HTML · Rust · ShellBSD-2-Clause★ 10 stars⑂ 2 forkssince Feb 2026View on GitHub ↗
kushaldas/bergshamra holds a health index of 61 out of 100, placing it in the Moderate band. It scores highest on Vitality (83/100) and lowest on Community & Adoption (45/100). It was last updated today. A single contributor accounts for most of its recent work.
61
overall / 100
Moderate
Software health index
Metrics are grouped into weighted categories on one standardized 1–100 scale. Overall starts as their weighted mean; when public evidence triggers the High-Risk Jurisdiction Policy, the rating is adjusted and receives an At risk ceiling of 49. AI Readiness sits outside the overall score.
61
Excellent85-100Exemplary; meets essentially all checked criteria
Good70-84Healthy; minor gaps
Moderate50-69Acceptable with notable gaps; review recommended
At risk30-49Significant weaknesses; adoption warrants caution
Critical1-29Severe problems (abandoned, single-maintainer, no hygiene)
Score profile
Each axis is a category. The shape matters more than the average — a healthy subject fills the whole shape, while a spike-and-crater profile means strength in one dimension is masking risk in another.
How well is the repo equipped to be developed and maintained with AI coding agents? An independent, experimental badge — weight 0.0, so it is surfaced on its own and does not affect the overall health score.
Star history unavailable: GitHub GraphQL error: Resource not accessible by personal access token
GitHub dependency-graph SBOM unavailable (404); the dependency graph may be disabled for this repository
deps.dev does not index crates:bergshamra@0.8.0; advisories assessed against the repository dependency graph instead
More detail
Star and fork history 0 ★ / 2 ⇿
0Stars
2Forks
7Releases
When each star and fork was added, collected from GitHub and bucketed by day. Cumulative growth sits directly above the daily additions it is made of, so the two read against each other: steady organic accretion looks nothing like an abrupt, short-lived burst. Where that difference is measurable, it is reported as growth authenticity.
Major 0Minor 2Patch 5
OpenSSF Scorecard 5.1 / 10
5.1aggregate
Independent, tool-agnostic security assessment from the open-source OpenSSF Scorecard. Each check rewards a security practice, not a specific vendor's tool. Checks Scorecard could not determine are marked n/a and excluded from the security score (never counted as zero).Scorecard v5.5.0 · 2026-08-01 20:01 UTC
The resolved dependency set could not be collected for this report: GitHub dependency-graph SBOM unavailable (404); the dependency graph may be disabled for this repository
Raw JSON report machine-readable
{
"data": {
"repo": {
"topics": [],
"is_fork": false,
"size_kb": 2407,
"has_wiki": true,
"homepage": null,
"languages": {
"C": 572,
"HTML": 2018666,
"Just": 3316,
"Perl": 5684,
"Rust": 938284,
"XSLT": 1386,
"Shell": 461762,
"Python": 18011,
"Go Template": 368844
},
"pushed_at": "2026-08-01T10:10:42Z",
"created_at": "2026-02-22T15:26:01Z",
"owner_type": "User",
"updated_at": "2026-08-01T10:09:37Z",
"description": "XML security library",
"is_archived": false,
"is_disabled": false,
"license_spdx": "BSD-2-Clause",
"default_branch": "main",
"license_spdx_raw": "BSD-2-Clause",
"primary_language": "HTML",
"significant_languages": [
"HTML",
"Rust",
"Shell"
]
},
"owner": {
"blog": "https://kushaldas.in",
"name": "Kushal Das",
"type": "User",
"login": "kushaldas",
"company": "@SUNET",
"location": "Stockholm",
"followers": 946,
"avatar_url": "https://avatars.githubusercontent.com/u/272303?v=4",
"created_at": "2010-05-10T12:02:20Z",
"is_verified": null,
"public_repos": 225,
"account_age_days": 5927
},
"license": {
"state": "standard",
"spdx_id": "BSD-2-Clause",
"raw_spdx": "BSD-2-Clause",
"file_present": true,
"scorecard_found": true,
"profile_has_license": true
},
"activity": {
"releases": [
{
"tag": "v0.8.0",
"kind": "minor",
"published_at": "2026-08-01T10:13:20Z"
},
{
"tag": "v0.7.0",
"kind": "minor",
"published_at": "2026-07-06T10:03:35Z"
},
{
"tag": "v0.6.4",
"kind": "patch",
"published_at": "2026-07-03T11:59:26Z"
},
{
"tag": "v0.6.3",
"kind": "patch",
"published_at": "2026-07-02T09:57:04Z"
},
{
"tag": "v0.6.2",
"kind": "patch",
"published_at": "2026-07-01T14:52:53Z"
},
{
"tag": "v0.6.1",
"kind": "patch",
"published_at": "2026-06-29T14:24:22Z"
},
{
"tag": "v0.6.0",
"kind": "minor",
"published_at": "2026-06-29T12:17:13Z"
},
{
"tag": "v0.5.1",
"kind": "patch",
"published_at": "2026-06-07T06:49:58Z"
}
],
"recent_commits": [
{
"oid": "f81a3883bd89ba00a8ec71a5f87dd3f0a73b27f8",
"body": "fix(ci): verify if package build is sane",
"is_bot": false,
"headline": "Merge pull request #32 from kushaldas/fix/ci_dry_run",
"author_name": "Kushal Das",
"author_login": "kushaldas",
"committed_at": "2026-08-01T10:09:28Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "3b2148408e978b01a6c24acf1d4cb421c314ed1d",
"body": null,
"is_bot": false,
"headline": "fix(ci): verify if package build is sane",
"author_name": "Kushal Das",
"author_login": "kushaldas",
"committed_at": "2026-08-01T10:05:08Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "40a4c1dee0617d7ef3371ebb354340b1b44ac31d",
"body": "feat(dsig): accept any document lifetime in document-native signing",
"is_bot": false,
"headline": "Merge pull request #31 from kushaldas/fix/sign_internals",
"author_name": "Kushal Das",
"author_login": "kushaldas",
"committed_at": "2026-08-01T09:40:42Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "f6d50e80da06933722520f2fac864455998f8fe0",
"body": "sign_document() and sign_enveloped_document() previously required\n&mut Document<'static>, forcing callers that hold a zero-copy document\n(one that borrows its decoded input text, like pybergshamra's\npyuppsala-interop cell) to detach it with into_static() before signing.\nThat conversion costs a per-n\n[…]\n strict generalization: existing Document<'static> callers\ncompile unchanged. In-place signing now works directly on borrowed\ndocuments, matching the already lifetime-generic verify_document()\nfamily.",
"is_bot": false,
"headline": "feat(dsig): accept any document lifetime in document-native signing",
"author_name": "Kushal Das",
"author_login": "kushaldas",
"committed_at": "2026-08-01T09:36:42Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "79ef9325de7b25fd8f3f9b9fe936a116fa401a5c",
"body": "fix: removes kryptering check from CI",
"is_bot": false,
"headline": "Merge pull request #30 from kushaldas/fix/more_ci",
"author_name": "Kushal Das",
"author_login": "kushaldas",
"committed_at": "2026-07-31T20:31:33Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "5782d9fe835392b16203e6291e2a37d84e67bf38",
"body": null,
"is_bot": false,
"headline": "fix: removes kryptering check from CI",
"author_name": "Kushal Das",
"author_login": "kushaldas",
"committed_at": "2026-07-31T20:29:33Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "e9da20d7a0c0842d86bcfcdb232ad1b09ec07e56",
"body": "fix: remove extra CI steps",
"is_bot": false,
"headline": "Merge pull request #29 from kushaldas/fix/ci-update",
"author_name": "Kushal Das",
"author_login": "kushaldas",
"committed_at": "2026-07-31T19:26:30Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "2c91a964903e6ee6fde9a4012baa84e1d58f1340",
"body": null,
"is_bot": false,
"headline": "fix: remove extra CI steps",
"author_name": "Kushal Das",
"author_login": "kushaldas",
"committed_at": "2026-07-31T19:22:41Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "8a4b80f3d94fbe8827f69382cde6113595da4e27",
"body": "For new release",
"is_bot": false,
"headline": "Merge pull request #28 from kushaldas/feat/bergshamra_bro",
"author_name": "Kushal Das",
"author_login": "kushaldas",
"committed_at": "2026-07-31T19:14:11Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "82392e5eb521cd7001cc1ff0d19bdd1e48ff7a71",
"body": "Release Bergshamra 0.8.0 with document cryptography routed through\nKryptering 0.5.0 and trust validation provided by tsp-ltv 0.4.0.\n\n- bump all workspace crates to 0.8.0 and raise the MSRV to Rust 1.88\n- resolve released Kryptering 0.5.0 and tsp-ltv 0.4.0 from crates.io\n- keep RustCrypto, legacy alg\n[…]\non is fallible. Alternate providers must be selected with\n--no-default-features, --all-features is intentionally invalid, and FIPS\napplications must call initialize_backend() before cryptographic use.",
"is_bot": false,
"headline": "feat(crypto)!: release 0.8.0 with selectable crypto providers",
"author_name": "Kushal Das",
"author_login": "kushaldas",
"committed_at": "2026-07-31T16:49:32Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "3088101c6ad4866770cb8990495ca5f64a5baf66",
"body": "Add APIs for signing and verifying existing Uppsala documents without an\nunconditional serialize/parse round trip.\n\nSupport in-place signature templates and enveloped signatures, direct\nsame-document C14N paths, and lazy serialization for generic transform\nfallbacks. Prepare the workspace for the 0.7.1 release.",
"is_bot": false,
"headline": "feat(dsig): add document-native signing and verification",
"author_name": "Kushal Das",
"author_login": "kushaldas",
"committed_at": "2026-07-09T19:39:31Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "f45465c11896bbd1f73b05f3a0ae316d518189d8",
"body": "fix: reject duplicate IDs in public XML ID map",
"is_bot": false,
"headline": "Merge pull request #26 from kushaldas/fix/duplicate_id",
"author_name": "Kushal Das",
"author_login": "kushaldas",
"committed_at": "2026-07-06T09:03:29Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "11b9cd61ebd31006d90833bde4e4b87c92cd4e03",
"body": "Clarify the bergshamra-xml crate docs so XmlDocument::build_id_map is\ndocumented as a Result-returning API that reports duplicate IDs with\nError::XmlStructure.\n\nAdd regression coverage for duplicate values split across a default ID\nattribute and a caller-registered custom ID attribute.",
"is_bot": false,
"headline": "fix: review comments",
"author_name": "Kushal Das",
"author_login": "kushaldas",
"committed_at": "2026-07-06T08:59:41Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "19bc112f7078b143f47946898cc13847255eeff4",
"body": "Update the README duplicate-ID error example to use the real\nError::XmlStructure constructor shape with .into().\n\nAdjust the custom ID regression test so both duplicate values are on the\ncaller-registered CustomId attribute, ensuring the extra_id_attrs path\nis tested directly.",
"is_bot": false,
"headline": "fix: review comments",
"author_name": "Kushal Das",
"author_login": "kushaldas",
"committed_at": "2026-07-06T08:44:35Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "af3de1c2d4d92edc8340dc4452c21ceed2cf4577",
"body": "Change XmlDocument::build_id_map to return a Result and fail closed when\nduplicate ID values are found across default or caller-registered ID\nattributes. This prevents later duplicate elements from silently\noverwriting earlier ID map entries.\n\nAdd regression tests for unique IDs, same-attribute duplicates,\ncross-default-attribute duplicates, and custom ID attribute duplicates.\n\nDocument the API change in the README, crate docs, and changelog.",
"is_bot": false,
"headline": "fix: reject duplicate IDs in public XML ID map",
"author_name": "Kushal Das",
"author_login": "kushaldas",
"committed_at": "2026-07-06T08:36:34Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "160c7917f61611d6cac42dfb1b8378deef650e4b",
"body": "fix: reject raw inline KeyInfo keys with trust anchors",
"is_bot": false,
"headline": "Merge pull request #25 from kushaldas/fix/raw_keys",
"author_name": "Kushal Das",
"author_login": "kushaldas",
"committed_at": "2026-07-06T08:22:14Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "ca084e3857ee0d2841eace5d13bb61365eca57ff",
"body": "When trust anchors are configured and raw inline KeyInfo keys are not\nexplicitly allowed, prefer certificate-backed X509Data before raw\nKeyValue or DEREncodedKeyValue material. This prevents mixed KeyInfo\ndocuments from failing only because a raw key appears before an\nanchorable certificate chain.\n\nAdd regression coverage for the certificate-only extraction helper and\nfor anchored verification of mixed KeyInfo content.",
"is_bot": false,
"headline": "fix: prefer X509Data for anchored KeyInfo verification",
"author_name": "Kushal Das",
"author_login": "kushaldas",
"committed_at": "2026-07-06T08:16:45Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "342417797d3dc4773d95ea9b06493b98802ed511",
"body": "Clarify that with_allow_raw_inline_keyinfo_with_trust_anchors is a\nbuilder method by documenting it as a chained call on an existing\nDsigContext value.\n\nAdjust README, ADR-0006, ADR-0007, and changelog prose to refer to\nDsigContext::new and DsigContext::new_permissive without implying\nzero-argument constructors.",
"is_bot": false,
"headline": "fix: pr #25 API documentation wording",
"author_name": "Kushal Das",
"author_login": "kushaldas",
"committed_at": "2026-07-06T07:59:27Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "cf56cd3dbcb4e187edbc7bc6130ba5067d62365d",
"body": "Raw inline KeyValue and DEREncodedKeyValue material can not be validated\nagainst configured trust anchors because it carries no certificate\nchain. Track when verification selected a raw inline KeyInfo key and\nreject it by default when trusted certificates are configured.\n\nAdd an explicit compatibili\n[…]\nge for:\n- raw inline KeyValue without anchors\n- rejection with configured anchors\n- explicit compatibility opt-in\n\nDocument the library-first policy in ADR-0007, README, crate docs, and\nthe changelog.",
