RustCrypto/sponges holds a health index of 34 out of 100, placing it in the At Risk band. It scores highest on Sustainability & Governance (72/100) and lowest on Vitality (35/100). It was last updated today. A single contributor accounts for most of its recent work.
34
overall / 100
At Risk
Software health index
Metrics are grouped into weighted categories on one standardized 1–100 scale. Overall starts as their weighted mean, calibrated against the distribution of the public record so bands carry percentile meaning; when public evidence triggers the High-Risk Jurisdiction Policy, the rating is adjusted and receives an At Risk ceiling of 34.
34
Exceptional93-100The record's top tier (≈ top 5%); essentially all checked criteria met
Excellent80-92Strong across the board; minor gaps
Good65-79Healthy; gaps are limited and manageable
Moderate50-64Acceptable with notable gaps; review recommended
Weak35-49Material weaknesses across several areas
At Risk20-34Significant weaknesses; adoption warrants caution
Critical1-19Severe problems (abandoned, single-maintainer, no hygiene)
Score profile
Each axis is a category. The shape matters more than the average — a healthy subject fills the whole shape, while a spike-and-crater profile means strength in one dimension is masking risk in another.
The weighted overall 53 is calibrated to 54 on the published index scale (record calibration 2026-08-02). High-Risk Jurisdiction Policy applies a 75% multiplier to weighted overall health and gives it an At Risk ceiling of 34.
Based on self-published public profile locations. This governance signal does not determine nationality, citizenship, intent, sanctions status, or individual trustworthiness.
Excluded from scoring (no data or not applicable): signed_releases. Remaining weights renormalized. High-Risk Jurisdiction Policy applies a 75% multiplier and gives Security posture an At risk ceiling of 34.
Direct dependencies free of known advisories — no direct dependency carries a known advisory
0/25
Indirect dependencies free of known advisories — transitive set not separable from development and test dependencies in this scope
0/40
No advisories left outstanding — no advisory carries a publication date
Inputs used
source
osv
advisories
0
affected_packages
0
assessed_packages
5
unassessed_packages
4
affected_by_severity
none
direct_affected_packages
0
Excluded from scoring (no data or not applicable): Indirect dependencies free of known advisories, No advisories left outstanding. Remaining weights renormalized. Matched 5 resolved dependencies against OSV. 4 could not be assessed — no resolved version, an unsupported ecosystem, or beyond the reported package list. This repository publishes no package the index resolves, so the repository dependency graph was assessed instead. That graph mixes development and test pins with shipped dependencies, so only the declared runtime dependencies are scored; transitive findings are reported as context and excluded from the score. Reachability is not analyzed.
How well is the repo equipped to be developed and maintained with AI coding agents? Carries a deliberately small weight (4%): agent tooling is a real maintenance signal, but a repository with none can still reach 100/100.
Manageable file sizes — 0/16 source files over 60KB
Inputs used
primary_language
Rust
largest_source_bytes
6,229
source_files_sampled
16
oversized_source_files
0
Key facts
55GitHub stars
12contributors
31commits, last 12 months
0days since last push
0releases
1bus factor
1open issues
crates.iopackage ecosystems
Data collection warnings
Star history unavailable: GitHub GraphQL error: Resource not accessible by personal access token
Could not fetch crates package 'benches' from its registry
More detail
Star and fork history 0 ★ / 21 ⇿
0Stars
21Forks
When each star and fork was added, collected from GitHub and bucketed by day. Cumulative growth sits directly above the daily additions it is made of, so the two read against each other: steady organic accretion looks nothing like an abrupt, short-lived burst. Where that difference is measurable, it is reported as growth authenticity.
Each point covers 7 days.
OpenSSF Scorecard 5.2 / 10
5.2aggregate
Independent, tool-agnostic security assessment from the open-source OpenSSF Scorecard. Each check rewards a security practice, not a specific vendor's tool. Checks Scorecard could not determine are marked n/a and excluded from the security score (never counted as zero).Scorecard v5.5.0 · 2026-08-06 04:30 UTC
Full resolved dependency set from the GitHub dependency graph: 4 direct and 5 indirect (transitive) packages. The transitive closure is complete when the repository commits a lockfile.
Registry
Package
Version
Relation
crates.io
cfg-if
—
direct
crates.io
cfg-if
1.0.4
direct
crates.io
hybrid-array
—
direct
crates.io
hybrid-array
0.4.14
direct
crates.io
cpufeatures
—
indirect
crates.io
cpufeatures
0.3.0
indirect
crates.io
criterion
—
indirect
crates.io
libc
0.2.189
indirect
crates.io
typenum
1.20.1
indirect
Dependency advisories 0
This repository publishes no package the index resolves, so its own dependency graph was assessed — 5 packages, which also include development and test pins that never ship: 0 carry known advisories, of which 0 are direct. 4 could not be assessed — no resolved version, an unsupported ecosystem, or beyond the reported package list.
No known advisories affect the assessed dependencies.
An advisory means the version recorded in the dependency graph falls inside an advisory’s affected range. Reachability is not analysed, and the graph includes development and test pins — a finding may concern tooling rather than shipped software.
Raw JSON report machine-readable
{
"data": {
"icon": {
"bytes": 9514,
"width": 256,
"height": 256,
"rejected": [
{
"url": "https://docs.rs/ascon/badge.svg",
"reason": "too small (86x20)",
"source_type": "readme"
},
{
"url": "https://docs.rs/bash-f/badge.svg",
"reason": "too small (86x20)",
"source_type": "readme"
},
{
"url": "https://docs.rs/keccak/badge.svg",
"reason": "too small (86x20)",
"source_type": "readme"
}
],
"collected": true,
"media_type": "image/png",
"source_url": "https://avatars.githubusercontent.com/u/22351541?v=4&s=256",
"source_type": "avatar",
"content_hash": "d70841902c8918c706b639f20a699a2927da266dd437f3ff7e68d4e0dd9a9f00",
"candidates_considered": 4
},
"repo": {
"topics": [],
"is_fork": false,
"size_kb": 202,
"has_wiki": false,
"homepage": null,
"languages": {
"Rust": 40132
},
"pushed_at": "2026-08-05T13:02:19Z",
"created_at": "2018-03-21T11:18:14Z",
"owner_type": "Organization",
"updated_at": "2026-08-06T03:46:40Z",
"description": "Collection of sponge functions written in pure Rust",
"is_archived": false,
"is_disabled": false,
"license_spdx": null,
"default_branch": "master",
"license_spdx_raw": null,
"primary_language": "Rust",
"significant_languages": [
"Rust"
]
},
"owner": {
"blog": null,
"name": "Rust Crypto",
"type": "Organization",
"login": "RustCrypto",
"company": null,
"location": null,
"followers": 2346,
"avatar_url": "https://avatars.githubusercontent.com/u/22351541?v=4",
"created_at": "2016-09-21T16:57:12Z",
"is_verified": null,
"public_repos": 40,
"account_age_days": 3605
},
"license": {
"state": "absent",
"spdx_id": null,
"raw_spdx": null,
"file_present": false,
"scorecard_found": false,
"profile_has_license": false
},
"activity": {
"releases": [],
"recent_commits": [
{
"oid": "13b709c25386f4a66ea524d07ace5857110c8a4d",
"body": "### Fixed\n- Warning on softfloat AArch64 targets by not enabling `aarch64_sha3`\nbackend on them ([#126])\n\n[#126]: https://github.com/RustCrypto/sponges/pull/126",
"is_bot": false,
"headline": "Release keccak v0.2.1 (#127)",
"author_name": "Artyom Pavlov",
"author_login": "newpavlov",
"committed_at": "2026-08-05T13:01:58Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "50f28e01489cf196ba35255e94d5f61726f3955e",
"body": "…(#126)",
"is_bot": false,
"headline": "keccak: disable `aarch64_sha3` backend on targets with softfloat ABI …",
"author_name": "Artyom Pavlov",
"author_login": "newpavlov",
"committed_at": "2026-08-05T12:53:48Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "f0863a4bee808b421224f2bdbec4a640cc1d4389",
"body": "### Changed\n- Edition changed to 2024 and MSRV bumped to 1.85 ([#89])\n- Improved performance of permutations ([#118])\n- Replaced the `State` struct with free-standing permutation functions\n([#122])\n\n### Removed\n- `zeroize` crate feature ([#122])\n\n[#89]: https://github.com/RustCrypto/sponges/pull/89\n[#118]: https://github.com/RustCrypto/sponges/pull/118\n[#122]: https://github.com/RustCrypto/sponges/pull/122",
"is_bot": false,
"headline": "Release ascon v0.5.0 (#123)",
"author_name": "Artyom Pavlov",
"author_login": "newpavlov",
"committed_at": "2026-04-22T15:32:33Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "c8caab973a54571cf5f3d70db67d57b54b848a88",
"body": null,
"is_bot": false,
"headline": "Tweak root README (#124)",
"author_name": "Artyom Pavlov",
"author_login": "newpavlov",
"committed_at": "2026-04-22T15:31:13Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "e2ac1d1f96de3fdf74db4cb000b219d73ef54666",
"body": "Simplifies the code and focuses it only on permutations.",
"is_bot": false,
"headline": "ascon: refactor implementation (#122)",
"author_name": "Artyom Pavlov",
"author_login": "newpavlov",
"committed_at": "2026-04-20T14:41:52Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "54f6e435935e980b1bb2e6d413dc7046a06201cf",
"body": null,
"is_bot": false,
"headline": "Tweak license files (#121)",
"author_name": "Artyom Pavlov",
"author_login": "newpavlov",
"committed_at": "2026-04-20T14:00:51Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "35a53705239cb1854ea62136a4e8a316de901686",
"body": "Use a slightly different substitution implementation that is slightly\nmore efficient. This does require that the function is now strictly\nseparated in the three layers.",
"is_bot": false,
"headline": "ascon: improve performance of permutation (#118)",
"author_name": "Gusted",
"author_login": "Gusted",
"committed_at": "2026-04-20T12:33:21Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "6004289dde16db873c143518ced222d9608b1a83",
"body": null,
"is_bot": false,
"headline": "benches: update criterion, tweak code (#120)",
"author_name": "Artyom Pavlov",
"author_login": "newpavlov",
"committed_at": "2026-04-20T12:29:18Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "8b2c41b0d22a70a2250519587040f90aa491af57",
"body": "### Added\n- `keccak_backend` configuration parameter with `aarch64_sha3`,\n`simd128`,\n `simd256`, `simd512`, and `soft` values ([#105], [#106], [#113])\n- `Keccak` struct with a closure-based API for a more efficient access\nto\n supported backends ([#113])\n\n### Changed\n- Edition changed to 2024 and M\n[…]\nhub.com/RustCrypto/sponges/pull/105\n[#106]: https://github.com/RustCrypto/sponges/pull/106\n[#112]: https://github.com/RustCrypto/sponges/pull/112\n[#113]: https://github.com/RustCrypto/sponges/pull/113",
"is_bot": false,
"headline": "Release `keccak` v0.2.0 (#117)",
"author_name": "Artyom Pavlov",
"author_login": "newpavlov",
"committed_at": "2026-03-16T00:24:48Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "609b63ecbf09e45959a37b859da1ed23bdf59d4d",
