "bindgen -o src/uapi/landlock.rs .../linux/include/uapi/linux/landlock.h\n\nUpdate Ruleset::create() accordingly.\n\nSigned-off-by: Mickaël Salaün <mic@digikod.net>",
"is_bot": false,
"headline": "uapi: Update to Linux 6.7",
"author_name": "Mickaël Salaün",
"author_login": "l0kod",
"committed_at": "2024-01-24T16:06:15Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "5765d06fe914932bcd7bc313d9531d87cf83b4fd",
"body": "Add changelog entry for v0.3.0 and explain the main changes brought by\nthis version.\n\nSigned-off-by: Mickaël Salaün <mic@digikod.net>",
"is_bot": false,
"headline": "lib: Bump to v0.3.0",
"author_name": "Mickaël Salaün",
"author_login": "l0kod",
"committed_at": "2023-10-09T09:10:39Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "e4f28ea6023b21a6c7a5a8d6dbd15896e8150f80",
"body": "List some use cases, point to code examples, and rearrange the readme.\n\nSigned-off-by: Mickaël Salaün <mic@digikod.net>",
"is_bot": false,
"headline": "lib,readme: Extend documentation",
"author_name": "Mickaël Salaün",
"author_login": "l0kod",
"committed_at": "2023-10-09T09:10:26Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "880bfb008aaf2a83b83afad03ac63a1726d47cf0",
"body": "Signed-off-by: Mickaël Salaün <mic@digikod.net>",
"is_bot": false,
"headline": "cargo: Bump strum to v0.25",
"author_name": "Mickaël Salaün",
"author_login": "l0kod",
"committed_at": "2023-10-09T09:00:14Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "e9e1ead66cd5d788e0e98945ac6983c233a1a8b9",
"body": "Explain more clearly why sticking to a specific Landlock ABI version to\ninfer access rights is highly recommended.\n\nAdd links to the landlock-test-tools repository and related CI changes.\n\nSigned-off-by: Mickaël Salaün <mic@digikod.net>",
"is_bot": false,
"headline": "compat: Improve the ABI documentation",
"author_name": "Mickaël Salaün",
"author_login": "l0kod",
"committed_at": "2023-10-09T08:52:14Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "a0da8c0432728c9e182dce9d36260b14b95df581",
"body": "Remove AsMut<Option<CompatLevel>> from the public API to avoid ambiguous types\nthat can lead to:\n error[E0283]: type annotations needed for `&mut T`\n --> src/ruleset.rs:306:9\n |\n 306 | let _ = ruleset.as_mut();\n | ^ ------ type must be known at this point\n \n[…]\n_>` found\n\nAdd tests to detect potential future change.\n\nThis is less elegant that the AsMut autoderivated implementations, but\nit is safer.\n\nFixes #48\n\nSigned-off-by: Mickaël Salaün <mic@digikod.net>",
"is_bot": false,
"headline": "src: Make AsMut<Ruleset> and AsMut<RulesetCreated> unambiguous",
"author_name": "Mickaël Salaün",
"author_login": "l0kod",
"committed_at": "2023-09-14T18:03:55Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "83da4b590c87494456884e2956e739209eae3198",
"body": "GitHub CI updated the Ubuntu kernel with Linux 6.2:\nhttps://ubuntu.com/about/release-cycle#ubuntu-kernel-release-cycle\n\nReflect this Landlock ABI bump in the tests.\n\nWe could only rely on the new landlock-test-tools UML kernels, but this\nkind of Ubuntu update should not be frequent, and I'd still like to test\nwith an Ubuntu kernel. Let's keep it for now, we'll update this CI\nconfiguration from time to time.\n\nSigned-off-by: Mickaël Salaün <mic@digikod.net>",
"is_bot": false,
"headline": "ci: Update Ubunty 22.04.3 kernel",
"author_name": "Mickaël Salaün",
"author_login": "l0kod",
"committed_at": "2023-09-14T11:09:11Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "fc5cff18cec507931859fed9bb0f456222e4f80e",
"body": "Run all tests against Linux 6.4.9 that supports Landlock ABI 3.\n\nSigned-off-by: Mickaël Salaün <mic@digikod.net>",
"is_bot": false,
"headline": "ci: Test with Landlock ABI 3",
"author_name": "Mickaël Salaün",
"author_login": "l0kod",
"committed_at": "2023-09-07T06:57:09Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "9fe121021ef7fabcf9e7d94765e125b51a3a50fa",
"body": "The new() function is planned to be changed and take parameters.\nThis also align with Rust best practice:\nhttps://rust-lang.github.io/rust-clippy/stable/index.html#new_without_default\n\nDeprecate Ruleset::new() and implement the Default trait for Ruleset.\n\nSigned-off-by: Mickaël Salaün <mic@digikod.net>",
"is_bot": false,
"headline": "ruleset: Use Ruleset::default() instead of Ruleset::new()",
"author_name": "Mickaël Salaün",
"author_login": "l0kod",
"committed_at": "2023-08-31T13:01:18Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "7a13afeafcbaa4c97e1c681967c252ce056d421a",
"body": "This is useful to detect test inconsistencies between Rust versions.\n\nThis new MSRV/UML test would have failed without commit dbd4105e0bed\n(\"src: Execute each restrict_self() test in a dedicated thread\").\n\nUse Ubuntu 22.04 to run MSRV and UML tests.\n\nSort steps to move all the checkout actions early.\n\nSigned-off-by: Mickaël Salaün <mic@digikod.net>",
"is_bot": false,
"headline": "ci: Run tests built with Rust MSRV",
"author_name": "Mickaël Salaün",
"author_login": "l0kod",
"committed_at": "2023-08-31T12:48:23Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "dbd4105e0bed546dcd49328fc1e1bb36ce08f761",
"body": "Ensures restrict_self() is called on a dedicated thread to avoid\ninconsistent tests.\n\nThe visible effect (with Rust 1.63) was for restrict_self() to sometime\nreturn E2BIG because of too many stacked domains. This inconsistency was\nrelated to the number of tests (i.e. the number of successful\nrestrict_self() calls), but not directly related to their content.\n\nSigned-off-by: Mickaël Salaün <mic@digikod.net>",
"is_bot": false,
"headline": "src: Execute each restrict_self() test in a dedicated thread",
"author_name": "Mickaël Salaün",
"author_login": "l0kod",
"committed_at": "2023-08-31T12:27:55Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "ce5727ee36d1244d564484a478d90af0a3c7a2e2",