"is_bot": false,
"headline": "fix: reject raw inline KeyInfo keys with trust anchors",
"author_name": "Kushal Das",
"author_login": "kushaldas",
"committed_at": "2026-07-06T07:32:52Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "7b962dcb03ad54b124de928afb8c36f89160dc36",
"body": "add: dsig tests",
"is_bot": false,
"headline": "Merge pull request #24 from kushaldas/fix/dsig_tests",
"author_name": "Kushal Das",
"author_login": "kushaldas",
"committed_at": "2026-07-06T07:13:55Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "91a7935d77c43f5ab69a068ee5769963dd54de53",
"body": null,
"is_bot": false,
"headline": "add: dsig tests",
"author_name": "Kushal Das",
"author_login": "kushaldas",
"committed_at": "2026-07-06T07:07:53Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "89d7ccba55a785e339184e5737f7f6dd4faff1c8",
"body": "fix: harden DSig Reference URI file handling",
"is_bot": false,
"headline": "Merge pull request #23 from kushaldas/fix/next",
"author_name": "Kushal Das",
"author_login": "kushaldas",
"committed_at": "2026-07-06T06:57:45Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "b650b3c979ea71db7d220ee49329049c0308dcfb",
"body": "Share DSig Reference URI helpers for URL-map matching, scheme detection,\nsafe relative-path validation, and canonical local-file containment. Use\nthe same local fallback rules for signing and verification so scheme\nURIs such as urn:... are not read from base_dir or CWD unless explicitly\nmapped, and \n[…]\nrejection, explicit\nURL-map support, and parent traversal rejection. Keep the\ndetached-reference debug redaction integration test and update README,\nchangelog, and API docs for the tightened behavior.",
"is_bot": false,
"headline": "fix: align DSig signing URI fallback",
"author_name": "Kushal Das",
"author_login": "kushaldas",
"committed_at": "2026-07-06T06:42:11Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "6d33276de72a969933c50237db9ccd70aa0e54e3",
"body": "Limit DSig Reference URL maps to exact URI matches, with only\nsame-resource fragment suffixes accepted as non-exact matches. This\nprevents host-prefix lookalikes such as example.com.evil from resolving\nto a caller-mapped local file.\n\nApply the matcher to signing and verification, document the URL-map\nmatching rule, update CLI help text, and add regression coverage for\nrejected prefix lookalikes, allowed fragment suffixes, and debug\nredaction of detached bytes.",
"is_bot": false,
"headline": "fix: constrain DSig URL map matching",
"author_name": "Kushal Das",
"author_login": "kushaldas",
"committed_at": "2026-07-05T22:01:56Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "7c1fdbe1d5aad37bdb08ee26fb6af6cf438f5c51",
"body": "Canonicalize relative detached Reference URI candidates and require\nresolved paths to stay under the lookup base before reading. This\nprevents symlink-based escapes from document-relative reference\nresolution.\n\nAdd regression coverage for symlink escape rejection and a CLI debug\ntest that verifies detached reference bytes are redacted from stderr.",
"is_bot": false,
"headline": "fix: harden detached Reference URI containment",
"author_name": "Kushal Das",
"author_login": "kushaldas",
"committed_at": "2026-07-05T21:14:50Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "25b028de4cd1dfe876238ebaadafb3f738e047e2",
"body": "Validate local path hazards before URI scheme detection so Windows\ndrive-qualified paths like C:\\secret.txt and C:secret.txt are rejected\nby the local-file Reference URI policy instead of being treated as\none-letter URI schemes.\n\nAdd Windows-only regression coverage for drive-qualified Reference URI\nrejection.",
"is_bot": false,
"headline": "fix: handle Windows drive Reference URI review",
"author_name": "Kushal Das",
"author_login": "kushaldas",
"committed_at": "2026-07-05T21:04:54Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "4ef45e51ad15eae692cf0b1ee30c91adc45c3cd4",
"body": "Clarify DSig reference digest coverage docs, base_dir lookup behavior,\nand per-reference inspection guidance. Fix a CryptoBinary test doc typo.\n\nUse atomic create_new temp-file creation with retry in DSig resolver\ntests to avoid accidental clobbering under parallel test runs.",
"is_bot": false,
"headline": "fix: address PR 23 review comments",
"author_name": "Kushal Das",
"author_login": "kushaldas",
"committed_at": "2026-07-05T20:52:58Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "e1715372ea99c6da7d731a4d152ab8b419d50915",
"body": "Reject absolute and parent-traversing local Reference URI values during\nXML-DSig verification, and redact detached reference bytes from debug\npre-digest output so invalid signatures cannot disclose local file\ncontents.\n\nKeep simple relative detached file references working for XML-DSig\ninterop, and document the updated url-map/base-dir behavior.",
"is_bot": false,
"headline": "fix: harden DSig Reference URI file handling",
"author_name": "Kushal Das",
"author_login": "kushaldas",
"committed_at": "2026-07-05T20:02:38Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "9d9691ff70c98ba111e8a7fdfdccc07203ef4cac",
"body": "security: harden XML signature verification",
"is_bot": false,
"headline": "Merge pull request #22 from kushaldas/fix/s23",
"author_name": "Kushal Das",
"author_login": "kushaldas",
"committed_at": "2026-07-05T19:47:31Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "d56d88cdcd0cc68f0d41a3db45c469116ea3ad58",
"body": null,
"is_bot": false,
"headline": "fix: review comment",
"author_name": "Kushal Das",
"author_login": "kushaldas",
"committed_at": "2026-07-05T19:43:19Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "1afb64fdb44812e85a4c03c2f463c2c2a0224f96",
"body": "- clarify digest helper methods as any/all checks\n- point callers to references for per-reference inspection\n- document full reference digest policy requirements\n- fix CryptoBinary test comment typo",
"is_bot": false,
"headline": "fix: address XML signature documentation review",
"author_name": "Kushal Das",
"author_login": "kushaldas",
"committed_at": "2026-07-05T19:35:21Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "0bfc1ca4330b1d0fecef919b2dece968a46633d7",
"body": "- make CLI digest warning helper return no warning for fully verified\n references\n- clarify reference coverage helpers for detached-content opt-out\n workflows\n- reword new_permissive docs to avoid implying pure W3C behavior",
"is_bot": false,
"headline": "fix: address XML signature review comments",
"author_name": "Kushal Das",
"author_login": "kushaldas",
"committed_at": "2026-07-05T19:24:45Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "e3fc7add1e9a33c35082a83084d89a9ee8a5ac71",
"body": "- treat single hex digit CryptoBinary as odd-length hex\n- report all-skipped references as no locally verified digests\n- align CLI verbose warning with verifier digest policy\n- clarify reference digest policy docs",
"is_bot": false,
"headline": "fix: address XML signature review comments",
"author_name": "Kushal Das",
"author_login": "kushaldas",
"committed_at": "2026-07-05T19:09:57Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "f1617ae7a74049ba23a089e97e6f1f3e20e29809",
"body": "- clarify reference digest policy docs\n- distinguish low-level cid handling from default fail-closed\n verification\n- make CryptoBinary fallback error message position agnostic",
"is_bot": false,
"headline": "fix: address XML signature review comments",
"author_name": "Kushal Das",
"author_login": "kushaldas",
"committed_at": "2026-07-05T18:36:53Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "0b964e5d7330bed84a8aed72c072598eafceb4e8",
"body": "- reject malformed RSA KeyValue hex without panicking\n- require locally verified Reference digests by default\n- add explicit opt-out for detached-content digest workflows\n- cover KeyValue panic and no-reference verification regressions\n- update README, changelog, crate docs, and CID reference ADR",
"is_bot": false,
"headline": "security: harden XML signature verification",
"author_name": "Kushal Das",
"author_login": "kushaldas",
"committed_at": "2026-07-05T18:22:17Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "2f0c675f3a31ce067461e166c3e867f1b912f9f2",
"body": "security: cap XML PBKDF2 iterations",
"is_bot": false,
"headline": "Merge pull request #21 from kushaldas/fix/s1",
"author_name": "Kushal Das",
"author_login": "kushaldas",
"committed_at": "2026-07-05T18:09:07Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "cddbcfb3c02f1a2366f2672ede80b7405250c3df",
"body": null,
"is_bot": false,
"headline": "fix: review comments",
"author_name": "Kushal Das",
"author_login": "kushaldas",
"committed_at": "2026-07-05T18:06:43Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "ed893d9e01fe595083568034eb8e21237e36ddb9",
"body": "- add a configurable EncContext PBKDF2 iteration limit\n- reject zero and over-limit XML Encryption IterationCount values\n- cover parser and DerivedKey decrypt-path regressions\n- document the setting in README and changelog",
"is_bot": false,
"headline": "security: cap XML PBKDF2 iterations",
"author_name": "Kushal Das",
"author_login": "kushaldas",
"committed_at": "2026-07-05T17:58:12Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "9c372555d4ea47b6bc5373cc598d83c4a2cfafec",
"body": "feat: memory performance",
"is_bot": false,
"headline": "Merge pull request #20 from kushaldas/fix/perf",
"author_name": "Kushal Das",
"author_login": "kushaldas",
"committed_at": "2026-07-05T15:56:08Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "7c791281ba1061d581cc2eb5e8f209c0c2834d45",
"body": "- Update crate versions, README, changelog, and performance docs for\n 0.7.0.\n- Add DSig verification fast paths for same-document enveloped-signature\n + C14N references.\n- Add compact/inverted NodeSet storage for whole-document and\n document-element selections.\n- Stream C14N output directly into \n[…]\nia Cow to avoid full-string\n clones.\n- Replace signing template values in place after dropping parsed DOMs,\n reducing peak RSS.\n- Add API docs and code comments for new and existing public surfaces.",
"is_bot": false,
"headline": "feat: memory performance",
"author_name": "Kushal Das",
"author_login": "kushaldas",
"committed_at": "2026-07-05T15:51:08Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "b1d75efaa81a7479c54b2a0bd919025b4b880bb3",
"body": "feat: release 0.6.4",
"is_bot": false,
"headline": "Merge pull request #19 from kushaldas/feat/release",
"author_name": "Kushal Das",
"author_login": "kushaldas",
"committed_at": "2026-07-03T11:55:35Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "10c93d7231f9ecc4b366ff0ad1b7727f856f6555",
"body": "Against 0.8.0 of uppsala",
"is_bot": false,
"headline": "feat: release 0.6.4",
"author_name": "Kushal Das",
"author_login": "kushaldas",
"committed_at": "2026-07-03T11:50:26Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "28499ecffd7af1399bf8d956ae021448bf75395f",
"body": "release: bump to 0.6.3",
"is_bot": false,
"headline": "Merge pull request #18 from kushaldas/feat/release",
"author_name": "Kushal Das",
"author_login": "kushaldas",
"committed_at": "2026-07-02T09:52:59Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "9cfbebb7b1b1f3fa58d99a271ad70d01c8315b4a",
"body": "Update uppsala from 0.7.0 to 0.7.1, a security-hardening release of the\nXML parser:\n\n- XSD validation fails closed on unresolved element references, invalid\n pattern facets, and malformed temporal values\n- Namespace-sensitive attribute declarations compare expanded names\n instead of falling back to local-name matches\n- DTD content-model parsing observes the parser nesting-depth limit\n- XSLT-generated comments and processing instructions reject content\n that would break out of XML markup",
"is_bot": false,
"headline": "release: bump to 0.6.3",
"author_name": "Kushal Das",
"author_login": "kushaldas",
"committed_at": "2026-07-02T09:37:08Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "7b03035baaca2d68ba33830b7b8246cef81bf396",
"body": "Feat/dep update",
"is_bot": false,
"headline": "Merge pull request #17 from kushaldas/feat/dep_update",
"author_name": "Kushal Das",
"author_login": "kushaldas",
"committed_at": "2026-07-01T14:49:05Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "f8aaf3267d09ff6a2253d44225602de820bdd0fa",
"body": null,
"is_bot": false,
"headline": "fix: review comments",
"author_name": "Kushal Das",
"author_login": "kushaldas",
"committed_at": "2026-07-01T14:45:21Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "b172aadffe38b7a789b6300247e711f01d0d83aa",
"body": "Follow-up hardening for the trust-anchor enforcement added in the prior\ncommit, closing a key/leaf confusion bypass found in differential\nreview, plus regression coverage requested in PR review.\n\nkeyinfo.rs (fix): extract_x509_certificate placed inline <X509Data>\ncertificates in document order, so x\n[…]\n adversarially ordered <X509Data>, x509_chain[0]\nis the leaf; the single-cert case is unchanged.\n\nDocs: add docs/adr/0006-x509-leaf-binding.md; note both items in the\n0.6.2 CHANGELOG Security section.",
"is_bot": false,
"headline": "fix(keys,dsig): bind X.509 leaf to signing key",
"author_name": "Kushal Das",
"author_login": "kushaldas",
"committed_at": "2026-07-01T14:39:43Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "c87912b8720bbdbcf44006b57739c70bca991b10",
