公开记录中等
软件健康报告模式 0.27.0 · 指标 1.13.0 · 2026-07-26 20:45 UTC
landlock-lsm / rust-landlock
A Rust library for the Linux Landlock sandboxing feature
landlock-lsm/rust-landlock 的健康指数为 100 分中的 64 分，处于「中等」区间。 其得分最高的类别是Vitality（73/100），最低的是AI Readiness（43/100）。 最近一次更新在 1 天前。 近期的大部分工作由 1 位贡献者完成。
64
总分 / 100软件健康指数
指标归入加权类别，统一采用 1–100 量表。总体分先取类别加权平均；当公开证据触发高风险司法辖区政策时，评级会按政策调整，并设置 49（有风险）的上限。AI 就绪度不计入总体分。
64
优秀85-100堪称典范；基本满足所有检验标准
良好70-84健康；仅有轻微不足
中等50-69可接受，但存在明显不足；建议进行审查
存在风险30-49存在重大薄弱环节；采用时应保持审慎
危急1-29问题严重（项目被弃置、仅有单一维护者、缺乏基本工程规范）
评分画像
每条轴代表一个类别。形状比平均值更重要——健康的对象会填满整个图形，而“一峰一谷”式画像意味着某一维度的优势正掩盖另一维度的风险。
所有权
软件包生态系统
| 注册表 | 软件包 | 版本 | 月下载量 | 版本数 | 最近发布 | 标签 |
|---|---|---|---|---|---|---|
| crates.io | landlock | 0.4.6 | 1,665,559 | 11 | 1 天前 | access-controllinuxsandboxsecurityvirtualizationapi-bindingsfilesystem |
按类别列示的指标
活力
项目是否仍有生命——是否仍在编写代码，是否仍在发布版本？
73
开发活跃度
66中等
评分方式
| 36/36 | 推送新近度 — 最近一次推送于 1 天前 |
| 6.9/36 | 提交节奏 — 52 周中有 10 周有提交 |
| 13/18 | 提交量 — 最近一年 27 次提交 |
| 10/10 | OpenSSF Scorecard：Maintained — 17 commit(s) and 3 issue activity found in the last 90 days -- score normalized to 10 |
所用输入
| commits_last_year | 27 |
| human_commit_share | 1 |
| days_since_last_push | 1 |
| active_weeks_last_year | 10 |
发布纪律
84良好
评分方式
| 27/27 | 有发布版本 — 已发布 9 个发布版本 |
| 36/36 | 发布时效 — 最近一次发布版本于 65 天前 |
| 12.6/27 | 发布节奏 — 约每 151 天发布一次 |
| 0/10 | OpenSSF Scorecard：Signed-Releases — 无数据 |
所用输入
| releases_count | 9 |
| latest_release_tag | v0.4.5 |
| releases_from_tags | 否 |
| days_since_latest_release | 65 |
| mean_days_between_releases | 151 |
已排除计分（无数据或不适用）：OpenSSF Scorecard：Signed-Releases。 其余权重已重新归一化。
社区与采用
项目是否拥有用户、下载量与关注度，并具备欢迎贡献者参与的配置？
69
流行度与采用
54中等
评分方式
| 39.8/60 | 星标 — 285 个星标 |
| 11.3/25 | 复刻 — 24 个复刻 |
| 3.3/15 | 关注者 — 5 位关注者 |
所用输入
| forks | 24 |
| stars | 285 |
| watchers | 5 |
| growth_state | unverified |
| growth_factor_pct | 100 |
| growth_unverified_reason | no_history |
社区健康
64中等
评分方式
| 22.5/22.5 | README |
| 16.9/22.5 | 许可证 — 存在许可证文件，但不是可识别的许可证 |
| 18/18 | CONTRIBUTING 指南 |
| 0/13.5 | 行为准则 |
| 0/7.2 | 议题模板 |
| 0/6.3 | PR 模板 |
所用输入
| has_readme | 是 |
| has_license | 是 |
| has_contributing | 是 |
| has_issue_template | 否 |
| has_code_of_conduct | 否 |
| has_pull_request_template | 否 |
生态采用（下载量）
100优秀
评分方式
| 80/80 | 月度下载量 — crates 合计每月 1,665,559 次下载 |
| 0/20 | 注册表被依赖数 — 该生态系统不报告此项 |
所用输入
| packages | landlock |
| dependents | — |
| ecosystems | crates |
| total_downloads | 13,000,824 |
| monthly_downloads | 1,665,559 |
已排除计分（无数据或不适用）：注册表被依赖数。 其余权重已重新归一化。
可持续性与治理
项目能否在其成员之外延续——巴士系数、响应能力、由谁支持，以及软件包的维护状况？
62
维护者韧性（巴士系数）
32存在风险
评分方式
| 9/54 | 巴士系数 — 1 位贡献者贡献了半数提交 |
| 1.8/22.5 | 提交分布 — 头号贡献者编写了 92% 的提交 |
| 10.8/13.5 | 贡献者广度 — 8 位贡献者 |
| 10/10 | OpenSSF Scorecard：Contributors — project has 7 contributing companies or organizations |
所用输入
| bus_factor | 1 |
| contributors_sampled | 8 |
| top_contributor_share | 0.921 |
议题与 PR 响应能力
66中等
评分方式