"body": "Set and export the CARGO environment variable to make sure the\nubuntu_22_rust_stable job uses a consistent Cargo version for\nlandlock-test-tools/test-rust.sh tests and the native test.\n\nSigned-off-by: Mickaël Salaün <mic@digikod.net>",
"is_bot": false,
"headline": "ci: Make sure the same Cargo version is used",
"author_name": "Mickaël Salaün",
"author_login": "l0kod",
"committed_at": "2023-08-31T10:53:52Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "e44d5391f34ed89fc3133608c784aaa2d0a9540b",
"body": "Add the AccessFs::Truncate right.\n\nSigned-off-by: Mickaël Salaün <mic@digikod.net>",
"is_bot": false,
"headline": "src: Handle Landlock ABI v3",
"author_name": "Mickaël Salaün",
"author_login": "l0kod",
"committed_at": "2023-08-30T15:13:22Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "aadd18a9ad3de706729a4fe421531fa625eb8939",
"body": "bindgen -o src/uapi/landlock.rs .../linux/include/uapi/linux/landlock.h\n\nSigned-off-by: Mickaël Salaün <mic@digikod.net>",
"is_bot": false,
"headline": "uapi: Update to Linux 6.2",
"author_name": "Mickaël Salaün",
"author_login": "l0kod",
"committed_at": "2023-08-30T15:13:22Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "a53f04a7ceabf6467b1c169aa6d85f0685e629a1",
"body": "Use the merge commits that introduced each specific Landlock ABI.\n\nSigned-off-by: Mickaël Salaün <mic@digikod.net>",
"is_bot": false,
"headline": "compat: Update Linux links",
"author_name": "Mickaël Salaün",
"author_login": "l0kod",
"committed_at": "2023-08-30T15:13:22Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "7c7aee112790deb409ff9750ca154ec561d71e88",
"body": "It is possible to implement try_compat() in an inconsistent way compared\nto other implementations. Instead, implement the whole compatibility\nlogic in the default try_compat() implementation, and create tailored\nmethod to be implemented by objects: try_compat_inner() and\ntry_compat_children().\n\nThe\n[…]\nloredCompatLevel for each\nCompatible implementation (only PathBeneath for now), which helps avoid\nmissing an implementation for a new Compatible types.\n\nSigned-off-by: Mickaël Salaün <mic@digikod.net>",
"is_bot": false,
"headline": "compat: Improve TryCompat trait type safety and fix consistency issue",
"author_name": "Mickaël Salaün",
"author_login": "l0kod",
"committed_at": "2023-08-30T15:05:49Z",
"body_truncated": true,
"is_coding_agent": false
}
],
"releases_count": 9,
"commits_last_year": 27,
"latest_release_at": "2026-05-22T14:33:37Z",
"latest_release_tag": "v0.4.5",
"releases_from_tags": false,
"days_since_last_push": 1,
"active_weeks_last_year": 10,
"days_since_latest_release": 65,
"mean_days_between_releases": 151
},
"community": {
"has_readme": true,
"has_license": true,
"has_description": true,
"has_contributing": true,
"health_percentage": 50,
"has_issue_template": false,
"has_code_of_conduct": false,
"has_pull_request_template": false
},
"ecosystem": {
"packages": [
{
"name": "landlock",
"exists": true,
"license": "MIT OR Apache-2.0",
"keywords": [
"access-control",
"linux",
"sandbox",
"security",
"os::linux-apis",
"virtualization",
"api-bindings",
"filesystem"
],
"ecosystem": "crates",
"matches_repo": true,
"registry_url": "https://crates.io/crates/landlock",
"is_deprecated": false,
"latest_version": "0.4.6",
"repository_url": "https://github.com/landlock-lsm/rust-landlock",
"versions_count": 11,
"total_downloads": 13000824,
"dependents_count": null,
"deprecation_note": null,
"maintainers_count": null,
"monthly_downloads": 1665559,
"first_published_at": "2021-04-14T07:26:02.079539Z",
"latest_published_at": "2026-07-25T14:54:52.305858Z",
"latest_version_yanked": false,
"days_since_latest_publish": 1
}
]
},
"popularity": {
"forks": 24,
"stars": 285,
"watchers": 5,
"fork_history": {
"days": [
{
"date": "2021-04-15",
"count": 1
},
{
"date": "2021-12-01",
"count": 1
},
{
"date": "2021-12-09",
"count": 1
},
{
"date": "2022-08-18",
"count": 1
},
{
"date": "2022-09-28",
"count": 1
},
{
"date": "2022-12-24",
"count": 1
},
{
"date": "2023-08-02",
"count": 1
},
{
"date": "2024-06-08",
"count": 1
},
{
"date": "2024-10-22",
"count": 1
},
{
"date": "2025-01-17",
"count": 1
},
{
"date": "2025-02-11",
"count": 1
},
{
"date": "2025-03-23",
"count": 1
},
{
"date": "2025-04-16",
"count": 1
},
{
"date": "2025-04-30",
"count": 1
},
{
"date": "2025-09-30",
"count": 1
},
{
"date": "2026-01-23",
"count": 1
},
{
"date": "2026-02-17",
"count": 1
},
{
"date": "2026-03-29",
"count": 1
},
{
"date": "2026-05-14",
"count": 1
},
{
"date": "2026-05-15",
"count": 1
},
{
"date": "2026-05-25",
"count": 1
},
{
"date": "2026-06-10",
"count": 1
},
{
"date": "2026-07-11",
"count": 1
},
{
"date": "2026-07-24",
"count": 1
}
],
"complete": true,
"collected": 24,
"total_forks": 24
},
"star_history": null,
"open_issues_and_prs": 14
},
"ai_readiness": {
"has_nix": false,
"example_dirs": [
"examples"
],
"has_llms_txt": false,
"has_dockerfile": false,
"has_mcp_signal": false,
"bootstrap_files": [],
"api_schema_files": [],
"has_devcontainer": false,
"typecheck_configs": [],
"toolchain_manifests": [
"Cargo.toml"
],
"largest_source_bytes": 54053,
"source_files_sampled": 17,
"oversized_source_files": 0,
"agent_instruction_files": [],
"agent_instruction_max_bytes": null
},
"dependencies": {
"manifests": [
"Cargo.toml"
],
"advisories": {
"error": null,
"scope": "published_package",
"source": "osv",
"findings": [],
"collected": true,
"malicious": [],
"truncated": false,
"by_severity": {},
"advisory_count": 0,
"affected_count": 0,
"assessed_count": 15,
"malicious_count": 0,
"assessed_package": "crates:landlock@0.4.6",
"unassessed_count": 0,
"direct_affected_count": 0
},
"ecosystems": [
"crates"
],
"dependencies": [
{
"name": "enumflags2",
"manifest": "Cargo.toml",
"ecosystem": "crates",
"version_constraint": "0.7"
},
{
"name": "libc",
"manifest": "Cargo.toml",