"body": "…act\"` (#116)\n\nThis would allow to extend configuration knobs for the software backend\nin future and would be more consisted with potential similar knobs for\nother backends.",
"is_bot": false,
"headline": "keccak: replace `keccak_soft_compact` with `keccak_backend_soft=\"comp…",
"author_name": "Artyom Pavlov",
"author_login": "newpavlov",
"committed_at": "2026-03-15T21:00:06Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "d96c7f3733a09606699d8dde7aeb67a1065a1a3d",
"body": "See https://github.com/RustCrypto/meta/issues/22",
"is_bot": false,
"headline": "Use the standard order of `[package]` fields (#115)",
"author_name": "Artyom Pavlov",
"author_login": "newpavlov",
"committed_at": "2026-03-12T01:17:45Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "1efeff7d020d75275fd03f3168a702feae7c8b4f",
"body": "The new API provides a better way for exposing support for parallel\nprocessing in implemented backends and resolves the issue with branching\non each application of a Keccak permutation.",
"is_bot": false,
"headline": "keccak: refactor to a closure-based API (#113)",
"author_name": "Artyom Pavlov",
"author_login": "newpavlov",
"committed_at": "2026-03-06T13:07:46Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "806d446c414a8662c42b03d9746dd15778782e22",
"body": "Rewrites the inline assembly implementation using an equivalent (but not\nidentical) intrinsics implementation. Also exposes support for computing\ntwo Keccak states in parallel which a previous comment in the ASM\nimplementation noted was possible but wasn't actually exposed, and is\nnow available as `\n[…]\n5 ns/iter (+/- 45.62) = 851 MB/s\ntest shake256_10000 ... bench: 11,659.19 ns/iter (+/- 330.23) = 857 MB/s\n\nThe performance seems pretty close to the original assembly, maybe just\nslightly slower.",
"is_bot": false,
"headline": "keccak: convert ARMv8 ASM into intrinsics (#112)",
"author_name": "Tony Arcieri",
"author_login": "tarcieri",
"committed_at": "2026-02-28T00:36:55Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "cf29ae32c6189b631986a674dc8fdef0443eada3",
"body": null,
"is_bot": false,
"headline": "keccak v0.2.0-rc.2 (#111)",
"author_name": "Tony Arcieri",
"author_login": "tarcieri",
"committed_at": "2026-02-26T17:56:38Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "38d10d219450dae3c2d4506f7b2ce13e6eb32f63",
"body": "Extracts a struct to hold the state for Keccak-p1600/Keccak-f1600, along\nwith a CPU feature detection `InitToken` which is queried at the time\nthe state is initialized.\n\nThe previous `p1600`/`f1600` functions with CPU feature detection\nsupport have been factored onto this struct, leaving the softwar\n[…]\nCPU feature detection on each invocation of the\npermutation.\n\nIt looks like it should be possible to slot a struct like this into\nsomething like `Sha3HasherCore` in place of its current `state` array.",
"is_bot": false,
"headline": "keccak: extract `Keccak1600` struct with CPU feature detection (#107)",
"author_name": "Tony Arcieri",
"author_login": "tarcieri",
"committed_at": "2026-02-17T19:33:46Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "9dc0b8d9504649acf2fb48acc12f9d9227f17127",
"body": "Replaces these non-additive \"features\" with a 1-of-n backend selection\nenabled by using `cfg` instead.\n\n- `asm` => `--cfg keccak_backend=\"armv8_asm\"`\n- `simd` => `--cfg keccak_backend=\"simd\"`\n\nCloses #85",
"is_bot": false,
"headline": "keccak: replace `asm`/`simd` features with `--cfg keccak_backend` (#106)",
"author_name": "Tony Arcieri",
"author_login": "tarcieri",
"committed_at": "2026-02-13T23:04:57Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "a1be08a7428b0d2068c007d7d044cb39981c2b8d",
"body": "The following crates now have a new `cfg` for backend selection:\n- `ascon`: `--cfg ascon_backend=\"soft-compact\"`\n- `keccak`: `--cfg keccak_backend=\"soft-compact\"`\n\nThis replaces the previous crate features, as suggested in #85",
"is_bot": false,
"headline": "Replace `no_unroll` feature(s) with `soft-compact` cfg (#105)",
"author_name": "Tony Arcieri",
"author_login": "tarcieri",
"committed_at": "2026-02-13T19:00:57Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "b27e9bff49e3fb70e3d3c8527248b6e2fb6a84ac",
"body": "Released in #103",
"is_bot": false,
"headline": "keccak: add CHANGELOG.md entry for v0.1.6 (#104)",
"author_name": "Tony Arcieri",
"author_login": "tarcieri",
"committed_at": "2026-02-13T18:31:51Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "7ac1920198ebb7d0192e6d2c3581e15b38a6e0e5",
"body": "We pass in `state.as_mut_ptr()` as `x0`, which was previously marked as\n`in`. However, it's modified in the `asm!`, e.g.:\n\n sub x0, x0, #192\n\nNote: it's also post-incremented by `ld1.1d` as state is loaded.\n\nSince it's modified, it needs to be `inout`. This marks it as such,\nusing the `=> _` syntax to discard the result, then it's reset, then\nmodified as state is written).\n\nSimilar mutations were occurring with `x1` and `x8` as well, which have\nbeen modified accordingly.",
"is_bot": false,
"headline": "keccak: ARMv8 `asm!` cleanups (#101)",
"author_name": "Tony Arcieri",
"author_login": "tarcieri",
"committed_at": "2026-02-13T14:29:27Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "239ff349af233819ecb1319e35f6fbc6b128da37",
"body": null,
"is_bot": false,
"headline": "Add Trusted Publishing Config (#102)",
"author_name": "Tony Arcieri",
"author_login": "tarcieri",
"committed_at": "2026-02-13T02:20:35Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "0d9bf82ee588e87c71aa974770fae4f1bd2ad466",
"body": "Uses the same config from other repos (e.g. `traits`, `utils`)",
"is_bot": false,
"headline": "Add workspace-level `clippy` config (#100)",
"author_name": "Tony Arcieri",
"author_login": "tarcieri",
"committed_at": "2026-02-12T22:01:09Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "c3a9ef249ea22cefebc258ffa0c221faa147a507",
"body": null,
"is_bot": false,
"headline": "keccak: bump `cpufeatures` to v0.3 (#99)",
"author_name": "Tony Arcieri",
"author_login": "tarcieri",
"committed_at": "2026-02-12T19:20:53Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "d0c9b2a828e5033644178c70ec981424d968cc61",
"body": null,
"is_bot": false,
"headline": "keccak v0.2.0-rc.1 (#98)",
"author_name": "Tony Arcieri",
"author_login": "tarcieri",
"committed_at": "2026-01-22T18:10:05Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "4519b3bcb980042302ca5375672bdbd00e00319d",
"body": "Also fixes a warning for the ARMv8 `asm!` backend:\n\nerror[E0133]: use of inline assembly is unsafe and requires unsafe block\n --> keccak/src/armv8.rs:8:5\n |\n8 | / core::arch::asm!(\"\n9 | | // Read state\n10 | | ld1.1d {{ v0- v3}}, [x0], #32\n11 | | ld1.1d {{ v4- v\n[…]\n: `-D unsafe-op-in-unsafe-fn` implied by `-D warnings`\n = help: to override `-D warnings` add `#[allow(unsafe_op_in_unsafe_fn)]`\n\nFor more information about this error, try `rustc --explain E0133`.",
"is_bot": false,
"headline": "keccak: test `asm` feature in CI (#97)",
"author_name": "Tony Arcieri",
"author_login": "tarcieri",
"committed_at": "2026-01-22T18:05:24Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "2d857d196b6c93e760d2a03572f959138d177aa9",
"body": "Uses the native `macos-latest` runner.\n\nI'm curious if this reproduces a warning I'm seeing locally.",
"is_bot": false,
"headline": "keccak: test on `aarch64-apple-darwin` (#96)",
"author_name": "Tony Arcieri",
"author_login": "tarcieri",
"committed_at": "2026-01-22T17:52:27Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "b7f87707eec4df29248a6d5201a687e1cc6ad56e",
"body": null,
"is_bot": false,
"headline": "bash-f: tweak benchmarks (#94)",
"author_name": "Artyom Pavlov",
"author_login": "newpavlov",
"committed_at": "2025-10-23T22:59:24Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "868527a13c056672660cc99d6f4015c56bfea8af",
"body": null,
"is_bot": false,
"headline": "bash-f: minor tweaks (#93)",
"author_name": "Artyom Pavlov",
"author_login": "newpavlov",
"committed_at": "2025-10-23T22:26:08Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "4d778574a6f154fa11f22e276f49ba3473faa4e5",
"body": null,
"is_bot": false,
"headline": "Add `bash-f` (STB 34.101.77-2020) (#92)",
"author_name": "Alexandr Kitaev",
"author_login": "makavity",
"committed_at": "2025-10-23T21:49:57Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "f205d0efbbfcc35e91b331cc3b4d4672ed56ecd8",
"body": null,
"is_bot": false,
"headline": "Use `doc_cfg` in place of removed `doc_auto_cfg` feature (#91)",
"author_name": "qj",
"author_login": "qrnch-jan",
"committed_at": "2025-10-05T20:13:30Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "95a176c25ba135cc3ca3a195b41ca41091fb0187",
"body": "Releases the following:\n- `ascon` v0.5.0-rc.0\n- `keccak` v0.2.0-rc.0",
"is_bot": false,
"headline": "Cut new prereleases (#90)",
"author_name": "Tony Arcieri",
"author_login": "tarcieri",
"committed_at": "2025-09-03T02:15:00Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "2bc1c383a4e472e3832d36e38d63de4c2e90dcc5",
"body": null,
"is_bot": false,
"headline": "Upgrade to Rust 2024 edition; MSRV 1.85 (#89)",
"author_name": "Tony Arcieri",
"author_login": "tarcieri",
"committed_at": "2025-09-03T02:09:23Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "13e501fa4e9b7d23c550a53f75e27ec291afc32a",
"body": null,
"is_bot": false,
"headline": "Update Cargo.lock",
"author_name": "Артём Павлов [Artyom Pavlov]",
"author_login": "newpavlov",
"committed_at": "2025-01-25T15:38:04Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "e47d6337ffc315247c785bb7addf259ff70d12c7",
"body": null,
"is_bot": false,
"headline": "Update Cargo.lock (#83)",
"author_name": "Artyom Pavlov",
"author_login": "newpavlov",
"committed_at": "2024-11-22T06:46:14Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "710788be9ebfc12f6d384459692b05b7f42cb71a",
"body": null,
"is_bot": false,
"headline": "Bump MSRV to 1.81 (#84)",
"author_name": "Artyom Pavlov",
"author_login": "newpavlov",
"committed_at": "2024-11-22T06:43:18Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "5902ea6e378313f64f2eafaf687b59cac1e95f1a",
"body": null,
"is_bot": true,
"headline": "build(deps): bump cpufeatures from 0.2.14 to 0.2.15 (#81)",
"author_name": "dependabot[bot]",
"author_login": "dependabot[bot]",
"committed_at": "2024-11-12T14:49:19Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "7a6ee9c1f14dc8d137a37ab4a61a559340308728",
"body": null,
"is_bot": false,
"headline": "keccak_p: improve efficiency of Theta phase (#80)",
"author_name": "Thomas Coratger",
"author_login": "tcoratger",
"committed_at": "2024-09-23T05:28:11Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "7b7196894d3655600e24d235a77bb869a006c892",
"body": null,
"is_bot": true,
"headline": "build(deps): bump cpufeatures from 0.2.12 to 0.2.14 (#79)",
"author_name": "dependabot[bot]",
"author_login": "dependabot[bot]",
"committed_at": "2024-09-09T12:09:25Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "c2b25b65cac0e5a4a98d497f7e5c7a21ed246a33",
"body": null,
"is_bot": false,
"headline": "README.md(s): use img.shields.io crate version badges",
"author_name": "Tony Arcieri",
"author_login": "tarcieri",
"committed_at": "2024-09-05T01:48:50Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "a30ba7775c252f9464d2f61ee318dd9b6f7707f6",