| 29.5/46.8 | 议题解决 — 63% 的议题已关闭 |
| 35.3/38.3 | PR 接受 — 已裁定的 PR 中 97/105 已合并 |
| 1.5/15 | OpenSSF Scorecard：Code-Review — Found 3/24 approved changesets -- score normalized to 1 |
所用输入
| merged_prs | 97 |
| open_issues | 10 |
| closed_issues | 17 |
| issue_closed_ratio | 0.63 |
| closed_unmerged_prs | 8 |
所有权与托管责任
64中等
评分方式
| 30/30 | 所有权背书 — 组织持有 |
| 0/20 | 已验证域名 |
| 14.1/25 | 所有者影响力 — landlock-lsm 有 91 位关注者 |
| 20.1/25 | 既往记录 — 12 个公开仓库，账户约 9 年 |
所用输入
| followers | 91 |
| owner_type | Organization |
| is_verified | — |
| owner_login | landlock-lsm |
| public_repos | 12 |
| account_age_days | 3,628 |
软件包维护
100优秀
评分方式
| 25/25 | 已发布且可解析 — crates 上有 1 个软件包 |
| 35/35 | 发布时效 — 最近一次发布于 1 天前 |
| 20/20 | 版本历史 — 11 个已发布版本 |
| 20/20 | 未被弃用 — 活跃，未被弃用或撤回 |
所用输入
| packages | landlock |
| ecosystems | crates |
| any_deprecated | 否 |
| min_days_since_publish | 1 |
工程质量
基础的工程与文档实践是否到位？
51
工程实践
42存在风险
评分方式
| 24/24 | CI 工作流 — 2 个工作流 |
| 0/24 | 存在测试 |
| 0/16 | Linter 配置 |
| 0/9.6 | Pre-commit 钩子 |
| 0/6.4 | .editorconfig |
| 18/20 | OpenSSF Scorecard：CI-Tests — 22 out of 24 merged PRs checked by a CI test -- score normalized to 9 |
所用输入
| has_ci | 是 |
| has_tests | 否 |
| has_editorconfig | 否 |
| has_linter_config | 否 |
| has_precommit_config | 否 |
文档
65中等
评分方式
| 30/30 | README |
| 0/25 | 文档目录 |
| 15/15 | 文档 / 主页站点 — https://crates.io/crates/landlock |
| 10/10 | 仓库描述 |
| 10/10 | 主题标签 — 4 个主题标签 |
| 0/10 | Wiki |
所用输入
| topics | landlock, linux, sandboxing, security |
| has_wiki | 否 |
| homepage | https://crates.io/crates/landlock |
| has_readme | 是 |
| has_docs_dir | 否 |
| has_description | 是 |
安全
可见的安全与供应链实践是否稳固，且不存在未解决的高风险司法辖区暴露？
64
安全态势
55中等
评分方式
| 7.5/7.5 | Binary-Artifacts — no binaries found in the repo |
| 0/7.5 | Branch-Protection — 无数据 |
| 2.2/2.5 | CI-Tests — 22 out of 24 merged PRs checked by a CI test -- score normalized to 9 |
| 0/2.5 | CII-Best-Practices — no effort to earn an OpenSSF best practices badge detected |
| 0.8/7.5 | Code-Review — Found 3/24 approved changesets -- score normalized to 1 |
| 2.5/2.5 | Contributors — project has 7 contributing companies or organizations |
| 10/10 | Dangerous-Workflow — no dangerous workflow patterns detected |
| 0/7.5 | Dependency-Update-Tool — no update tool detected |
| 0/5 | Fuzzing — project is not fuzzed |
| 2.2/2.5 | 许可证 — license file detected |
| 7.5/7.5 | Maintained — 17 commit(s) and 3 issue activity found in the last 90 days -- score normalized to 10 |
| 0/5 | Packaging — 无数据 |
| 0/5 | Pinned-Dependencies — dependency not pinned by hash detected -- score normalized to 0 |
| 0/5 | SAST — SAST tool is not run on all commits -- score normalized to 0 |
| 0/5 | Security-Policy — security policy file not detected |
| 0/7.5 | Signed-Releases — 无数据 |
| 6.8/7.5 | Token-Permissions — detected GitHub workflow tokens with excessive permissions |
| 7.5/7.5 | Vulnerabilities — 0 existing vulnerabilities detected |
所用输入
