AndreyAkinshin / zesven

本报告未能采集到解析后的依赖集合：GitHub dependency-graph SBOM unavailable (404); the dependency graph may be disabled for this repository

{
  "data": {
    "repo": {
      "topics": [],
      "is_fork": false,
      "size_kb": 959,
      "has_wiki": false,
      "homepage": "https://zesven.akinshin.dev",
      "languages": {
        "Rust": 2198357
      },
      "pushed_at": "2026-07-25T18:45:21Z",
      "created_at": "2026-01-19T01:10:48Z",
      "owner_type": "User",
      "updated_at": "2026-07-25T18:44:40Z",
      "description": "Pure Rust 7z Toolkit",
      "is_archived": false,
      "is_disabled": false,
      "license_spdx": "Apache-2.0",
      "default_branch": "main",
      "license_spdx_raw": "Apache-2.0",
      "primary_language": "Rust",
      "significant_languages": [
        "Rust"
      ]
    },
    "owner": {
      "blog": "https://akinshin.dev/",
      "name": "Andrey Akinshin",
      "type": "User",
      "login": "AndreyAkinshin",
      "company": "@JetBrains",
      "location": "Netherlands",
      "followers": 1368,
      "avatar_url": "https://avatars.githubusercontent.com/u/2259237?v=4",
      "created_at": "2012-09-01T06:45:51Z",
      "is_verified": null,
      "public_repos": 35,
      "account_age_days": 5076
    },
    "license": {
      "state": "standard",
      "spdx_id": "Apache-2.0",
      "raw_spdx": "Apache-2.0",
      "file_present": true,
      "scorecard_found": true,
      "profile_has_license": true
    },
    "activity": {
      "releases": [
        {
          "tag": "v1.2.0",
          "kind": "minor",
          "published_at": "2026-07-25T18:45:30Z"
        },
        {
          "tag": "v1.1.0",
          "kind": "minor",
          "published_at": "2026-01-27T20:34:48Z"
        },
        {
          "tag": "v1.0.1",
          "kind": "patch",
          "published_at": "2026-01-26T18:01:50Z"
        },
        {
          "tag": "v1.0.0",
          "kind": "major",
          "published_at": "2026-01-19T02:30:22Z"
        }
      ],
      "recent_commits": [
        {
          "oid": "763f08815077cc7b44b66d3ee8ddac8bdb0b556c",
          "body": null,
          "is_bot": false,
          "headline": "chore: bump version to 1.2.0",
          "author_name": "Jane",
          "author_login": "jn8128",
          "committed_at": "2026-07-25T18:44:35Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "e26f3b2d7f392c52a91b8fc752db3ccffedc0f1b",
          "body": "Without it `cargo` resolves to a mise shim with nothing behind it, and every\ntask dies with \"No version is set for shim: cargo\" on any machine that has not\nset a global rust through mise. My own runs hid this: I was putting\n~/.cargo/bin ahead of the shims by hand, which fixed my shell and nobody els\n[…]\nplicitly, since it needs\n-Z build-std and a matching rust-src, and would otherwise inherit the stable\ntoolchain the rest of the repo builds with.\n\nAcked-by: Andrey Akinshin <andrey.akinshin@gmail.com>",
          "is_bot": false,
          "headline": "build(mise): declare the Rust toolchain",
          "author_name": "Jane",
          "author_login": "jn8128",
          "committed_at": "2026-07-25T18:31:49Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "a702e5323bc13366f68f99c80d52dbb160b42f7f",
          "body": "Shipping meant editing rs/Cargo.toml by hand, committing, pushing and then\nremembering to trigger the workflow. This follows what pragmastat and perfolizer\nalready do: the version lives in a VERSION file at the root, `mise run version`\nwrites it and commits, `mise run publish` bumps, pushes and trig\n[…]\ne rather than grepping\na manifest. The crate manifest is synced from VERSION, and both CI and the\nworkflow refuse to proceed if the two disagree.\n\nAcked-by: Andrey Akinshin <andrey.akinshin@gmail.com>",
          "is_bot": false,
          "headline": "build(mise): publish through VERSION, like the other repos",
          "author_name": "Jane",
          "author_login": "jn8128",
          "committed_at": "2026-07-25T18:31:49Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "8e4d6cd84377534d9d90b9302117374d1f7a3bd5",
          "body": "The test demanded that extraction without a password fail. Decrypting with the\nwrong key usually yields something the decoder rejects, but it can also yield\nbytes it accepts - garbage, or nothing - so the test failed on CI at random. What\nthe archive actually promises is that the plaintext does not come back, and that\nis what it now asserts.\n\nAcked-by: Andrey Akinshin <andrey.akinshin@gmail.com>",
          "is_bot": false,
          "headline": "test(streaming): assert confidentiality, not which error surfaced",
          "author_name": "Jane",
          "author_login": "jn8128",
          "committed_at": "2026-07-25T16:34:19Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "24aa3cde4f711a8e5822467b61643d1dd3366e91",
          "body": "Only the counter changes between rounds of the key derivation, and the block was\nrebuilt from salt and password every time - half a million times at the default\nstrength. Writing the counter into a block built once takes the derivation from\n7.8 ms to 6.7 ms, which is where SHA-256 itself becomes the limit.\n\nAcked-by: Andrey Akinshin <andrey.akinshin@gmail.com>",
          "is_bot": false,
          "headline": "perf(crypto): build the hashed block once per derivation",
          "author_name": "Jane",
          "author_login": "jn8128",
          "committed_at": "2026-07-25T15:44:55Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "6bc88d000c8176d7c97ad67e11acdcf3ecf4f368",
          "body": "Every stream of an archive is encrypted under the same password, and the salt is\nwhat selects the key, so a per-stream salt meant re-deriving the key for every\nstream - 2^19 SHA-256 rounds each. Writing a hundred small encrypted files took\n938 ms against 56 ms unencrypted, nearly all of it key deriv\n[…]\n archive and the IV, which is what CBC\nactually requires to differ, is fresh for every stream. This is also what 7-Zip\ndoes, with no salt at all.\n\nAcked-by: Andrey Akinshin <andrey.akinshin@gmail.com>",
          "is_bot": false,
          "headline": "perf(crypto): derive one key per archive, not one per stream",
          "author_name": "Jane",
          "author_login": "jn8128",
          "committed_at": "2026-07-25T15:40:49Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "729ac116d3a6abe21e02fe50982e298a4ee10c46",
          "body": "The steps shared one target directory and ran at once, so a rebuild in one could\ndelete a test binary another was about to execute. That surfaced as \"could not\nexecute process ... No such file or directory\" on a random test and reads as a\nbroken test rather than the race it is.\n\nAcked-by: Andrey Akinshin <andrey.akinshin@gmail.com>",
          "is_bot": false,
          "headline": "build(mise): run the CI steps in sequence",
          "author_name": "Jane",
          "author_login": "jn8128",
          "committed_at": "2026-07-25T15:27:20Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "7f711daa69eafead103dd637c0015846e6f23325",
          "body": "`--no-default-features --features async` had never compiled: unused imports and\nan unused argument, all of them denied warnings, in code paths that only exist\nwhen a codec is present. The combination was absent from the feature matrix, so\nnothing noticed. Both are fixed - the items are gated on the features that use\nthem, and the combination is now built and tested in CI alongside the others.\n\nAcked-by: Andrey Akinshin <andrey.akinshin@gmail.com>",
          "is_bot": false,
          "headline": "build: make the codec-free async build compile, and check it",
          "author_name": "Jane",
          "author_login": "jn8128",
          "committed_at": "2026-07-25T15:14:41Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "6fede311b1d872e28595c0886bf3bdd705957ff1",
          "body": "CBC works in whole blocks and the true plaintext length is recorded in the\nfolder's coder sizes, so the padding is never inspected by anyone. PKCS#7, which\nwe used, is obliged to append an entire wasted block whenever the data already\nends on a boundary; 7-Zip fills with zeros and appends nothing. O\n[…]\nribed PKCS#7 and demanded that readers validate it, which would\nreject every real 7-Zip archive - it now describes what the format actually does.\n\nAcked-by: Andrey Akinshin <andrey.akinshin@gmail.com>",
          "is_bot": false,
          "headline": "fix(crypto): pad encrypted streams the way the format does",
          "author_name": "Jane",
          "author_login": "jn8128",
          "committed_at": "2026-07-25T15:03:28Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "b2467e4066f410a9b87e1b375c75c57b38ca2f5b",
          "body": "AsyncArchive reads the whole archive into memory for the synchronous parser and\nthen handed a fresh copy of it to every extraction, so an archive of N entries\nmoved its own size through the allocator N times - a gigabyte archive of a\nthousand files pushed a terabyte of memmove before writing anything. The buffer\nis now shared, which also removes the second copy made at open time.\n\nAcked-by: Andrey Akinshin <andrey.akinshin@gmail.com>",
          "is_bot": false,
          "headline": "perf(async): share the archive buffer instead of copying it per entry",
          "author_name": "Jane",
          "author_login": "jn8128",
          "committed_at": "2026-07-25T14:59:16Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "8e9abf84996b0dfccf38440db1c45428cabe33fb",
          "body": "StreamingArchive allocated a decoder pool and never consulted it: nothing in\nthe crate called get_decoder, so pool_stats() reported zeros forever while the\ntype documented itself as the answer to selective reads. It now backs a new\nextract_entry_to, where it matters: every entry of a solid block com\n[…]\n call at a time re-decoded the block from the\nstart each time. Pulling forty entries from one block now reuses the decoder for\nall but the first.\n\nAcked-by: Andrey Akinshin <andrey.akinshin@gmail.com>",
          "is_bot": false,
          "headline": "perf(streaming): use the decoder pool it already carried",
          "author_name": "Jane",
          "author_login": "jn8128",
          "committed_at": "2026-07-25T14:54:49Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "a879a7bf60c34d88ab9f9e4778f29043ea062cad",
          "body": "…olume\n\nopen_path detected a volume set, read its header across all volumes and then\nhanded back a reader over the first file alone, so listing worked and extraction\nfailed with an I/O error the moment an entry's data crossed a boundary - which\nreads as a corrupt archive rather than as the wrong API\n[…]\nle or\nthe volume set, so callers no longer have to know which they have; Archive::\nopen_multivolume stays for callers who want the concrete type.\n\nAcked-by: Andrey Akinshin <andrey.akinshin@gmail.com>",
          "is_bot": false,
          "headline": "fix(read): read a volume set through open_path instead of its first v…",
          "author_name": "Jane",
          "author_login": "jn8128",
          "committed_at": "2026-07-25T14:49:25Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "4d8c0f23985dd157b3dee45f524d63c853e1d13e",