"body": "Close a certificate trust-bypass: when the caller has configured trust\nanchors, any key carrying an X.509 chain -- including a certificate\nembedded in the signed document's <KeyInfo> -- must now chain to a\nconfigured anchor, even when enabled_key_data_x509/verify_keys are not\nset. Previously a signa\n[…]\nfigured with just the root anchor can build the path.\n- Require tsp-ltv 0.3.1, which adds DSA (DSS) certificate-signature\n verification needed to validate the DSA cert chains in the interop\n corpus.",
"is_bot": false,
"headline": "feat(dsig): enforce trust-anchor chaining",
"author_name": "Kushal Das",
"author_login": "kushaldas",
"committed_at": "2026-07-01T14:17:25Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "73661d185829b4f0c84a3ea3293e701ed1146e73",
"body": "Update shared deps and release 0.6.2:\n\n- Bump workspace version 0.6.1 -> 0.6.2 (workspace.package + all\n internal bergshamra-* pins).\n- Update uppsala 0.5.2 -> 0.7.0 and kryptering 0.4.0 -> 0.4.1.\n- Align AES/3DES cipher primitives with the RustCrypto cipher 0.5 wave\n used by kryptering 0.4.1: aes\n[…]\nr 0.4 copy remains via pkcs5 0.7 (encrypted PKCS#8),\nwhich is locked to the pkcs8 0.10 / der 0.7 format wave and cannot be\ncollapsed yet. No public API changes. Build, tests, clippy, and fmt all\npass.",
"is_bot": false,
"headline": "build(deps): bump to 0.6.2",
"author_name": "Kushal Das",
"author_login": "kushaldas",
"committed_at": "2026-07-01T10:30:52Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "8faff060127f9c0f23980aa690236432800b7b1f",
"body": "perf(c14n): faster canonicalization; bump uppsala to 0.6.0",
"is_bot": false,
"headline": "Merge pull request #16 from kushaldas/feat/perf-harness-uppsala-path",
"author_name": "Kushal Das",
"author_login": "kushaldas",
"committed_at": "2026-06-30T09:10:37Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "2d3cdfd64be8eb9fd6c86bb72a26ef5264936461",
"body": "- base64_transform: in the ASCII path, only allocate a cleaned buffer\n when whitespace is actually present. For line-break-free base64 (the\n common case) decode directly from text.as_bytes(), avoiding an extra\n allocation and copy. Whitespace-bearing ASCII input and non-ASCII\n input behave exact\n[…]\nxt.clone() in the Text/CData\n canonicalization arm. escape_text_into takes &str, so the borrowed\n value passes directly (deref coercion), removing an allocation per\n text node on the C14N hot path.",
"is_bot": false,
"headline": "perf(c14n,transforms): review fixes",
"author_name": "Kushal Das",
"author_login": "kushaldas",
"committed_at": "2026-06-30T08:36:03Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "01cc7efdfffa30d2f7eb708d7bde15acbe109c52",
"body": "PR review (Copilot) follow-up: in the ASCII base64 path the filter\nclosure bound b as &u8 while the matches! arms are u8 literals. The code\ncompiled via match ergonomics, but destructuring |&b| makes the match\nagainst a plain u8 explicit and idiomatic.",
"is_bot": false,
"headline": "fix(transforms): destructure byte in base64 whitespace filter",
"author_name": "Kushal Das",
"author_login": "kushaldas",
"committed_at": "2026-06-30T08:24:41Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "3e67a6b3a0a97fbd81e94695bbabb0b7369c5d55",
"body": "PR review (Copilot) follow-up: the non-ASCII base64 whitespace fallback\ncalled engine.decode() with an owned String, while the ASCII branch and\nthe rest of the codebase pass a reference. It compiles (decode takes\nimpl AsRef<[u8]>), but pass &cleaned for consistency and to avoid a\npotential type mismatch.",
"is_bot": false,
"headline": "fix(transforms): pass base64 fallback buffer by reference",
"author_name": "Kushal Das",
"author_login": "kushaldas",
"committed_at": "2026-06-30T08:12:56Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "356045d974a40c7d177c1929c354f82894ec6c71",
"body": "PR review (Copilot) noted that stripping base64 whitespace at the byte\nlevel changed acceptance semantics: char::is_whitespace() also removes\nnon-ASCII Unicode whitespace (NBSP U+00A0, U+2028, etc.), which the\nbyte-only filter would leave in place, turning previously-accepted input\ninto a decode err\n[…]\ns_whitespace() matches, so behavior is identical;\nnon-ASCII input now runs the original code verbatim. This keeps the\nperformance win for the common ASCII case without changing accept/reject\nbehavior.",
"is_bot": false,
"headline": "fix(transforms): preserve Unicode-whitespace stripping",
"author_name": "Kushal Das",
"author_login": "kushaldas",
"committed_at": "2026-06-30T08:02:14Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "23752da5e80b06cfbdea8eab7afa006d5e652b93",
"body": "Speed up the C14N hot paths that every XML-DSig/XML-Enc operation\nexercises, with no change to output bytes and no measured regression.\n\nChanges:\n\n- deps: bump uppsala 0.5.2 -> 0.6.0 (crates.io). Picks up the upstream\n parser performance work (faster default-namespace resolution,\n attribute/entity\n[…]\n7 / FAILED 0, Enc TOTAL OK 701 / FAILED 0. C14N output is\nhash input, so any changed byte would flip signature/digest tests to\nFAILED; none did.\n\nNew deps: memchr (lib), criterion (dev-only, benches).",
"is_bot": false,
"headline": "perf(c14n): faster canonicalization; bump uppsala to 0.6.0",
"author_name": "Kushal Das",
"author_login": "kushaldas",
"committed_at": "2026-06-30T07:35:53Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "dfe78f79497dac3a067324a6612db6b22a8ea4d8",
"body": "build(deps): cargo update safe patches",
"is_bot": false,
"headline": "Merge pull request #15 from kushaldas/fix/deps",
"author_name": "Kushal Das",
"author_login": "kushaldas",
"committed_at": "2026-06-29T16:52:27Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "98bbde762e84c0f1654f4bd78bf074b3840daea6",
"body": "Roll forward in-range deps. wasm-bindgen 0.2.122->0.2.126 drops the\nwit-bindgen build toolchain that pulled anyhow 1.0.102, clearing the\nRUSTSEC-2026-0190 unsound advisory that failed `cargo audit` in CI. Also\nbumps zeroize 1.8->1.9, zerocopy, syn, quote, smallvec, log.\n\ncipher 0.4->0.5 wave left untouched: blocked by kryptering 0.4.0 (pins\naes 0.8 / cbc 0.1 / des 0.8 / aes-kw 0.2).",
"is_bot": false,
"headline": "build(deps): cargo update safe patches",
"author_name": "Kushal Das",
"author_login": "kushaldas",
"committed_at": "2026-06-29T16:47:39Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "690552d55a244a522d323fe4841e4d0adbf6be7c",
"body": "build(deps): update uppsala to 0.5.2 from crates.io",
"is_bot": false,
"headline": "Merge pull request #14 from kushaldas/feat/uppsala_update",
"author_name": "Kushal Das",
"author_login": "kushaldas",
"committed_at": "2026-06-29T14:21:17Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "d90c892c0a22801ba0516fd8c11ba5db4cc053f0",
"body": "Bump the uppsala XML parser dependency from 0.5.0 to 0.5.2,\nsourced from crates.io. All workspace crates inherit the version\nvia `uppsala.workspace = true`, so only the root Cargo.toml and\nCargo.lock change. No API changes required; full build and the\nDSig/Enc xmlsec integration suites pass",
"is_bot": false,
"headline": "build(deps): update uppsala to 0.5.2 from crates.io",
"author_name": "Kushal Das",
"author_login": "kushaldas",
"committed_at": "2026-06-29T14:18:43Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "d32fc1e94273ce4aa221f21c6c9c6e408d0658cb",
"body": "feat(dsig): add verify_all to verify every signature",
"is_bot": false,
"headline": "Merge pull request #13 from kushaldas/feat/dsig",
"author_name": "Kushal Das",
"author_login": "kushaldas",
"committed_at": "2026-06-29T12:52:55Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "7719787ea1aba1d33d5dc5a66b8d8120709989e1",
"body": "PR #13 review: the verify_all code block in\ndocs/adr/0005-verify-all-signatures.md still used `?` inside the\nper-signature loop, contradicting the ADR's own stated contract that a\nper-signature structural/processing error is reported as\nVerifyResult::Invalid and must not short-circuit the whole call\n[…]\ndate the snippet to mirror the actual implementation: match on\nverify_signature_node, map Err to a VerifyResult::Invalid entry, and\ncontinue, so document-level errors are the only ones that propagate.",
"is_bot": false,
"headline": "docs(adr): match verify_all snippet in adr",
"author_name": "Kushal Das",
"author_login": "kushaldas",
"committed_at": "2026-06-29T12:42:22Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "41a682f5fbc2d18184ef36f6bd767d54f3888de6",
"body": "Two review findings from the second pass on the verify_all change.\n\nverify_all no longer short-circuits on a per-signature error. A `?`\ninside the loop let one structurally broken signature (missing\nSignedInfo, unsupported algorithm, unresolvable key, XSW position\nviolation, etc.) abort the entire c\n[…]\nong order.\n\nbergshamra: cargo test -p bergshamra-dsig 33 passed; clippy + fmt clean.\nDownstream gamlastan double-signature test and the full SPID conformance\nsuite (263 passed, 0 failed) remain green.",
"is_bot": false,
"headline": "fix(dsig): address PR #13 review on verify_all",
"author_name": "Kushal Das",
"author_login": "kushaldas",
"committed_at": "2026-06-29T12:33:17Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "669a3c6df81ad812572b2d2c6a2bc15021a2f725",
"body": "PR #13 review: the document-order assertion compared the Option<usize>\nvalues returned by Iterator::position directly. Because None < Some(_)\nevaluates to true, a missing signature node would have satisfied the\nordering check and masked a traversal or ordering bug instead of\nfailing.\n\nUnwrap both positions with expect (so an absent node fails the test\nloudly with a clear message) and compare the resulting usize indices. No\nchange to find_all_elements or any non-test code.",
"is_bot": false,
"headline": "test(dsig): unwrap signature positions in find_all_elements test",
"author_name": "Kushal Das",
"author_login": "kushaldas",
"committed_at": "2026-06-29T12:22:47Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "5ec9814d8e586a31722ac866f5814086f66048c3",
"body": "verify() reports only the first <Signature> in document order. That is\ninsufficient for documents signed in more than one place -- most\nimportantly a SAML Response signed at both the Response and the\nAssertion level, where the Response signature comes first. A caller that\nmust confirm a specific obj\n[…]\ned end to end by the downstream gamlastan\nSP (double-signed Response + Assertion).\n\nBump workspace to 0.6.1 and update CHANGELOG. No behavior change to the\nexisting verify() / verify_enveloped() path.",
"is_bot": false,
"headline": "feat(dsig): add verify_all to verify every signature",
"author_name": "Kushal Das",
"author_login": "kushaldas",
"committed_at": "2026-06-29T12:13:11Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "d642f88ad5943a05d430666685d73c3e8f835056",
"body": "fix: one by one publish",
"is_bot": false,
"headline": "Merge pull request #12 from kushaldas/publish_flow",
"author_name": "Kushal Das",
"author_login": "kushaldas",
"committed_at": "2026-06-27T12:53:21Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "b777e15b1a1f9107bd767892f22d57b056231e83",
"body": null,
"is_bot": false,
"headline": "fix: one by one publish",
"author_name": "Kushal Das",
"author_login": "kushaldas",
"committed_at": "2026-06-27T12:43:37Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "c9c2c8cbd396f0021678a688d5235f3660b1b6c8",
"body": "refactor(dsig): dedup reference-digest policy",
"is_bot": false,
"headline": "Merge pull request #11 from kushaldas/cleanup",
"author_name": "Kushal Das",
"author_login": "kushaldas",
"committed_at": "2026-06-27T12:28:17Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "60e1dc3fa98d548ba160b81ab8112b127f63cf55",
"body": "Route the CLI reference-digest check through the canonical VerifyResult\nmethods instead of a parallel reference_digest_policy_error helper, so the\n\"all verified / any unverified / no coverage\" policy lives in one place.\n\n- main.rs: drop reference_digest_policy_error and its tests; cmd_verify now\n c\n[…]\nferences and\n all_reference_digests_verified, spelling out the zero-reference case.\n- CHANGELOG: record the new VerifyResult helpers and the CLI\n verify --require-reference-digests flag under 0.6.0.",
"is_bot": false,
"headline": "refactor(dsig): dedup reference-digest policy",
"author_name": "Kushal Das",
"author_login": "kushaldas",
"committed_at": "2026-06-27T12:27:04Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "1b38b84b4e0fa889187142ea96dfe82da2e75b05",
"body": "feat(cli): require verified reference digests on request",
"is_bot": false,
"headline": "Merge pull request #9 from salasebas/feat/001-reference-digest-policy",
"author_name": "Kushal Das",
"author_login": "kushaldas",
"committed_at": "2026-06-27T12:09:24Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "1ffd37cf8f9c4ab645fdcc9d738c1267a150cb6a",
"body": "feat: release 0.6.0",
"is_bot": false,
"headline": "Merge pull request #10 from kushaldas/feat/release060",
"author_name": "Kushal Das",
"author_login": "kushaldas",
"committed_at": "2026-06-27T11:52:40Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "e80e1d6e0b5b8b008412dc789516428c4c9a0e89",
"body": null,
"is_bot": false,
"headline": "chore: crypto-bigint to 0.7.5",
"author_name": "Kushal Das",
"author_login": "kushaldas",
"committed_at": "2026-06-27T11:48:40Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "33174b9b20dd94138c7229c3d8c28065a26086a3",
"body": null,
"is_bot": false,
"headline": "chore: action updates",
"author_name": "Kushal Das",
"author_login": "kushaldas",
"committed_at": "2026-06-27T11:43:44Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "c5c85650f8fc56de7f818261e569c3ca52b6d64a",