"body": "This tweaks the `repository` fields in Cargo metadata in order to use the correct (i.e. git clonable) URL.\r\nThe existing GitHub webUI URLs for each package have been retained and moved to `homepage` fields.",
"is_bot": false,
"headline": "cargo: point `repository` metadata to clonable URLs (#77)",
"author_name": "Luca Bruno",
"author_login": "lucab",
"committed_at": "2024-06-10T13:48:30Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "3c63bd4e6c359dffd435b5d81ee20f7100497e6a",
"body": "This is possible now that we've bumped `ascon`'s MSRV to 1.60",
"is_bot": false,
"headline": "Cargo.lock: bump `zeroize` to v1.8.1 (#76)",
"author_name": "Tony Arcieri",
"author_login": "tarcieri",
"committed_at": "2024-06-05T14:05:33Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "8ef2e47617dfa10192b7b4c18345e75870c0e4d3",
"body": null,
"is_bot": false,
"headline": "ascon: MSRV 1.60 (#75)",
"author_name": "Sebastian Ramacher",
"author_login": "sebastinas",
"committed_at": "2024-06-01T18:37:24Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "b82fdb2121273fdb8ae18e641fb7da8cb7808031",
"body": "Bumps [actions/cache](https://github.com/actions/cache) from 3 to 4.\r\n- [Release notes](https://github.com/actions/cache/releases)\r\n- [Changelog](https://github.com/actions/cache/blob/main/RELEASES.md)\r\n- [Commits](https://github.com/actions/cache/compare/v3...v4)\r\n\r\n---\r\nupdated-dependencies:\r\n- de\n[…]\n:production\r\n update-type: version-update:semver-major\r\n...\r\n\r\nSigned-off-by: dependabot[bot] <support@github.com>\r\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
"is_bot": true,
"headline": "build(deps): bump actions/cache from 3 to 4 (#72)",
"author_name": "dependabot[bot]",
"author_login": "dependabot[bot]",
"committed_at": "2024-01-22T13:42:42Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "b67665f9bb592329c17e711fb92aed8a245e1046",
"body": null,
"is_bot": false,
"headline": "keccak v0.2.0-pre.0 (#71)",
"author_name": "Tony Arcieri",
"author_login": "tarcieri",
"committed_at": "2024-01-16T19:13:55Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "8b74c7fc1a0f387b861e67111634d5216df8afb2",
"body": null,
"is_bot": false,
"headline": "ascon/Cargo.toml: rust -> Rust",
"author_name": "Tony Arcieri",
"author_login": "tarcieri",
"committed_at": "2024-01-16T19:11:08Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "7675b171ad78d552d909e8399faf2ea362354704",
"body": "`keccak` was previously excluded from the toplevel workspace due to its\r\nMSRV of 1.41 and incompatibilities with packages used by `ascon`.\r\n\r\nThis bumps the edition, changes the version to `0.2.0-pre` to denote it\r\ncontains breaking changes (though this is not intended to be a\r\n`0.2.0-pre` release), and bumps MSRV.\r\n\r\nWith the MSRV bumped, `keccak` can and has been re-added to the toplevel\r\nworkspace.",
"is_bot": false,
"headline": "keccak: 2021 edition upgrade; MSRV 1.60 (#70)",
"author_name": "Tony Arcieri",
"author_login": "tarcieri",
"committed_at": "2024-01-12T21:45:05Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "40c50c16410392439e2ac4ee0286285db479a106",
"body": null,
"is_bot": false,
"headline": "keccak v0.1.5 (#69)",
"author_name": "Tony Arcieri",
"author_login": "tarcieri",
"committed_at": "2024-01-12T18:30:01Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "2dc13bf92e6a20b7342aab54f5124495415d697d",
"body": null,
"is_bot": false,
"headline": "keccak: enable asm backend for p1600 (#68)",
"author_name": "Coda Hale",
"author_login": "codahale",
"committed_at": "2024-01-09T19:41:20Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "a3a4e01607500af1542cb9c5ebfcc7374d051935",
"body": "This reverts commit 3a9a29ef77f4718b6a385d08779d098dded51ef7.\r\n\r\nThis update is higher than the current Ascon MSRV and broke the build",
"is_bot": false,
"headline": "Revert \"Update Cargo.lock\" (#67)",
"author_name": "Tony Arcieri",
"author_login": "tarcieri",
"committed_at": "2023-12-09T21:46:16Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "3a9a29ef77f4718b6a385d08779d098dded51ef7",
"body": null,
"is_bot": false,
"headline": "Update Cargo.lock",
"author_name": "Артём Павлов [Artyom Pavlov]",
"author_login": "newpavlov",
"committed_at": "2023-11-18T12:32:47Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "9e4f6bc6954fe4301b6d4367867177d220f09bd3",
"body": "It requires `nightly`, whereas the tests are run under `stable`.\r\n\r\nThe `simd` feature itself is already tested in the `test-simd` job.",
"is_bot": false,
"headline": "keccak: don't test `simd` feature in `minimal-versions` workflow (#66)",
"author_name": "Tony Arcieri",
"author_login": "tarcieri",
"committed_at": "2023-11-18T12:31:51Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "329d4cdcb19d77658267367e8e3ce49e2e91c64e",
"body": null,
"is_bot": false,
"headline": "Replace cross tests with MIRI (#63)",
"author_name": "Artyom Pavlov",
"author_login": "newpavlov",
"committed_at": "2023-09-12T14:19:27Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "48cc4acf38bd5b88acf96599dd50d0fc91a13a3a",
"body": "Bumps [actions/checkout](https://github.com/actions/checkout) from 3 to 4.\r\n- [Release notes](https://github.com/actions/checkout/releases)\r\n- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md)\r\n- [Commits](https://github.com/actions/checkout/compare/v3...v4)\r\n\r\n---\r\nupdated-dep\n[…]\n:production\r\n update-type: version-update:semver-major\r\n...\r\n\r\nSigned-off-by: dependabot[bot] <support@github.com>\r\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
"is_bot": true,
"headline": "build(deps): bump actions/checkout from 3 to 4 (#61)",
"author_name": "dependabot[bot]",
"author_login": "dependabot[bot]",
"committed_at": "2023-09-11T14:58:53Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "651a34ea2f97a9cd8ace1a63cbf9118009fa4167",
"body": "`mips-unknown-linux-gnu` is now a Tier 3 target: rust-lang/rust#115218.\r\n\r\nThis means we can't use it for cross tests anymore since std is no\r\nlonger built for it.\r\n\r\nThis commit replaces it with `powerpc-unknown-linux-gnu`, a big endian\r\nTier 2 target.",
"is_bot": false,
"headline": "keccak: replace CI tests on MIPS with PPC32 (#62)",
"author_name": "Tony Arcieri",
"author_login": "tarcieri",
"committed_at": "2023-09-11T14:39:33Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "4730c6fbba0b7a0766cb1a6d323f1412667eb6cf",
"body": null,
"is_bot": false,
"headline": "benches: remove criterion deps workaround (#60)",
"author_name": "Artyom Pavlov",
"author_login": "newpavlov",
"committed_at": "2023-08-19T16:24:47Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "690624016ec82683bcfbf4ced931e68afe29fc73",
"body": null,
"is_bot": false,
"headline": "Pin Clippy version and fix lints (#59)",
"author_name": "Artyom Pavlov",
"author_login": "newpavlov",
"committed_at": "2023-08-07T14:36:22Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "aa5da2013e123c33e6aaba7b00d1a3e1eb41f6cb",
"body": null,
"is_bot": false,
"headline": "ascon v0.4.0 (#58)",
"author_name": "Sebastian Ramacher",
"author_login": "sebastinas",
"committed_at": "2023-07-27T20:09:49Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "e767312a21655183eec230d8ab0ecf6882cf2133",
"body": "Not zeroizing the state allows to recover any squeezed output. This is\r\nbecause the `ascon` permutations can be inversed. Hence, access to the\r\ncomplete state allows to perform this operation.",
"is_bot": false,
"headline": "ascon: Add Drop & ZeroizeOnDrop for State (#57)",
"author_name": "Alexander Wagner",
"author_login": "aewag",
"committed_at": "2023-05-23T13:10:15Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "7cdccabc7ab31801ac7d9a12551be0634f8e558c",
"body": null,
"is_bot": false,
"headline": "keccak v0.1.4 (#56)",
"author_name": "Tony Arcieri",
"author_login": "tarcieri",
"committed_at": "2023-05-04T17:12:22Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "6e512a3b1ad215a992532740124568a67c72988f",
"body": "Due to the generics approach of the keccak_p routine, the performance\r\ndegrades significantly. To encounter this the commonly used functions\r\nare now defined by macros.",
"is_bot": false,
"headline": "keccak: Add keccak_p fns for [200, 400, 800, 1600] (#55)",
"author_name": "Alexander Wagner",
"author_login": "aewag",
"committed_at": "2023-04-30T16:25:27Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "5eab159369e9429b22f17dc27c307b76c003911d",
"body": null,
"is_bot": false,
"headline": "Add SECURITY.md",
"author_name": "Tony Arcieri",
"author_login": "tarcieri",
"committed_at": "2023-04-24T02:02:13Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "9932b6b9cafd807e0e99d9c7dd3abb62cde1a53b",
"body": null,
"is_bot": false,
"headline": "README.md: fix \"Keccak\" link",
"author_name": "Tony Arcieri",
"author_login": "tarcieri",
"committed_at": "2023-04-07T13:54:39Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "c90f1be21713a81a7cfad8c679deb91af0af0979",
"body": "Helps with discovery of the other crates and their relationships",
"is_bot": false,
"headline": "ascon: link to `ascon-aead` and `ascon-hash` in README.md (#54)",
"author_name": "Tony Arcieri",
"author_login": "tarcieri",
"committed_at": "2023-04-03T21:49:13Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "4b0b454d4a8c9dbb8b3d3eef845b1d129276f61d",
"body": "Basically all of the `actions-rs/*` actions are unmaintained. See\r\n<https://github.com/actions-rs/toolchain/issues/216> for more\r\ninformation. Due to their age they generate several warnings in\r\nCI runs.\r\n\r\nTo get rid of those warnings the occurrences of\r\n`actions-rs/toolchain` are replaced by `dtolnay/rust-toolchain`,\r\nand the occurrences of `actions-rs/cargo` are replaced by direct\r\ninvocations of `cargo`.",
"is_bot": false,
"headline": "Replace unmaintained actions-rs/* actions in CI workflows (#53)",
"author_name": "Dirk Stolle",
"author_login": "striezel",
"committed_at": "2023-03-24T14:53:47Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "c48f3310d9787e5506343f9c97645667e377e147",
"body": null,
"is_bot": false,
"headline": "ascon v0.3.1 (#52)",
"author_name": "Sebastian Ramacher",
"author_login": "sebastinas",
"committed_at": "2023-03-19T15:40:52Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "fc88ab5cc368cd1c2bb811a99a33c038886bfdb9",
"body": "* ascon: make tests compatible with Rust 1.56\r\n\r\n* ascon: drop MSRV to 1.56\r\n\r\nMSRV was raised for `ascon` in c8b07a46c86b240d3ce9c5e75a4f23117a874e19.\r\nAfter the merge of `ascon-core`, 1.56 provides all required features.",
"is_bot": false,
"headline": "ascon: drop MSRV to 1.56 (#51)",
"author_name": "Sebastian Ramacher",
"author_login": "sebastinas",
"committed_at": "2023-03-19T15:23:24Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "633777a1c9ee8763b0970350d75ec9a2e5760807",
"body": null,
"is_bot": false,
"headline": "ascon v0.3.0 (#50)",
"author_name": "Sebastian Ramacher",
"author_login": "sebastinas",
"committed_at": "2023-03-17T14:45:49Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "3e38152a4ad8b4464b189efbebc3be78c07798b6",
"body": "Originally from https://github.com/sebastinas/ascon-aead/tree/main/ascon-core",
"is_bot": false,
"headline": "ascon: replace implementation with `ascon-core` (#49)",