          "body": "A header lists every entry's name and metadata, so it grows with the archive\nand compresses very well; ours was written raw, and for a few hundred small\nfiles it was most of the archive - 30 KB of a 35 KB result where 7-Zip needs\ntens of bytes. It is now stored the same way an encrypted header is, a\n[…]\npped declaring a\nflat 16 MB LZMA2 dictionary for a few hundred bytes of data, which every reader\nhad to allocate before it could decode anything.\n\nAcked-by: Andrey Akinshin <andrey.akinshin@gmail.com>",
          "is_bot": false,
          "headline": "perf(write): compress the header and size its dictionary to fit",
          "author_name": "Jane",
          "author_login": "jn8128",
          "committed_at": "2026-07-25T14:21:15Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "497c19b6c843e833bb50b7435c6e34f6ae709eee",
          "body": "Archives carried no digest any other implementation could check: `7zz t`\nreported corrupted data as intact because there was nothing to compare against.\nPer-entry checksums now go in SubStreamsInfo, where readers look for them, and\nthe folder-level CRC is left out rather than duplicated - the format counts the\ndigests that follow, and declaring both made the header describe more than it\ncarried.\n\nAcked-by: Andrey Akinshin <andrey.akinshin@gmail.com>",
          "is_bot": false,
          "headline": "fix(write): record a checksum for every entry",
          "author_name": "Jane",
          "author_login": "jn8128",
          "committed_at": "2026-07-25T14:21:15Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "57f8387af4e522b42cd11229033bd38bea3ba82a",
          "body": "Entries in a solid block share one decoder, so bytes left behind by an entry the\ncaller skipped or read only in part sat in front of the next one and every\nfollowing entry came out shifted. The iterator already had the helper for this,\nmarked dead code; the documentation already promised the behaviour.\n\nAcked-by: Andrey Akinshin <andrey.akinshin@gmail.com>",
          "is_bot": false,
          "headline": "fix(streaming): drain what the caller did not read before moving on",
          "author_name": "Jane",
          "author_login": "jn8128",
          "committed_at": "2026-07-25T14:21:15Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "e8982de53a1e9113d072761a652fddb940e197b1",
          "body": "The decoder for a folder was built with the pack size of whichever folder was\ncurrent before the switch, so in an archive of several folders every one after\nthe first was read at the wrong length: truncated when the previous folder was\nsmaller, overrunning into the next when it was larger.\n\nAcked-by: Andrey Akinshin <andrey.akinshin@gmail.com>",
          "is_bot": false,
          "headline": "fix(streaming): size each folder read by the folder being read",
          "author_name": "Jane",
          "author_login": "jn8128",
          "committed_at": "2026-07-25T14:21:14Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "e14f5cf9a2d5c81ce3f2d3025599ed241856caca",
          "body": "…them\n\nkArchiveProperties and kAdditionalStreamsInfo are ordinary parts of the format\nthat carry nothing this crate uses, and rejecting them meant rejecting archives\nanother implementation writes without a second thought. Unknown archive\nproperties are stepped over by their declared size, which is the rule the format\nsets for exactly this case.\n\nAcked-by: Andrey Akinshin <andrey.akinshin@gmail.com>",
          "is_bot": false,
          "headline": "fix(read): skip header sections we do not act on instead of refusing …",
          "author_name": "Jane",
          "author_login": "jn8128",
          "committed_at": "2026-07-25T14:21:14Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "cfaa39322206aa4b0962b1ad55c570dcaf430f5f",
          "body": "…ry point\n\nA header-encrypted volume set could not be opened by any public API: the\nmulti-volume paths read the header without a password, and open_path_with_password\ndid not detect a volume set at all. The streaming reader took a password in its\nconstructor and then read the header without it, and skipped the SFX stub the\nsynchronous reader detects, so archives that open fine there failed here.\n\nAcked-by: Andrey Akinshin <andrey.akinshin@gmail.com>",
          "is_bot": false,
          "headline": "fix(read): open encrypted and self-extracting archives from every ent…",
          "author_name": "Jane",
          "author_login": "jn8128",
          "committed_at": "2026-07-25T14:04:04Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "a626f5f9fde49f33b182286618222d0cea15ebcc",
          "body": "A folder holding several entries recorded a CRC of zero and the header declared\nit defined, so the archive stated a checksum for data whose checksum it did not\nhave. Such folders now leave it undeclared, which is what the per-entry digests\nin SubStreamsInfo are for, and the encrypted header gained t\n[…]\nd be rejected before its garbage is parsed.\nThe format validator rejects a declared zero over non-empty output, so this\ncannot come back quietly.\n\nAcked-by: Andrey Akinshin <andrey.akinshin@gmail.com>",
          "is_bot": false,
          "headline": "fix(write): only declare a folder CRC that is actually known",
          "author_name": "Jane",
          "author_login": "jn8128",
          "committed_at": "2026-07-25T14:01:03Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "cc51cff02c12976cf01bde9f754a54664a476bf9",
          "body": "…nes them\n\nThe property blob is one byte when it carries neither salt nor IV, and we\ndemanded two, so archives 7-Zip reads fine failed to open here. In the other\ndirection a salt over 16 bytes overflowed the size nibble and was silently\ntruncated, producing an archive nothing could decrypt; that is now an error.\nA blob longer than its declared sizes is rejected rather than decrypted with\nwhatever the extra bytes leave as the IV.\n\nAcked-by: Andrey Akinshin <andrey.akinshin@gmail.com>",
          "is_bot": false,
          "headline": "fix(crypto): read and write AES properties exactly as the format defi…",
          "author_name": "Jane",
          "author_login": "jn8128",
          "committed_at": "2026-07-25T13:37:33Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "495e2b6467b8065a1fd6dfb8419407febf05e153",
          "body": "Key derivation is 2^19 SHA-256 rounds by design, around 9 ms, and every folder\nof an archive shares one password - but a non-solid archive has one folder per\nfile, and each of them re-derived from scratch. The KeyCache the crate already\nhad was never consulted; both the encoder and the decoder now go through it,\nkeyed on password, salt and cycle count, so nothing is shared between archives\nthat should not be.\n\nAcked-by: Andrey Akinshin <andrey.akinshin@gmail.com>",
          "is_bot": false,
          "headline": "perf(crypto): derive each encryption key once",
          "author_name": "Jane",
          "author_login": "jn8128",
          "committed_at": "2026-07-25T13:34:59Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "762bca7d5de2680df7972a02da4dca2139b80d82",
          "body": "AsyncArchive read the header without the password, so a header-encrypted\narchive could not even be listed, and extraction decoded with the folder's first\ncoder alone, which quietly returned the wrong bytes for anything filtered and\nfailed outright for anything encrypted. The password now reaches both the header\nparser and the decode chain, and the chain is the shared one.\n\nAcked-by: Andrey Akinshin <andrey.akinshin@gmail.com>",
          "is_bot": false,
          "headline": "fix(async): decrypt headers and decode full folder chains",
          "author_name": "Jane",
          "author_login": "jn8128",
          "committed_at": "2026-07-25T13:32:12Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "1d54f8c753ad97cd47205117a8052feed9f9dd4d",
          "body": "The streaming readers each decoded with folder.coders[0] alone, so a folder that\nfilters or encrypts came back as data of the right length and the wrong\ncontents, and the streaming path verifies no CRC, so callers received the\ncorruption silently. They now share the reader's chain builder and carry \n[…]\nalready included it, and the random-access reader\nderived the start of the data area from next_header_offset, which points at the\nheader instead.\n\nAcked-by: Andrey Akinshin <andrey.akinshin@gmail.com>",
          "is_bot": false,
          "headline": "fix(streaming): decode the whole folder chain, not just its first coder",
          "author_name": "Jane",
          "author_login": "jn8128",
          "committed_at": "2026-07-25T13:28:22Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "f2859640f1ee2c7357a4685a7dd5056013a049e4",
          "body": "Writer tests verify their output by reading it back through our own reader,\nwhich agrees with the writer even when both are wrong; that is how a bad\nencrypted-header layout and a transposed coder size list survived a suite of\nover a thousand tests. This adds an independent structural validator, writ\n[…]\n than as\na false accusation against the writer. The archive 1.1.0 produced for\nencrypt_header is kept as a fixture: the validator must reject it.\n\nAcked-by: Andrey Akinshin <andrey.akinshin@gmail.com>",
          "is_bot": false,
          "headline": "test(format): validate written archives against the format itself",
          "author_name": "Jane",
          "author_login": "jn8128",
          "committed_at": "2026-07-25T13:21:44Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "af5fd440eec988245c56032794d0c6e07da4802a",
          "body": "The front-page \"Creating an Encrypted Archive\" example produced an unencrypted\narchive. Nonce policy docs still described the old weak-entropy behaviour and\nsteered readers away from the default, which is now the CSPRNG-backed one, and\nthe documented iteration count had no example showing how to set it.\n\nAcked-by: Andrey Akinshin <andrey.akinshin@gmail.com>",
          "is_bot": false,
          "headline": "docs: fix the encryption examples and the nonce policy guidance",
          "author_name": "Jane",
          "author_login": "jn8128",
          "committed_at": "2026-07-25T12:51:39Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "066c523b7cc8e4dfc1acedcc33789ccae6fdc8a5",
          "body": "The WASM writer exposed encryptHeader to JavaScript and dropped it. The async\nwriter accepts the same WriteOptions as the sync one, has no encryption support\nat all, and wrote plaintext for any of them; it now refuses instead.\n\nAcked-by: Andrey Akinshin <andrey.akinshin@gmail.com>",
          "is_bot": false,
          "headline": "fix(wasm,async): stop discarding encryption options",
          "author_name": "Jane",
          "author_login": "jn8128",
          "committed_at": "2026-07-25T12:51:39Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "cfc467d991bc64848555397b8d1aa37a881da100",
          "body": "Setting a password left encryption off unless the caller also passed\nencrypt_data(true), and asking for encryption without a password silently\nproduced plaintext; `zesven create -p` walked straight into the first case and\nwrote an archive the user believed was protected, with --encrypt-headers parse\n[…]\nns the CLI binary and asks 7-Zip whether the entries really are\nencrypted, since reading back what we wrote proves nothing about\nconfidentiality.\n\nAcked-by: Andrey Akinshin <andrey.akinshin@gmail.com>",
          "is_bot": false,