"body": "Bump workspace to 0.6.0 and align internal crate dep pins.\n\nUpdates shared dependencies to their latest releases:\n - kryptering 0.3.0 -> 0.4.0\n - tsp-ltv 0.2.0 -> 0.3.0\n - uppsala 0.4.0 -> 0.5.0",
"is_bot": false,
"headline": "feat: release 0.6.0",
"author_name": "Kushal Das",
"author_login": "kushaldas",
"committed_at": "2026-06-27T11:40:17Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "73c4e13ab06aa08a4b057ab1206c2484fc71ba4e",
"body": null,
"is_bot": false,
"headline": "feat(cli): require verified reference digests on request",
"author_name": "sebastian",
"author_login": "salasebas",
"committed_at": "2026-06-20T23:09:59Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "0472caa685946c8bf414fb75ab32ea0bc8bc2d43",
"body": null,
"is_bot": false,
"headline": "feat: 0.5.1 release",
"author_name": "Kushal Das",
"author_login": "kushaldas",
"committed_at": "2026-06-07T06:46:49Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "0a41a04581639898947d53be17e42e2eab94991d",
"body": "chore: CI release to crates.io",
"is_bot": false,
"headline": "Merge pull request #7 from kushaldas/fix/crates",
"author_name": "Kushal Das",
"author_login": "kushaldas",
"committed_at": "2026-06-07T05:28:49Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "d4aadf01763c0969d3fabeb28de6b02959905d91",
"body": null,
"is_bot": false,
"headline": "chore: CI release to crates.io",
"author_name": "Kushal Das",
"author_login": "kushaldas",
"committed_at": "2026-06-07T05:26:23Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "6ac3a1706fdcbf19c9c9f27eddcef5b96e90fd22",
"body": "fix: Enforce trusted X509 validation in CLI verify path",
"is_bot": false,
"headline": "Merge pull request #6 from kushaldas/fix/cli_verify_x509",
"author_name": "Kushal Das",
"author_login": "kushaldas",
"committed_at": "2026-06-06T20:07:35Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "1a92a1ebe464bd7459dfc240071dfb023e7dce10",
"body": "Make the bergshamra CLI treat trusted roots as sufficient to enable\ninline X509 validation during verify, while preserving xmlsec\ncompatibility through x509-skip-strict-checks. Forward the skip-strict\nflag from the xmlsec shim, keep library behavior unchanged, and add an\nADR documenting why this was implemented in the CLI instead of the DSig\nlibrary.",
"is_bot": false,
"headline": "fix: Enforce trusted X509 validation in CLI verify path",
"author_name": "Kushal Das",
"author_login": "kushaldas",
"committed_at": "2026-06-06T19:56:34Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "7d8c370f683269e81dc8a27f334f4945a451f9aa",
"body": "For next release",
"is_bot": false,
"headline": "Merge pull request #5 from kushaldas/updates",
"author_name": "Kushal Das",
"author_login": "kushaldas",
"committed_at": "2026-06-06T18:38:30Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "d538932a58c0636100f7213fec2a8f161ccd24a0",
"body": null,
"is_bot": false,
"headline": "fix: review comments removing old legacy URL",
"author_name": "Kushal Das",
"author_login": "kushaldas",
"committed_at": "2026-06-06T18:34:15Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "82ed0af35c794c31738f8231d2969a9aa11605f0",
"body": "- reject explicit unsupported OAEP DigestMethod and MGF URIs instead of\n silently falling back\n- require HSM encrypt/decrypt/wrap/unwrap contexts to declare which\n EncryptionMethod URIs they are allowed to service\n- fail closed when an HSM operation does not match the XML-declared\n algorithm\n- add unit tests for OAEP URI validation and HSM algorithm binding keep\n current xmlsec interop level unchanged",
"is_bot": false,
"headline": "fix: harden OAEP parsing and bind HSM ops to XML methods",
"author_name": "Kushal Das",
"author_login": "kushaldas",
"committed_at": "2026-06-06T18:03:40Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "144ae000a51752ee18a6954014612ca825c097f0",
"body": "setup.sh no longer overwrites the committed softhsm2.conf\n- Generate a gitignored hsm-test/softhsm2.local.conf (with the absolute,\n machine-specific tokendir) instead of rewriting the committed file in\n place. This keeps the working tree clean and prevents accidental\n commits of machine-specific \n[…]\neric, Debian multiarch,\n lib64, /usr/local) so the ignored integration tests do not panic on\n systems where SoftHSM2 lives in the additional paths.\n- The not-found panic now lists every probed path.",
"is_bot": false,
"headline": "fix: review comments",
"author_name": "Kushal Das",
"author_login": "kushaldas",
"committed_at": "2026-06-06T13:41:52Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "5df95000053f76a655ff0f3152415a015fa4b476",
"body": "Version\n- workspace.package version 0.4.1 -> 0.5.0\n- bump the 9 internal crate version refs in workspace.dependencies\n\nSecurity\n- DsigContext/EncContext Debug impls no longer format the KeysManager,\n which (via derived Debug on KeysManager/Key) printed private RSA/EC key\n material and raw HMAC/AES\n[…]\ntale note claiming kryptering is a local path\n dep; the workspace now resolves kryptering and tsp-ltv from crates.io.\n- .cargo/audit.toml: update the ml-dsa advisory note from =0.1.0-rc.8 to\n 0.1.1.",
"is_bot": false,
"headline": "fix: resolve all 11 review comments on PR #5.",
"author_name": "Kushal Das",
"author_login": "kushaldas",
"committed_at": "2026-06-06T13:08:53Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "2afa858c14ffc48fbf9b6c8c82cd5f7406f4bfb4",
"body": "Updates kryptering and tsp-ltv dependencies.",
"is_bot": false,
"headline": "feat(keys): gate weak-digest X.509 chains behind legacy-algorithms",
"author_name": "Kushal Das",
"author_login": "kushaldas",
"committed_at": "2026-06-06T12:29:49Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "832c9f511356abfb944386576db537fca7fd3a95",
"body": "Three new GitHub Actions workflows under .github/workflows:\n\n - audit.yml - cargo audit --deny warnings on push/PR (paths-filtered\n to Cargo.* and .cargo/audit.toml) and on a weekly cron.\n - ci.yml - fmt + clippy + test across three feature configs\n (--no-d\n[…]\namples/debug_digest.rs - 5 map_or simplifications via\n cargo clippy --fix\n\nCargo.lock rolls forward with cryptoki 0.12.0 and secrecy 0.10.3\nreplacing cryptoki 0.7.0 + paste 1.0.15 + bitflags 1.x.",
"is_bot": false,
"headline": "chore: add CI workflows, audit config, and clean preexisting lints",
"author_name": "Kushal Das",
"author_login": "kushaldas",
"committed_at": "2026-04-23T07:11:24Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "61a1d1991b4549ff81be8c40e626a3470c92066c",
"body": "Bump ml-dsa 0.1.0-rc.7 -> 0.1.0-rc.8 and replace sign_deterministic\nwith sign_randomized seeded from getrandom::SysRng. Deterministic\nML-DSA is vulnerable to fault-injection attacks that recover bits of\nthe secret vectors by diffing a faulted signature against a clean one\non the same message (Bruind\n[…]\nrationale and the\ntwo-RNG split pending upstream rand_core unification. Verify path\nunchanged; existing signatures continue to verify. ML-DSA output is\nno longer bit-for-bit reproducible across calls.",
"is_bot": false,
"headline": "fix(sign): randomized ML-DSA + syscall-backed RNG on signing paths",
"author_name": "Kushal Das",
"author_login": "kushaldas",
"committed_at": "2026-04-23T06:39:13Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "b218c79227477b65fa740e82d1b834a72760fbab",
"body": "…ntly\n\nresolve_decryption_key (decrypt.rs) and resolve_encryption_key\n(encrypt.rs) both used `if let Ok(key) = resolve_derived_key(...)` for\n<DerivedKey> elements. A failing derivation would fall through to the\nKeyName / first-symmetric-key fallback below, which in the PBKDF2 /\nConcatKDF test vector\n[…]\nng commit that relaxes\nPBKDF2_MIN_SALT_LEN (16 -> 8) and PBKDF2_MIN_ITERATIONS (1000 -> 1).\nTogether they take `just test-enc` from 21 failures to 0 while\nkeeping `just test-dsig` green (447 / 0 / 3).",
"is_bot": false,
"headline": "fix(enc): surface DerivedKey failures instead of swallowing them sile…",
"author_name": "Kushal Das",
"author_login": "kushaldas",
"committed_at": "2026-04-22T19:00:27Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "658c947a33c5c284bd61c7088f2f1e4d70b975ae",
"body": "DsigContext::new() now enables XSW protection, trusted-keys-only, and a\n160-bit HMAC output floor (CVE-2009-0217) out of the box the posture\nSAML and WS-Security consumers actually need. W3C-standard permissive\nbehavior moves to new_permissive() for self-contained signatures and\nexisting callers tha\n[…]\nened defaults; new_permissive() preserves\nprior behavior\n- lib.rs: rustdoc updated to document the split\n- verify.rs tests + CLI (cmd_verify, cmd_sign): use new_permissive() to\nkeep existing semantics",
"is_bot": false,
"headline": "feat(dsig): secure-by-default DsigContext::new() for federated identity",
"author_name": "Kushal Das",
"author_login": "kushaldas",
"committed_at": "2026-04-22T17:33:36Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "4618621b4cd5fad7fe10c683f4ec042335f16607",
"body": "VerifiedReference now carries a digest_verified flag so callers can\ndistinguish references whose digest was computed and checked (true)\nfrom cid: URI references that were skipped (false). WS-Security\nconsumers must verify MIME attachment digests separately when\ndigest_verified is false.",
"is_bot": false,
"headline": "feat: add digest_verified field to VerifiedReference",
"author_name": "Kushal Das",
"author_login": "kushaldas",
"committed_at": "2026-04-09T07:04:46Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "ae94be4038b1ad83362d0453167e8b46b7d32efa",
"body": null,
"is_bot": false,
"headline": "fix: tsp-ltv from crates.io",
"author_name": "Kushal Das",
"author_login": "kushaldas",
"committed_at": "2026-04-02T10:56:43Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "943faea93dd807f3ba3b644c9a56f7127de0ae7b",
"body": null,
"is_bot": false,
"headline": "add: test gitignore",
"author_name": "Kushal Das",
"author_login": "kushaldas",
"committed_at": "2026-04-02T10:54:12Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "01da8c7d5e04f22a25774b994f9e0ad001305860",
"body": "Replace internal crypto implementations with the shared kryptering crate\n(v0.1.0) for all cryptographic operations. This eliminates ~1700 lines of\nduplicated crypto code and adds PKCS#11 HSM support to both XML-DSig and\nXML-Enc.\n\n- bergshamra-crypto: becomes a thin URI-mapping adapter over krypterin\n[…]\nEd25519, HMAC, and AES test keys. 11 integration\n tests covering RSA, RSA-PSS, ECDSA P-256/P-384, Ed25519, HMAC, and\n full XML signature sign/verify via HSM. Justfile recipes: hsm-setup,\n test-hsm.",
"is_bot": false,
"headline": "feat: kryptering shared crypto backend and HSM support",
"author_name": "Kushal Das",
"author_login": "kushaldas",
"committed_at": "2026-04-02T10:52:39Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "db872b9f444d742bc17bf45396d4ee91c229914f",
"body": "Add convenience methods on Key (algorithm_name, to_spki_der,\nto_key_value_xml, has_private_key) and make Ed25519 and post-quantum\nkey loader functions public for downstream use.",
"is_bot": false,
"headline": "feat: 0.3.1 expose Key introspection and loader functions",
"author_name": "Kushal Das",
"author_login": "kushaldas",
"committed_at": "2026-03-06T08:45:54Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "531b400b0027380cdeb87c9b93902ab6241d05d0",
"body": null,
"is_bot": false,
"headline": "feat: 0.3.0",
"author_name": "Kushal Das",
"author_login": "kushaldas",
"committed_at": "2026-02-26T11:46:34Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "6bd1374888d29b2044f10722d239943b875c5aa2",
"body": "- Add with_* builder methods on DsigContext (10) and EncContext (1) for\nfluent configuration while keeping fields public (non-breaking)\n- Add top-level re-exports in bergshamra crate for commonly used types\n(Error, DsigContext, EncContext, KeysManager, Key, etc.) and\nentry-point functions (verify, s\n[…]\nring] to\n&[S: AsRef<str>], accepting both &[String] and &[&str]\n- Add VerifiedKeyInfo struct to VerifyResult::Valid carrying the signing\n key's algorithm name, key name, and X.509 certificate chain",
"is_bot": false,
"headline": "refactor: public API",
"author_name": "Kushal Das",
"author_login": "kushaldas",
"committed_at": "2026-02-26T11:42:12Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "894f37e6dc5380f428aab1d11d3abf6cca48873f",
"body": "Migrates 7 sites across sign.rs, encrypt.rs, and verify.rs from string\ninterpolation with if/else prefix branches to Uppsala's XmlWriter API.\nAdd pname() helpers for prefixed element names.\n\nThe OPC Relationships builder in verify.rs benefits most \\u2014\nreplacing 10+ push_str() calls and manual xml\n[…]\nn attribute escaping via empty_element_expanded().\n\nSites not migrated: tag-preservation utilities\n(format_cipher_value_element_range, populate_der_encoded_key_value),\nC14N render, and XSLT evaluator.",
"is_bot": false,
"headline": "refactor: Replace format!()-based XML construction with XmlWriter",
"author_name": "Kushal Das",
"author_login": "kushaldas",
"committed_at": "2026-02-26T11:06:51Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "5a9dbf29f0947490a807f12f560ad79930bafd72",
"body": "Replace format!()-based XML construction in KeyData::to_key_value_xml()\nwith Uppsala's XmlWriter for RSA, DSA, DH, EC, and X25519 key types.\nDeduplicate EC key value generation into a shared\nbuild_ec_key_value_xml() helper.\n\nAdd build_x509_key_info() and build_x509_key_info_from_der() for\nprogrammatic construction of <KeyInfo> fragments containing X.509\ncertificates, with unit tests.\n\nApply cargo fmt across bergshamra-keys.",