"author_name": "Sebastian Ramacher",
"author_login": "sebastinas",
"committed_at": "2023-03-12T15:25:14Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "d8f8fbca7dfb146c82558ff87070f5207a2a43cc",
"body": "Bumps [subtle](https://github.com/dalek-cryptography/subtle) from 2.4.1 to 2.5.0.\r\n- [Release notes](https://github.com/dalek-cryptography/subtle/releases)\r\n- [Changelog](https://github.com/dalek-cryptography/subtle/blob/main/CHANGELOG.md)\r\n- [Commits](https://github.com/dalek-cryptography/subtle/co\n[…]\n:production\r\n update-type: version-update:semver-minor\r\n...\r\n\r\nSigned-off-by: dependabot[bot] <support@github.com>\r\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
"is_bot": true,
"headline": "build(deps): bump subtle from 2.4.1 to 2.5.0 (#46)",
"author_name": "dependabot[bot]",
"author_login": "dependabot[bot]",
"committed_at": "2023-03-11T21:36:52Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "dc103866d4d9c51ca4e2b1fb4b2f659d7f687f4d",
"body": null,
"is_bot": false,
"headline": "ascon: use `chunks_exact_mut` for encoding permutation output (#48)",
"author_name": "Artyom Pavlov",
"author_login": "newpavlov",
"committed_at": "2023-03-01T10:37:39Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "17519f46c6eb8df7bfa83b109f03433176d96b1a",
"body": null,
"is_bot": false,
"headline": "ascon: use `chunks_exact` for decoding permutation input (#47)",
"author_name": "Tony Arcieri",
"author_login": "tarcieri",
"committed_at": "2023-02-28T21:09:08Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "a3906aab4892a821e1a72e9aee45b8ed7bd5a1ef",
"body": null,
"is_bot": false,
"headline": "ascon v0.2.0 (#45)",
"author_name": "Tony Arcieri",
"author_login": "tarcieri",
"committed_at": "2023-02-26T04:12:23Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "c8b07a46c86b240d3ce9c5e75a4f23117a874e19",
"body": "Impls the standard AEAD API from the `aead` crate.\r\n\r\nEventually we can split this API out into a separate crate, e.g.\r\n`ascon-aead`, but for now this just gets things working initially.\r\n\r\nUses weak/namespaced features which requires MSRV 1.60.",
"is_bot": false,
"headline": "ascon: use `aead` crate for AEAD API; MSRV 1.60 (#44)",
"author_name": "Tony Arcieri",
"author_login": "tarcieri",
"committed_at": "2023-02-26T03:48:50Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "11cb7366da7bef43b2cfc2b09d93b0286b036c7c",
"body": "Adds a type alias for Ascon nonces, set to `[u8; 16]`.\r\n\r\nFrom the Ascon paper section 2.4:\r\n\r\nhttps://link.springer.com/article/10.1007/s00145-021-09398-9\r\n\r\n> The 320-bit initial state of Ascon is formed by the secret key K of\r\n> k bits and nonce N of 128 bits",
"is_bot": false,
"headline": "ascon: add `Nonce` type alias (#43)",
"author_name": "Tony Arcieri",
"author_login": "tarcieri",
"committed_at": "2023-02-26T02:23:59Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "37bc65830655ed97ce4e36f8f34d057942fb9c4e",
"body": "- Adds a type alias for Ascon keys (16-byte)\r\n- Stores key internally in `struct Ascon` so it doesn't need to be\r\n passed separately to `Ascon::finalize`.",
"is_bot": false,
"headline": "ascon: `Key` type alias; cache key in `Ascon` state (#42)",
"author_name": "Tony Arcieri",
"author_login": "tarcieri",
"committed_at": "2023-02-26T02:00:09Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "8773f6a963a0100fff2636612380aa49fddf282e",
"body": "The build is failing because `keccak` has a very old MSRV of 1.41, which\r\nafter merging #40 (which bumped the `ascon` edition to 2021) broke the\r\nbuild because it can't handle the `edition` key.\r\n\r\nAs a workaround, this excludes `keccak` from the toplevel workspace so\r\nit doesn't try to read the `ascon` edition key.\r\n\r\nSeparately, we should probably bump the `keccak` edition to 2021 as well\r\nand release `keccak` v0.2.0, but that is left for future work.",
"is_bot": false,
"headline": "CI: exclude `keccak` from toplevel workspace (#41)",
"author_name": "Tony Arcieri",
"author_login": "tarcieri",
"committed_at": "2023-02-26T00:59:40Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "2a71bae6b2dfca73728da2c5c9f80b4d9cb04ae6",
"body": "Since #39 bumped MSRV to 1.59, we can go ahead and do a 2021 edition\r\nupgrade, including README.md in the toplevel rustdoc.",
"is_bot": false,
"headline": "ascon: 2021 edition (#40)",
"author_name": "Tony Arcieri",
"author_login": "tarcieri",
"committed_at": "2023-02-26T00:36:18Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "8eb14719c0ac88c70cb211e9e1d1154d8e1420ab",
"body": "Adds a struct which wraps the permutation state, using const generics as\r\nwell as `feature(const_generics_defaults)` to express the `A`/`B`\r\nparameters for `Ascon(a,b)`.",
"is_bot": false,
"headline": "ascon: extract `Ascon` permutation type; MSRV 1.59 (#39)",
"author_name": "Tony Arcieri",
"author_login": "tarcieri",
"committed_at": "2023-02-26T00:08:19Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "d50fca63d26e92b39213b0bd3791dba5c03b951b",
"body": "Factors the `u8` <-> `u64` conversions to be inline",
"is_bot": false,
"headline": "ascon: eliminate `util` module (#38)",
"author_name": "Tony Arcieri",
"author_login": "tarcieri",
"committed_at": "2023-02-25T23:36:54Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "6de759ac156a787eb3a89ea807df27590d810542",
"body": "We can use the support in `core` instead",
"is_bot": false,
"headline": "ascon: remove `byteorder` dependency (#37)",
"author_name": "Tony Arcieri",
"author_login": "tarcieri",
"committed_at": "2023-02-25T22:49:52Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "e4c0b56c7c9f95ec5906aeb176f25936c02737a3",
"body": "The permutation does not have any `std`/`alloc` dependency.\r\n\r\nThe current AEAD interface requires `alloc` (though we should migrate it\r\nto use the `aead` crate anyway).",
"is_bot": false,
"headline": "ascon: add `no_std` support (#36)",
"author_name": "Tony Arcieri",
"author_login": "tarcieri",
"committed_at": "2023-02-11T19:28:02Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "ace9dd7723e3d1e58658d3d6242e8f6f6cfe2a0a",
"body": "Provides raw access to the Ascon permutation, allowing it to be used for\r\nmore things than just AEAD.",
"is_bot": false,
"headline": "ascon: expose permutation (#35)",
"author_name": "Tony Arcieri",
"author_login": "tarcieri",
"committed_at": "2023-02-11T19:12:58Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "2e113f5f964000f3dcec681dcdff80904a300bff",
"body": "- Bumps the crate's edition to 2018, which is MSRV-compatible\r\n- Adds a more expansive set of lints\r\n- Adds the `missing_docs` lint, and adds docs where missing",
"is_bot": false,
"headline": "ascon: 2018 edition upgrade, lints, docs (#34)",
"author_name": "Tony Arcieri",
"author_login": "tarcieri",
"committed_at": "2023-02-11T18:54:59Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "5831f8bd51b0539c7e9bdc9c9a2d1be62e49b1f5",
"body": "- Bumps the crate's edition to 2018, which is MSRV-compatible.\r\n- Adds a more expansive set of lints\r\n- Adds the `missing_docs` lint, and adds docs where missing\r\n- Fixes tests on ARMv8",
"is_bot": false,
"headline": "keccak: 2018 edition upgrade, lints, docs (#32)",
"author_name": "Tony Arcieri",
"author_login": "tarcieri",
"committed_at": "2023-02-11T18:40:15Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "88c73ff02b1bf2bc5512dd6466de72a4fff436b0",
"body": null,
"is_bot": false,
"headline": "README.md: add `ascon` (#33)",
"author_name": "Tony Arcieri",
"author_login": "tarcieri",
"committed_at": "2023-02-11T18:35:18Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "75b1918ee9c6dce1ed66b37dc403dcce3adac2d7",
"body": "Follows our standard README.md template",
"is_bot": false,
"headline": "ascon: new README.md (#31)",
"author_name": "Tony Arcieri",
"author_login": "tarcieri",
"committed_at": "2023-02-11T18:05:08Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "dac6767968bacf4fa73fb7a7b8c3cc73f01b34b1",
"body": "Imports the source code of the `ascon` crate originally from:\r\n\r\nhttps://github.com/quininer/ascon\r\n\r\nCode is imported as of this commit:\r\n\r\n commit 997e51ff0cad48510ad31934f9c361d25bf5f938\r\n Author: quininer kel <quininer@live.com>\r\n Date: Mon Feb 20 09:52:28 2017 +0800\r\n\r\n refact\n[…]\nd 2023-02-07)\r\n\r\nDual licensed as Apache 2.0 + MIT\r\n\r\nPermission given here:\r\n\r\nhttps://github.com/RustCrypto/sponges/pull/30#discussion_r1103554334\r\n\r\nCo-authored-by: quininer kel <quininer@live.com>",
"is_bot": false,
"headline": "ascon: import crate sources (#30)",
"author_name": "Tony Arcieri",
"author_login": "tarcieri",
"committed_at": "2023-02-11T17:34:01Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "2d2be3511ab9810d0c34632036255067e085d36b",
"body": "The previously CC0-licensed public domain code has been relicensed as Apache 2.0 + MIT\r\n\r\nCloses #29",
"is_bot": false,
"headline": "keccak: delete original CC0 license",
"author_name": "Tony Arcieri",
"author_login": "tarcieri",
"committed_at": "2022-12-10T19:50:13Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "6c98ff8396cd1410a6045d6abdd70f2d4dedfd31",
"body": null,
"is_bot": false,
"headline": "keccak v0.1.3 (#28)",
"author_name": "Tony Arcieri",
"author_login": "tarcieri",
"committed_at": "2022-11-14T19:30:19Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "d82151aa0d6264cf0dfbc3a54427a56ed9dfa504",
"body": "As discussed in #24",
"is_bot": false,
"headline": "keccak: remove `f1600_armv8_sha3_asm` re-export (#27)",
"author_name": "Tony Arcieri",
"author_login": "tarcieri",
"committed_at": "2022-11-14T18:06:04Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "6bd1a6d0abb20b6051ef1109b0ad073b67242a89",
"body": "Include the target architecture and feature in the name of the function.",
"is_bot": false,
"headline": "keccak: rename `f1600_armv8_sha3_asm` (#26)",
"author_name": "Tony Arcieri",
"author_login": "tarcieri",
"committed_at": "2022-11-14T03:56:27Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "4e36eefaa0f8729fed1101f85bc491218ef556ad",
"body": "This is more consistent with the other crates we have which implement\r\nARMv8 intrinsics, such as the `aes` and `polyal` crates.",
"is_bot": false,
"headline": "keccak: rename `aarch64_sha3` module to `armv8` (#25)",
"author_name": "Tony Arcieri",
"author_login": "tarcieri",
"committed_at": "2022-11-13T22:32:07Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "a687839512adf1cf7e8261a8bf8f31ca29b2c301",
"body": "Gates `asm` support under a crate feature.\r\n\r\nUses the `cpufeatures` crate to detect the presence of the `sha3`\r\nextension for ARMv8 CPUs, automatically falling back to a software\r\nimplementation if it isn't available.\r\n\r\nWhen the `asm` feature is enabled on `aarch64` targets, exposes\r\n`f1600_asm` that relies on ARMv8 `sha3` hardware intrinsics.",
"is_bot": false,
"headline": "keccak: add `asm` feature; use `cpufeatures` on `aarch64` (#24)",
"author_name": "Tony Arcieri",
"author_login": "tarcieri",
"committed_at": "2022-11-13T22:15:26Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "b2d1e84abf731120e8c049d9d816bec64550fb4e",
"body": null,
"is_bot": false,
"headline": "keccak: add `aarch64` asm intrinsics implementation keccak_f1600 (#23)",
"author_name": "Remco Bloemen",