"ecosystem": "crates",
"version_constraint": "0.2.186"
},
{
"name": "thiserror",
"manifest": "Cargo.toml",
"ecosystem": "crates",
"version_constraint": "2.0"
}
],
"all_dependencies": {
"error": null,
"source": "github-sbom",
"packages": [
{
"name": "enumflags2",
"direct": true,
"version": null,
"ecosystem": "crates"
},
{
"name": "libc",
"direct": true,
"version": null,
"ecosystem": "crates"
},
{
"name": "thiserror",
"direct": true,
"version": null,
"ecosystem": "crates"
},
{
"name": "anyhow",
"direct": false,
"version": null,
"ecosystem": "crates"
},
{
"name": "lazy_static",
"direct": false,
"version": null,
"ecosystem": "crates"
},
{
"name": "strum",
"direct": false,
"version": null,
"ecosystem": "crates"
},
{
"name": "strum_macros",
"direct": false,
"version": null,
"ecosystem": "crates"
}
],
"collected": true,
"truncated": false,
"total_count": 7,
"direct_count": 3,
"indirect_count": 4
}
},
"maintainership": {
"issues": {
"open_prs": 4,
"merged_prs": 97,
"open_issues": 10,
"closed_ratio": 0.63,
"closed_issues": 17,
"closed_unmerged_prs": 8
},
"bus_factor": 1,
"bot_contributors": 0,
"top_contributors": [
{
"type": "User",
"login": "l0kod",
"commits": 211,
"avatar_url": "https://avatars.githubusercontent.com/u/1286585?v=4"
},
{
"type": "User",
"login": "bjorn3",
"commits": 7,
"avatar_url": "https://avatars.githubusercontent.com/u/17426603?v=4"
},
{
"type": "User",
"login": "dburgener",
"commits": 3,
"avatar_url": "https://avatars.githubusercontent.com/u/4738703?v=4"
},
{
"type": "User",
"login": "n0toose",
"commits": 3,
"avatar_url": "https://avatars.githubusercontent.com/u/30193966?v=4"
},
{
"type": "User",
"login": "vdagonneau",
"commits": 2,
"avatar_url": "https://avatars.githubusercontent.com/u/40261096?v=4"
},
{
"type": "User",
"login": "cd-work",
"commits": 1,
"avatar_url": "https://avatars.githubusercontent.com/u/102963075?v=4"
},
{
"type": "User",
"login": "mrcnski",
"commits": 1,
"avatar_url": "https://avatars.githubusercontent.com/u/6035856?v=4"
},
{
"type": "User",
"login": "rusty-snake",
"commits": 1,
"avatar_url": "https://avatars.githubusercontent.com/u/41237666?v=4"
}
],
"contributors_sampled": 8,
"top_contributor_share": 0.921
},
"quality_signals": {
"has_ci": true,
"has_tests": false,
"ci_workflows": [
"pages.yml",
"rust.yml"
],
"has_docs_dir": false,
"linter_configs": [],
"has_editorconfig": false,
"has_linter_config": false,
"has_precommit_config": false
},
"security_signals": {
"lockfiles": [],
"scorecard": {
"checks": [
{
"name": "Binary-Artifacts",
"score": 10,
"reason": "no binaries found in the repo",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#binary-artifacts"
},
{
"name": "Branch-Protection",
"score": null,
"reason": "internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#branch-protection"
},
{
"name": "CI-Tests",
"score": 9,
"reason": "22 out of 24 merged PRs checked by a CI test -- score normalized to 9",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#ci-tests"
},
{
"name": "CII-Best-Practices",
"score": 0,
"reason": "no effort to earn an OpenSSF best practices badge detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#cii-best-practices"
},
{
"name": "Code-Review",
"score": 1,
"reason": "Found 3/24 approved changesets -- score normalized to 1",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#code-review"
},
{
"name": "Contributors",
"score": 10,
"reason": "project has 7 contributing companies or organizations",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#contributors"
},
{
"name": "Dangerous-Workflow",
"score": 10,
"reason": "no dangerous workflow patterns detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#dangerous-workflow"
},
{
"name": "Dependency-Update-Tool",
"score": 0,
"reason": "no update tool detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#dependency-update-tool"
},
{
"name": "Fuzzing",
"score": 0,
"reason": "project is not fuzzed",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#fuzzing"
},
{
"name": "License",
"score": 9,
"reason": "license file detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#license"
},
{
"name": "Maintained",
"score": 10,
"reason": "17 commit(s) and 3 issue activity found in the last 90 days -- score normalized to 10",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#maintained"
},
{
"name": "Packaging",
"score": null,
"reason": "packaging workflow not detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#packaging"
},
{
"name": "Pinned-Dependencies",
"score": 0,
"reason": "dependency not pinned by hash detected -- score normalized to 0",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#pinned-dependencies"
},
{
"name": "SAST",
"score": 0,
"reason": "SAST tool is not run on all commits -- score normalized to 0",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#sast"
},
{
"name": "Security-Policy",
"score": 0,
"reason": "security policy file not detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#security-policy"
},
{
"name": "Signed-Releases",
"score": null,
"reason": "no releases found",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#signed-releases"
},
{
"name": "Token-Permissions",
"score": 9,
"reason": "detected GitHub workflow tokens with excessive permissions",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#token-permissions"
},
{
"name": "Vulnerabilities",
"score": 10,
"reason": "0 existing vulnerabilities detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#vulnerabilities"
}
],
"commit": "2ff9281776b039fccc6075c46ccabe1acdb7ba6e",
"ran_at": "2026-07-26T20:45:24Z",
"aggregate_score": 5.5,
"scorecard_version": "v5.5.0"
},
"has_codeql_workflow": false,
"has_security_policy": false,
"has_dependabot_config": false
},
"contribution_flow": {
"collected": true,
"ci_last_run_at": "2026-07-25T14:59:54Z",
"oldest_open_prs": [
{
"number": 23,
"created_at": "2022-12-24T18:06:04Z",