"is_bot": false,
"headline": "refactor: KeyValue XML generation",
"author_name": "Kushal Das",
"author_login": "kushaldas",
"committed_at": "2026-02-25T20:35:26Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "74af1ca2530126e841906c8c73bdaa8065508dbe",
"body": "Adds link to the external repo for attack examples.",
"is_bot": false,
"headline": "doc: security examples",
"author_name": "Kushal Das",
"author_login": "kushaldas",
"committed_at": "2026-02-25T16:02:35Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "1c9ceac5c466028ee082271861d17753084d03f9",
"body": null,
"is_bot": false,
"headline": "chore: 0.2.1",
"author_name": "Kushal Das",
"author_login": "kushaldas",
"committed_at": "2026-02-24T16:35:23Z",
"body_truncated": false,
"is_coding_agent": false
}
],
"releases_count": 8,
"commits_last_year": 119,
"latest_release_at": "2026-08-01T10:13:20Z",
"latest_release_tag": "v0.8.0",
"releases_from_tags": false,
"days_since_last_push": 0,
"active_weeks_last_year": 11,
"days_since_latest_release": 0,
"mean_days_between_releases": 7.9
},
"community": {
"has_readme": true,
"has_license": true,
"has_description": true,
"has_contributing": false,
"health_percentage": 42,
"has_issue_template": false,
"has_code_of_conduct": false,
"has_pull_request_template": false
},
"ecosystem": {
"packages": [
{
"name": "bergshamra",
"exists": true,
"license": "BSD-2-Clause",
"keywords": [],
"ecosystem": "crates",
"matches_repo": true,
"registry_url": "https://crates.io/crates/bergshamra",
"is_deprecated": false,
"latest_version": "0.8.0",
"repository_url": "https://github.com/kushaldas/bergshamra",
"versions_count": 16,
"total_downloads": 32347,
"dependents_count": null,
"deprecation_note": null,
"maintainers_count": null,
"monthly_downloads": 9169,
"first_published_at": "2026-02-22T15:12:55.719543Z",
"latest_published_at": "2026-08-01T10:13:09.203744Z",
"latest_version_yanked": false,
"days_since_latest_publish": 0
},
{
"name": "bergshamra-enc",
"exists": true,
"license": "BSD-2-Clause",
"keywords": [],
"ecosystem": "crates",
"matches_repo": true,
"registry_url": "https://crates.io/crates/bergshamra-enc",
"is_deprecated": false,
"latest_version": "0.8.0",
"repository_url": "https://github.com/kushaldas/bergshamra",
"versions_count": 16,
"total_downloads": 32816,
"dependents_count": null,
"deprecation_note": null,
"maintainers_count": null,
"monthly_downloads": 9297,
"first_published_at": "2026-02-22T15:01:24.419690Z",
"latest_published_at": "2026-08-01T10:13:04.395735Z",
"latest_version_yanked": false,
"days_since_latest_publish": 0
},
{
"name": "bergshamra-xml",
"exists": true,
"license": "BSD-2-Clause",
"keywords": [],
"ecosystem": "crates",
"matches_repo": true,
"registry_url": "https://crates.io/crates/bergshamra-xml",
"is_deprecated": false,
"latest_version": "0.8.0",
"repository_url": "https://github.com/kushaldas/bergshamra",
"versions_count": 16,
"total_downloads": 48052,
"dependents_count": null,
"deprecation_note": null,
"maintainers_count": null,
"monthly_downloads": 13960,
"first_published_at": "2026-02-22T14:24:46.524157Z",
"latest_published_at": "2026-08-01T10:12:42.198623Z",
"latest_version_yanked": false,
"days_since_latest_publish": 0
},
{
"name": "bergshamra-c14n",
"exists": true,
"license": "BSD-2-Clause",
"keywords": [],
"ecosystem": "crates",
"matches_repo": true,
"registry_url": "https://crates.io/crates/bergshamra-c14n",
"is_deprecated": false,
"latest_version": "0.8.0",
"repository_url": "https://github.com/kushaldas/bergshamra",
"versions_count": 16,
"total_downloads": 47995,
"dependents_count": null,
"deprecation_note": null,
"maintainers_count": null,
"monthly_downloads": 13955,
"first_published_at": "2026-02-22T14:24:49.781961Z",
"latest_published_at": "2026-08-01T10:12:50.214164Z",
"latest_version_yanked": false,
"days_since_latest_publish": 0
},
{
"name": "bergshamra-core",
"exists": true,
"license": "BSD-2-Clause",
"keywords": [],
"ecosystem": "crates",
"matches_repo": true,
"registry_url": "https://crates.io/crates/bergshamra-core",
"is_deprecated": false,
"latest_version": "0.8.0",
"repository_url": "https://github.com/kushaldas/bergshamra",
"versions_count": 16,
"total_downloads": 49699,
"dependents_count": null,
"deprecation_note": null,
"maintainers_count": null,
"monthly_downloads": 14458,
"first_published_at": "2026-02-22T14:24:42.651944Z",
"latest_published_at": "2026-08-01T10:12:39.739999Z",
"latest_version_yanked": false,
"days_since_latest_publish": 0
},
{
"name": "bergshamra-dsig",
"exists": true,
"license": "BSD-2-Clause",
"keywords": [],
"ecosystem": "crates",
"matches_repo": true,
"registry_url": "https://crates.io/crates/bergshamra-dsig",
"is_deprecated": false,
"latest_version": "0.8.0",
"repository_url": "https://github.com/kushaldas/bergshamra",
"versions_count": 16,
"total_downloads": 41539,
"dependents_count": null,
"deprecation_note": null,
"maintainers_count": null,
"monthly_downloads": 12485,
"first_published_at": "2026-02-22T14:50:09.382844Z",
"latest_published_at": "2026-08-01T10:13:01.831514Z",
"latest_version_yanked": false,
"days_since_latest_publish": 0
},
{
"name": "bergshamra-keys",
"exists": true,
"license": "BSD-2-Clause",
"keywords": [],
"ecosystem": "crates",
"matches_repo": true,
"registry_url": "https://crates.io/crates/bergshamra-keys",
"is_deprecated": false,
"latest_version": "0.8.0",
"repository_url": "https://github.com/kushaldas/bergshamra",
"versions_count": 16,
"total_downloads": 42220,
"dependents_count": null,
"deprecation_note": null,
"maintainers_count": null,
"monthly_downloads": 12612,
"first_published_at": "2026-02-22T14:30:05.217177Z",
"latest_published_at": "2026-08-01T10:12:53.747116Z",
"latest_version_yanked": false,
"days_since_latest_publish": 0
},
{
"name": "bergshamra-crypto",
"exists": true,
"license": "BSD-2-Clause",
"keywords": [],
"ecosystem": "crates",
"matches_repo": true,
"registry_url": "https://crates.io/crates/bergshamra-crypto",
"is_deprecated": false,
"latest_version": "0.8.0",
"repository_url": "https://github.com/kushaldas/bergshamra",
"versions_count": 16,
"total_downloads": 42321,
"dependents_count": null,
"deprecation_note": null,
"maintainers_count": null,
"monthly_downloads": 12630,
"first_published_at": "2026-02-22T14:24:45.322449Z",
"latest_published_at": "2026-08-01T10:12:44.583147Z",
"latest_version_yanked": false,
"days_since_latest_publish": 0
}
]
},
"popularity": {
"forks": 2,
"stars": 10,
"watchers": 0,
"fork_history": {
"days": [
{
"date": "2026-06-01",
"count": 1
},
{
"date": "2026-07-20",
"count": 1
}
],
"complete": true,
"collected": 2,
"total_forks": 2
},
"star_history": null,
"open_issues_and_prs": 2
},
"ai_readiness": {
"has_nix": false,
"example_dirs": [
"examples"
],
"has_llms_txt": false,
"has_dockerfile": false,
"has_mcp_signal": false,
"bootstrap_files": [
"justfile"
],
"api_schema_files": [],
"has_devcontainer": false,
"typecheck_configs": [],
"toolchain_manifests": [
"Cargo.toml",
"crates/bergshamra-c14n/Cargo.toml",
"crates/bergshamra-core/Cargo.toml",
"crates/bergshamra-crypto/Cargo.toml",
"crates/bergshamra-dsig/Cargo.toml",
"crates/bergshamra-enc/Cargo.toml",
"crates/bergshamra-keys/Cargo.toml",
"crates/bergshamra-pkcs12/Cargo.toml",
"crates/bergshamra-transforms/Cargo.toml",
"crates/bergshamra-xml/Cargo.toml",
"crates/bergshamra/Cargo.toml"
],
"largest_source_bytes": 208188,
"source_files_sampled": 59,
"oversized_source_files": 3,
"agent_instruction_files": [],
"agent_instruction_max_bytes": null
},
"dependencies": {
"manifests": [
"Cargo.toml"
],
"advisories": {
"error": null,
"scope": null,
"source": null,
"findings": [],
"collected": false,
"malicious": [],
"truncated": false,
"by_severity": {},
"advisory_count": 0,
"affected_count": 0,
"assessed_count": 0,
"malicious_count": 0,
"assessed_package": null,
"unassessed_count": 0,
"direct_affected_count": 0
},
"ecosystems": [
"crates"
],
"dependencies": [
{
"name": "bergshamra-core",
"manifest": "crates/bergshamra-c14n/Cargo.toml",
"ecosystem": "crates",
"version_constraint": null
},
{
"name": "bergshamra-xml",
"manifest": "crates/bergshamra-c14n/Cargo.toml",
"ecosystem": "crates",
"version_constraint": null
},
{
"name": "uppsala",
"manifest": "crates/bergshamra-c14n/Cargo.toml",
"ecosystem": "crates",
"version_constraint": null
},
{
"name": "memchr",
"manifest": "crates/bergshamra-c14n/Cargo.toml",
"ecosystem": "crates",
"version_constraint": null
},
{
"name": "thiserror",
"manifest": "crates/bergshamra-core/Cargo.toml",
"ecosystem": "crates",
"version_constraint": null
},
{
"name": "bergshamra-core",
"manifest": "crates/bergshamra-crypto/Cargo.toml",
"ecosystem": "crates",
"version_constraint": null
},
{
"name": "kryptering",
"manifest": "crates/bergshamra-crypto/Cargo.toml",
"ecosystem": "crates",
"version_constraint": null
},
{
"name": "bergshamra-core",
"manifest": "crates/bergshamra-dsig/Cargo.toml",
"ecosystem": "crates",
"version_constraint": null
},
{
"name": "bergshamra-xml",
"manifest": "crates/bergshamra-dsig/Cargo.toml",
"ecosystem": "crates",
"version_constraint": null
},
{
"name": "bergshamra-transforms",
"manifest": "crates/bergshamra-dsig/Cargo.toml",
"ecosystem": "crates",
"version_constraint": null
},
{
"name": "bergshamra-keys",
"manifest": "crates/bergshamra-dsig/Cargo.toml",
"ecosystem": "crates",
"version_constraint": null
},
{
"name": "bergshamra-c14n",
"manifest": "crates/bergshamra-dsig/Cargo.toml",
"ecosystem": "crates",
"version_constraint": null
},
{
"name": "bergshamra-crypto",
"manifest": "crates/bergshamra-dsig/Cargo.toml",
"ecosystem": "crates",
"version_constraint": null
},
{
"name": "kryptering",
"manifest": "crates/bergshamra-dsig/Cargo.toml",
"ecosystem": "crates",
"version_constraint": null
},
{
"name": "base64",
"manifest": "crates/bergshamra-dsig/Cargo.toml",
"ecosystem": "crates",
"version_constraint": null
},
{
"name": "uppsala",
"manifest": "crates/bergshamra-dsig/Cargo.toml",
"ecosystem": "crates",
"version_constraint": null
},
{
"name": "x509-cert",
"manifest": "crates/bergshamra-dsig/Cargo.toml",
"ecosystem": "crates",
"version_constraint": null
},
{
"name": "der",
"manifest": "crates/bergshamra-dsig/Cargo.toml",
"ecosystem": "crates",
"version_constraint": null
},
{
"name": "bergshamra-core",
"manifest": "crates/bergshamra-enc/Cargo.toml",
"ecosystem": "crates",
"version_constraint": null
},
{
"name": "bergshamra-xml",
"manifest": "crates/bergshamra-enc/Cargo.toml",
"ecosystem": "crates",
"version_constraint": null
},
{
"name": "bergshamra-transforms",
"manifest": "crates/bergshamra-enc/Cargo.toml",
"ecosystem": "crates",
"version_constraint": null
},
{
"name": "bergshamra-keys",
"manifest": "crates/bergshamra-enc/Cargo.toml",
"ecosystem": "crates",
"version_constraint": null
},
{
"name": "bergshamra-c14n",
"manifest": "crates/bergshamra-enc/Cargo.toml",
"ecosystem": "crates",
"version_constraint": null
},
{
"name": "bergshamra-crypto",
"manifest": "crates/bergshamra-enc/Cargo.toml",
"ecosystem": "crates",
"version_constraint": null
},
{
"name": "base64",
"manifest": "crates/bergshamra-enc/Cargo.toml",
"ecosystem": "crates",
"version_constraint": null
},
{
"name": "uppsala",
"manifest": "crates/bergshamra-enc/Cargo.toml",
"ecosystem": "crates",
"version_constraint": null
},
{
"name": "kryptering",
"manifest": "crates/bergshamra-enc/Cargo.toml",
"ecosystem": "crates",
"version_constraint": null
},
{
"name": "bergshamra-core",
"manifest": "crates/bergshamra-keys/Cargo.toml",
"ecosystem": "crates",
"version_constraint": null
},
{
"name": "bergshamra-crypto",
"manifest": "crates/bergshamra-keys/Cargo.toml",
"ecosystem": "crates",
"version_constraint": null
},
{
"name": "kryptering",
"manifest": "crates/bergshamra-keys/Cargo.toml",
"ecosystem": "crates",
"version_constraint": null
},
{
"name": "ed25519-dalek",
"manifest": "crates/bergshamra-keys/Cargo.toml",
"ecosystem": "crates",
"version_constraint": null
},
{
"name": "x25519-dalek",
"manifest": "crates/bergshamra-keys/Cargo.toml",
"ecosystem": "crates",
"version_constraint": null
},
{
"name": "rsa",
"manifest": "crates/bergshamra-keys/Cargo.toml",
"ecosystem": "crates",
"version_constraint": null
},
{
"name": "ecdsa",
"manifest": "crates/bergshamra-keys/Cargo.toml",
"ecosystem": "crates",
"version_constraint": null
},
{
"name": "dsa",
"manifest": "crates/bergshamra-keys/Cargo.toml",
"ecosystem": "crates",
"version_constraint": null
},
{
"name": "ml-dsa",
"manifest": "crates/bergshamra-keys/Cargo.toml",
"ecosystem": "crates",
"version_constraint": null
},
{
"name": "slh-dsa",
"manifest": "crates/bergshamra-keys/Cargo.toml",
"ecosystem": "crates",
"version_constraint": null
},
{
"name": "p256",
"manifest": "crates/bergshamra-keys/Cargo.toml",
"ecosystem": "crates",
"version_constraint": null
},
{
"name": "p384",
"manifest": "crates/bergshamra-keys/Cargo.toml",
"ecosystem": "crates",
"version_constraint": null
},
{
"name": "p521",
"manifest": "crates/bergshamra-keys/Cargo.toml",
"ecosystem": "crates",
"version_constraint": null
},
{
"name": "pkcs1",
"manifest": "crates/bergshamra-keys/Cargo.toml",
"ecosystem": "crates",
"version_constraint": null
},
{
"name": "pkcs8",
"manifest": "crates/bergshamra-keys/Cargo.toml",
"ecosystem": "crates",
"version_constraint": "0.10"
},
{
"name": "pkcs8-pq",
"manifest": "crates/bergshamra-keys/Cargo.toml",
"ecosystem": "crates",
"version_constraint": null
},
{
"name": "const-oid-pq",
"manifest": "crates/bergshamra-keys/Cargo.toml",
"ecosystem": "crates",
"version_constraint": null
},
{
"name": "spki",
"manifest": "crates/bergshamra-keys/Cargo.toml",
"ecosystem": "crates",
"version_constraint": null