          "headline": "fix(write,cli): encrypt when a password is set",
          "author_name": "Jane",
          "author_login": "jn8128",
          "committed_at": "2026-07-25T12:51:38Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "9cbeabc70ee30145f439020af50543d8a51dc03e",
          "body": "Nonces came from the wall clock mixed with a thread-id hash. AES-CBC needs an\nunpredictable IV, and an attacker knows roughly when an archive was written, so\nthe guarantee the docs promised was not there. The wrong-password test no longer\npins which error variant comes back: with real randomness the garbage plaintext\nparses differently from run to run, which made the test fail occasionally.\n\nAcked-by: Andrey Akinshin <andrey.akinshin@gmail.com>",
          "is_bot": false,
          "headline": "fix(crypto): derive salt and IV from the system CSPRNG",
          "author_name": "Jane",
          "author_login": "jn8128",
          "committed_at": "2026-07-25T12:51:05Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "3d2e7a9a8b2387ef6f11ef841353257680aa7d27",
          "body": "Extraction from a solid block called the codec helper directly instead of the\nreader's own chain builder, so the password never reached the decoder and every\nencrypted solid archive failed with PasswordRequired. The reader's builder also\ncarried its own positional copy of the chain logic, now gone.\n\nAcked-by: Andrey Akinshin <andrey.akinshin@gmail.com>",
          "is_bot": false,
          "headline": "fix(read): decrypt encrypted solid blocks",
          "author_name": "Jane",
          "author_login": "jn8128",
          "committed_at": "2026-07-25T12:51:05Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "b61e647a3bcffcef76235e18e2c600ccdfa5f732",
          "body": "Round-trip tests cannot see a writer and a reader that diverge from the format\nin the same direction, which is how the bugs above survived a suite of over a\nthousand tests. This suite drives a pinned 7-Zip build in both directions and\nis a required CI job; a missing binary is a loud skip locally and a failure in\nCI. The reference is only ever the pinned build, never whichever 7z a machine\nhappens to carry.\n\nCloses #7\n\nAcked-by: Andrey Akinshin <andrey.akinshin@gmail.com>",
          "is_bot": false,
          "headline": "test(interop): verify archives against the reference 7-Zip binary",
          "author_name": "Jane",
          "author_login": "jn8128",
          "committed_at": "2026-07-25T12:48:22Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "50dec5df665a0f779fff650fab3562e23f7c72ee",
          "body": "A solid block of nothing but empty entries produced a folder with zero\nsubstreams, which 7-Zip refuses to open; such entries are carried by\nkEmptyStream and kEmptyFile alone.\n\nAcked-by: Andrey Akinshin <andrey.akinshin@gmail.com>",
          "is_bot": false,
          "headline": "fix(write): omit the folder for a block that holds no data",
          "author_name": "Jane",
          "author_login": "jn8128",
          "committed_at": "2026-07-25T12:48:22Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "a838b15bea08d21a2eabc1835b78808437837724",
          "body": "Three divergences made every encrypted archive we wrote unreadable outside\nthis crate, and 7-Zip's own header-encrypted archives unreadable here: the\nENCODED_HEADER recorded PackInfo.pack_pos = 0 with the ciphertext carried\ninline behind the structure, encrypted folders listed their coder unpack siz\n[…]\nplan, chains are resolved through bind\npairs, and early password validation no longer runs against LZMA1, whose 7z\nstream has no header to check.\n\nAcked-by: Andrey Akinshin <andrey.akinshin@gmail.com>",
          "is_bot": false,
          "headline": "fix(format): align encrypted archives with the 7z format",
          "author_name": "Jane",
          "author_login": "jn8128",
          "committed_at": "2026-07-25T12:48:21Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "a400686070104320efdfe21e1c6c1e5d81e754c5",
          "body": "Current clippy rejects the comparator form under unnecessary_sort_by.\n\nAcked-by: Andrey Akinshin <andrey.akinshin@gmail.com>",
          "is_bot": false,
          "headline": "style(codec): use sort_by_key for match ordering",
          "author_name": "Jane",
          "author_login": "jn8128",
          "committed_at": "2026-07-25T12:24:24Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "24fd5f41cfdaf87730890ac98231e0a0e5d011b9",
          "body": "Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "chore: bump version to 1.1.0",
          "author_name": "Andrey Akinshin",
          "author_login": "AndreyAkinshin",
          "committed_at": "2026-01-27T20:26:09Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "909b62b1fd068a87f61d57591f4ed664b1360660",
          "body": "Add support for decoding LZ4 and Brotli archives created with 7-Zip forks\n(7-Zip-zstd, NanaZip) that use zstdmt internally. These tools wrap compressed\ndata in \"skippable frames\" - a format from zstd that allows embedding metadata.\n\nChanges:\n- Add shared skippable_frame module with FrameReader for f\n[…]\nd frames (InvalidData)\n- Support multiple concatenated skippable frames\n- Add integration tests with real archives from sevenz-rust2\n\nCloses #4\n\nCo-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "feat(codec): add zstdmt skippable frame support for LZ4 and Brotli",
          "author_name": "Andrey Akinshin",
          "author_login": "AndreyAkinshin",
          "committed_at": "2026-01-27T20:20:09Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "18f70abb3871e9ae91a93842e04836f69260cbc4",
          "body": "O(n) worst-case when all items have freq > 0, but amortizes to O(1)\nsince freq is capped at 3. This is inherent to S3-FIFO algorithm.\n\nAddresses review feedback: https://github.com/AndreyAkinshin/zesven/pull/2#discussion_r2731047023\n\nCo-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "docs(s3fifo): document evict_m complexity",
          "author_name": "Andrey Akinshin",
          "author_login": "AndreyAkinshin",
          "committed_at": "2026-01-27T17:59:02Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "a10286a99e8020a02732434ff0a0045dcb80e154",
          "body": "Prepares release v1.0.1 with S3FIFO cache improvements and bug fixes.\n\nCo-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "chore: bump version to 1.0.1",
          "author_name": "Andrey Akinshin",
          "author_login": "AndreyAkinshin",
          "committed_at": "2026-01-26T17:49:32Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "4269ebf6874072d978e122b474b7295e0542e544",
          "body": "- Add #[allow(dead_code)] to get() method since it's conditionally used\n  only when crypto and streaming features are enabled\n- Fix tests to use `let _ = cache.get()` to acknowledge side effect calls\n  (incrementing frequency counter) without triggering must_use warnings\n- Add documentation clarifying that get() increments access frequency\n\nCo-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "fix(s3fifo): resolve CI issues with feature flags and must_use",
          "author_name": "Andrey Akinshin",
          "author_login": "AndreyAkinshin",
          "committed_at": "2026-01-26T17:43:59Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "7a6c339a477aa29fc89b7e9f2243bf49c73b692b",
          "body": "The s3fifo module is fully used by crypto::KeyCache and streaming::DecoderPool,\nso the #[allow(unused)] attribute on the module declaration is not needed.\n\nCo-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "refactor(s3fifo): remove unnecessary #[allow(unused)] attribute",
          "author_name": "Andrey Akinshin",
          "author_login": "AndreyAkinshin",
          "committed_at": "2026-01-26T17:43:59Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "028cefdbfd410ba56ee22c327ae1cc2f796d25c6",
          "body": "Add #[must_use] attribute to len(), capacity(), and is_empty() methods.\nIgnoring the return value of these query methods is likely a bug.\n\nCo-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "style(s3fifo): add #[must_use] to query methods",
          "author_name": "Andrey Akinshin",
          "author_login": "AndreyAkinshin",
          "committed_at": "2026-01-26T17:43:59Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "ee6eb4df794d774d524859781a578f11368331ce",
          "body": "Fix infinite loop when capacity=1 by setting small_capacity=0, which\nroutes all insertions directly to the main queue. This avoids the\ncase where main_capacity=0 causes evict_m() to loop forever.\n\nAdd edge case tests:\n- test_capacity_one: verifies single-item cache works correctly\n- test_capacity_tw\n[…]\nfter pop()\n- test_queue_consistency_after_operations: verifies len tracking\n- test_ghost_promotion: verifies ghost list -> main queue promotion\n\nCo-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "fix(s3fifo): handle capacity=1 edge case and add comprehensive tests",
          "author_name": "Andrey Akinshin",
          "author_login": "AndreyAkinshin",
          "committed_at": "2026-01-26T17:43:59Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "dfa9c3af140ed24f174ac68392b5922c484cc6b3",
          "body": "Add a queue_map HashMap to track which queue (small or main) each key\nbelongs to. This replaces the O(n) VecDeque::contains() calls in pop()\nwith O(1) HashMap lookups.\n\nThe queue_map is maintained during insert, eviction, and clear operations.\nWhen a key is removed via pop(), it's removed from queue_map but remains\nin the queue as a tombstone (which is skipped during eviction).\n\nCo-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "fix(s3fifo): use O(1) queue lookup in pop() instead of O(n) scan",
          "author_name": "Andrey Akinshin",
          "author_login": "AndreyAkinshin",
          "committed_at": "2026-01-26T17:43:59Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "ead9df7abf4d79c33b9c6b8ec348b1bc56ba1fbd",
          "body": "Removed a dependency and uses a very easy to understand cache logic, that can be implemented in 250 lines of pure, safe Rust code.",
          "is_bot": false,
          "headline": "Replace LRU with S3FIFO strategy",
          "author_name": "Nils Hasenbanck",
          "author_login": "hasenbanck",
          "committed_at": "2026-01-26T17:43:59Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "c269252e9ce351bf8b47d476fdbd690c2a08511d",
          "body": null,
          "is_bot": false,
          "headline": "chore: initial commit",
          "author_name": "Andrey Akinshin",
          "author_login": "AndreyAkinshin",
          "committed_at": "2026-01-19T02:23:19Z",
          "body_truncated": false,
          "is_coding_agent": false
        }
      ],
      "releases_count": 4,
      "commits_last_year": 44,
      "latest_release_at": "2026-07-25T18:45:30Z",
      "latest_release_tag": "v1.2.0",
      "releases_from_tags": false,
      "days_since_last_push": 1,
      "active_weeks_last_year": 3,
      "days_since_latest_release": 1,
      "mean_days_between_releases": 62.6
    },
    "community": {
      "has_readme": true,
      "has_license": true,
      "has_description": true,
      "has_contributing": false,
      "health_percentage": 42,
      "has_issue_template": false,
      "has_code_of_conduct": false,
      "has_pull_request_template": false
    },
    "ecosystem": {
      "packages": [