"author_login": "recmo",
"committed_at": "2022-11-01T16:08:45Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "b68b313ee2632a51477e0a370259926e178f29b7",
"body": null,
"is_bot": false,
"headline": "Update actions used in GitHub Actions workflows to newest version (#19)",
"author_name": "Dirk Stolle",
"author_login": "striezel",
"committed_at": "2022-10-06T00:12:39Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "5cac553c05ce7be0251771e4f11439bb3f5a3c3f",
"body": null,
"is_bot": false,
"headline": "Extend Dependabot configuration to keep GitHub Actions up to date (#20)",
"author_name": "Dirk Stolle",
"author_login": "striezel",
"committed_at": "2022-10-06T00:12:22Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "b59a4d5aa93725dfa7d3ebcba2dbf79db97f621b",
"body": null,
"is_bot": false,
"headline": "keccak v0.1.2 (#18)",
"author_name": "Tony Arcieri",
"author_login": "tarcieri",
"committed_at": "2022-05-24T23:53:43Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "0901b5f42061c44c4f782f058fa280824de3be3a",
"body": null,
"is_bot": false,
"headline": "Add description of features and remove the dependencies section (#17)",
"author_name": "Artyom Pavlov",
"author_login": "newpavlov",
"committed_at": "2022-05-24T23:22:02Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "f31b4b6eee3424d5e606e59515c4900c109128b1",
"body": null,
"is_bot": false,
"headline": "Use portable_simd instead of deprecate packed_simd (#16)",
"author_name": "Alexander Wagner",
"author_login": "aewag",
"committed_at": "2022-05-24T23:07:32Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "5ec2be15381786b8673134ecbe8c7329dcb36c5d",
"body": null,
"is_bot": false,
"headline": "keccak v0.1.1 (#15)",
"author_name": "Tony Arcieri",
"author_login": "tarcieri",
"committed_at": "2022-05-24T22:35:18Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "79780c5df3f94dd9d0291f7ffe4ec20013240e21",
"body": "Was previously CC0 (i.e. public domain)\r\n\r\nCloses #5",
"is_bot": false,
"headline": "keccak: relicense as Apache 2.0 + MIT (#14)",
"author_name": "Tony Arcieri",
"author_login": "tarcieri",
"committed_at": "2022-05-24T22:05:47Z",
"body_truncated": false,
"is_coding_agent": false
}
],
"releases_count": 0,
"commits_last_year": 31,
"latest_release_at": null,
"latest_release_tag": null,
"releases_from_tags": false,
"days_since_last_push": 0,
"active_weeks_last_year": 10,
"days_since_latest_release": null,
"mean_days_between_releases": null
},
"artifacts": {
"collected": true,
"structure": [
"tree.cargo_lib"
],
"declarations": [
{
"name": null,
"path": "Cargo.toml",
"tokens": [
"cargo.workspace"
],
"ecosystem": "crates"
},
{
"name": "ascon",
"path": "ascon/Cargo.toml",
"tokens": [
"cargo.category:cryptography",
"cargo.category:no-std"
],
"ecosystem": "crates"
},
{
"name": "bash-f",
"path": "bash-f/Cargo.toml",
"tokens": [
"cargo.category:cryptography",
"cargo.category:no-std"
],
"ecosystem": "crates"
},
{
"name": "benches",
"path": "benches/Cargo.toml",
"tokens": [
"cargo.publish_false",
"cargo.workspace"
],
"ecosystem": "crates"
},
{
"name": "keccak",
"path": "keccak/Cargo.toml",
"tokens": [
"cargo.category:cryptography",
"cargo.category:no-std"
],
"ecosystem": "crates"
}
]
},
"community": {
"has_readme": true,
"has_license": false,
"readme_badges": {
"hosts": [
"shields.io"
],
"total": 3,
"header": 0,
"collected": true,
"has_inspect_badge": false
},
"has_description": true,
"has_contributing": false,
"health_percentage": 37,
"has_issue_template": false,
"has_code_of_conduct": false,
"has_pull_request_template": false
},
"ecosystem": {
"packages": [
{
"name": "ascon",
"exists": true,
"license": "Apache-2.0 OR MIT",
"keywords": [
"ascon",
"crypto",
"permutation",
"cryptography",
"no-std"
],
"ecosystem": "crates",
"categories": [
"cryptography",
"no-std"
],
"matches_repo": true,
"registry_url": "https://crates.io/crates/ascon",
"declared_type": null,
"is_deprecated": false,
"latest_version": "0.5.0",
"repository_url": "https://github.com/RustCrypto/sponges",
"versions_count": 11,
"total_downloads": 222867,
"dependents_count": null,
"deprecation_note": null,
"maintainers_count": null,
"monthly_downloads": 4550,
"first_published_at": "2016-07-22T10:27:32.477700Z",
"latest_published_at": "2026-04-22T15:33:20.075106Z",
"latest_version_yanked": false,
"days_since_latest_publish": 105
},
{
"name": "bash-f",
"exists": true,
"license": "Apache-2.0 OR MIT",
"keywords": [
"bash",
"belt",
"permutation",
"sponge",
"cryptography",
"no-std"
],
"ecosystem": "crates",
"categories": [
"cryptography",
"no-std"
],
"matches_repo": true,
"registry_url": "https://crates.io/crates/bash-f",
"declared_type": null,
"is_deprecated": false,
"latest_version": "0.1.0",
"repository_url": "https://github.com/RustCrypto/sponges",
"versions_count": 1,
"total_downloads": 13531,
"dependents_count": null,
"deprecation_note": null,
"maintainers_count": null,
"monthly_downloads": 1576,
"first_published_at": "2025-10-23T22:26:24.300911Z",
"latest_published_at": "2025-10-23T22:26:24.300911Z",
"latest_version_yanked": false,
"days_since_latest_publish": 286
},
{
"name": "keccak",
"exists": true,
"license": "Apache-2.0 OR MIT",
"keywords": [
"crypto",
"keccak",
"keccak-f",
"keccak-p",
"sponge",
"cryptography",
"no-std"
],
"ecosystem": "crates",
"categories": [
"cryptography",
"no-std"
],
"matches_repo": true,
"registry_url": "https://crates.io/crates/keccak",
"declared_type": null,
"is_deprecated": false,
"latest_version": "0.2.1",
"repository_url": "https://github.com/RustCrypto/sponges",
"versions_count": 14,
"total_downloads": 134875871,
"dependents_count": null,
"deprecation_note": null,
"maintainers_count": null,
"monthly_downloads": 10444806,
"first_published_at": "2018-03-19T15:38:15.485407Z",
"latest_published_at": "2026-08-05T13:03:04.261567Z",
"latest_version_yanked": false,
"days_since_latest_publish": 0
}
]
},
"popularity": {
"forks": 21,
"stars": 55,
"watchers": 7,
"fork_history": {
"days": [
{
"date": "2019-06-15",
"count": 1
},
{
"date": "2019-07-11",
"count": 1
},
{
"date": "2020-08-04",
"count": 1
},
{
"date": "2021-12-23",
"count": 1
},
{
"date": "2022-10-29",
"count": 1
},
{
"date": "2023-03-10",
"count": 1
},
{
"date": "2024-05-31",
"count": 1
},
{
"date": "2024-06-10",
"count": 1
},
{
"date": "2024-08-05",
"count": 1
},
{
"date": "2024-09-22",
"count": 1
},
{
"date": "2025-01-24",
"count": 1
},
{
"date": "2025-02-21",
"count": 1
},
{
"date": "2025-05-17",
"count": 1
},
{
"date": "2025-05-28",
"count": 1
},
{
"date": "2025-10-03",
"count": 1
},
{
"date": "2025-10-22",
"count": 1
},
{
"date": "2026-01-23",
"count": 1
},
{
"date": "2026-03-22",
"count": 1
},
{
"date": "2026-05-01",
"count": 1
},
{
"date": "2026-06-19",
"count": 1
},
{
"date": "2026-06-23",
"count": 1
}
],
"complete": true,
"collected": 21,
"total_forks": 21
},
"star_history": null,
"open_issues_and_prs": 1
},
"ai_readiness": {
"has_nix": false,
"example_dirs": [],
"has_llms_txt": false,
"has_dockerfile": false,
"has_mcp_signal": false,
"bootstrap_files": [],
"api_schema_files": [],
"has_devcontainer": false,
"typecheck_configs": [],
"toolchain_manifests": [
"Cargo.toml",
"ascon/Cargo.toml",
"bash-f/Cargo.toml",
"benches/Cargo.toml",
"keccak/Cargo.toml"
],
"largest_source_bytes": 6229,
"source_files_sampled": 16,
"oversized_source_files": 0,
"agent_instruction_files": [],
"agent_instruction_max_bytes": null
},
"dependencies": {
"manifests": [
"Cargo.toml",
"ascon/Cargo.toml",
"bash-f/Cargo.toml",
"benches/Cargo.toml",
"keccak/Cargo.toml"
],
"advisories": {
"error": null,
"scope": "repository_graph",
"source": "osv",
"findings": [],
"collected": true,
"malicious": [],
"truncated": false,
"by_severity": {},
"advisory_count": 0,
"affected_count": 0,
"assessed_count": 5,
"malicious_count": 0,
"assessed_package": null,
"unassessed_count": 4,
"direct_affected_count": 0
},
"ecosystems": [
"crates"
],
"dependencies": [
{
"name": "cfg-if",
"manifest": "keccak/Cargo.toml",
"ecosystem": "crates",
"version_constraint": "1"
},
{
"name": "hybrid-array",
"manifest": "keccak/Cargo.toml",
"ecosystem": "crates",
"version_constraint": "0.4"
}
],
"all_dependencies": {
"error": null,
"source": "github-sbom",
"packages": [
{
"name": "cfg-if",
"direct": true,
"version": null,
"ecosystem": "crates"
},
{
"name": "cfg-if",
"direct": true,
"version": "1.0.4",
"ecosystem": "crates"
},
{
"name": "hybrid-array",
"direct": true,
"version": null,
"ecosystem": "crates"
},
{
"name": "hybrid-array",
"direct": true,
"version": "0.4.14",
"ecosystem": "crates"
},
{
"name": "cpufeatures",
"direct": false,
"version": null,
"ecosystem": "crates"
},
{
"name": "cpufeatures",
"direct": false,
"version": "0.3.0",
"ecosystem": "crates"
},
{
"name": "criterion",
"direct": false,
"version": null,
"ecosystem": "crates"
},
{
"name": "libc",
"direct": false,
"version": "0.2.189",
"ecosystem": "crates"
},
{
"name": "typenum",
"direct": false,
"version": "1.20.1",
"ecosystem": "crates"
}
],
"collected": true,
"truncated": false,
"total_count": 9,
"direct_count": 4,
"indirect_count": 5
}
},
"maintainership": {
"issues": {
"open_prs": 0,
"merged_prs": 101,
"open_issues": 1,
"closed_ratio": 0.909,
"closed_issues": 10,
"closed_unmerged_prs": 14
},
"bus_factor": 1,
"bot_contributors": 1,
"top_contributors": [
{
"type": "User",
"login": "tarcieri",
"commits": 57,
"avatar_url": "https://avatars.githubusercontent.com/u/797?v=4"
},
{
"type": "User",
"login": "newpavlov",
"commits": 32,
"avatar_url": "https://avatars.githubusercontent.com/u/329626?v=4"
},
{
"type": "User",
"login": "aewag",
"commits": 9,
"avatar_url": "https://avatars.githubusercontent.com/u/15267977?v=4"
},
{
"type": "User",
"login": "sebastinas",
"commits": 6,
"avatar_url": "https://avatars.githubusercontent.com/u/114613?v=4"
},
{
"type": "User",
"login": "striezel",
"commits": 3,
"avatar_url": "https://avatars.githubusercontent.com/u/20865852?v=4"
},
{
"type": "User",
"login": "makavity",
"commits": 1,
"avatar_url": "https://avatars.githubusercontent.com/u/5614215?v=4"
},
{
"type": "User",
"login": "codahale",
"commits": 1,
"avatar_url": "https://avatars.githubusercontent.com/u/207?v=4"
},
{
"type": "User",
"login": "Gusted",
"commits": 1,
"avatar_url": "https://avatars.githubusercontent.com/u/25481501?v=4"
},
{
"type": "User",
"login": "lucab",
"commits": 1,
"avatar_url": "https://avatars.githubusercontent.com/u/98086?v=4"
},
{
"type": "User",
"login": "recmo",
"commits": 1,
"avatar_url": "https://avatars.githubusercontent.com/u/4532328?v=4"
}
],
"contributors_sampled": 12,
"top_contributor_share": 0.5
},
"quality_signals": {
"has_ci": true,
"has_tests": true,
"ci_workflows": [
"ascon.yml",
"bash-f.yml",
"keccak.yml",
"publish.yml",
"security-audit.yml",
"workspace.yml"
],
"has_docs_dir": false,
"linter_configs": [],
"has_editorconfig": false,
"has_linter_config": false,
"has_precommit_config": false
},
"security_signals": {
"lockfiles": [
"Cargo.lock"
],
"scorecard": {
"checks": [
{
"name": "Binary-Artifacts",
"score": 10,
"reason": "no binaries found in the repo",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#binary-artifacts"
},
{
"name": "Branch-Protection",
"score": 0,
"reason": "branch protection not enabled on development/release branches",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#branch-protection"
},
{
"name": "CI-Tests",