},
{
"name": "der",
"manifest": "crates/bergshamra-keys/Cargo.toml",
"ecosystem": "crates",
"version_constraint": null
},
{
"name": "pem-rfc7468",
"manifest": "crates/bergshamra-keys/Cargo.toml",
"ecosystem": "crates",
"version_constraint": null
},
{
"name": "x509-cert",
"manifest": "crates/bergshamra-keys/Cargo.toml",
"ecosystem": "crates",
"version_constraint": null
},
{
"name": "bergshamra-pkcs12",
"manifest": "crates/bergshamra-keys/Cargo.toml",
"ecosystem": "crates",
"version_constraint": null
},
{
"name": "base64",
"manifest": "crates/bergshamra-keys/Cargo.toml",
"ecosystem": "crates",
"version_constraint": null
},
{
"name": "num-bigint-dig",
"manifest": "crates/bergshamra-keys/Cargo.toml",
"ecosystem": "crates",
"version_constraint": null
},
{
"name": "num-traits",
"manifest": "crates/bergshamra-keys/Cargo.toml",
"ecosystem": "crates",
"version_constraint": null
},
{
"name": "signature",
"manifest": "crates/bergshamra-keys/Cargo.toml",
"ecosystem": "crates",
"version_constraint": null
},
{
"name": "uppsala",
"manifest": "crates/bergshamra-keys/Cargo.toml",
"ecosystem": "crates",
"version_constraint": null
},
{
"name": "tsp-ltv",
"manifest": "crates/bergshamra-keys/Cargo.toml",
"ecosystem": "crates",
"version_constraint": null
},
{
"name": "zeroize",
"manifest": "crates/bergshamra-keys/Cargo.toml",
"ecosystem": "crates",
"version_constraint": null
},
{
"name": "bergshamra-core",
"manifest": "crates/bergshamra-pkcs12/Cargo.toml",
"ecosystem": "crates",
"version_constraint": null
},
{
"name": "kryptering",
"manifest": "crates/bergshamra-pkcs12/Cargo.toml",
"ecosystem": "crates",
"version_constraint": null
},
{
"name": "zeroize",
"manifest": "crates/bergshamra-pkcs12/Cargo.toml",
"ecosystem": "crates",
"version_constraint": null
},
{
"name": "yasna",
"manifest": "crates/bergshamra-pkcs12/Cargo.toml",
"ecosystem": "crates",
"version_constraint": null
},
{
"name": "cipher",
"manifest": "crates/bergshamra-pkcs12/Cargo.toml",
"ecosystem": "crates",
"version_constraint": "0.5"
},
{
"name": "bergshamra-core",
"manifest": "crates/bergshamra-transforms/Cargo.toml",
"ecosystem": "crates",
"version_constraint": null
},
{
"name": "bergshamra-xml",
"manifest": "crates/bergshamra-transforms/Cargo.toml",
"ecosystem": "crates",
"version_constraint": null
},
{
"name": "bergshamra-c14n",
"manifest": "crates/bergshamra-transforms/Cargo.toml",
"ecosystem": "crates",
"version_constraint": null
},
{
"name": "bergshamra-crypto",
"manifest": "crates/bergshamra-transforms/Cargo.toml",
"ecosystem": "crates",
"version_constraint": null
},
{
"name": "bergshamra-keys",
"manifest": "crates/bergshamra-transforms/Cargo.toml",
"ecosystem": "crates",
"version_constraint": null
},
{
"name": "base64",
"manifest": "crates/bergshamra-transforms/Cargo.toml",
"ecosystem": "crates",
"version_constraint": null
},
{
"name": "uppsala",
"manifest": "crates/bergshamra-transforms/Cargo.toml",
"ecosystem": "crates",
"version_constraint": null
},
{
"name": "bergshamra-core",
"manifest": "crates/bergshamra-xml/Cargo.toml",
"ecosystem": "crates",
"version_constraint": null
},
{
"name": "uppsala",
"manifest": "crates/bergshamra-xml/Cargo.toml",
"ecosystem": "crates",
"version_constraint": null
},
{
"name": "bergshamra-core",
"manifest": "crates/bergshamra/Cargo.toml",
"ecosystem": "crates",
"version_constraint": null
},
{
"name": "bergshamra-xml",
"manifest": "crates/bergshamra/Cargo.toml",
"ecosystem": "crates",
"version_constraint": null
},
{
"name": "bergshamra-c14n",
"manifest": "crates/bergshamra/Cargo.toml",
"ecosystem": "crates",
"version_constraint": null
},
{
"name": "bergshamra-crypto",
"manifest": "crates/bergshamra/Cargo.toml",
"ecosystem": "crates",
"version_constraint": null
},
{
"name": "bergshamra-keys",
"manifest": "crates/bergshamra/Cargo.toml",
"ecosystem": "crates",
"version_constraint": null
},
{
"name": "bergshamra-transforms",
"manifest": "crates/bergshamra/Cargo.toml",
"ecosystem": "crates",
"version_constraint": null
},
{
"name": "bergshamra-dsig",
"manifest": "crates/bergshamra/Cargo.toml",
"ecosystem": "crates",
"version_constraint": null
},
{
"name": "bergshamra-enc",
"manifest": "crates/bergshamra/Cargo.toml",
"ecosystem": "crates",
"version_constraint": null
},
{
"name": "clap",
"manifest": "crates/bergshamra/Cargo.toml",
"ecosystem": "crates",
"version_constraint": null
},
{
"name": "base64",
"manifest": "crates/bergshamra/Cargo.toml",
"ecosystem": "crates",
"version_constraint": null
},
{
"name": "uppsala",
"manifest": "crates/bergshamra/Cargo.toml",
"ecosystem": "crates",
"version_constraint": null
},
{
"name": "kryptering",
"manifest": "crates/bergshamra/Cargo.toml",
"ecosystem": "crates",
"version_constraint": null
}
],
"all_dependencies": {
"error": "GitHub dependency-graph SBOM unavailable (404); the dependency graph may be disabled for this repository",
"source": null,
"packages": [],
"collected": false,
"truncated": false,
"total_count": null,
"direct_count": null,
"indirect_count": null
}
},
"maintainership": {
"issues": {
"open_prs": 1,
"merged_prs": 26,
"open_issues": 1,
"closed_ratio": 0,
"closed_issues": 0,
"closed_unmerged_prs": 4
},
"bus_factor": 1,
"bot_contributors": 0,
"top_contributors": [
{
"type": "User",
"login": "kushaldas",
"commits": 122,
"avatar_url": "https://avatars.githubusercontent.com/u/272303?v=4"
},
{
"type": "User",
"login": "salasebas",
"commits": 1,
"avatar_url": "https://avatars.githubusercontent.com/u/126188343?v=4"
}
],
"contributors_sampled": 2,
"top_contributor_share": 0.992
},
"quality_signals": {
"has_ci": true,
"has_tests": true,
"ci_workflows": [
"audit.yml",
"ci.yml",
"publish.yml"
],
"has_docs_dir": true,
"linter_configs": [],
"has_editorconfig": false,
"has_linter_config": false,
"has_precommit_config": false
},
"security_signals": {
"lockfiles": [
"Cargo.lock"
],
"scorecard": {
"checks": [
{
"name": "Binary-Artifacts",
"score": 10,
"reason": "no binaries found in the repo",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#binary-artifacts"
},
{
"name": "Branch-Protection",
"score": 0,
"reason": "branch protection not enabled on development/release branches",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#branch-protection"
},
{
"name": "CI-Tests",
"score": 10,
"reason": "10 out of 10 merged PRs checked by a CI test -- score normalized to 10",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#ci-tests"
},
{
"name": "CII-Best-Practices",
"score": 0,
"reason": "no effort to earn an OpenSSF best practices badge detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#cii-best-practices"
},
{
"name": "Code-Review",
"score": 0,
"reason": "Found 0/10 approved changesets -- score normalized to 0",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#code-review"
},
{
"name": "Contributors",
"score": 10,
"reason": "project has 4 contributing companies or organizations",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#contributors"
},
{
"name": "Dangerous-Workflow",
"score": 10,
"reason": "no dangerous workflow patterns detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#dangerous-workflow"
},
{
"name": "Dependency-Update-Tool",
"score": 0,
"reason": "no update tool detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#dependency-update-tool"
},
{
"name": "Fuzzing",
"score": 0,
"reason": "project is not fuzzed",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#fuzzing"
},
{
"name": "License",
"score": 10,
"reason": "license file detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#license"
},
{
"name": "Maintained",
"score": 10,
"reason": "30 commit(s) and 1 issue activity found in the last 90 days -- score normalized to 10",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#maintained"
},
{
"name": "Packaging",
"score": 10,
"reason": "packaging workflow detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#packaging"
},
{
"name": "Pinned-Dependencies",
"score": 10,
"reason": "all dependencies are pinned",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#pinned-dependencies"
},
{
"name": "SAST",
"score": 0,
"reason": "SAST tool is not run on all commits -- score normalized to 0",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#sast"
},
{
"name": "Security-Policy",
"score": 0,
"reason": "security policy file not detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#security-policy"
},
{
"name": "Signed-Releases",
"score": null,
"reason": "no releases found",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#signed-releases"
},
{
"name": "Token-Permissions",
"score": 0,
"reason": "detected GitHub workflow tokens with excessive permissions",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#token-permissions"
},
{
"name": "Vulnerabilities",
"score": 9,
"reason": "1 existing vulnerabilities detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#vulnerabilities"
}
],
"commit": "f81a3883bd89ba00a8ec71a5f87dd3f0a73b27f8",
"ran_at": "2026-08-01T20:01:24Z",
"aggregate_score": 5.1,
"scorecard_version": "v5.5.0"
},
"has_codeql_workflow": false,
"has_security_policy": false,
"has_dependabot_config": false
},
"contribution_flow": {
"collected": true,
"ci_last_run_at": "2026-08-01T10:13:23Z",
"oldest_open_prs": [
{
"number": 27,
"created_at": "2026-07-20T14:25:50Z",
"last_comment_at": "2026-08-01T08:36:30Z",
"last_comment_author": "kushaldas"
}
],
"last_merged_pr_at": "2026-08-01T10:09:29Z",
"ci_last_conclusion": "SUCCESS",
"oldest_open_issues": [
{
"number": 8,
"created_at": "2026-06-19T03:30:24Z",
"last_comment_at": "2026-06-27T11:35:02Z",
"last_comment_author": "kushaldas"
}
]
}
},
"config": {
"disabled_metrics": [],
"disabled_categories": [],
"disabled_components": {}
},
"source": {
"url": "https://github.com/kushaldas/bergshamra",
"host": "github.com",
"name": "bergshamra",
"owner": "kushaldas"
},
"metrics": {
"overall": {
"key": "overall",
"band": "moderate",
"name": "Overall health",
"note": null,
"notes": [],
"value": 61,
"inputs": {
"security": 51,
"vitality": 83,
"community": 45,
"governance": 52,
"engineering": 71
},
"components": []
},
"categories": [
{
"key": "vitality",
"band": "good",
"name": "Vitality",
"value": 83,
"weight": 0.22,
"metrics": [
{
"key": "development_activity",
"band": "good",
"name": "Development activity",
"note": null,
"notes": [],
"value": 72,
"inputs": {
"commits_last_year": 119,
"human_commit_share": 1,
"days_since_last_push": 0,
"active_weeks_last_year": 11
},
"components": [
{
"key": "push_recency",
"name": "Push recency",
"detail": "last push 0 days ago",
"points": 36,
"status": "met",
"details": [
{
"code": "push_recency",
"params": {
"days": 0
}
}
],
"max_points": 36
},
{
"key": "commit_cadence",
"name": "Commit cadence",
"detail": "11/52 weeks with commits",
"points": 7.6,
"status": "partial",
"details": [
{
"code": "commit_cadence_weeks",
"params": {
"weeks": 11
}
}
],
"max_points": 36
},
{
"key": "commit_volume",
"name": "Commit volume",
"detail": "119 commits in the last year",
"points": 18,
"status": "met",
"details": [
{
"code": "commits_last_year",
"params": {
"count": 119
}
}
],
"max_points": 18
},
{
"key": "openssf_scorecard_maintained",
"name": "OpenSSF Scorecard: Maintained",
"detail": "30 commit(s) and 1 issue activity found in the last 90 days -- score normalized to 10",
"points": 10,
"status": "met",
"details": [],
"max_points": 10
}
]
},
{
"key": "release_discipline",
"band": "excellent",
"name": "Release discipline",
"note": "Excluded from scoring (no data or not applicable): OpenSSF Scorecard: Signed-Releases. Remaining weights renormalized.",
"notes": [
{
"code": "excluded_no_data",
"params": {
"components": [
"openssf_scorecard_signed_releases"
]
}
},
{
"code": "weights_renormalized",
"params": {}
}
],
"value": 100,
"inputs": {
"releases_count": 8,
"latest_release_tag": "v0.8.0",
"releases_from_tags": false,
"days_since_latest_release": 0,
"mean_days_between_releases": 7.9
},
"components": [
{
"key": "ships_releases",
"name": "Ships releases",
"detail": "8 releases published",
"points": 27,
"status": "met",
"details": [
{
"code": "releases_published",
"params": {
"count": 8
}
}
],
"max_points": 27
},
{
"key": "release_recency",
"name": "Release recency",
"detail": "latest release 0 days ago",
"points": 36,
"status": "met",
"details": [
{
"code": "release_recency",
"params": {
"days": 0
}
}
],
"max_points": 36
},
{
"key": "release_cadence",
"name": "Release cadence",
"detail": "a release every ~7.9 days",
"points": 27,
"status": "met",
"details": [
{
"code": "release_cadence",
"params": {
"gap": 7.9
}
}
],
"max_points": 27
},
{
"key": "openssf_scorecard_signed_releases",
"name": "OpenSSF Scorecard: Signed-Releases",
"detail": "no releases found",
"points": 0,
"status": "excluded",
"details": [
{
"code": "no_data",
"params": {}
}
],
"max_points": 10
}
]
},
{
"key": "abandonment",
"band": "excellent",
"name": "Abandonment",
"note": null,
"notes": [],
"value": 100,
"inputs": {
"cap": null,
"state": "unverified",
"guards": [],
"signals": [],
"red_flag": false,
"multiplier_pct": 100,
"declared_reason": null,
"unverified_reason": "repository_too_young",
"unanswered_open_prs": null,
"unanswered_open_issues": null,
"days_since_last_merged_pr": null,
"days_since_last_human_commit": null,
"days_since_last_human_commit_is_floor": false
},
"components": [
{
"key": "project_is_still_maintained",
"name": "Project is still maintained",
"detail": "maintenance record not established from the collected data",
"points": 100,
"status": "met",
"details": [
{
"code": "abandonment_unverified",
"params": {}
}
],
"max_points": 100
}
]
}
],
"description": "Is the project alive — is code being written and are releases shipping?"