        {
          "name": "zesven",
          "exists": true,
          "license": "MIT OR Apache-2.0",
          "keywords": [
            "7z",
            "7zip",
            "archive",
            "compression",
            "lzma",
            "compression",
            "encoding"
          ],
          "ecosystem": "crates",
          "matches_repo": true,
          "registry_url": "https://crates.io/crates/zesven",
          "is_deprecated": false,
          "latest_version": "1.2.0",
          "repository_url": "https://github.com/AndreyAkinshin/zesven",
          "versions_count": 4,
          "total_downloads": 18430,
          "dependents_count": null,
          "deprecation_note": null,
          "maintainers_count": null,
          "monthly_downloads": 6102,
          "first_published_at": "2026-01-19T02:29:59.727728Z",
          "latest_published_at": "2026-07-25T18:45:01.832986Z",
          "latest_version_yanked": false,
          "days_since_latest_publish": 1
        }
      ]
    },
    "popularity": {
      "forks": 1,
      "stars": 26,
      "watchers": 2,
      "fork_history": {
        "days": [
          {
            "date": "2026-02-19",
            "count": 1
          }
        ],
        "complete": true,
        "collected": 1,
        "total_forks": 1
      },
      "star_history": null,
      "open_issues_and_prs": 1
    },
    "ai_readiness": {
      "has_nix": false,
      "example_dirs": [
        "examples"
      ],
      "has_llms_txt": false,
      "has_dockerfile": false,
      "has_mcp_signal": false,
      "bootstrap_files": [
        "mise.toml"
      ],
      "api_schema_files": [],
      "has_devcontainer": false,
      "typecheck_configs": [],
      "toolchain_manifests": [
        "rs/Cargo.toml",
        "rs/fuzz/Cargo.toml"
      ],
      "largest_source_bytes": 56326,
      "source_files_sampled": 151,
      "oversized_source_files": 0,
      "agent_instruction_files": [
        "AGENTS.md",
        "rs/AGENTS.md"
      ],
      "agent_instruction_max_bytes": 4435
    },
    "dependencies": {
      "manifests": [
        "docs/package.json",
        "rs/Cargo.toml"
      ],
      "advisories": {
        "error": null,
        "scope": null,
        "source": null,
        "findings": [],
        "collected": false,
        "malicious": [],
        "truncated": false,
        "by_severity": {},
        "advisory_count": 0,
        "affected_count": 0,
        "assessed_count": 0,
        "malicious_count": 0,
        "assessed_package": null,
        "unassessed_count": 0,
        "direct_affected_count": 0
      },
      "ecosystems": [
        "crates",
        "npm"
      ],
      "dependencies": [
        {
          "name": "crc32fast",
          "manifest": "rs/Cargo.toml",
          "ecosystem": "crates",
          "version_constraint": "1"
        },
        {
          "name": "crc64fast",
          "manifest": "rs/Cargo.toml",
          "ecosystem": "crates",
          "version_constraint": "1"
        },
        {
          "name": "thiserror",
          "manifest": "rs/Cargo.toml",
          "ecosystem": "crates",
          "version_constraint": "2"
        },
        {
          "name": "log",
          "manifest": "rs/Cargo.toml",
          "ecosystem": "crates",
          "version_constraint": "0.4"
        },
        {
          "name": "filetime",
          "manifest": "rs/Cargo.toml",
          "ecosystem": "crates",
          "version_constraint": "0.2"
        },
        {
          "name": "lzma-rust2",
          "manifest": "rs/Cargo.toml",
          "ecosystem": "crates",
          "version_constraint": "0.15"
        },
        {
          "name": "flate2",
          "manifest": "rs/Cargo.toml",
          "ecosystem": "crates",
          "version_constraint": "1"
        },
        {
          "name": "bzip2",
          "manifest": "rs/Cargo.toml",
          "ecosystem": "crates",
          "version_constraint": "0.6"
        },
        {
          "name": "ppmd-rust",
          "manifest": "rs/Cargo.toml",
          "ecosystem": "crates",
          "version_constraint": "1"
        },
        {
          "name": "lz4_flex",
          "manifest": "rs/Cargo.toml",
          "ecosystem": "crates",
          "version_constraint": "0.11"
        },
        {
          "name": "zstd",
          "manifest": "rs/Cargo.toml",
          "ecosystem": "crates",
          "version_constraint": "0.13"
        },
        {
          "name": "brotli",
          "manifest": "rs/Cargo.toml",
          "ecosystem": "crates",
          "version_constraint": "6"
        },
        {
          "name": "aes",
          "manifest": "rs/Cargo.toml",
          "ecosystem": "crates",
          "version_constraint": "0.8"
        },
        {
          "name": "cbc",
          "manifest": "rs/Cargo.toml",
          "ecosystem": "crates",
          "version_constraint": "0.1"
        },
        {
          "name": "sha2",
          "manifest": "rs/Cargo.toml",
          "ecosystem": "crates",
          "version_constraint": "0.10"
        },
        {
          "name": "zeroize",
          "manifest": "rs/Cargo.toml",
          "ecosystem": "crates",
          "version_constraint": "1"
        },
        {
          "name": "rayon",
          "manifest": "rs/Cargo.toml",
          "ecosystem": "crates",
          "version_constraint": "1.10"
        },
        {
          "name": "regex",
          "manifest": "rs/Cargo.toml",
          "ecosystem": "crates",
          "version_constraint": "1"
        },
        {
          "name": "sysinfo",
          "manifest": "rs/Cargo.toml",
          "ecosystem": "crates",
          "version_constraint": "0.32"
        },
        {
          "name": "clap",
          "manifest": "rs/Cargo.toml",
          "ecosystem": "crates",
          "version_constraint": "4.5"
        },
        {
          "name": "clap_complete",
          "manifest": "rs/Cargo.toml",
          "ecosystem": "crates",
          "version_constraint": "4.5"
        },
        {
          "name": "indicatif",
          "manifest": "rs/Cargo.toml",
          "ecosystem": "crates",
          "version_constraint": "0.17"
        },
        {
          "name": "rpassword",
          "manifest": "rs/Cargo.toml",
          "ecosystem": "crates",
          "version_constraint": "7.3"
        },
        {
          "name": "glob",
          "manifest": "rs/Cargo.toml",
          "ecosystem": "crates",
          "version_constraint": "0.3"
        },
        {
          "name": "serde_json",
          "manifest": "rs/Cargo.toml",
          "ecosystem": "crates",
          "version_constraint": "1.0"
        },
        {
          "name": "console",
          "manifest": "rs/Cargo.toml",
          "ecosystem": "crates",
          "version_constraint": "0.15"
        },
        {
          "name": "dialoguer",
          "manifest": "rs/Cargo.toml",
          "ecosystem": "crates",
          "version_constraint": "0.11"
        },
        {
          "name": "ctrlc",
          "manifest": "rs/Cargo.toml",
          "ecosystem": "crates",
          "version_constraint": "3.4"
        },
        {
          "name": "walkdir",
          "manifest": "rs/Cargo.toml",
          "ecosystem": "crates",
          "version_constraint": "2.5"
        },
        {
          "name": "tokio",
          "manifest": "rs/Cargo.toml",
          "ecosystem": "crates",
          "version_constraint": "1.43"
        },
        {
          "name": "tokio-util",
          "manifest": "rs/Cargo.toml",
          "ecosystem": "crates",
          "version_constraint": "0.7"
        },
        {
          "name": "async-compression",
          "manifest": "rs/Cargo.toml",
          "ecosystem": "crates",
          "version_constraint": "0.4"
        },
        {
          "name": "pin-project-lite",
          "manifest": "rs/Cargo.toml",
          "ecosystem": "crates",
          "version_constraint": "0.2"
        },
        {
          "name": "futures",
          "manifest": "rs/Cargo.toml",
          "ecosystem": "crates",
          "version_constraint": "0.3"
        },
        {
          "name": "wasm-bindgen",
          "manifest": "rs/Cargo.toml",
          "ecosystem": "crates",
          "version_constraint": "0.2"
        },
        {
          "name": "wasm-bindgen-futures",
          "manifest": "rs/Cargo.toml",
          "ecosystem": "crates",
          "version_constraint": "0.4"
        },
        {
          "name": "js-sys",
          "manifest": "rs/Cargo.toml",
          "ecosystem": "crates",
          "version_constraint": "0.3"
        },
        {
          "name": "web-sys",
          "manifest": "rs/Cargo.toml",
          "ecosystem": "crates",
          "version_constraint": "0.3.70"
        },
        {
          "name": "getrandom",
          "manifest": "rs/Cargo.toml",
          "ecosystem": "crates",
          "version_constraint": "0.2"
        }
      ],
      "all_dependencies": {
        "error": "GitHub dependency-graph SBOM unavailable (404); the dependency graph may be disabled for this repository",
        "source": null,
        "packages": [],
        "collected": false,
        "truncated": false,
        "total_count": null,
        "direct_count": null,
        "indirect_count": null
      }
    },
    "maintainership": {
      "issues": {
        "open_prs": 0,
        "merged_prs": 9,
        "open_issues": 1,
        "closed_ratio": 0.667,
        "closed_issues": 2,
        "closed_unmerged_prs": 0
      },
      "bus_factor": 1,
      "bot_contributors": 0,
      "top_contributors": [
        {
          "type": "User",
          "login": "jn8128",
          "commits": 33,
          "avatar_url": "https://avatars.githubusercontent.com/u/270032950?v=4"
        },
        {
          "type": "User",
          "login": "AndreyAkinshin",
          "commits": 10,
          "avatar_url": "https://avatars.githubusercontent.com/u/2259237?v=4"
        },
        {
          "type": "User",
          "login": "hasenbanck",
          "commits": 1,
          "avatar_url": "https://avatars.githubusercontent.com/u/12084860?v=4"
        }
      ],
      "contributors_sampled": 3,
      "top_contributor_share": 0.75
    },
    "quality_signals": {
      "has_ci": true,
      "has_tests": true,
      "ci_workflows": [
        "ci.yml",
        "publish.yml"
      ],
      "has_docs_dir": true,
      "linter_configs": [],
      "has_editorconfig": false,
      "has_linter_config": false,
      "has_precommit_config": false
    },
    "security_signals": {
      "lockfiles": [
        "pnpm-lock.yaml"
      ],
      "scorecard": {
        "checks": [
          {
            "name": "Binary-Artifacts",
            "score": 10,
            "reason": "no binaries found in the repo",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#binary-artifacts"
          },
          {
            "name": "Branch-Protection",
            "score": 0,
            "reason": "branch protection not enabled on development/release branches",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#branch-protection"
          },
          {
            "name": "CI-Tests",
            "score": 10,
            "reason": "7 out of 7 merged PRs checked by a CI test -- score normalized to 10",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#ci-tests"
          },
          {
            "name": "CII-Best-Practices",