| source | openssf_scorecard |
| checks_evaluated | 15 |
| scorecard_version | v5.5.0 |
| checks_inconclusive | 3 |
| scorecard_aggregate | 5.5 |
已排除计分（无数据或不适用）：branch_protection, packaging, signed_releases。 其余权重已重新归一化。
依赖安全公告
100优秀
评分方式
| 35/35 | 直接依赖不含已知公告 — 没有直接依赖携带已知公告 |
| 25/25 | 间接依赖不含已知公告 — 没有间接依赖携带已知公告 |
| 0/40 | 没有长期未处理的公告 — 没有公告带有发布日期 |
所用输入
| source | osv |
| advisories | 0 |
| affected_packages | 0 |
| assessed_packages | 15 |
| unassessed_packages | 0 |
| affected_by_severity | none |
| direct_affected_packages | 0 |
已排除计分（无数据或不适用）：没有长期未处理的公告。 其余权重已重新归一化。 比对的是 crates:landlock@0.4.6 的运行时依赖闭包——安装已发布的软件包时真正被拉取进来的内容——共 15 个软件包。 未对可达性进行分析。
AI 就绪度
该仓库在多大程度上具备与 AI 编码代理协同开发与维护的条件？这是一枚独立的实验性徽章——权重为 0.0，因此单独呈现，不影响总体健康评分。
43
AI 代理上下文与指引
40存在风险
评分方式
| 0/45 | 代理指令 — 没有 CLAUDE.md / AGENTS.md / 编辑器规则 |
| 0/15 | 机器可读文档（llms.txt） |
| 40/40 | 可读的提交历史 — 100 次人类提交中有 100 次说明了意图（结构化标题或解释性正文） |
所用输入
| has_llms_txt | 否 |
| legible_history_share | 1 |
| agent_instruction_files | — |
| agent_instruction_max_bytes | — |
评分方式
| 12.6/18 | 一条命令的引导启动 — Cargo.toml（工具链约定，无任务运行器） |
| 0/22 | 自动化测试 |
| 0/11 | Lint / 格式化配置 |
| 11/11 | 静态类型检查 — Rust（静态类型） |
| 0/10 | 可复现环境 |
| 0/10 | 已体现的代理实践 — 最近 100 次提交中没有代理编写的提交 |
| 0/8 | 自动化维护 — 未观察到自动依赖更新 |
| 0/10 | OpenSSF Scorecard：Pinned-Dependencies — dependency not pinned by hash detected -- score normalized to 0 |
所用输入
| has_nix | 否 |
| has_tests | 否 |
| lockfiles | — |
| has_dockerfile | 否 |
| typed_language | 是 |
| bootstrap_files | — |
| has_devcontainer | 否 |
| has_linter_config | 否 |
| typecheck_configs | — |
| agent_commit_share | 0 |
| toolchain_manifests | Cargo.toml |
| dependency_bot_commit_share | 0 |
面向模型的代码可读性
100优秀
评分方式
| 45/45 | 可类型检查的代码 — Rust（静态类型） |
| 55/55 | 可控的文件大小 — 采样的 17 个源文件中有 0 个超过 60KB |
所用输入
| primary_language | Rust |
| largest_source_bytes | 54,053 |
| source_files_sampled | 17 |
| oversized_source_files | 0 |
机器可读接口
40存在风险
评分方式
| 0/40 | API 模式（OpenAPI/GraphQL/proto） |
| 0/20 | MCP 服务器 |
| 40/40 | 可运行示例 — examples |
所用输入
| example_dirs | examples |
| has_mcp_signal | 否 |
| api_schema_files | — |
关键数据
285GitHub 星标
8贡献者
27最近 12 个月提交数
1距最近推送天数
9发布版本数
1巴士系数（bus factor）
10开放议题
crates.io软件包生态系统数
数据采集警告
- Star history unavailable: GitHub GraphQL error: Resource not accessible by personal access token
更多细节
Star 与 Fork 历史 0 ★ / 24 ⇿
0Star
24Fork
9发布
每颗 star 和每个 fork 的添加时间，来自 GitHub 并按天汇总。累计增长位于其构成来源——每日新增——的正上方，二者可相互对照：稳定的自然增长与短暂的突增形态截然不同。当这一差别可被衡量时，它会作为增长真实性予以报告。
主版本 0次版本 3修订 6
每个点涵盖 5 天。
OpenSSF Scorecard 5.5 / 10
5.5综合
来自开源项目 OpenSSF Scorecard 的独立、工具无关的安全评估。每项检查奖励的是安全实践本身，而非特定供应商的工具。Scorecard 无法判定的检查项标记为 不适用，并从安全评分中剔除（绝不按零分计）。
| 10 | Binary-Artifacts | no binaries found in the repo |
| 不适用 | Branch-Protection | internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md |
| 9 | CI-Tests | 22 out of 24 merged PRs checked by a CI test -- score normalized to 9 |