},
{
"key": "community",
"band": "at_risk",
"name": "Community & Adoption",
"value": 45,
"weight": 0.18,
"metrics": [
{
"key": "popularity",
"band": "critical",
"name": "Popularity & adoption",
"note": null,
"notes": [],
"value": 16,
"inputs": {
"forks": 2,
"stars": 10,
"watchers": 0,
"growth_state": "unverified",
"growth_factor_pct": 100,
"growth_unverified_reason": "no_history"
},
"components": [
{
"key": "stars",
"name": "Stars",
"detail": "10 stars",
"points": 15.5,
"status": "partial",
"details": [
{
"code": "stars",
"params": {
"count": 10
}
}
],
"max_points": 60
},
{
"key": "forks",
"name": "Forks",
"detail": "2 forks",
"points": 0,
"status": "missed",
"details": [
{
"code": "forks",
"params": {
"count": 2
}
}
],
"max_points": 25
},
{
"key": "watchers",
"name": "Watchers",
"detail": "0 watchers",
"points": 0,
"status": "missed",
"details": [
{
"code": "watchers",
"params": {
"count": 0
}
}
],
"max_points": 15
}
]
},
{
"key": "community_health",
"band": "moderate",
"name": "Community health",
"note": null,
"notes": [],
"value": 50,
"inputs": {
"has_readme": true,
"has_license": true,
"has_contributing": false,
"has_issue_template": false,
"has_code_of_conduct": false,
"has_pull_request_template": false
},
"components": [
{
"key": "readme",
"name": "README",
"detail": null,
"points": 22.5,
"status": "met",
"details": [],
"max_points": 22.5
},
{
"key": "license",
"name": "License",
"detail": "recognized license (BSD-2-Clause)",
"points": 22.5,
"status": "met",
"details": [
{
"code": "license_standard",
"params": {}
},
{
"code": "license_spdx",
"params": {
"spdx": "BSD-2-Clause"
}
}
],
"max_points": 22.5
},
{
"key": "contributing_guide",
"name": "CONTRIBUTING guide",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 18
},
{
"key": "code_of_conduct",
"name": "Code of conduct",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 13.5
},
{
"key": "issue_template",
"name": "Issue template",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 7.2
},
{
"key": "pr_template",
"name": "PR template",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 6.3
}
]
},
{
"key": "ecosystem_adoption",
"band": "good",
"name": "Ecosystem adoption (downloads)",
"note": "Excluded from scoring (no data or not applicable): Registry dependents. Remaining weights renormalized.",
"notes": [
{
"code": "excluded_no_data",
"params": {
"components": [
"registry_dependents"
]
}
},
{
"code": "weights_renormalized",
"params": {}
}
],
"value": 83,
"inputs": {
"packages": [
"bergshamra",
"bergshamra-enc",
"bergshamra-xml",
"bergshamra-c14n",
"bergshamra-core",
"bergshamra-dsig",
"bergshamra-keys",
"bergshamra-crypto"
],
"dependents": null,
"ecosystems": "crates",
"total_downloads": 336989,
"monthly_downloads": 98566
},
"components": [
{
"key": "monthly_downloads",
"name": "Monthly downloads",
"detail": "98,566 downloads/month across crates",
"points": 66.6,
"status": "partial",
"details": [
{
"code": "downloads_monthly",
"params": {
"count": 98566,
"ecosystems": "crates"
}
}
],
"max_points": 80
},
{
"key": "registry_dependents",
"name": "Registry dependents",
"detail": "not reported by this ecosystem",
"points": 0,
"status": "excluded",
"details": [
{
"code": "not_reported_by_this_ecosystem",
"params": {}
}
],
"max_points": 20
}
]
}
],
"description": "Does the project have users, downloads, attention, and a welcoming setup for contributors?"
},
{
"key": "governance",
"band": "moderate",
"name": "Sustainability & Governance",
"value": 52,
"weight": 0.24,
"metrics": [
{
"key": "maintainer_resilience",
"band": "critical",
"name": "Maintainer resilience (bus factor)",
"note": null,
"notes": [],
"value": 22,
"inputs": {
"bus_factor": 1,
"contributors_sampled": 2,
"top_contributor_share": 0.992
},
"components": [
{
"key": "bus_factor",
"name": "Bus factor",
"detail": "1 contributor(s) cover half of all commits",
"points": 9,
"status": "partial",
"details": [
{
"code": "bus_factor",
"params": {
"count": 1
}
}
],
"max_points": 54
},
{
"key": "commit_distribution",
"name": "Commit distribution",
"detail": "top contributor authored 99% of commits",
"points": 0.2,
"status": "partial",
"details": [
{
"code": "top_contributor_share",
"params": {
"share": 99
}
}
],
"max_points": 22.5
},
{
"key": "contributor_breadth",
"name": "Contributor breadth",
"detail": "2 contributors",
"points": 2.7,
"status": "partial",
"details": [
{
"code": "contributors_sampled",
"params": {
"count": 2
}
}
],
"max_points": 13.5
},
{
"key": "openssf_scorecard_contributors",
"name": "OpenSSF Scorecard: Contributors",
"detail": "project has 4 contributing companies or organizations",
"points": 10,
"status": "met",
"details": [],
"max_points": 10
}
]
},
{
"key": "responsiveness",
"band": "at_risk",
"name": "Issue & PR responsiveness",
"note": null,
"notes": [],
"value": 33,
"inputs": {
"merged_prs": 26,
"open_issues": 1,
"closed_issues": 0,
"issue_closed_ratio": 0,
"closed_unmerged_prs": 4
},
"components": [
{
"key": "issue_resolution",
"name": "Issue resolution",
"detail": "0% of issues closed",
"points": 0,
"status": "missed",
"details": [
{
"code": "issues_closed_share",
"params": {
"share": 0
}
}
],
"max_points": 46.75
},
{
"key": "pr_acceptance",
"name": "PR acceptance",
"detail": "26/30 decided PRs merged",
"points": 33.1,
"status": "partial",
"details": [
{
"code": "decided_prs_merged",
"params": {
"merged": 26,
"decided": 30
}
}
],
"max_points": 38.25
},
{
"key": "openssf_scorecard_code_review",
"name": "OpenSSF Scorecard: Code-Review",
"detail": "Found 0/10 approved changesets -- score normalized to 0",
"points": 0,
"status": "missed",
"details": [],
"max_points": 15
}
]
},
{
"key": "stewardship",
"band": "good",
"name": "Ownership & stewardship",
"note": "Excluded from scoring (no data or not applicable): Verified domain. Remaining weights renormalized.",
"notes": [
{
"code": "excluded_no_data",
"params": {
"components": [
"verified_domain"
]
}
},
{
"code": "weights_renormalized",
"params": {}
}
],
"value": 70,
"inputs": {
"followers": 946,
"owner_type": "User",
"is_verified": null,
"owner_login": "kushaldas",
"public_repos": 225,
"account_age_days": 5927
},
"components": [
{
"key": "ownership_backing",
"name": "Ownership backing",
"detail": "personal (user) account",
"points": 10,
"status": "partial",
"details": [
{
"code": "owner_personal",
"params": {}
}
],
"max_points": 30
},
{
"key": "verified_domain",
"name": "Verified domain",
"detail": "not applicable to user accounts",
"points": 0,
"status": "excluded",
"details": [
{
"code": "not_applicable_to_user_accounts",
"params": {}
}
],
"max_points": 20
},
{
"key": "owner_reach",
"name": "Owner reach",
"detail": "946 followers of kushaldas",
"points": 21.4,
"status": "partial",
"details": [
{
"code": "owner_followers",
"params": {
"count": 946,
"login": "kushaldas"
}
}
],
"max_points": 25
},
{
"key": "track_record",
"name": "Track record",
"detail": "225 public repos, account ~16 yr old",
"points": 25,
"status": "met",
"details": [
{
"code": "public_repos",
"params": {
"count": 225
}
},
{
"code": "account_age_years",
"params": {
"years": 16
}
}
],
"max_points": 25
}
]
},
{
"key": "package_maintenance",
"band": "excellent",
"name": "Package maintenance",
"note": null,
"notes": [],
"value": 100,
"inputs": {
"packages": [
"bergshamra",
"bergshamra-enc",
"bergshamra-xml",
"bergshamra-c14n",
"bergshamra-core",
"bergshamra-dsig",
"bergshamra-keys",
"bergshamra-crypto"
],
"ecosystems": "crates",
"any_deprecated": false,
"min_days_since_publish": 0
},
"components": [
{
"key": "published_resolvable",
"name": "Published & resolvable",
"detail": "8 package(s) on crates",
"points": 25,
"status": "met",
"details": [
{
"code": "packages_published",
"params": {
"count": 8,
"ecosystems": "crates"
}
}
],
"max_points": 25
},
{
"key": "publish_recency",
"name": "Publish recency",
"detail": "latest publish 0 days ago",
"points": 35,
"status": "met",
"details": [
{
"code": "publish_recency",
"params": {
"days": 0
}
}
],
"max_points": 35
},
{
"key": "version_history",
"name": "Version history",
"detail": "16 published versions",
"points": 20,
"status": "met",
"details": [
{
"code": "published_versions",
"params": {
"count": 16
}
}
],
"max_points": 20
},
{
"key": "not_deprecated",
"name": "Not deprecated",
"detail": "active, not deprecated or yanked",
"points": 20,
"status": "met",
"details": [
{
"code": "package_not_deprecated",
"params": {}
}
],
"max_points": 20
}
]
}
],
"description": "Will the project survive its people — bus factor, responsiveness, who backs it, and package upkeep?"