"score": 9,
"reason": "29 out of 30 merged PRs checked by a CI test -- score normalized to 9",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#ci-tests"
},
{
"name": "CII-Best-Practices",
"score": 0,
"reason": "no effort to earn an OpenSSF best practices badge detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#cii-best-practices"
},
{
"name": "Code-Review",
"score": 3,
"reason": "Found 9/30 approved changesets -- score normalized to 3",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#code-review"
},
{
"name": "Contributors",
"score": 10,
"reason": "project has 17 contributing companies or organizations",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#contributors"
},
{
"name": "Dangerous-Workflow",
"score": 10,
"reason": "no dangerous workflow patterns detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#dangerous-workflow"
},
{
"name": "Dependency-Update-Tool",
"score": 10,
"reason": "update tool detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#dependency-update-tool"
},
{
"name": "Fuzzing",
"score": 0,
"reason": "project is not fuzzed",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#fuzzing"
},
{
"name": "License",
"score": 0,
"reason": "license file not detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#license"
},
{
"name": "Maintained",
"score": 2,
"reason": "2 commit(s) and 1 issue activity found in the last 90 days -- score normalized to 2",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#maintained"
},
{
"name": "Packaging",
"score": 10,
"reason": "packaging workflow detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#packaging"
},
{
"name": "Pinned-Dependencies",
"score": 0,
"reason": "dependency not pinned by hash detected -- score normalized to 0",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#pinned-dependencies"
},
{
"name": "SAST",
"score": 0,
"reason": "SAST tool is not run on all commits -- score normalized to 0",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#sast"
},
{
"name": "Security-Policy",
"score": 10,
"reason": "security policy file detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#security-policy"
},
{
"name": "Signed-Releases",
"score": null,
"reason": "no releases found",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#signed-releases"
},
{
"name": "Token-Permissions",
"score": 0,
"reason": "detected GitHub workflow tokens with excessive permissions",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#token-permissions"
},
{
"name": "Vulnerabilities",
"score": 10,
"reason": "0 existing vulnerabilities detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#vulnerabilities"
}
],
"commit": "13b709c25386f4a66ea524d07ace5857110c8a4d",
"ran_at": "2026-08-06T04:30:57Z",
"aggregate_score": 5.2,
"scorecard_version": "v5.5.0"
},
"has_codeql_workflow": false,
"has_security_policy": true,
"has_dependabot_config": true
},
"contribution_flow": {
"collected": true,
"recent_prs": {
"merged_7d": 2,
"decided_7d": 2,
"merged_30d": 2,
"authors_30d": 1,
"decided_30d": 2,
"sample_size": 60,
"window_days": 30,
"sample_exhausted": false,
"authors_probed_30d": 1,
"newcomer_merged_30d": 0,
"bot_prs_excluded_30d": 0,
"newcomer_authors_30d": 0,
"newcomer_decided_30d": 0
},
"ci_last_run_at": "2026-08-05T13:03:08Z",
"oldest_open_prs": [],
"last_merged_pr_at": "2026-08-05T13:01:58Z",
"ci_last_conclusion": "SUCCESS",
"oldest_open_issues": [
{
"number": 108,
"created_at": "2026-02-14T00:38:41Z",
"last_comment_at": "2026-02-25T23:40:04Z",
"last_comment_author": "tarcieri"
}
]
}
},
"config": {
"disabled_metrics": [],
"disabled_categories": [],
"disabled_components": {}
},
"source": {
"url": "https://github.com/RustCrypto/sponges",
"host": "github.com",
"name": "sponges",
"owner": "RustCrypto"
},
"metrics": {
"overall": {
"key": "overall",
"band": "at_risk",
"name": "Overall health",
"note": "The weighted overall 53 is calibrated to 54 on the published index scale (record calibration 2026-08-02). High-Risk Jurisdiction Policy applies a 75% multiplier to weighted overall health and gives it an At Risk ceiling of 34.",
"notes": [
{
"code": "overall_calibration",
"params": {
"raw": 53,
"calibrated": 54,
"calibration": "2026-08-02"
}
},
{
"code": "jurisdiction_overall_adjustment",
"params": {
"cap": 34,
"pct": 75
}
}
],
"value": 34,
"inputs": {
"security": 47,
"vitality": 35,
"community": 51,
"governance": 72,
"calibration": "2026-08-02",
"engineering": 56,
"ai_readiness": 62,
"weighted_overall_raw": 53,
"high_risk_jurisdiction_cap": 34,
"high_risk_jurisdiction_multiplier": 75,
"weighted_overall_before_jurisdiction": 54,
"overall_after_jurisdiction_multiplier": 40
},
"components": []
},
"categories": [
{
"key": "vitality",
"band": "weak",
"name": "Vitality",
"value": 35,
"weight": 0.21,
"metrics": [
{
"key": "development_activity",
"band": "moderate",
"name": "Development activity",
"note": null,
"notes": [],
"value": 58,
"inputs": {
"commits_last_year": 31,
"human_commit_share": 0.95,
"days_since_last_push": 0,
"active_weeks_last_year": 10
},
"components": [
{
"key": "push_recency",
"name": "Push recency",
"detail": "last push 0 days ago",
"points": 36,
"status": "met",
"details": [
{
"code": "push_recency",
"params": {
"days": 0
}
}
],
"max_points": 36
},
{
"key": "commit_cadence",
"name": "Commit cadence",
"detail": "10/52 weeks with commits",
"points": 6.9,
"status": "partial",
"details": [
{
"code": "commit_cadence_weeks",
"params": {
"weeks": 10
}
}
],
"max_points": 36
},
{
"key": "commit_volume",
"name": "Commit volume",
"detail": "31 commits in the last year",
"points": 13.5,
"status": "partial",
"details": [
{
"code": "commits_last_year",
"params": {
"count": 31
}
}
],
"max_points": 18
},
{
"key": "openssf_scorecard_maintained",
"name": "OpenSSF Scorecard: Maintained",
"detail": "2 commit(s) and 1 issue activity found in the last 90 days -- score normalized to 2",
"points": 2,
"status": "partial",
"details": [],
"max_points": 10
}
]
},
{
"key": "release_discipline",
"band": "critical",
"name": "Release discipline",
"note": "Excluded from scoring (no data or not applicable): OpenSSF Scorecard: Signed-Releases. Remaining weights renormalized.",
"notes": [
{
"code": "excluded_no_data",
"params": {
"components": [
"openssf_scorecard_signed_releases"
]
}
},
{
"code": "weights_renormalized",
"params": {}
}
],
"value": 1,
"inputs": {
"releases_count": 0
},
"components": [
{
"key": "ships_releases",
"name": "Ships releases",
"detail": "no releases published",
"points": 0,
"status": "missed",
"details": [
{
"code": "no_releases_published",
"params": {}
}
],
"max_points": 27
},
{
"key": "release_recency",
"name": "Release recency",
"detail": "no releases",
"points": 0,
"status": "missed",
"details": [
{
"code": "no_releases",
"params": {}
}
],
"max_points": 36
},
{
"key": "release_cadence",
"name": "Release cadence",
"detail": "no releases",
"points": 0,
"status": "missed",
"details": [
{
"code": "no_releases",
"params": {}
}
],
"max_points": 27
},
{
"key": "openssf_scorecard_signed_releases",
"name": "OpenSSF Scorecard: Signed-Releases",
"detail": "no releases found",
"points": 0,
"status": "excluded",
"details": [
{
"code": "no_data",
"params": {}
}
],
"max_points": 10
}
]
},
{
"key": "abandonment",
"band": "exceptional",
"name": "Abandonment",
"note": null,
"notes": [],
"value": 100,
"inputs": {
"cap": null,
"state": "maintained",
"guards": [],
"signals": [],
"red_flag": false,
"multiplier_pct": 100,
"declared_reason": null,
"unverified_reason": null,
"unanswered_open_prs": null,
"unanswered_open_issues": null,
"days_since_last_merged_pr": null,
"days_since_last_human_commit": 0,
"days_since_last_human_commit_is_floor": false
},
"components": [
{
"key": "project_is_still_maintained",
"name": "Project is still maintained",
"detail": "last human commit 0 days ago",
"points": 100,
"status": "met",
"details": [
{
"code": "abandonment_maintained",
"params": {
"days": 0
}
}
],
"max_points": 100
}
]
}
],
"description": "Is the project alive — is code being written and are releases shipping?"
},
{
"key": "community",
"band": "moderate",
"name": "Community & Adoption",
"value": 51,
"weight": 0.17,
"metrics": [
{
"key": "popularity",
"band": "weak",
"name": "Popularity & adoption",
"note": null,
"notes": [],
"value": 43,
"inputs": {
"forks": 21,
"stars": 55,
"watchers": 7,
"growth_state": "unverified",
"growth_factor_pct": 100,
"growth_unverified_reason": "no_history"
},
"components": [
{
"key": "stars",
"name": "Stars",
"detail": "55 stars",
"points": 28.1,
"status": "partial",
"details": [
{
"code": "stars",
"params": {
"count": 55
}
}
],
"max_points": 60
},
{
"key": "forks",
"name": "Forks",
"detail": "21 forks",
"points": 10.8,
"status": "partial",
"details": [
{
"code": "forks",
"params": {
"count": 21
}
}
],
"max_points": 25
},
{
"key": "watchers",
"name": "Watchers",
"detail": "7 watchers",
"points": 4.3,
"status": "partial",
"details": [
{
"code": "watchers",
"params": {
"count": 7
}
}
],
"max_points": 15
}
]
},
{
"key": "community_health",
"band": "at_risk",
"name": "Community health",
"note": null,
"notes": [],
"value": 25,
"inputs": {
"has_readme": true,
"has_license": false,
"readme_badges": 3,
"has_contributing": false,
"has_issue_template": false,
"has_code_of_conduct": false,
"readme_badge_services": [
"shields.io"
],
"has_pull_request_template": false
},
"components": [
{
"key": "readme",
"name": "README",
"detail": null,
"points": 22.5,
"status": "met",
"details": [],
"max_points": 22.5
},
{
"key": "license",
"name": "License",
"detail": "no license file detected",
"points": 0,
"status": "missed",
"details": [
{
"code": "license_absent",
"params": {}
}
],
"max_points": 22.5
},
{
"key": "contributing_guide",
"name": "CONTRIBUTING guide",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 18
},
{
"key": "code_of_conduct",
"name": "Code of conduct",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 13.5
},
{
"key": "issue_template",
"name": "Issue template",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 7.2
},
{
"key": "pr_template",
"name": "PR template",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 6.3
}
]
},
{
"key": "ecosystem_adoption",
"band": "exceptional",
"name": "Ecosystem adoption (downloads)",
"note": "Excluded from scoring (no data or not applicable): Registry dependents. Remaining weights renormalized.",
"notes": [
{
"code": "excluded_no_data",
"params": {
"components": [
"registry_dependents"
]
}
},
{
"code": "weights_renormalized",
"params": {}
}
],
"value": 100,
"inputs": {
"packages": [
"ascon",
"bash-f",
"keccak"
],
"dependents": null,
"ecosystems": "crates",
"total_downloads": 135112269,
"monthly_downloads": 10450932
},
"components": [
{
"key": "monthly_downloads",
"name": "Monthly downloads",
"detail": "10,450,932 downloads/month across crates",
"points": 80,
"status": "met",
"details": [
{
"code": "downloads_monthly",
"params": {
"count": 10450932,
"ecosystems": "crates"
}
}
],
"max_points": 80
},
{
"key": "registry_dependents",
"name": "Registry dependents",
"detail": "not reported by this ecosystem",
"points": 0,
"status": "excluded",
"details": [
{
"code": "not_reported_by_this_ecosystem",
"params": {}
}
],
"max_points": 20
}
]
}
],
"description": "Does the project have users, downloads, attention, and a welcoming setup for contributors?"