            "score": 0,
            "reason": "no effort to earn an OpenSSF best practices badge detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#cii-best-practices"
          },
          {
            "name": "Code-Review",
            "score": 0,
            "reason": "Found 0/8 approved changesets -- score normalized to 0",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#code-review"
          },
          {
            "name": "Contributors",
            "score": 10,
            "reason": "project has 4 contributing companies or organizations",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#contributors"
          },
          {
            "name": "Dangerous-Workflow",
            "score": 10,
            "reason": "no dangerous workflow patterns detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#dangerous-workflow"
          },
          {
            "name": "Dependency-Update-Tool",
            "score": 0,
            "reason": "no update tool detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#dependency-update-tool"
          },
          {
            "name": "Fuzzing",
            "score": 10,
            "reason": "project is fuzzed",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#fuzzing"
          },
          {
            "name": "License",
            "score": 10,
            "reason": "license file detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#license"
          },
          {
            "name": "Maintained",
            "score": 10,
            "reason": "30 commit(s) and 1 issue activity found in the last 90 days -- score normalized to 10",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#maintained"
          },
          {
            "name": "Packaging",
            "score": 10,
            "reason": "packaging workflow detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#packaging"
          },
          {
            "name": "Pinned-Dependencies",
            "score": 0,
            "reason": "dependency not pinned by hash detected -- score normalized to 0",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#pinned-dependencies"
          },
          {
            "name": "SAST",
            "score": 0,
            "reason": "SAST tool is not run on all commits -- score normalized to 0",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#sast"
          },
          {
            "name": "Security-Policy",
            "score": 0,
            "reason": "security policy file not detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#security-policy"
          },
          {
            "name": "Signed-Releases",
            "score": null,
            "reason": "no releases found",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#signed-releases"
          },
          {
            "name": "Token-Permissions",
            "score": 0,
            "reason": "detected GitHub workflow tokens with excessive permissions",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#token-permissions"
          },
          {
            "name": "Vulnerabilities",
            "score": 2,
            "reason": "8 existing vulnerabilities detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#vulnerabilities"
          }
        ],
        "commit": "763f08815077cc7b44b66d3ee8ddac8bdb0b556c",
        "ran_at": "2026-07-26T19:41:07Z",
        "aggregate_score": 4.5,
        "scorecard_version": "v5.5.0"
      },
      "has_codeql_workflow": false,
      "has_security_policy": false,
      "has_dependabot_config": false
    },
    "contribution_flow": {
      "collected": true,
      "ci_last_run_at": "2026-07-25T18:49:08Z",
      "oldest_open_prs": [],
      "last_merged_pr_at": "2026-07-25T18:42:49Z",
      "ci_last_conclusion": "SUCCESS",
      "oldest_open_issues": [
        {
          "number": 16,
          "created_at": "2026-07-25T21:28:48Z",
          "last_comment_at": null,
          "last_comment_author": null
        }
      ]
    }
  },
  "config": {
    "disabled_metrics": [],
    "disabled_categories": [],
    "disabled_components": {}
  },
  "source": {
    "url": "https://github.com/AndreyAkinshin/zesven",
    "host": "github.com",
    "name": "zesven",
    "owner": "AndreyAkinshin"
  },
  "metrics": {
    "overall": {
      "key": "overall",
      "band": "moderate",
      "name": "Overall health",
      "note": null,
      "notes": [],
      "value": 61,
      "inputs": {
        "security": 45,
        "vitality": 75,
        "community": 42,
        "governance": 62,
        "engineering": 73
      },
      "components": []
    },
    "categories": [
      {
        "key": "vitality",
        "band": "good",
        "name": "Vitality",
        "value": 75,
        "weight": 0.22,
        "metrics": [
          {
            "key": "development_activity",
            "band": "moderate",
            "name": "Development activity",
            "note": null,
            "notes": [],
            "value": 63,
            "inputs": {
              "commits_last_year": 44,
              "human_commit_share": 1,
              "days_since_last_push": 1,
              "active_weeks_last_year": 3
            },
            "components": [
              {
                "key": "push_recency",
                "name": "Push recency",
                "detail": "last push 1 days ago",
                "points": 36,
                "status": "met",
                "details": [
                  {
                    "code": "push_recency",
                    "params": {
                      "days": 1
                    }
                  }
                ],
                "max_points": 36
              },
              {
                "key": "commit_cadence",
                "name": "Commit cadence",
                "detail": "3/52 weeks with commits",
                "points": 2.1,
                "status": "partial",
                "details": [
                  {
                    "code": "commit_cadence_weeks",
                    "params": {
                      "weeks": 3
                    }
                  }
                ],
                "max_points": 36
              },
              {
                "key": "commit_volume",
                "name": "Commit volume",
                "detail": "44 commits in the last year",
                "points": 14.8,
                "status": "partial",
                "details": [
                  {
                    "code": "commits_last_year",
                    "params": {
                      "count": 44
                    }
                  }
                ],
                "max_points": 18
              },
              {
                "key": "openssf_scorecard_maintained",
                "name": "OpenSSF Scorecard: Maintained",
                "detail": "30 commit(s) and 1 issue activity found in the last 90 days -- score normalized to 10",
                "points": 10,
                "status": "met",
                "details": [],
                "max_points": 10
              }
            ]
          },
          {
            "key": "release_discipline",
            "band": "excellent",
            "name": "Release discipline",
            "note": "Excluded from scoring (no data or not applicable): OpenSSF Scorecard: Signed-Releases. Remaining weights renormalized.",
            "notes": [
              {
                "code": "excluded_no_data",
                "params": {
                  "components": [
                    "openssf_scorecard_signed_releases"
                  ]
                }
              },
              {
                "code": "weights_renormalized",
                "params": {}
              }
            ],
            "value": 92,
            "inputs": {
              "releases_count": 4,
              "latest_release_tag": "v1.2.0",
              "releases_from_tags": false,
              "days_since_latest_release": 1,
              "mean_days_between_releases": 62.6
            },
            "components": [
              {
                "key": "ships_releases",
                "name": "Ships releases",
                "detail": "4 releases published",
                "points": 27,
                "status": "met",
                "details": [
                  {
                    "code": "releases_published",
                    "params": {
                      "count": 4
                    }
                  }
                ],
                "max_points": 27
              },
              {
                "key": "release_recency",
                "name": "Release recency",
                "detail": "latest release 1 days ago",
                "points": 36,
                "status": "met",
                "details": [
                  {
                    "code": "release_recency",
                    "params": {
                      "days": 1
                    }
                  }
                ],
                "max_points": 36
              },
              {
                "key": "release_cadence",
                "name": "Release cadence",
                "detail": "a release every ~62.6 days",
                "points": 19.8,
                "status": "partial",
                "details": [
                  {
                    "code": "release_cadence",
                    "params": {
                      "gap": 62.6
                    }
                  }
                ],
                "max_points": 27
              },
              {
                "key": "openssf_scorecard_signed_releases",
                "name": "OpenSSF Scorecard: Signed-Releases",
                "detail": "no releases found",
                "points": 0,
                "status": "excluded",
                "details": [
                  {
                    "code": "no_data",
                    "params": {}
                  }
                ],
                "max_points": 10
              }
            ]
          },
          {
            "key": "abandonment",
            "band": "excellent",
            "name": "Abandonment",
            "note": null,
            "notes": [],
            "value": 100,
            "inputs": {
              "cap": null,
              "state": "maintained",
              "guards": [],
              "signals": [],
              "red_flag": false,
              "multiplier_pct": 100,
              "declared_reason": null,
              "unverified_reason": null,
              "unanswered_open_prs": null,
              "unanswered_open_issues": null,
              "days_since_last_merged_pr": null,
              "days_since_last_human_commit": 1,
              "days_since_last_human_commit_is_floor": false
            },
            "components": [
              {
                "key": "project_is_still_maintained",
                "name": "Project is still maintained",
                "detail": "last human commit 1 days ago",
                "points": 100,
                "status": "met",
                "details": [
                  {
                    "code": "abandonment_maintained",
                    "params": {
                      "days": 1
                    }
                  }
                ],
                "max_points": 100
              }
            ]
          }
        ],
        "description": "Is the project alive — is code being written and are releases shipping?"