"last_comment_at": "2025-02-10T13:37:06Z",
"last_comment_author": "l0kod"
},
{
"number": 58,
"created_at": "2024-02-21T14:12:49Z",
"last_comment_at": "2024-03-08T16:31:11Z",
"last_comment_author": "l0kod"
},
{
"number": 115,
"created_at": "2026-02-21T15:02:08Z",
"last_comment_at": null,
"last_comment_author": null
},
{
"number": 135,
"created_at": "2026-07-23T15:40:25Z",
"last_comment_at": "2026-07-23T22:24:21Z",
"last_comment_author": "eslerm"
}
],
"last_merged_pr_at": "2026-07-25T14:58:46Z",
"ci_last_conclusion": "SUCCESS",
"oldest_open_issues": [
{
"number": 17,
"created_at": "2022-08-26T13:56:06Z",
"last_comment_at": "2022-08-29T11:34:26Z",
"last_comment_author": "cd-work"
},
{
"number": 36,
"created_at": "2023-05-26T22:03:54Z",
"last_comment_at": "2024-02-21T14:36:52Z",
"last_comment_author": "mrcnski"
},
{
"number": 43,
"created_at": "2023-08-25T19:39:17Z",
"last_comment_at": "2024-04-02T10:52:58Z",
"last_comment_author": "l0kod"
},
{
"number": 57,
"created_at": "2024-02-21T11:11:32Z",
"last_comment_at": "2025-06-05T10:56:35Z",
"last_comment_author": "n0toose"
},
{
"number": 59,
"created_at": "2024-02-21T14:23:25Z",
"last_comment_at": null,
"last_comment_author": null
},
{
"number": 60,
"created_at": "2024-02-21T14:33:07Z",
"last_comment_at": null,
"last_comment_author": null
},
{
"number": 61,
"created_at": "2024-02-21T17:28:47Z",
"last_comment_at": null,
"last_comment_author": null
},
{
"number": 62,
"created_at": "2024-02-21T17:33:03Z",
"last_comment_at": "2025-04-17T06:28:54Z",
"last_comment_author": "l0kod"
},
{
"number": 93,
"created_at": "2025-04-16T17:06:02Z",
"last_comment_at": "2025-04-28T18:43:30Z",
"last_comment_author": "n0toose"
},
{
"number": 121,
"created_at": "2026-05-14T07:59:39Z",
"last_comment_at": "2026-05-26T06:24:02Z",
"last_comment_author": "lukehinds"
}
]
}
},
"config": {
"disabled_metrics": [],
"disabled_categories": [],
"disabled_components": {}
},
"source": {
"url": "https://github.com/landlock-lsm/rust-landlock",
"host": "github.com",
"name": "rust-landlock",
"owner": "landlock-lsm"
},
"metrics": {
"overall": {
"key": "overall",
"band": "moderate",
"name": "Overall health",
"note": null,
"notes": [],
"value": 64,
"inputs": {
"security": 64,
"vitality": 73,
"community": 69,
"governance": 62,
"engineering": 51
},
"components": []
},
"categories": [
{
"key": "vitality",
"band": "good",
"name": "Vitality",
"value": 73,
"weight": 0.22,
"metrics": [
{
"key": "development_activity",
"band": "moderate",
"name": "Development activity",
"note": null,
"notes": [],
"value": 66,
"inputs": {
"commits_last_year": 27,
"human_commit_share": 1,
"days_since_last_push": 1,
"active_weeks_last_year": 10
},
"components": [
{
"key": "push_recency",
"name": "Push recency",
"detail": "last push 1 days ago",
"points": 36,
"status": "met",
"details": [
{
"code": "push_recency",
"params": {
"days": 1
}
}
],
"max_points": 36
},
{
"key": "commit_cadence",
"name": "Commit cadence",
"detail": "10/52 weeks with commits",
"points": 6.9,
"status": "partial",
"details": [
{
"code": "commit_cadence_weeks",
"params": {
"weeks": 10
}
}
],
"max_points": 36
},
{
"key": "commit_volume",
"name": "Commit volume",
"detail": "27 commits in the last year",
"points": 13,
"status": "partial",
"details": [
{
"code": "commits_last_year",
"params": {
"count": 27
}
}
],
"max_points": 18
},
{
"key": "openssf_scorecard_maintained",
"name": "OpenSSF Scorecard: Maintained",
"detail": "17 commit(s) and 3 issue activity found in the last 90 days -- score normalized to 10",
"points": 10,
"status": "met",
"details": [],
"max_points": 10
}
]
},
{
"key": "release_discipline",
"band": "good",
"name": "Release discipline",
"note": "Excluded from scoring (no data or not applicable): OpenSSF Scorecard: Signed-Releases. Remaining weights renormalized.",
"notes": [
{
"code": "excluded_no_data",
"params": {
"components": [
"openssf_scorecard_signed_releases"
]
}
},
{
"code": "weights_renormalized",
"params": {}
}
],
"value": 84,
"inputs": {
"releases_count": 9,
"latest_release_tag": "v0.4.5",
"releases_from_tags": false,
"days_since_latest_release": 65,
"mean_days_between_releases": 151
},
"components": [
{
"key": "ships_releases",
"name": "Ships releases",
"detail": "9 releases published",
"points": 27,
"status": "met",
"details": [
{
"code": "releases_published",
"params": {
"count": 9
}
}
],
"max_points": 27
},
{
"key": "release_recency",
"name": "Release recency",
"detail": "latest release 65 days ago",
"points": 36,
"status": "met",
"details": [
{
"code": "release_recency",
"params": {
"days": 65
}
}
],
"max_points": 36
},
{
"key": "release_cadence",
"name": "Release cadence",
"detail": "a release every ~151 days",
"points": 12.6,
"status": "partial",
"details": [
{
"code": "release_cadence",
"params": {
"gap": 151
}
}
],
"max_points": 27
},
{
"key": "openssf_scorecard_signed_releases",
"name": "OpenSSF Scorecard: Signed-Releases",
"detail": "no releases found",
"points": 0,
"status": "excluded",
"details": [
{
"code": "no_data",
"params": {}
}
],
"max_points": 10
}
]
},
{
"key": "abandonment",
"band": "excellent",
"name": "Abandonment",
"note": null,
"notes": [],
"value": 100,
"inputs": {
"cap": null,
"state": "maintained",
"guards": [],
"signals": [],
"red_flag": false,
"multiplier_pct": 100,
"declared_reason": null,
"unverified_reason": null,
"unanswered_open_prs": null,
"unanswered_open_issues": null,
"days_since_last_merged_pr": null,
"days_since_last_human_commit": 1,
"days_since_last_human_commit_is_floor": false
},
"components": [
{
"key": "project_is_still_maintained",
"name": "Project is still maintained",
"detail": "last human commit 1 days ago",
"points": 100,
"status": "met",
"details": [
{
"code": "abandonment_maintained",
"params": {
"days": 1
}
}
],
"max_points": 100
}
]
}
],
"description": "Is the project alive — is code being written and are releases shipping?"