},
{
"key": "governance",
"band": "good",
"name": "Sustainability & Governance",
"value": 72,
"weight": 0.23,
"metrics": [
{
"key": "maintainer_resilience",
"band": "weak",
"name": "Maintainer resilience (bus factor)",
"note": null,
"notes": [],
"value": 44,
"inputs": {
"bus_factor": 1,
"contributors_sampled": 12,
"top_contributor_share": 0.5
},
"components": [
{
"key": "bus_factor",
"name": "Bus factor",
"detail": "1 contributor(s) cover half of all commits",
"points": 9,
"status": "partial",
"details": [
{
"code": "bus_factor",
"params": {
"count": 1
}
}
],
"max_points": 54
},
{
"key": "commit_distribution",
"name": "Commit distribution",
"detail": "top contributor authored 50% of commits",
"points": 11.2,
"status": "partial",
"details": [
{
"code": "top_contributor_share",
"params": {
"share": 50
}
}
],
"max_points": 22.5
},
{
"key": "contributor_breadth",
"name": "Contributor breadth",
"detail": "12 contributors",
"points": 13.5,
"status": "met",
"details": [
{
"code": "contributors_sampled",
"params": {
"count": 12
}
}
],
"max_points": 13.5
},
{
"key": "openssf_scorecard_contributors",
"name": "OpenSSF Scorecard: Contributors",
"detail": "project has 17 contributing companies or organizations",
"points": 10,
"status": "met",
"details": [],
"max_points": 10
}
]
},
{
"key": "responsiveness",
"band": "good",
"name": "Issue & PR responsiveness",
"note": "Excluded from scoring (no data or not applicable): Newcomer PR acceptance. Remaining weights renormalized.",
"notes": [
{
"code": "excluded_no_data",
"params": {
"components": [
"newcomer_pr_acceptance"
]
}
},
{
"code": "weights_renormalized",
"params": {}
}
],
"value": 79,
"inputs": {
"merged_prs": 101,
"open_issues": 1,
"closed_issues": 10,
"prs_merged_7d": 2,
"prs_decided_7d": 2,
"prs_merged_30d": 2,
"prs_decided_30d": 2,
"issue_closed_ratio": 0.909,
"closed_unmerged_prs": 14,
"first_time_authors_30d": 0,
"first_time_prs_merged_30d": 0,
"first_time_prs_decided_30d": 0
},
"components": [
{
"key": "issue_resolution",
"name": "Issue resolution",
"detail": "91% of issues closed",
"points": 38.2,
"status": "partial",
"details": [
{
"code": "issues_closed_share",
"params": {
"share": 91
}
}
],
"max_points": 42
},
{
"key": "pr_acceptance",
"name": "PR acceptance",
"detail": "101/115 decided PRs merged",
"points": 26.3,
"status": "partial",
"details": [
{
"code": "decided_prs_merged",
"params": {
"merged": 101,
"decided": 115
}
}
],
"max_points": 30
},
{
"key": "newcomer_pr_acceptance",
"name": "Newcomer PR acceptance",
"detail": "no first-time contributor's PR decided in 30d",
"points": 0,
"status": "excluded",
"details": [
{
"code": "no_newcomer_prs",
"params": {
"days": 30
}
}
],
"max_points": 13
},
{
"key": "openssf_scorecard_code_review",
"name": "OpenSSF Scorecard: Code-Review",
"detail": "Found 9/30 approved changesets -- score normalized to 3",
"points": 4.5,
"status": "partial",
"details": [],
"max_points": 15
}
]
},
{
"key": "stewardship",
"band": "good",
"name": "Ownership & stewardship",
"note": null,
"notes": [],
"value": 78,
"inputs": {
"followers": 2346,
"owner_type": "Organization",
"is_verified": null,
"owner_login": "RustCrypto",
"public_repos": 40,
"account_age_days": 3605
},
"components": [
{
"key": "ownership_backing",
"name": "Ownership backing",
"detail": "organization-owned",
"points": 30,
"status": "met",
"details": [
{
"code": "owner_organization",
"params": {}
}
],
"max_points": 30
},
{
"key": "verified_domain",
"name": "Verified domain",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 20
},
{
"key": "owner_reach",
"name": "Owner reach",
"detail": "2,346 followers of RustCrypto",
"points": 24.2,
"status": "partial",
"details": [
{
"code": "owner_followers",
"params": {
"count": 2346,
"login": "RustCrypto"
}
}
],
"max_points": 25
},
{
"key": "track_record",
"name": "Track record",
"detail": "40 public repos, account ~9 yr old",
"points": 23.7,
"status": "partial",
"details": [
{
"code": "public_repos",
"params": {
"count": 40
}
},
{
"code": "account_age_years",
"params": {
"years": 9
}
}
],
"max_points": 25
}
]
},
{
"key": "package_maintenance",
"band": "exceptional",
"name": "Package maintenance",
"note": null,
"notes": [],
"value": 100,
"inputs": {
"packages": [
"ascon",
"bash-f",
"keccak"
],
"ecosystems": "crates",
"any_deprecated": false,
"min_days_since_publish": 0
},
"components": [
{
"key": "published_resolvable",
"name": "Published & resolvable",
"detail": "3 package(s) on crates",
"points": 25,
"status": "met",
"details": [
{
"code": "packages_published",
"params": {
"count": 3,
"ecosystems": "crates"
}
}
],
"max_points": 25
},
{
"key": "publish_recency",
"name": "Publish recency",
"detail": "latest publish 0 days ago",
"points": 35,
"status": "met",
"details": [
{
"code": "publish_recency",
"params": {
"days": 0
}
}
],
"max_points": 35
},
{
"key": "version_history",
"name": "Version history",
"detail": "14 published versions",
"points": 20,
"status": "met",
"details": [
{
"code": "published_versions",
"params": {
"count": 14
}
}
],
"max_points": 20
},
{
"key": "not_deprecated",
"name": "Not deprecated",
"detail": "active, not deprecated or yanked",
"points": 20,
"status": "met",
"details": [
{
"code": "package_not_deprecated",
"params": {}
}
],
"max_points": 20
}
]
}
],
"description": "Will the project survive its people — bus factor, responsiveness, who backs it, and package upkeep?"
},
{
"key": "engineering",
"band": "moderate",
"name": "Engineering Quality",
"value": 56,
"weight": 0.19,
"metrics": [
{
"key": "engineering_practices",
"band": "good",
"name": "Engineering practices",
"note": null,
"notes": [],
"value": 66,
"inputs": {
"has_ci": true,
"has_tests": true,
"has_editorconfig": false,
"has_linter_config": false,
"has_precommit_config": false
},
"components": [
{
"key": "ci_workflows",
"name": "CI workflows",
"detail": "6 workflow(s)",
"points": 24,
"status": "met",
"details": [
{
"code": "ci_workflows",
"params": {
"count": 6
}
}
],
"max_points": 24
},
{
"key": "tests_present",
"name": "Tests present",
"detail": null,
"points": 24,
"status": "met",
"details": [],
"max_points": 24
},
{
"key": "linter_config",
"name": "Linter config",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 16
},
{
"key": "pre_commit_hooks",
"name": "Pre-commit hooks",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 9.6
},
{
"key": "editorconfig",
"name": ".editorconfig",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 6.4
},
{
"key": "openssf_scorecard_ci_tests",
"name": "OpenSSF Scorecard: CI-Tests",
"detail": "29 out of 30 merged PRs checked by a CI test -- score normalized to 9",
"points": 18,
"status": "partial",
"details": [],
"max_points": 20
}
]
},
{
"key": "documentation",
"band": "weak",
"name": "Documentation",
"note": null,
"notes": [],
"value": 40,
"inputs": {
"topics": [],
"has_wiki": false,
"homepage": null,
"has_readme": true,
"has_docs_dir": false,
"has_description": true
},
"components": [
{
"key": "readme",
"name": "README",
"detail": null,
"points": 30,
"status": "met",
"details": [],
"max_points": 30
},
{
"key": "documentation_directory",
"name": "Documentation directory",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 25
},
{
"key": "documentation_homepage_site",
"name": "Documentation / homepage site",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 15
},
{
"key": "repository_description",
"name": "Repository description",
"detail": null,
"points": 10,
"status": "met",
"details": [],
"max_points": 10
},
{
"key": "topics",
"name": "Topics",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 10
},
{
"key": "wiki",
"name": "Wiki",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 10
}
]
}
],
"description": "Are baseline engineering and documentation practices in place?"
},
{
"key": "security",
"band": "weak",
"name": "Security",
"value": 47,
"weight": 0.16,
"metrics": [
{
"key": "security_posture",
"band": "at_risk",
"name": "Security posture",
"note": "Excluded from scoring (no data or not applicable): Signed-Releases. Remaining weights renormalized. High-Risk Jurisdiction Policy applies a 75% multiplier to Security posture and gives it an At Risk ceiling of 34.",
"notes": [
{
"code": "excluded_no_data",
"params": {
"components": [
"signed_releases"
]
}
},
{
"code": "weights_renormalized",
"params": {}
},
{
"code": "jurisdiction_posture_adjustment",
"params": {
"cap": 34,
"pct": 75
}
}
],
"value": 34,
"inputs": {
"source": "openssf_scorecard",
"checks_evaluated": 17,
"scorecard_version": "v5.5.0",
"checks_inconclusive": 1,
"scorecard_aggregate": 5.2,
"high_risk_jurisdiction_cap": 34,
"high_risk_jurisdiction_multiplier": 75,
"security_posture_after_multiplier": 39,
"security_posture_before_jurisdiction": 52
},
"components": [
{
"key": "binary_artifacts",
"name": "Binary-Artifacts",
"detail": "no binaries found in the repo",
"points": 7.5,
"status": "met",
"details": [],
"max_points": 7.5
},
{
"key": "branch_protection",
"name": "Branch-Protection",
"detail": "branch protection not enabled on development/release branches",
"points": 0,
"status": "missed",
"details": [],
"max_points": 7.5
},
{
"key": "ci_tests",
"name": "CI-Tests",
"detail": "29 out of 30 merged PRs checked by a CI test -- score normalized to 9",
"points": 2.2,
"status": "partial",
"details": [],
"max_points": 2.5
},
{
"key": "cii_best_practices",
"name": "CII-Best-Practices",
"detail": "no effort to earn an OpenSSF best practices badge detected",
"points": 0,
"status": "missed",
"details": [],
"max_points": 2.5
},
{
"key": "code_review",
"name": "Code-Review",
"detail": "Found 9/30 approved changesets -- score normalized to 3",
"points": 2.2,
"status": "partial",
"details": [],
"max_points": 7.5
},
{
"key": "contributors",
"name": "Contributors",
"detail": "project has 17 contributing companies or organizations",
"points": 2.5,
"status": "met",
"details": [],
"max_points": 2.5
},
{
"key": "dangerous_workflow",
"name": "Dangerous-Workflow",
"detail": "no dangerous workflow patterns detected",
"points": 10,
"status": "met",
"details": [],
"max_points": 10
},
{
"key": "dependency_update_tool",
"name": "Dependency-Update-Tool",
"detail": "update tool detected",
"points": 7.5,
"status": "met",
"details": [],
"max_points": 7.5
},
{
"key": "fuzzing",
"name": "Fuzzing",
"detail": "project is not fuzzed",
"points": 0,
"status": "missed",
"details": [],
"max_points": 5
},
{
"key": "license",
"name": "License",
"detail": "license file not detected",
"points": 0,
"status": "missed",
"details": [],
"max_points": 2.5
},
{
"key": "maintained",
"name": "Maintained",
"detail": "2 commit(s) and 1 issue activity found in the last 90 days -- score normalized to 2",
"points": 1.5,
"status": "partial",
"details": [],
"max_points": 7.5
},
{
"key": "packaging",
"name": "Packaging",
"detail": "packaging workflow detected",
"points": 5,
"status": "met",
"details": [],
"max_points": 5
},
{
"key": "pinned_dependencies",
"name": "Pinned-Dependencies",
"detail": "dependency not pinned by hash detected -- score normalized to 0",
"points": 0,
"status": "missed",
"details": [],
"max_points": 5
},
{
"key": "sast",
"name": "SAST",
"detail": "SAST tool is not run on all commits -- score normalized to 0",
"points": 0,
"status": "missed",
"details": [],
"max_points": 5
},
{
"key": "security_policy",
"name": "Security-Policy",
"detail": "security policy file detected",
"points": 5,
"status": "met",
"details": [],
"max_points": 5
},
{
"key": "signed_releases",
"name": "Signed-Releases",
"detail": "no releases found",
"points": 0,