      },
      {
        "key": "community",
        "band": "at_risk",
        "name": "Community & Adoption",
        "value": 42,
        "weight": 0.18,
        "metrics": [
          {
            "key": "popularity",
            "band": "critical",
            "name": "Popularity & adoption",
            "note": null,
            "notes": [],
            "value": 23,
            "inputs": {
              "forks": 1,
              "stars": 26,
              "watchers": 2,
              "growth_state": "unverified",
              "growth_factor_pct": 100,
              "growth_unverified_reason": "no_history"
            },
            "components": [
              {
                "key": "stars",
                "name": "Stars",
                "detail": "26 stars",
                "points": 22.7,
                "status": "partial",
                "details": [
                  {
                    "code": "stars",
                    "params": {
                      "count": 26
                    }
                  }
                ],
                "max_points": 60
              },
              {
                "key": "forks",
                "name": "Forks",
                "detail": "1 forks",
                "points": 0,
                "status": "missed",
                "details": [
                  {
                    "code": "forks",
                    "params": {
                      "count": 1
                    }
                  }
                ],
                "max_points": 25
              },
              {
                "key": "watchers",
                "name": "Watchers",
                "detail": "2 watchers",
                "points": 0,
                "status": "missed",
                "details": [
                  {
                    "code": "watchers",
                    "params": {
                      "count": 2
                    }
                  }
                ],
                "max_points": 15
              }
            ]
          },
          {
            "key": "community_health",
            "band": "moderate",
            "name": "Community health",
            "note": null,
            "notes": [],
            "value": 50,
            "inputs": {
              "has_readme": true,
              "has_license": true,
              "has_contributing": false,
              "has_issue_template": false,
              "has_code_of_conduct": false,
              "has_pull_request_template": false
            },
            "components": [
              {
                "key": "readme",
                "name": "README",
                "detail": null,
                "points": 22.5,
                "status": "met",
                "details": [],
                "max_points": 22.5
              },
              {
                "key": "license",
                "name": "License",
                "detail": "recognized license (Apache-2.0)",
                "points": 22.5,
                "status": "met",
                "details": [
                  {
                    "code": "license_standard",
                    "params": {}
                  },
                  {
                    "code": "license_spdx",
                    "params": {
                      "spdx": "Apache-2.0"
                    }
                  }
                ],
                "max_points": 22.5
              },
              {
                "key": "contributing_guide",
                "name": "CONTRIBUTING guide",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 18
              },
              {
                "key": "code_of_conduct",
                "name": "Code of conduct",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 13.5
              },
              {
                "key": "issue_template",
                "name": "Issue template",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 7.2
              },
              {
                "key": "pr_template",
                "name": "PR template",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 6.3
              }
            ]
          },
          {
            "key": "ecosystem_adoption",
            "band": "moderate",
            "name": "Ecosystem adoption (downloads)",
            "note": "Excluded from scoring (no data or not applicable): Registry dependents. Remaining weights renormalized.",
            "notes": [
              {
                "code": "excluded_no_data",
                "params": {
                  "components": [
                    "registry_dependents"
                  ]
                }
              },
              {
                "code": "weights_renormalized",
                "params": {}
              }
            ],
            "value": 63,
            "inputs": {
              "packages": [
                "zesven"
              ],
              "dependents": null,
              "ecosystems": "crates",
              "total_downloads": 18430,
              "monthly_downloads": 6102
            },
            "components": [
              {
                "key": "monthly_downloads",
                "name": "Monthly downloads",
                "detail": "6,102 downloads/month across crates",
                "points": 50.5,
                "status": "partial",
                "details": [
                  {
                    "code": "downloads_monthly",
                    "params": {
                      "count": 6102,
                      "ecosystems": "crates"
                    }
                  }
                ],
                "max_points": 80
              },
              {
                "key": "registry_dependents",
                "name": "Registry dependents",
                "detail": "not reported by this ecosystem",
                "points": 0,
                "status": "excluded",
                "details": [
                  {
                    "code": "not_reported_by_this_ecosystem",
                    "params": {}
                  }
                ],
                "max_points": 20
              }
            ]
          }
        ],
        "description": "Does the project have users, downloads, attention, and a welcoming setup for contributors?"
      },
      {
        "key": "governance",
        "band": "moderate",
        "name": "Sustainability & Governance",
        "value": 62,
        "weight": 0.24,
        "metrics": [
          {
            "key": "maintainer_resilience",
            "band": "critical",
            "name": "Maintainer resilience (bus factor)",
            "note": null,
            "notes": [],
            "value": 29,
            "inputs": {
              "bus_factor": 1,
              "contributors_sampled": 3,
              "top_contributor_share": 0.75
            },
            "components": [
              {
                "key": "bus_factor",
                "name": "Bus factor",
                "detail": "1 contributor(s) cover half of all commits",
                "points": 9,
                "status": "partial",
                "details": [
                  {
                    "code": "bus_factor",
                    "params": {
                      "count": 1
                    }
                  }
                ],
                "max_points": 54
              },
              {
                "key": "commit_distribution",
                "name": "Commit distribution",
                "detail": "top contributor authored 75% of commits",
                "points": 5.6,
                "status": "partial",
                "details": [
                  {
                    "code": "top_contributor_share",
                    "params": {
                      "share": 75
                    }
                  }
                ],
                "max_points": 22.5
              },
              {
                "key": "contributor_breadth",
                "name": "Contributor breadth",
                "detail": "3 contributors",
                "points": 4.1,
                "status": "partial",
                "details": [
                  {
                    "code": "contributors_sampled",
                    "params": {
                      "count": 3
                    }
                  }
                ],
                "max_points": 13.5
              },
              {
                "key": "openssf_scorecard_contributors",
                "name": "OpenSSF Scorecard: Contributors",
                "detail": "project has 4 contributing companies or organizations",
                "points": 10,
                "status": "met",
                "details": [],
                "max_points": 10
              }
            ]
          },
          {
            "key": "responsiveness",
            "band": "moderate",
            "name": "Issue & PR responsiveness",
            "note": null,
            "notes": [],
            "value": 69,
            "inputs": {
              "merged_prs": 9,
              "open_issues": 1,
              "closed_issues": 2,
              "issue_closed_ratio": 0.667,
              "closed_unmerged_prs": 0
            },
            "components": [
              {
                "key": "issue_resolution",
                "name": "Issue resolution",
                "detail": "67% of issues closed",
                "points": 31.2,
                "status": "partial",
                "details": [
                  {
                    "code": "issues_closed_share",
                    "params": {
                      "share": 67
                    }
                  }
                ],
                "max_points": 46.75
              },
              {
                "key": "pr_acceptance",
                "name": "PR acceptance",
                "detail": "9/9 decided PRs merged",
                "points": 38.2,
                "status": "met",
                "details": [
                  {
                    "code": "decided_prs_merged",
                    "params": {
                      "merged": 9,
                      "decided": 9
                    }
                  }
                ],
                "max_points": 38.25
              },
              {
                "key": "openssf_scorecard_code_review",
                "name": "OpenSSF Scorecard: Code-Review",
                "detail": "Found 0/8 approved changesets -- score normalized to 0",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 15
              }
            ]
          },
          {
            "key": "stewardship",
            "band": "good",
            "name": "Ownership & stewardship",
            "note": "Excluded from scoring (no data or not applicable): Verified domain. Remaining weights renormalized.",
            "notes": [
              {
                "code": "excluded_no_data",
                "params": {
                  "components": [
                    "verified_domain"
                  ]
                }
              },
              {
                "code": "weights_renormalized",
                "params": {}
              }
            ],
            "value": 70,
            "inputs": {
              "followers": 1368,
              "owner_type": "User",
              "is_verified": null,
              "owner_login": "AndreyAkinshin",
              "public_repos": 35,
              "account_age_days": 5076
            },
            "components": [
              {
                "key": "ownership_backing",
                "name": "Ownership backing",
                "detail": "personal (user) account",
                "points": 10,
                "status": "partial",
                "details": [
                  {
                    "code": "owner_personal",
                    "params": {}
                  }
                ],
                "max_points": 30
              },
              {
                "key": "verified_domain",
                "name": "Verified domain",
                "detail": "not applicable to user accounts",
                "points": 0,
                "status": "excluded",
                "details": [
                  {
                    "code": "not_applicable_to_user_accounts",
                    "params": {}
                  }
                ],
                "max_points": 20
              },
              {
                "key": "owner_reach",
                "name": "Owner reach",
                "detail": "1,368 followers of AndreyAkinshin",
                "points": 22.5,
                "status": "partial",
                "details": [
                  {
                    "code": "owner_followers",
                    "params": {
                      "count": 1368,
                      "login": "AndreyAkinshin"
                    }
                  }
                ],
                "max_points": 25
              },
              {
                "key": "track_record",
                "name": "Track record",
                "detail": "35 public repos, account ~13 yr old",
                "points": 23.3,
                "status": "partial",
                "details": [
                  {
                    "code": "public_repos",
                    "params": {
                      "count": 35
                    }
                  },
                  {
                    "code": "account_age_years",
                    "params": {
                      "years": 13
                    }
                  }
                ],
                "max_points": 25
              }
            ]
          },
          {
            "key": "package_maintenance",
            "band": "excellent",
            "name": "Package maintenance",
            "note": null,
            "notes": [],
            "value": 92,
            "inputs": {
              "packages": [
                "zesven"
              ],
              "ecosystems": "crates",
              "any_deprecated": false,
              "min_days_since_publish": 1
            },
            "components": [
              {
                "key": "published_resolvable",
                "name": "Published & resolvable",
                "detail": "1 package(s) on crates",
                "points": 25,
                "status": "met",
                "details": [