| 0 | CII-Best-Practices | no effort to earn an OpenSSF best practices badge detected |
| 1 | Code-Review | Found 3/24 approved changesets -- score normalized to 1 |
| 10 | Contributors | project has 7 contributing companies or organizations |
| 10 | Dangerous-Workflow | no dangerous workflow patterns detected |
| 0 | Dependency-Update-Tool | no update tool detected |
| 0 | Fuzzing | project is not fuzzed |
| 9 | License | license file detected |
| 10 | Maintained | 17 commit(s) and 3 issue activity found in the last 90 days -- score normalized to 10 |
| 不适用 | Packaging | packaging workflow not detected |
| 0 | Pinned-Dependencies | dependency not pinned by hash detected -- score normalized to 0 |
| 0 | SAST | SAST tool is not run on all commits -- score normalized to 0 |
| 0 | Security-Policy | security policy file not detected |
| 不适用 | Signed-Releases | no releases found |
| 9 | Token-Permissions | detected GitHub workflow tokens with excessive permissions |
| 10 | Vulnerabilities | 0 existing vulnerabilities detected |
直接依赖 3
| 注册表 | 软件包 | 版本约束 | 清单文件 |
|---|---|---|---|
| crates.io | enumflags2 | 0.7 | Cargo.toml |
| crates.io | libc | 0.2.186 | Cargo.toml |
| crates.io | thiserror | 2.0 | Cargo.toml |
全部依赖 7
来自 GitHub 依赖图的完整解析依赖集合：3 个直接依赖与 4 个间接（传递）软件包。仓库提交锁文件时，传递闭包才是完整的。
| 注册表 | 软件包 | 版本 | 关系 |
|---|---|---|---|
| crates.io | enumflags2 | — | 直接 |
| crates.io | libc | — | 直接 |
| crates.io | thiserror | — | 直接 |
| crates.io | anyhow | — | 间接 |
| crates.io | lazy_static | — | 间接 |
| crates.io | strum | — | 间接 |
| crates.io | strum_macros | — | 间接 |
依赖安全公告 0
安装 crates:landlock@0.4.6 会引入 15 个包（直接与传递）：其中 0 个存在已知公告，0 个为直接依赖。
没有已知公告影响已评估的依赖。
公告表示依赖图中记录的版本落入某条公告的受影响范围。可达性未经分析，且依赖图包含开发与测试的版本固定——某项发现可能只涉及工具链而非交付的软件。
原始 JSON 报告 机器可读
{
"data": {
"repo": {
"topics": [
"landlock",
"linux",
"sandboxing",
"security"
],
"is_fork": false,
"size_kb": 345,
"has_wiki": false,
"homepage": "https://crates.io/crates/landlock",
"languages": {
"Rust": 227329,
"Shell": 1089
},
"pushed_at": "2026-07-25T14:58:46Z",
"created_at": "2021-04-13T18:34:45Z",
"owner_type": "Organization",
"updated_at": "2026-07-26T09:38:27Z",
"description": "A Rust library for the Linux Landlock sandboxing feature",
"is_archived": false,
"is_disabled": false,
"license_spdx": null,
"default_branch": "main",
"license_spdx_raw": "NOASSERTION",
"primary_language": "Rust",
"significant_languages": [
"Rust"
]
},
"owner": {
"blog": "https://landlock.io",
"name": "Landlock",
"type": "Organization",
"login": "landlock-lsm",
"company": null,
"location": null,
"followers": 91,
"avatar_url": "https://avatars.githubusercontent.com/u/21111839?v=4",
"created_at": "2016-08-18T20:55:26Z",
"is_verified": null,
"public_repos": 12,
"account_age_days": 3628
},
"license": {
"state": "custom",
"spdx_id": null,
"raw_spdx": "NOASSERTION",
"file_present": true,
"scorecard_found": true,
"profile_has_license": true
},
"activity": {
"releases": [