},
{
"key": "community",
"band": "moderate",
"name": "Community & Adoption",
"value": 69,
"weight": 0.18,
"metrics": [
{
"key": "popularity",
"band": "moderate",
"name": "Popularity & adoption",
"note": null,
"notes": [],
"value": 54,
"inputs": {
"forks": 24,
"stars": 285,
"watchers": 5,
"growth_state": "unverified",
"growth_factor_pct": 100,
"growth_unverified_reason": "no_history"
},
"components": [
{
"key": "stars",
"name": "Stars",
"detail": "285 stars",
"points": 39.8,
"status": "partial",
"details": [
{
"code": "stars",
"params": {
"count": 285
}
}
],
"max_points": 60
},
{
"key": "forks",
"name": "Forks",
"detail": "24 forks",
"points": 11.3,
"status": "partial",
"details": [
{
"code": "forks",
"params": {
"count": 24
}
}
],
"max_points": 25
},
{
"key": "watchers",
"name": "Watchers",
"detail": "5 watchers",
"points": 3.3,
"status": "partial",
"details": [
{
"code": "watchers",
"params": {
"count": 5
}
}
],
"max_points": 15
}
]
},
{
"key": "community_health",
"band": "moderate",
"name": "Community health",
"note": null,
"notes": [],
"value": 64,
"inputs": {
"has_readme": true,
"has_license": true,
"has_contributing": true,
"has_issue_template": false,
"has_code_of_conduct": false,
"has_pull_request_template": false
},
"components": [
{
"key": "readme",
"name": "README",
"detail": null,
"points": 22.5,
"status": "met",
"details": [],
"max_points": 22.5
},
{
"key": "license",
"name": "License",
"detail": "license file present, not a recognized license",
"points": 16.9,
"status": "partial",
"details": [
{
"code": "license_custom",
"params": {}
}
],
"max_points": 22.5
},
{
"key": "contributing_guide",
"name": "CONTRIBUTING guide",
"detail": null,
"points": 18,
"status": "met",
"details": [],
"max_points": 18
},
{
"key": "code_of_conduct",
"name": "Code of conduct",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 13.5
},
{
"key": "issue_template",
"name": "Issue template",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 7.2
},
{
"key": "pr_template",
"name": "PR template",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 6.3
}
]
},
{
"key": "ecosystem_adoption",
"band": "excellent",
"name": "Ecosystem adoption (downloads)",
"note": "Excluded from scoring (no data or not applicable): Registry dependents. Remaining weights renormalized.",
"notes": [
{
"code": "excluded_no_data",
"params": {
"components": [
"registry_dependents"
]
}
},
{
"code": "weights_renormalized",
"params": {}
}
],
"value": 100,
"inputs": {
"packages": [
"landlock"
],
"dependents": null,
"ecosystems": "crates",
"total_downloads": 13000824,
"monthly_downloads": 1665559
},
"components": [
{
"key": "monthly_downloads",
"name": "Monthly downloads",
"detail": "1,665,559 downloads/month across crates",
"points": 80,
"status": "met",
"details": [
{
"code": "downloads_monthly",
"params": {
"count": 1665559,
"ecosystems": "crates"
}
}
],
"max_points": 80
},
{
"key": "registry_dependents",
"name": "Registry dependents",
"detail": "not reported by this ecosystem",
"points": 0,
"status": "excluded",
"details": [
{
"code": "not_reported_by_this_ecosystem",
"params": {}
}
],
"max_points": 20
}
]
}
],
"description": "Does the project have users, downloads, attention, and a welcoming setup for contributors?"
},
{
"key": "governance",
"band": "moderate",
"name": "Sustainability & Governance",
"value": 62,
"weight": 0.24,
"metrics": [
{
"key": "maintainer_resilience",
"band": "at_risk",
"name": "Maintainer resilience (bus factor)",
"note": null,
"notes": [],
"value": 32,
"inputs": {
"bus_factor": 1,
"contributors_sampled": 8,
"top_contributor_share": 0.921
},
"components": [
{
"key": "bus_factor",
"name": "Bus factor",
"detail": "1 contributor(s) cover half of all commits",
"points": 9,
"status": "partial",
"details": [
{
"code": "bus_factor",
"params": {
"count": 1
}
}
],
"max_points": 54
},
{
"key": "commit_distribution",
"name": "Commit distribution",
"detail": "top contributor authored 92% of commits",
"points": 1.8,
"status": "partial",
"details": [
{
"code": "top_contributor_share",
"params": {
"share": 92
}
}
],
"max_points": 22.5
},
{
"key": "contributor_breadth",
"name": "Contributor breadth",
"detail": "8 contributors",
"points": 10.8,
"status": "partial",
"details": [
{
"code": "contributors_sampled",
"params": {
"count": 8
}
}
],
"max_points": 13.5
},
{
"key": "openssf_scorecard_contributors",
"name": "OpenSSF Scorecard: Contributors",
"detail": "project has 7 contributing companies or organizations",
"points": 10,
"status": "met",
"details": [],
"max_points": 10
}
]
},
{
"key": "responsiveness",
"band": "moderate",
"name": "Issue & PR responsiveness",
"note": null,
"notes": [],
"value": 66,
"inputs": {
"merged_prs": 97,
"open_issues": 10,
"closed_issues": 17,
"issue_closed_ratio": 0.63,
"closed_unmerged_prs": 8
},
"components": [
{
"key": "issue_resolution",
"name": "Issue resolution",
"detail": "63% of issues closed",
"points": 29.5,
"status": "partial",
"details": [
{
"code": "issues_closed_share",
"params": {
"share": 63
}
}
],
"max_points": 46.75
},
{
"key": "pr_acceptance",
"name": "PR acceptance",
"detail": "97/105 decided PRs merged",
"points": 35.3,
"status": "partial",
"details": [
{
"code": "decided_prs_merged",
"params": {
"merged": 97,
"decided": 105
}
}
],