"status": "excluded",
"details": [
{
"code": "no_data",
"params": {}
}
],
"max_points": 7.5
},
{
"key": "token_permissions",
"name": "Token-Permissions",
"detail": "detected GitHub workflow tokens with excessive permissions",
"points": 0,
"status": "missed",
"details": [],
"max_points": 7.5
},
{
"key": "vulnerabilities",
"name": "Vulnerabilities",
"detail": "0 existing vulnerabilities detected",
"points": 7.5,
"status": "met",
"details": [],
"max_points": 7.5
}
]
},
{
"key": "dependency_advisories",
"band": "exceptional",
"name": "Dependency advisories",
"note": "Excluded from scoring (no data or not applicable): Indirect dependencies free of known advisories, No advisories left outstanding. Remaining weights renormalized. Matched 5 resolved dependencies against OSV; 4 could not be assessed (no resolved version, an unsupported ecosystem, or beyond the reported package list). This repository publishes no package the index resolves, so the repository dependency graph was assessed instead. That graph mixes development and test pins with shipped dependencies, so only the declared runtime dependencies are scored; transitive findings are reported as context and excluded from the score. Reachability is not analyzed.",
"notes": [
{
"code": "excluded_no_data",
"params": {
"components": [
"indirect_dependencies_free_of_known_advisories",
"no_advisories_left_outstanding"
]
}
},
{
"code": "weights_renormalized",
"params": {}
},
{
"code": "advisories_scope_repository",
"params": {
"assessed": 5
}
},
{
"code": "advisories_unassessed",
"params": {
"count": 4
}
},
{
"code": "advisories_repo_graph_caveat",
"params": {}
},
{
"code": "advisories_reachability",
"params": {}
}
],
"value": 100,
"inputs": {
"source": "osv",
"advisories": 0,
"affected_packages": 0,
"assessed_packages": 5,
"unassessed_packages": 4,
"affected_by_severity": "none",
"direct_affected_packages": 0
},
"components": [
{
"key": "direct_dependencies_free_of_known_advisories",
"name": "Direct dependencies free of known advisories",
"detail": "no direct dependency carries a known advisory",
"points": 35,
"status": "met",
"details": [
{
"code": "no_direct_advisories",
"params": {}
}
],
"max_points": 35
},
{
"key": "indirect_dependencies_free_of_known_advisories",
"name": "Indirect dependencies free of known advisories",
"detail": "transitive set not separable from development and test dependencies in this scope",
"points": 0,
"status": "excluded",
"details": [
{
"code": "advisories_scope_not_separable",
"params": {}
}
],
"max_points": 25
},
{
"key": "no_advisories_left_outstanding",
"name": "No advisories left outstanding",
"detail": "no advisory carries a publication date",
"points": 0,
"status": "excluded",
"details": [
{
"code": "advisories_no_publication_date",
"params": {}
}
],
"max_points": 40
}
]
},
{
"key": "malicious_dependencies",
"band": "exceptional",
"name": "Malicious dependencies",
"note": null,
"notes": [],
"value": 100,
"inputs": {
"source": "osv",
"meaning": "reported as a malicious package by the OpenSSF corpus; the remedy is removal or moving off the compromised name, never an upgrade of the same artifact. Versions the registry has since pulled are listed but not scored",
"packages": [],
"red_flag": false,
"assessed_packages": 5,
"malicious_packages": 0,
"direct_malicious_packages": 0,
"withdrawn_malicious_packages": 0,
"installable_malicious_packages": 0
},
"components": [
{
"key": "no_dependency_reported_as_a_malicious_package",
"name": "No dependency reported as a malicious package",
"detail": "no dependency is reported as a malicious package",
"points": 100,
"status": "met",
"details": [
{
"code": "no_malicious_dependencies",
"params": {}
}
],
"max_points": 100
}
]
},
{
"key": "high_risk_jurisdiction_exposure",
"band": "good",
"name": "High-Risk Jurisdiction Exposure",
"note": "Only high-confidence self-published location evidence affects this multiplier. Ambiguous matches are review-only; country evidence is not proof of nationality, citizenship, legal registration, malicious intent, or sanctions status.",
"notes": [
{
"code": "jurisdiction_evidence_limits",
"params": {}
}
],
"value": 75,
"inputs": {
"meaning": "self-published location evidence; not nationality or citizenship",
"red_flag": true,
"exposures": [
{
"role": "contributor_organization",
"count": 1,
"country": "Russia"
}
],
"policy_countries": [
"Russia",
"Iran",
"North Korea"
],
"commit_weight_rule": {
"min_commits": 50,
"min_commit_share": 0.1
},
"review_only_matches": 0,
"below_threshold_exposures": [],
"assessed_self_published_locations": 18
},
"components": [
{
"key": "policy_exposure_multiplier",
"name": "Policy exposure multiplier",
"detail": "Russia: contributor_organization (1)",
"points": 75,
"status": "partial",
"details": [
{
"code": "jurisdiction_exposure",
"params": {
"role": "contributor_organization",
"count": 1,
"country": "Russia"
}
}
],
"max_points": 100
}
]
}
],
"description": "Are visible security and supply-chain practices strong, with no malicious dependency and no unresolved high-risk jurisdiction exposure?"
},
{
"key": "ai_readiness",
"band": "moderate",
"name": "AI Readiness",
"value": 62,
"weight": 0.04,
"metrics": [
{
"key": "ai_agent_context",
"band": "weak",
"name": "Agent context & guidance",
"note": null,
"notes": [],
"value": 40,
"inputs": {
"has_llms_txt": false,
"legible_history_share": 0.937,
"agent_instruction_files": [],
"agent_instruction_max_bytes": null
},
"components": [
{
"key": "agent_instructions",
"name": "Agent instructions",
"detail": "no CLAUDE.md / AGENTS.md / editor rules",
"points": 0,
"status": "missed",
"details": [
{
"code": "no_agent_instructions",
"params": {}
}
],
"max_points": 45
},
{
"key": "machine_readable_docs_llms_txt",
"name": "Machine-readable docs (llms.txt)",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 15
},
{
"key": "legible_commit_history",
"name": "Legible commit history",
"detail": "89 of 95 human commits state their intent (structured subject or explanatory body)",
"points": 40,
"status": "met",
"details": [
{
"code": "legible_history",
"params": {
"legible": 89,
"sampled": 95
}
}
],
"max_points": 40
}
]
},
{
"key": "ai_verify_loop",
"band": "moderate",
"name": "Verify loop (build / test / typecheck)",
"note": null,
"notes": [],
"value": 64,
"inputs": {
"has_nix": false,
"has_tests": true,
"lockfiles": [
"Cargo.lock"
],
"has_dockerfile": false,
"typed_language": true,
"bootstrap_files": [],
"has_devcontainer": false,
"has_linter_config": false,
"typecheck_configs": [],
"agent_commit_share": 0,
"toolchain_manifests": [
"Cargo.toml",
"ascon/Cargo.toml",
"bash-f/Cargo.toml",
"benches/Cargo.toml",
"keccak/Cargo.toml"
],
"dependency_bot_commit_share": 0.05
},
"components": [
{
"key": "one_command_bootstrap",
"name": "One-command bootstrap",
"detail": "Cargo.toml, ascon/Cargo.toml, bash-f/Cargo.toml (toolchain convention, no task runner)",
"points": 12.6,
"status": "partial",
"details": [
{
"code": "toolchain_convention",
"params": {
"files": "Cargo.toml, ascon/Cargo.toml, bash-f/Cargo.toml"
}
}
],
"max_points": 18
},
{
"key": "automated_tests",
"name": "Automated tests",
"detail": null,
"points": 22,
"status": "met",
"details": [],
"max_points": 22
},
{
"key": "lint_format_config",
"name": "Lint / format config",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 11
},
{
"key": "static_type_checking",
"name": "Static type checking",
"detail": "Rust (statically typed)",
"points": 11,
"status": "met",
"details": [
{
"code": "statically_typed_language",
"params": {
"language": "Rust"
}
}
],
"max_points": 11
},
{
"key": "reproducible_environment",
"name": "Reproducible environment",
"detail": "lockfile",
"points": 10,
"status": "met",
"details": [
{
"code": "file_list",
"params": {
"files": "lockfile"
}
}
],
"max_points": 10
},
{
"key": "demonstrated_agent_practice",
"name": "Demonstrated agent practice",
"detail": "no agent-authored commits among the last 100",
"points": 0,
"status": "missed",
"details": [
{
"code": "no_agent_authored_commits",
"params": {
"sampled": 100
}
}
],
"max_points": 10
},
{
"key": "automated_maintenance",
"name": "Automated maintenance",
"detail": "5 of the last 100 commits are automated dependency updates",
"points": 8,
"status": "met",
"details": [
{
"code": "dependency_bot_commits",
"params": {
"count": 5,
"sampled": 100
}
}
],
"max_points": 8
},
{
"key": "openssf_scorecard_pinned_dependencies",
"name": "OpenSSF Scorecard: Pinned-Dependencies",
"detail": "dependency not pinned by hash detected -- score normalized to 0",
"points": 0,
"status": "missed",
"details": [],
"max_points": 10
}
]
},
{
"key": "ai_code_legibility",
"band": "exceptional",
"name": "Code legibility for models",
"note": null,
"notes": [],
"value": 100,
"inputs": {
"primary_language": "Rust",
"largest_source_bytes": 6229,
"source_files_sampled": 16,
"oversized_source_files": 0
},
"components": [
{
"key": "type_checkable_code",
"name": "Type-checkable code",
"detail": "Rust (statically typed)",
"points": 45,
"status": "met",
"details": [
{
"code": "statically_typed_language",
"params": {
"language": "Rust"
}
}
],
"max_points": 45
},
{
"key": "manageable_file_sizes",
"name": "Manageable file sizes",
"detail": "0/16 source files over 60KB",
"points": 55,
"status": "met",
"details": [
{
"code": "oversized_source_files",
"params": {
"kb": 60,
"sampled": 16,
"oversized": 0
}
}
],
"max_points": 55
}
]
}
],
"description": "How well is the repo equipped to be developed and maintained with AI coding agents? Carries a deliberately small weight: agent tooling is a real maintenance signal, but its absence must never gate the top of the scale (calibration saturates at raw 91, so 100/100 remains reachable with AI Readiness at zero)."
}
],
"classification": {
"top": [
"library"
],
"labels": [
"library"
],
"scores": {
"library": 5.4
},
"primary": "library",
"evidence": [
{
"tier": "distribution",
"label": "library",
"source": "registry:crates",
"weight": 6
},
{
"tier": "declared",
"label": "library",
"source": "cargo.publish_false",
"weight": -3.6
},
{
"tier": "structure",
"label": "library",
"source": "tree.cargo_lib",
"weight": 3
}
],
"artifacts": [
{
"path": "Cargo.toml",
"labels": [],
"ecosystem": "crates"
},
{
"path": "ascon/Cargo.toml",
"labels": [],
"ecosystem": "crates"
},
{
"path": "bash-f/Cargo.toml",
"labels": [],
"ecosystem": "crates"
},
{
"path": "benches/Cargo.toml",
"labels": [],
"ecosystem": "crates"
},
{
"path": "keccak/Cargo.toml",
"labels": [],
"ecosystem": "crates"
}
],
"confidence": "low",
"host_extension": false,
"runs_as_process": false,
"consumed_by_code": true
},
"metrics_version": "2.5.0"
},
"warnings": [
"Star history unavailable: GitHub GraphQL error: Resource not accessible by personal access token",
"Could not fetch crates package 'benches' from its registry"
],
"report_type": "repository",
"generated_at": "2026-08-06T04:31:20.888281Z",
"schema_version": "0.31.0",
"badge_url": "https://raw.githubusercontent.com/inspect-software/badges/main/v1/r/RustCrypto/sponges.svg",
"full_name": "RustCrypto/sponges",
"license_state": "absent",
"license_spdx": null
}
Related records
Inspected repositories sharing catalogue tags or ecosystems with RustCrypto/sponges. Read them side by side →
Scores are signals, not warranties. They reflect publicly visible practices on GitHub — not a code audit, and not a security guarantee.
Missing data is excluded and weights renormalized, never scored as zero. Methodology is versioned and open: metrics v2.5.0, schema v0.31.0 — full methodology · metrics wiki.