                  {
                    "code": "packages_published",
                    "params": {
                      "count": 1,
                      "ecosystems": "crates"
                    }
                  }
                ],
                "max_points": 25
              },
              {
                "key": "publish_recency",
                "name": "Publish recency",
                "detail": "latest publish 1 days ago",
                "points": 35,
                "status": "met",
                "details": [
                  {
                    "code": "publish_recency",
                    "params": {
                      "days": 1
                    }
                  }
                ],
                "max_points": 35
              },
              {
                "key": "version_history",
                "name": "Version history",
                "detail": "4 published versions",
                "points": 12,
                "status": "partial",
                "details": [
                  {
                    "code": "published_versions",
                    "params": {
                      "count": 4
                    }
                  }
                ],
                "max_points": 20
              },
              {
                "key": "not_deprecated",
                "name": "Not deprecated",
                "detail": "active, not deprecated or yanked",
                "points": 20,
                "status": "met",
                "details": [
                  {
                    "code": "package_not_deprecated",
                    "params": {}
                  }
                ],
                "max_points": 20
              }
            ]
          }
        ],
        "description": "Will the project survive its people — bus factor, responsiveness, who backs it, and package upkeep?"
      },
      {
        "key": "engineering",
        "band": "good",
        "name": "Engineering Quality",
        "value": 73,
        "weight": 0.2,
        "metrics": [
          {
            "key": "engineering_practices",
            "band": "moderate",
            "name": "Engineering practices",
            "note": null,
            "notes": [],
            "value": 68,
            "inputs": {
              "has_ci": true,
              "has_tests": true,
              "has_editorconfig": false,
              "has_linter_config": false,
              "has_precommit_config": false
            },
            "components": [
              {
                "key": "ci_workflows",
                "name": "CI workflows",
                "detail": "2 workflow(s)",
                "points": 24,
                "status": "met",
                "details": [
                  {
                    "code": "ci_workflows",
                    "params": {
                      "count": 2
                    }
                  }
                ],
                "max_points": 24
              },
              {
                "key": "tests_present",
                "name": "Tests present",
                "detail": null,
                "points": 24,
                "status": "met",
                "details": [],
                "max_points": 24
              },
              {
                "key": "linter_config",
                "name": "Linter config",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 16
              },
              {
                "key": "pre_commit_hooks",
                "name": "Pre-commit hooks",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 9.6
              },
              {
                "key": "editorconfig",
                "name": ".editorconfig",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 6.4
              },
              {
                "key": "openssf_scorecard_ci_tests",
                "name": "OpenSSF Scorecard: CI-Tests",
                "detail": "7 out of 7 merged PRs checked by a CI test -- score normalized to 10",
                "points": 20,
                "status": "met",
                "details": [],
                "max_points": 20
              }
            ]
          },
          {
            "key": "documentation",
            "band": "good",
            "name": "Documentation",
            "note": null,
            "notes": [],
            "value": 80,
            "inputs": {
              "topics": [],
              "has_wiki": false,
              "homepage": "https://zesven.akinshin.dev",
              "has_readme": true,
              "has_docs_dir": true,
              "has_description": true
            },
            "components": [
              {
                "key": "readme",
                "name": "README",
                "detail": null,
                "points": 30,
                "status": "met",
                "details": [],
                "max_points": 30
              },
              {
                "key": "documentation_directory",
                "name": "Documentation directory",
                "detail": null,
                "points": 25,
                "status": "met",
                "details": [],
                "max_points": 25
              },
              {
                "key": "documentation_homepage_site",
                "name": "Documentation / homepage site",
                "detail": "https://zesven.akinshin.dev",
                "points": 15,
                "status": "met",
                "details": [],
                "max_points": 15
              },
              {
                "key": "repository_description",
                "name": "Repository description",
                "detail": null,
                "points": 10,
                "status": "met",
                "details": [],
                "max_points": 10
              },
              {
                "key": "topics",
                "name": "Topics",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 10
              },
              {
                "key": "wiki",
                "name": "Wiki",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 10
              }
            ]
          }
        ],
        "description": "Are baseline engineering and documentation practices in place?"
      },
      {
        "key": "security",
        "band": "at_risk",
        "name": "Security",
        "value": 45,
        "weight": 0.16,
        "metrics": [
          {
            "key": "security_posture",
            "band": "at_risk",
            "name": "Security posture",
            "note": "Excluded from scoring (no data or not applicable): Signed-Releases. Remaining weights renormalized.",
            "notes": [
              {
                "code": "excluded_no_data",
                "params": {
                  "components": [
                    "signed_releases"
                  ]
                }
              },
              {
                "code": "weights_renormalized",
                "params": {}
              }
            ],
            "value": 45,
            "inputs": {
              "source": "openssf_scorecard",
              "checks_evaluated": 17,
              "scorecard_version": "v5.5.0",
              "checks_inconclusive": 1,
              "scorecard_aggregate": 4.5
            },
            "components": [
              {
                "key": "binary_artifacts",
                "name": "Binary-Artifacts",
                "detail": "no binaries found in the repo",
                "points": 7.5,
                "status": "met",
                "details": [],
                "max_points": 7.5
              },
              {
                "key": "branch_protection",
                "name": "Branch-Protection",
                "detail": "branch protection not enabled on development/release branches",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 7.5
              },
              {
                "key": "ci_tests",
                "name": "CI-Tests",
                "detail": "7 out of 7 merged PRs checked by a CI test -- score normalized to 10",
                "points": 2.5,
                "status": "met",
                "details": [],
                "max_points": 2.5
              },
              {
                "key": "cii_best_practices",
                "name": "CII-Best-Practices",
                "detail": "no effort to earn an OpenSSF best practices badge detected",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 2.5
              },
              {
                "key": "code_review",
                "name": "Code-Review",
                "detail": "Found 0/8 approved changesets -- score normalized to 0",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 7.5
              },
              {
                "key": "contributors",
                "name": "Contributors",
                "detail": "project has 4 contributing companies or organizations",
                "points": 2.5,
                "status": "met",
                "details": [],
                "max_points": 2.5
              },
              {
                "key": "dangerous_workflow",
                "name": "Dangerous-Workflow",
                "detail": "no dangerous workflow patterns detected",
                "points": 10,
                "status": "met",
                "details": [],
                "max_points": 10
              },
              {
                "key": "dependency_update_tool",
                "name": "Dependency-Update-Tool",
                "detail": "no update tool detected",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 7.5
              },
              {
                "key": "fuzzing",
                "name": "Fuzzing",
                "detail": "project is fuzzed",
                "points": 5,
                "status": "met",
                "details": [],
                "max_points": 5
              },
              {
                "key": "license",
                "name": "License",
                "detail": "license file detected",
                "points": 2.5,
                "status": "met",
                "details": [],
                "max_points": 2.5
              },
              {
                "key": "maintained",
                "name": "Maintained",
                "detail": "30 commit(s) and 1 issue activity found in the last 90 days -- score normalized to 10",
                "points": 7.5,
                "status": "met",
                "details": [],
                "max_points": 7.5
              },
              {
                "key": "packaging",
                "name": "Packaging",
                "detail": "packaging workflow detected",
                "points": 5,
                "status": "met",
                "details": [],
                "max_points": 5
              },
              {
                "key": "pinned_dependencies",
                "name": "Pinned-Dependencies",
                "detail": "dependency not pinned by hash detected -- score normalized to 0",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 5
              },
              {
                "key": "sast",
                "name": "SAST",
                "detail": "SAST tool is not run on all commits -- score normalized to 0",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 5
              },
              {
                "key": "security_policy",
                "name": "Security-Policy",
                "detail": "security policy file not detected",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 5
              },
              {
                "key": "signed_releases",
                "name": "Signed-Releases",
                "detail": "no releases found",
                "points": 0,
                "status": "excluded",
                "details": [
                  {
                    "code": "no_data",
                    "params": {}
                  }
                ],
                "max_points": 7.5
              },
              {
                "key": "token_permissions",
                "name": "Token-Permissions",
                "detail": "detected GitHub workflow tokens with excessive permissions",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 7.5
              },
              {
                "key": "vulnerabilities",
                "name": "Vulnerabilities",
                "detail": "8 existing vulnerabilities detected",
                "points": 1.5,
                "status": "partial",
                "details": [],
                "max_points": 7.5
              }
            ]
          },
          {
            "key": "high_risk_jurisdiction_exposure",
            "band": "excellent",
            "name": "High-Risk Jurisdiction Exposure",
            "note": "Only high-confidence self-published location evidence affects this multiplier. Ambiguous matches are review-only; country evidence is not proof of nationality, citizenship, legal registration, malicious intent, or sanctions status.",
            "notes": [
              {
                "code": "jurisdiction_evidence_limits",
                "params": {}
              }
            ],
            "value": 100,
            "inputs": {
              "meaning": "self-published location evidence; not nationality or citizenship",
              "red_flag": false,
              "exposures": [],
              "policy_countries": [
                "Russia",
                "Iran",
                "North Korea"
              ],
              "review_only_matches": 0,
              "assessed_self_published_locations": 4
            },
            "components": [
              {
                "key": "policy_exposure_multiplier",
                "name": "Policy exposure multiplier",
                "detail": "no confirmed policy-scope location match",
                "points": 100,
                "status": "met",
                "details": [
                  {
                    "code": "jurisdiction_no_match",
                    "params": {}
                  }
                ],
                "max_points": 100
              }
            ]
          }
        ],
        "description": "Are visible security and supply-chain practices strong, with no malicious dependency and no unresolved high-risk jurisdiction exposure?"