"max_points": 38.25
},
{
"key": "openssf_scorecard_code_review",
"name": "OpenSSF Scorecard: Code-Review",
"detail": "Found 3/24 approved changesets -- score normalized to 1",
"points": 1.5,
"status": "partial",
"details": [],
"max_points": 15
}
]
},
{
"key": "stewardship",
"band": "moderate",
"name": "Ownership & stewardship",
"note": null,
"notes": [],
"value": 64,
"inputs": {
"followers": 91,
"owner_type": "Organization",
"is_verified": null,
"owner_login": "landlock-lsm",
"public_repos": 12,
"account_age_days": 3628
},
"components": [
{
"key": "ownership_backing",
"name": "Ownership backing",
"detail": "organization-owned",
"points": 30,
"status": "met",
"details": [
{
"code": "owner_organization",
"params": {}
}
],
"max_points": 30
},
{
"key": "verified_domain",
"name": "Verified domain",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 20
},
{
"key": "owner_reach",
"name": "Owner reach",
"detail": "91 followers of landlock-lsm",
"points": 14.1,
"status": "partial",
"details": [
{
"code": "owner_followers",
"params": {
"count": 91,
"login": "landlock-lsm"
}
}
],
"max_points": 25
},
{
"key": "track_record",
"name": "Track record",
"detail": "12 public repos, account ~9 yr old",
"points": 20.1,
"status": "partial",
"details": [
{
"code": "public_repos",
"params": {
"count": 12
}
},
{
"code": "account_age_years",
"params": {
"years": 9
}
}
],
"max_points": 25
}
]
},
{
"key": "package_maintenance",
"band": "excellent",
"name": "Package maintenance",
"note": null,
"notes": [],
"value": 100,
"inputs": {
"packages": [
"landlock"
],
"ecosystems": "crates",
"any_deprecated": false,
"min_days_since_publish": 1
},
"components": [
{
"key": "published_resolvable",
"name": "Published & resolvable",
"detail": "1 package(s) on crates",
"points": 25,
"status": "met",
"details": [
{
"code": "packages_published",
"params": {
"count": 1,
"ecosystems": "crates"
}
}
],
"max_points": 25
},
{
"key": "publish_recency",
"name": "Publish recency",
"detail": "latest publish 1 days ago",
"points": 35,
"status": "met",
"details": [
{
"code": "publish_recency",
"params": {
"days": 1
}
}
],
"max_points": 35
},
{
"key": "version_history",
"name": "Version history",
"detail": "11 published versions",
"points": 20,
"status": "met",
"details": [
{
"code": "published_versions",
"params": {
"count": 11
}
}
],
"max_points": 20
},
{
"key": "not_deprecated",
"name": "Not deprecated",
"detail": "active, not deprecated or yanked",
"points": 20,
"status": "met",
"details": [
{
"code": "package_not_deprecated",
"params": {}
}
],
"max_points": 20
}
]
}
],
"description": "Will the project survive its people — bus factor, responsiveness, who backs it, and package upkeep?"
},
{
"key": "engineering",
"band": "moderate",
"name": "Engineering Quality",
"value": 51,
"weight": 0.2,
"metrics": [
{
"key": "engineering_practices",
"band": "at_risk",
"name": "Engineering practices",
"note": null,
"notes": [],
"value": 42,
"inputs": {
"has_ci": true,
"has_tests": false,
"has_editorconfig": false,
"has_linter_config": false,
"has_precommit_config": false
},
"components": [
{
"key": "ci_workflows",
"name": "CI workflows",
"detail": "2 workflow(s)",
"points": 24,
"status": "met",
"details": [
{
"code": "ci_workflows",
"params": {
"count": 2
}
}
],
"max_points": 24
},
{
"key": "tests_present",
"name": "Tests present",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 24
},
{
"key": "linter_config",
"name": "Linter config",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 16
},
{
"key": "pre_commit_hooks",
"name": "Pre-commit hooks",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 9.6
},
{
"key": "editorconfig",
"name": ".editorconfig",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 6.4
},
{
"key": "openssf_scorecard_ci_tests",
"name": "OpenSSF Scorecard: CI-Tests",
"detail": "22 out of 24 merged PRs checked by a CI test -- score normalized to 9",
"points": 18,
"status": "partial",
"details": [],
"max_points": 20
}
]
},
{
"key": "documentation",
"band": "moderate",
"name": "Documentation",
"note": null,
"notes": [],
"value": 65,
"inputs": {
"topics": [
"landlock",
"linux",
"sandboxing",
"security"
],
"has_wiki": false,
"homepage": "https://crates.io/crates/landlock",
"has_readme": true,
"has_docs_dir": false,
"has_description": true
},
"components": [
{
"key": "readme",
"name": "README",
"detail": null,
"points": 30,
"status": "met",
"details": [],
"max_points": 30
},
{
"key": "documentation_directory",
"name": "Documentation directory",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 25
},
{
"key": "documentation_homepage_site",
"name": "Documentation / homepage site",
"detail": "https://crates.io/crates/landlock",
"points": 15,
"status": "met",
"details": [],
"max_points": 15
},
{
"key": "repository_description",
"name": "Repository description",
"detail": null,
"points": 10,
"status": "met",
"details": [],
"max_points": 10
},
{
"key": "topics",
"name": "Topics",
"detail": "4 topics",
"points": 10,
"status": "met",
"details": [
{
"code": "topics_count",
"params": {
"count": 4
}
}
],
"max_points": 10
},
{
"key": "wiki",
"name": "Wiki",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 10
}
]
}
],
"description": "Are baseline engineering and documentation practices in place?"