},
{
"key": "engineering",
"band": "good",
"name": "Engineering Quality",
"value": 71,
"weight": 0.2,
"metrics": [
{
"key": "engineering_practices",
"band": "moderate",
"name": "Engineering practices",
"note": null,
"notes": [],
"value": 68,
"inputs": {
"has_ci": true,
"has_tests": true,
"has_editorconfig": false,
"has_linter_config": false,
"has_precommit_config": false
},
"components": [
{
"key": "ci_workflows",
"name": "CI workflows",
"detail": "3 workflow(s)",
"points": 24,
"status": "met",
"details": [
{
"code": "ci_workflows",
"params": {
"count": 3
}
}
],
"max_points": 24
},
{
"key": "tests_present",
"name": "Tests present",
"detail": null,
"points": 24,
"status": "met",
"details": [],
"max_points": 24
},
{
"key": "linter_config",
"name": "Linter config",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 16
},
{
"key": "pre_commit_hooks",
"name": "Pre-commit hooks",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 9.6
},
{
"key": "editorconfig",
"name": ".editorconfig",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 6.4
},
{
"key": "openssf_scorecard_ci_tests",
"name": "OpenSSF Scorecard: CI-Tests",
"detail": "10 out of 10 merged PRs checked by a CI test -- score normalized to 10",
"points": 20,
"status": "met",
"details": [],
"max_points": 20
}
]
},
{
"key": "documentation",
"band": "good",
"name": "Documentation",
"note": null,
"notes": [],
"value": 75,
"inputs": {
"topics": [],
"has_wiki": true,
"homepage": null,
"has_readme": true,
"has_docs_dir": true,
"has_description": true
},
"components": [
{
"key": "readme",
"name": "README",
"detail": null,
"points": 30,
"status": "met",
"details": [],
"max_points": 30
},
{
"key": "documentation_directory",
"name": "Documentation directory",
"detail": null,
"points": 25,
"status": "met",
"details": [],
"max_points": 25
},
{
"key": "documentation_homepage_site",
"name": "Documentation / homepage site",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 15
},
{
"key": "repository_description",
"name": "Repository description",
"detail": null,
"points": 10,
"status": "met",
"details": [],
"max_points": 10
},
{
"key": "topics",
"name": "Topics",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 10
},
{
"key": "wiki",
"name": "Wiki",
"detail": null,
"points": 10,
"status": "met",
"details": [],
"max_points": 10
}
]
}
],
"description": "Are baseline engineering and documentation practices in place?"
},
{
"key": "security",
"band": "moderate",
"name": "Security",
"value": 51,
"weight": 0.16,
"metrics": [
{
"key": "security_posture",
"band": "moderate",
"name": "Security posture",
"note": "Excluded from scoring (no data or not applicable): Signed-Releases. Remaining weights renormalized.",
"notes": [
{
"code": "excluded_no_data",
"params": {
"components": [
"signed_releases"
]
}
},
{
"code": "weights_renormalized",
"params": {}
}
],
"value": 51,
"inputs": {
"source": "openssf_scorecard",
"checks_evaluated": 17,
"scorecard_version": "v5.5.0",
"checks_inconclusive": 1,
"scorecard_aggregate": 5.1
},
"components": [
{
"key": "binary_artifacts",
"name": "Binary-Artifacts",
"detail": "no binaries found in the repo",
"points": 7.5,
"status": "met",
"details": [],
"max_points": 7.5
},
{
"key": "branch_protection",
"name": "Branch-Protection",
"detail": "branch protection not enabled on development/release branches",
"points": 0,
"status": "missed",
"details": [],
"max_points": 7.5
},
{
"key": "ci_tests",
"name": "CI-Tests",
"detail": "10 out of 10 merged PRs checked by a CI test -- score normalized to 10",
"points": 2.5,
"status": "met",
"details": [],
"max_points": 2.5
},
{
"key": "cii_best_practices",
"name": "CII-Best-Practices",
"detail": "no effort to earn an OpenSSF best practices badge detected",
"points": 0,
"status": "missed",
"details": [],
"max_points": 2.5
},
{
"key": "code_review",
"name": "Code-Review",
"detail": "Found 0/10 approved changesets -- score normalized to 0",
"points": 0,
"status": "missed",
"details": [],
"max_points": 7.5
},
{
"key": "contributors",
"name": "Contributors",
"detail": "project has 4 contributing companies or organizations",
"points": 2.5,
"status": "met",
"details": [],
"max_points": 2.5
},
{
"key": "dangerous_workflow",
"name": "Dangerous-Workflow",
"detail": "no dangerous workflow patterns detected",
"points": 10,
"status": "met",
"details": [],
"max_points": 10
},
{
"key": "dependency_update_tool",
"name": "Dependency-Update-Tool",
"detail": "no update tool detected",
"points": 0,
"status": "missed",
"details": [],
"max_points": 7.5
},
{
"key": "fuzzing",
"name": "Fuzzing",
"detail": "project is not fuzzed",
"points": 0,
"status": "missed",
"details": [],
"max_points": 5
},
{
"key": "license",
"name": "License",
"detail": "license file detected",
"points": 2.5,
"status": "met",
"details": [],
"max_points": 2.5
},
{
"key": "maintained",
"name": "Maintained",
"detail": "30 commit(s) and 1 issue activity found in the last 90 days -- score normalized to 10",
"points": 7.5,
"status": "met",
"details": [],
"max_points": 7.5
},
{
"key": "packaging",
"name": "Packaging",
"detail": "packaging workflow detected",
"points": 5,
"status": "met",
"details": [],
"max_points": 5
},
{
"key": "pinned_dependencies",
"name": "Pinned-Dependencies",
"detail": "all dependencies are pinned",
"points": 5,
"status": "met",
"details": [],
"max_points": 5
},
{
"key": "sast",
"name": "SAST",
"detail": "SAST tool is not run on all commits -- score normalized to 0",
"points": 0,
"status": "missed",
"details": [],
"max_points": 5
},
{
"key": "security_policy",
"name": "Security-Policy",
"detail": "security policy file not detected",
"points": 0,
"status": "missed",
"details": [],
"max_points": 5
},
{
"key": "signed_releases",
"name": "Signed-Releases",
"detail": "no releases found",
"points": 0,
"status": "excluded",
"details": [
{
"code": "no_data",
"params": {}
}
],
"max_points": 7.5
},
{
"key": "token_permissions",
"name": "Token-Permissions",
"detail": "detected GitHub workflow tokens with excessive permissions",
"points": 0,
"status": "missed",
"details": [],
"max_points": 7.5
},
{
"key": "vulnerabilities",
"name": "Vulnerabilities",
"detail": "1 existing vulnerabilities detected",
"points": 6.8,
"status": "partial",
"details": [],
"max_points": 7.5
}
]
},
{
"key": "high_risk_jurisdiction_exposure",
"band": "excellent",
"name": "High-Risk Jurisdiction Exposure",
"note": "Only high-confidence self-published location evidence affects this multiplier. Ambiguous matches are review-only; country evidence is not proof of nationality, citizenship, legal registration, malicious intent, or sanctions status.",
"notes": [
{
"code": "jurisdiction_evidence_limits",
"params": {}
}
],
"value": 100,
"inputs": {
"meaning": "self-published location evidence; not nationality or citizenship",
"red_flag": false,
"exposures": [],
"policy_countries": [
"Russia",
"Iran",
"North Korea"
],
"review_only_matches": 0,
"assessed_self_published_locations": 4
},
"components": [
{
"key": "policy_exposure_multiplier",
"name": "Policy exposure multiplier",
"detail": "no confirmed policy-scope location match",
"points": 100,
"status": "met",
"details": [
{
"code": "jurisdiction_no_match",
"params": {}
}
],
"max_points": 100
}
]
}
],
"description": "Are visible security and supply-chain practices strong, with no malicious dependency and no unresolved high-risk jurisdiction exposure?"
},
{
"key": "ai_readiness",
"band": "moderate",
"name": "AI Readiness",
"value": 50,
"weight": 0,
"metrics": [
{
"key": "ai_agent_context",
"band": "at_risk",
"name": "Agent context & guidance",
"note": null,
"notes": [],
"value": 40,
"inputs": {
"has_llms_txt": false,
"legible_history_share": 1,
"agent_instruction_files": [],
"agent_instruction_max_bytes": null
},
"components": [
{
"key": "agent_instructions",
"name": "Agent instructions",
"detail": "no CLAUDE.md / AGENTS.md / editor rules",
"points": 0,
"status": "missed",
"details": [
{
"code": "no_agent_instructions",
"params": {}
}
],
"max_points": 45
},
{
"key": "machine_readable_docs_llms_txt",
"name": "Machine-readable docs (llms.txt)",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 15
},
{
"key": "legible_commit_history",
"name": "Legible commit history",
"detail": "100 of 100 human commits state their intent (structured subject or explanatory body)",
"points": 40,
"status": "met",
"details": [
{
"code": "legible_history",
"params": {
"legible": 100,
"sampled": 100
}
}
],
"max_points": 40
}
]
},
{
"key": "ai_verify_loop",
"band": "moderate",
"name": "Verify loop (build / test / typecheck)",
"note": null,
"notes": [],
"value": 60,
"inputs": {
"has_nix": false,
"has_tests": true,
"lockfiles": [
"Cargo.lock"
],
"has_dockerfile": false,
"typed_language": false,
"bootstrap_files": [
"justfile"
],
"has_devcontainer": false,
"has_linter_config": false,
"typecheck_configs": [],
"agent_commit_share": 0,
"toolchain_manifests": [
"Cargo.toml",
"crates/bergshamra-c14n/Cargo.toml",
"crates/bergshamra-core/Cargo.toml",
"crates/bergshamra-crypto/Cargo.toml",
"crates/bergshamra-dsig/Cargo.toml",
"crates/bergshamra-enc/Cargo.toml",
"crates/bergshamra-keys/Cargo.toml",
"crates/bergshamra-pkcs12/Cargo.toml",
"crates/bergshamra-transforms/Cargo.toml",
"crates/bergshamra-xml/Cargo.toml",
"crates/bergshamra/Cargo.toml"
],
"dependency_bot_commit_share": 0
},
"components": [
{
"key": "one_command_bootstrap",
"name": "One-command bootstrap",
"detail": "justfile",
"points": 18,
"status": "met",
"details": [
{
"code": "file_list",
"params": {
"files": "justfile"
}
}
],
"max_points": 18
},
{
"key": "automated_tests",
"name": "Automated tests",
"detail": null,
"points": 22,
"status": "met",
"details": [],
"max_points": 22
},
{
"key": "lint_format_config",
"name": "Lint / format config",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 11
},
{
"key": "static_type_checking",
"name": "Static type checking",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 11
},
{
"key": "reproducible_environment",
"name": "Reproducible environment",
"detail": "lockfile",
"points": 10,
"status": "met",
"details": [
{
"code": "file_list",
"params": {
"files": "lockfile"
}
}
],
"max_points": 10
},
{
"key": "demonstrated_agent_practice",
"name": "Demonstrated agent practice",
"detail": "no agent-authored commits among the last 100",
"points": 0,
"status": "missed",
"details": [
{
"code": "no_agent_authored_commits",
"params": {
"sampled": 100
}
}
],
"max_points": 10
},
{
"key": "automated_maintenance",
"name": "Automated maintenance",
"detail": "no automated dependency updates observed",
"points": 0,
"status": "missed",
"details": [
{
"code": "no_dependency_automation",
"params": {}
}
],
"max_points": 8
},
{
"key": "openssf_scorecard_pinned_dependencies",
"name": "OpenSSF Scorecard: Pinned-Dependencies",
"detail": "all dependencies are pinned",
"points": 10,
"status": "met",
"details": [],
"max_points": 10
}
]
},
{
"key": "ai_code_legibility",
"band": "moderate",
"name": "Code legibility for models",
"note": null,
"notes": [],
"value": 52,
"inputs": {
"primary_language": "HTML",
"largest_source_bytes": 208188,
"source_files_sampled": 59,
"oversized_source_files": 3
},
"components": [
{
"key": "type_checkable_code",
"name": "Type-checkable code",
"detail": "HTML without a type-check config",
"points": 0,
"status": "missed",
"details": [
{
"code": "no_typecheck_config_language",
"params": {
"language": "HTML"
}
}
],
"max_points": 45
},
{
"key": "manageable_file_sizes",
"name": "Manageable file sizes",
"detail": "3/59 source files over 60KB",
"points": 52.2,
"status": "partial",
"details": [
{
"code": "oversized_source_files",
"params": {
"kb": 60,
"sampled": 59,
"oversized": 3
}
}
],
"max_points": 55
}
]
},
{
"key": "ai_interfaces",
"band": "at_risk",
"name": "Machine-readable interfaces",
"note": null,
"notes": [],
"value": 40,
"inputs": {
"example_dirs": [
"examples"
],
"has_mcp_signal": false,
"api_schema_files": []
},
"components": [
{
"key": "api_schema_openapi_graphql_proto",
"name": "API schema (OpenAPI/GraphQL/proto)",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 40
},
{
"key": "mcp_server",
"name": "MCP server",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 20
},
{
"key": "runnable_examples",
"name": "Runnable examples",
"detail": "examples",
"points": 40,
"status": "met",
"details": [
{
"code": "file_list",
"params": {
"files": "examples"
}
}
],
"max_points": 40
}
]
}
],
"description": "How well is the repo equipped to be developed and maintained with AI coding agents? An independent, experimental badge — weight 0.0, so it is surfaced on its own and does not affect the overall health score."
}
],
"metrics_version": "1.13.0"
},
"warnings": [
"Star history unavailable: GitHub GraphQL error: Resource not accessible by personal access token",
"GitHub dependency-graph SBOM unavailable (404); the dependency graph may be disabled for this repository",
"deps.dev does not index crates:bergshamra@0.8.0; advisories assessed against the repository dependency graph instead"
],
"report_type": "repository",
"generated_at": "2026-08-01T20:01:38.537037Z",
"schema_version": "0.27.0",
"badge_url": "https://raw.githubusercontent.com/inspect-software/badges/main/v1/k/kushaldas/bergshamra.svg",
"full_name": "kushaldas/bergshamra",
"license_state": "standard",
"license_spdx": "BSD-2-Clause"
}
Related records
Inspected repositories sharing catalogue tags or ecosystems with kushaldas/bergshamra. Read them side by side →
Scores are signals, not warranties. They reflect publicly visible practices on GitHub — not a code audit, and not a security guarantee.
Missing data is excluded and weights renormalized, never scored as zero. Methodology is versioned and open: metrics v1.13.0, schema v0.27.0 — full methodology · metrics wiki.