      },
      {
        "key": "ai_readiness",
        "band": "good",
        "name": "AI Readiness",
        "value": 75,
        "weight": 0,
        "metrics": [
          {
            "key": "ai_agent_context",
            "band": "excellent",
            "name": "Agent context & guidance",
            "note": null,
            "notes": [],
            "value": 85,
            "inputs": {
              "has_llms_txt": false,
              "legible_history_share": 1,
              "agent_instruction_files": [
                "AGENTS.md",
                "rs/AGENTS.md"
              ],
              "agent_instruction_max_bytes": 4435
            },
            "components": [
              {
                "key": "agent_instructions",
                "name": "Agent instructions",
                "detail": "AGENTS.md, rs/AGENTS.md",
                "points": 45,
                "status": "met",
                "details": [
                  {
                    "code": "file_list",
                    "params": {
                      "files": "AGENTS.md, rs/AGENTS.md"
                    }
                  }
                ],
                "max_points": 45
              },
              {
                "key": "machine_readable_docs_llms_txt",
                "name": "Machine-readable docs (llms.txt)",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 15
              },
              {
                "key": "legible_commit_history",
                "name": "Legible commit history",
                "detail": "44 of 44 human commits state their intent (structured subject or explanatory body)",
                "points": 40,
                "status": "met",
                "details": [
                  {
                    "code": "legible_history",
                    "params": {
                      "legible": 44,
                      "sampled": 44
                    }
                  }
                ],
                "max_points": 40
              }
            ]
          },
          {
            "key": "ai_verify_loop",
            "band": "good",
            "name": "Verify loop (build / test / typecheck)",
            "note": null,
            "notes": [],
            "value": 71,
            "inputs": {
              "has_nix": false,
              "has_tests": true,
              "lockfiles": [
                "pnpm-lock.yaml"
              ],
              "has_dockerfile": false,
              "typed_language": true,
              "bootstrap_files": [
                "mise.toml"
              ],
              "has_devcontainer": false,
              "has_linter_config": false,
              "typecheck_configs": [],
              "agent_commit_share": 0.205,
              "toolchain_manifests": [
                "rs/Cargo.toml",
                "rs/fuzz/Cargo.toml"
              ],
              "dependency_bot_commit_share": 0
            },
            "components": [
              {
                "key": "one_command_bootstrap",
                "name": "One-command bootstrap",
                "detail": "mise.toml",
                "points": 18,
                "status": "met",
                "details": [
                  {
                    "code": "file_list",
                    "params": {
                      "files": "mise.toml"
                    }
                  }
                ],
                "max_points": 18
              },
              {
                "key": "automated_tests",
                "name": "Automated tests",
                "detail": null,
                "points": 22,
                "status": "met",
                "details": [],
                "max_points": 22
              },
              {
                "key": "lint_format_config",
                "name": "Lint / format config",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 11
              },
              {
                "key": "static_type_checking",
                "name": "Static type checking",
                "detail": "Rust (statically typed)",
                "points": 11,
                "status": "met",
                "details": [
                  {
                    "code": "statically_typed_language",
                    "params": {
                      "language": "Rust"
                    }
                  }
                ],
                "max_points": 11
              },
              {
                "key": "reproducible_environment",
                "name": "Reproducible environment",
                "detail": "lockfile",
                "points": 10,
                "status": "met",
                "details": [
                  {
                    "code": "file_list",
                    "params": {
                      "files": "lockfile"
                    }
                  }
                ],
                "max_points": 10
              },
              {
                "key": "demonstrated_agent_practice",
                "name": "Demonstrated agent practice",
                "detail": "9 of the last 44 commits agent-authored or agent-credited",
                "points": 10,
                "status": "met",
                "details": [
                  {
                    "code": "agent_authored_commits",
                    "params": {
                      "count": 9,
                      "sampled": 44
                    }
                  }
                ],
                "max_points": 10
              },
              {
                "key": "automated_maintenance",
                "name": "Automated maintenance",
                "detail": "no automated dependency updates observed",
                "points": 0,
                "status": "missed",
                "details": [
                  {
                    "code": "no_dependency_automation",
                    "params": {}
                  }
                ],
                "max_points": 8
              },
              {
                "key": "openssf_scorecard_pinned_dependencies",
                "name": "OpenSSF Scorecard: Pinned-Dependencies",
                "detail": "dependency not pinned by hash detected -- score normalized to 0",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 10
              }
            ]
          },
          {
            "key": "ai_code_legibility",
            "band": "excellent",
            "name": "Code legibility for models",
            "note": null,
            "notes": [],
            "value": 100,
            "inputs": {
              "primary_language": "Rust",
              "largest_source_bytes": 56326,
              "source_files_sampled": 151,
              "oversized_source_files": 0
            },
            "components": [
              {
                "key": "type_checkable_code",
                "name": "Type-checkable code",
                "detail": "Rust (statically typed)",
                "points": 45,
                "status": "met",
                "details": [
                  {
                    "code": "statically_typed_language",
                    "params": {
                      "language": "Rust"
                    }
                  }
                ],
                "max_points": 45
              },
              {
                "key": "manageable_file_sizes",
                "name": "Manageable file sizes",
                "detail": "0/151 source files over 60KB",
                "points": 55,
                "status": "met",
                "details": [
                  {
                    "code": "oversized_source_files",
                    "params": {
                      "kb": 60,
                      "sampled": 151,
                      "oversized": 0
                    }
                  }
                ],
                "max_points": 55
              }
            ]
          },
          {
            "key": "ai_interfaces",
            "band": "at_risk",
            "name": "Machine-readable interfaces",
            "note": null,
            "notes": [],
            "value": 40,
            "inputs": {
              "example_dirs": [
                "examples"
              ],
              "has_mcp_signal": false,
              "api_schema_files": []
            },
            "components": [
              {
                "key": "api_schema_openapi_graphql_proto",
                "name": "API schema (OpenAPI/GraphQL/proto)",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 40
              },
              {
                "key": "mcp_server",
                "name": "MCP server",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 20
              },
              {
                "key": "runnable_examples",
                "name": "Runnable examples",
                "detail": "examples",
                "points": 40,
                "status": "met",
                "details": [
                  {
                    "code": "file_list",
                    "params": {
                      "files": "examples"
                    }
                  }
                ],
                "max_points": 40
              }
            ]
          }
        ],
        "description": "How well is the repo equipped to be developed and maintained with AI coding agents? An independent, experimental badge — weight 0.0, so it is surfaced on its own and does not affect the overall health score."
      }
    ],
    "metrics_version": "1.13.0"
  },
  "warnings": [
    "Star history unavailable: GitHub GraphQL error: Resource not accessible by personal access token",
    "GitHub dependency-graph SBOM unavailable (404); the dependency graph may be disabled for this repository"
  ],
  "report_type": "repository",
  "generated_at": "2026-07-26T19:41:20.817973Z",
  "schema_version": "0.27.0",
  "badge_url": "https://raw.githubusercontent.com/inspect-software/badges/main/v1/a/AndreyAkinshin/zesven.svg",
  "full_name": "AndreyAkinshin/zesven",
  "license_state": "standard",
  "license_spdx": "Apache-2.0"
}