},
{
"key": "security",
"band": "moderate",
"name": "Security",
"value": 64,
"weight": 0.16,
"metrics": [
{
"key": "security_posture",
"band": "moderate",
"name": "Security posture",
"note": "Excluded from scoring (no data or not applicable): Branch-Protection, Packaging, Signed-Releases. Remaining weights renormalized.",
"notes": [
{
"code": "excluded_no_data",
"params": {
"components": [
"branch_protection",
"packaging",
"signed_releases"
]
}
},
{
"code": "weights_renormalized",
"params": {}
}
],
"value": 55,
"inputs": {
"source": "openssf_scorecard",
"checks_evaluated": 15,
"scorecard_version": "v5.5.0",
"checks_inconclusive": 3,
"scorecard_aggregate": 5.5
},
"components": [
{
"key": "binary_artifacts",
"name": "Binary-Artifacts",
"detail": "no binaries found in the repo",
"points": 7.5,
"status": "met",
"details": [],
"max_points": 7.5
},
{
"key": "branch_protection",
"name": "Branch-Protection",
"detail": "internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md",
"points": 0,
"status": "excluded",
"details": [
{
"code": "no_data",
"params": {}
}
],
"max_points": 7.5
},
{
"key": "ci_tests",
"name": "CI-Tests",
"detail": "22 out of 24 merged PRs checked by a CI test -- score normalized to 9",
"points": 2.2,
"status": "partial",
"details": [],
"max_points": 2.5
},
{
"key": "cii_best_practices",
"name": "CII-Best-Practices",
"detail": "no effort to earn an OpenSSF best practices badge detected",
"points": 0,
"status": "missed",
"details": [],
"max_points": 2.5
},
{
"key": "code_review",
"name": "Code-Review",
"detail": "Found 3/24 approved changesets -- score normalized to 1",
"points": 0.8,
"status": "partial",
"details": [],
"max_points": 7.5
},
{
"key": "contributors",
"name": "Contributors",
"detail": "project has 7 contributing companies or organizations",
"points": 2.5,
"status": "met",
"details": [],
"max_points": 2.5
},
{
"key": "dangerous_workflow",
"name": "Dangerous-Workflow",
"detail": "no dangerous workflow patterns detected",
"points": 10,
"status": "met",
"details": [],
"max_points": 10
},
{
"key": "dependency_update_tool",
"name": "Dependency-Update-Tool",
"detail": "no update tool detected",
"points": 0,
"status": "missed",
"details": [],
"max_points": 7.5
},
{
"key": "fuzzing",
"name": "Fuzzing",
"detail": "project is not fuzzed",
"points": 0,
"status": "missed",
"details": [],
"max_points": 5
},
{
"key": "license",
"name": "License",
"detail": "license file detected",
"points": 2.2,
"status": "partial",
"details": [],
"max_points": 2.5
},
{
"key": "maintained",
"name": "Maintained",
"detail": "17 commit(s) and 3 issue activity found in the last 90 days -- score normalized to 10",
"points": 7.5,
"status": "met",
"details": [],
"max_points": 7.5
},
{
"key": "packaging",
"name": "Packaging",
"detail": "packaging workflow not detected",
"points": 0,
"status": "excluded",
"details": [
{
"code": "no_data",
"params": {}
}
],
"max_points": 5
},
{
"key": "pinned_dependencies",
"name": "Pinned-Dependencies",
"detail": "dependency not pinned by hash detected -- score normalized to 0",
"points": 0,
"status": "missed",
"details": [],
"max_points": 5
},
{
"key": "sast",
"name": "SAST",
"detail": "SAST tool is not run on all commits -- score normalized to 0",
"points": 0,
"status": "missed",
"details": [],
"max_points": 5
},
{
"key": "security_policy",
"name": "Security-Policy",
"detail": "security policy file not detected",
"points": 0,
"status": "missed",
"details": [],
"max_points": 5
},
{
"key": "signed_releases",
"name": "Signed-Releases",
"detail": "no releases found",
"points": 0,
"status": "excluded",
"details": [
{
"code": "no_data",
"params": {}
}
],
"max_points": 7.5
},
{
"key": "token_permissions",
"name": "Token-Permissions",
"detail": "detected GitHub workflow tokens with excessive permissions",
"points": 6.8,
"status": "partial",
"details": [],
"max_points": 7.5
},
{
"key": "vulnerabilities",
"name": "Vulnerabilities",
"detail": "0 existing vulnerabilities detected",
"points": 7.5,
"status": "met",
"details": [],
"max_points": 7.5
}
]
},
{
"key": "dependency_advisories",
"band": "excellent",
"name": "Dependency advisories",
"note": "Excluded from scoring (no data or not applicable): No advisories left outstanding. Remaining weights renormalized. Matched the crates:landlock@0.4.6 runtime dependency closure — what installing the published package pulls in — 15 packages. Reachability is not analyzed.",
"notes": [
{
"code": "excluded_no_data",
"params": {
"components": [
"no_advisories_left_outstanding"
]
}
},
{
"code": "weights_renormalized",
"params": {}
},
{
"code": "advisories_scope_published",
"params": {
"package": "crates:landlock@0.4.6",
"assessed": 15
}
},
{
"code": "advisories_reachability",
"params": {}
}
],
"value": 100,
"inputs": {
"source": "osv",
"advisories": 0,
"affected_packages": 0,
"assessed_packages": 15,
"unassessed_packages": 0,
"affected_by_severity": "none",
"direct_affected_packages": 0
},
"components": [
{
"key": "direct_dependencies_free_of_known_advisories",
"name": "Direct dependencies free of known advisories",
"detail": "no direct dependency carries a known advisory",
"points": 35,
"status": "met",
"details": [
{
"code": "no_direct_advisories",
"params": {}
}
],
"max_points": 35
},
{
"key": "indirect_dependencies_free_of_known_advisories",
"name": "Indirect dependencies free of known advisories",
"detail": "no indirect dependency carries a known advisory",
"points": 25,
"status": "met",
"details": [
{
"code": "no_indirect_advisories",
"params": {}
}
],
"max_points": 25
},
{
"key": "no_advisories_left_outstanding",
"name": "No advisories left outstanding",
"detail": "no advisory carries a publication date",
"points": 0,
"status": "excluded",
"details": [
{
"code": "advisories_no_publication_date",
"params": {}
}
],
"max_points": 40
}
]
},
{
"key": "malicious_dependencies",
"band": "excellent",
"name": "Malicious dependencies",
"note": null,
"notes": [],
"value": 100,
"inputs": {
"source": "osv",
"meaning": "reported as a malicious package by the OpenSSF corpus; the remedy is removal or moving off the compromised name, never an upgrade of the same artifact. Versions the registry has since pulled are listed but not scored",
"packages": [],
"red_flag": false,
"assessed_packages": 15,
"malicious_packages": 0,
"direct_malicious_packages": 0,
"withdrawn_malicious_packages": 0,
"installable_malicious_packages": 0
},
"components": [
{
"key": "no_dependency_reported_as_a_malicious_package",
"name": "No dependency reported as a malicious package",
"detail": "no dependency is reported as a malicious package",
"points": 100,
"status": "met",
"details": [
{
"code": "no_malicious_dependencies",
"params": {}
}
],
"max_points": 100
}
]
},
{
"key": "high_risk_jurisdiction_exposure",
"band": "excellent",
"name": "High-Risk Jurisdiction Exposure",
"note": "Only high-confidence self-published location evidence affects this multiplier. Ambiguous matches are review-only; country evidence is not proof of nationality, citizenship, legal registration, malicious intent, or sanctions status.",
"notes": [
{
"code": "jurisdiction_evidence_limits",
"params": {}
}
],
"value": 100,
"inputs": {
"meaning": "self-published location evidence; not nationality or citizenship",
"red_flag": false,
"exposures": [],
"policy_countries": [
"Russia",
"Iran",
"North Korea"
],
"review_only_matches": 0,
"assessed_self_published_locations": 6
},
"components": [
{
"key": "policy_exposure_multiplier",
"name": "Policy exposure multiplier",
"detail": "no confirmed policy-scope location match",
"points": 100,
"status": "met",
"details": [
{
"code": "jurisdiction_no_match",
"params": {}
}
],
"max_points": 100
}
]
}
],
"description": "Are visible security and supply-chain practices strong, with no malicious dependency and no unresolved high-risk jurisdiction exposure?"
},
{
"key": "ai_readiness",
"band": "at_risk",
"name": "AI Readiness",
"value": 43,
"weight": 0,
"metrics": [
{
"key": "ai_agent_context",
"band": "at_risk",
"name": "Agent context & guidance",
"note": null,
"notes": [],
"value": 40,
"inputs": {
"has_llms_txt": false,
"legible_history_share": 1,
"agent_instruction_files": [],
"agent_instruction_max_bytes": null
},
"components": [
{
"key": "agent_instructions",
"name": "Agent instructions",
"detail": "no CLAUDE.md / AGENTS.md / editor rules",
"points": 0,
"status": "missed",
"details": [
{
"code": "no_agent_instructions",
"params": {}
}
],
"max_points": 45
},
{
"key": "machine_readable_docs_llms_txt",
"name": "Machine-readable docs (llms.txt)",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 15
},
{
"key": "legible_commit_history",
"name": "Legible commit history",
"detail": "100 of 100 human commits state their intent (structured subject or explanatory body)",
"points": 40,
"status": "met",
"details": [
{
"code": "legible_history",
"params": {
"legible": 100,
"sampled": 100
}
}
],
"max_points": 40
}
]
},
{
"key": "ai_verify_loop",
"band": "critical",
"name": "Verify loop (build / test / typecheck)",
"note": null,
"notes": [],
"value": 24,
"inputs": {
"has_nix": false,
"has_tests": false,
"lockfiles": [],
"has_dockerfile": false,
"typed_language": true,
"bootstrap_files": [],
"has_devcontainer": false,
"has_linter_config": false,
"typecheck_configs": [],
"agent_commit_share": 0,
"toolchain_manifests": [
"Cargo.toml"
],
"dependency_bot_commit_share": 0
},
"components": [
{
"key": "one_command_bootstrap",
"name": "One-command bootstrap",
"detail": "Cargo.toml (toolchain convention, no task runner)",
"points": 12.6,
"status": "partial",
"details": [
{
"code": "toolchain_convention",
"params": {
"files": "Cargo.toml"
}
}
],
"max_points": 18
},
{
"key": "automated_tests",
"name": "Automated tests",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 22
},
{
"key": "lint_format_config",
"name": "Lint / format config",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 11
},
{
"key": "static_type_checking",
"name": "Static type checking",
"detail": "Rust (statically typed)",
"points": 11,
"status": "met",
"details": [
{
"code": "statically_typed_language",
"params": {
"language": "Rust"
}
}
],
"max_points": 11
},
{
"key": "reproducible_environment",
"name": "Reproducible environment",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 10
},
{
"key": "demonstrated_agent_practice",
"name": "Demonstrated agent practice",
"detail": "no agent-authored commits among the last 100",
"points": 0,
"status": "missed",
"details": [
{
"code": "no_agent_authored_commits",
"params": {
"sampled": 100
}
}
],
"max_points": 10
},
{
"key": "automated_maintenance",
"name": "Automated maintenance",
"detail": "no automated dependency updates observed",
"points": 0,
"status": "missed",
"details": [
{
"code": "no_dependency_automation",
"params": {}
}
],
"max_points": 8
},
{
"key": "openssf_scorecard_pinned_dependencies",
"name": "OpenSSF Scorecard: Pinned-Dependencies",
"detail": "dependency not pinned by hash detected -- score normalized to 0",
"points": 0,
"status": "missed",
"details": [],
"max_points": 10
}
]
},
{
"key": "ai_code_legibility",
"band": "excellent",
"name": "Code legibility for models",
"note": null,
"notes": [],
"value": 100,
"inputs": {
"primary_language": "Rust",
"largest_source_bytes": 54053,
"source_files_sampled": 17,
"oversized_source_files": 0
},
"components": [
{
"key": "type_checkable_code",
"name": "Type-checkable code",
"detail": "Rust (statically typed)",
"points": 45,
"status": "met",
"details": [
{
"code": "statically_typed_language",
"params": {
"language": "Rust"
}
}
],
"max_points": 45
},
{
"key": "manageable_file_sizes",
"name": "Manageable file sizes",
"detail": "0/17 source files over 60KB",
"points": 55,
"status": "met",
"details": [
{
"code": "oversized_source_files",
"params": {
"kb": 60,
"sampled": 17,
"oversized": 0
}
}
],
"max_points": 55
}
]
},
{
"key": "ai_interfaces",
"band": "at_risk",
"name": "Machine-readable interfaces",
"note": null,
"notes": [],
"value": 40,
"inputs": {
"example_dirs": [
"examples"
],
"has_mcp_signal": false,
"api_schema_files": []
},
"components": [
{
"key": "api_schema_openapi_graphql_proto",
"name": "API schema (OpenAPI/GraphQL/proto)",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 40
},
{
"key": "mcp_server",
"name": "MCP server",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 20
},
{
"key": "runnable_examples",
"name": "Runnable examples",
"detail": "examples",
"points": 40,
"status": "met",
"details": [
{
"code": "file_list",
"params": {
"files": "examples"
}
}
],
"max_points": 40
}
]
}
],
"description": "How well is the repo equipped to be developed and maintained with AI coding agents? An independent, experimental badge — weight 0.0, so it is surfaced on its own and does not affect the overall health score."
}
],
"metrics_version": "1.13.0"
},
"warnings": [
"Star history unavailable: GitHub GraphQL error: Resource not accessible by personal access token"
],
"report_type": "repository",
"generated_at": "2026-07-26T20:45:42.026326Z",
"schema_version": "0.27.0",
"badge_url": "https://raw.githubusercontent.com/inspect-software/badges/main/v1/l/landlock-lsm/rust-landlock.svg",
"full_name": "landlock-lsm/rust-landlock",
"license_state": "custom",
"license_spdx": null
}
Registros relacionados
Repositorios inspeccionados que comparten etiquetas de catálogo o ecosistemas con landlock-lsm/rust-landlock. Leer en paralelo →
Las puntuaciones son señales, no garantías. Reflejan prácticas públicamente visibles en GitHub; no son una auditoría de código ni una garantía de seguridad.
Los datos ausentes se excluyen y los pesos se renormalizan; nunca se puntúan como cero. La metodología es versionada y abierta: métricas v1.13.0, esquema v0.27.0 — metodología completa · wiki de métricas.