{
"tag": "v0.4.5",
"kind": "patch",
"published_at": "2026-05-22T14:33:37Z"
},
{
"tag": "v0.4.4",
"kind": "patch",
"published_at": "2025-11-20T13:30:20Z"
},
{
"tag": "v0.4.3",
"kind": "patch",
"published_at": "2025-09-14T12:56:13Z"
},
{
"tag": "v0.4.2",
"kind": "patch",
"published_at": "2025-04-29T09:27:37Z"
},
{
"tag": "v0.4.1",
"kind": "patch",
"published_at": "2024-09-13T18:04:56Z"
},
{
"tag": "v0.4.0",
"kind": "minor",
"published_at": "2024-06-19T09:19:02Z"
},
{
"tag": "v0.3.1",
"kind": "patch",
"published_at": "2024-03-26T15:02:46Z"
},
{
"tag": "v0.3.0",
"kind": "minor",
"published_at": "2023-10-10T10:41:17Z"
},
{
"tag": "v0.2.0",
"kind": "minor",
"published_at": "2023-01-30T19:06:29Z"
}
],
"recent_commits": [
{
"oid": "2ff9281776b039fccc6075c46ccabe1acdb7ba6e",
"body": " ./src/uapi/bindgen.sh .../linux-7.1\n\nSigned-off-by: Mickaël Salaün <mic@digikod.net>",
"is_bot": false,
"headline": "uapi: Update to Linux 7.1",
"author_name": "Mickaël Salaün",
"author_login": "l0kod",
"committed_at": "2026-07-25T14:58:46Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "17d619e72baf27f37ef484d0234ae318fa4a074d",
"body": "Add changelog entry.\n\nSigned-off-by: Mickaël Salaün <mic@digikod.net>",
"is_bot": false,
"headline": "lib: Bump to v0.4.6",
"author_name": "Mickaël Salaün",
"author_login": "l0kod",
"committed_at": "2026-07-24T21:34:29Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "bf64e9e8092af1e501329e6b7b7ba0cdef6ac6f0",
"body": "GitHub CI may run jobs on different machines, with different CPUs, which\ncan trigger a (non-backported) UML kernel bug.\n\nUpdate landlock-test-tools to bring improvements and fixes, especially:\n- landlock-lsm/landlock-test-tools@f644a251231e: reported result fix;\n- landlock-lsm/landlock-test-tools@1dd31a0f7961: UML FP XSTATE fix.\n\nSigned-off-by: Mickaël Salaün <mic@digikod.net>",
"is_bot": false,
"headline": "ci: Fix old UML kernels for newer CPUs",
"author_name": "Mickaël Salaün",
"author_login": "l0kod",
"committed_at": "2026-07-24T21:32:32Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "489b554f2fd286f6143fc61d87aa1ecff96ecb09",
"body": "Bump the sandboxer target to Landlock ABI v8, matching the\nLANDLOCK_ABI_LAST update in the kernel sample for Linux 7.0.\n\nThe kernel sample does not use LANDLOCK_RESTRICT_SELF_TSYNC (it is\nsingle-threaded), so no all_threads() call is added. The existing\nhint logic already reports an outdated kernel for any effective ABI\nbelow the targeted one.\n\nSigned-off-by: Mickaël Salaün <mic@digikod.net>",
"is_bot": false,
"headline": "sandboxer: Sync with kernel's sandboxer.c",
"author_name": "Mickaël Salaün",
"author_login": "l0kod",
"committed_at": "2026-07-23T15:09:43Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "fc151039bf64e9b32e66d9f90014b999dfa96d48",
"body": "Add ABI::V8 for the multithreading support introduced with Linux 7.0.\nThe new LANDLOCK_RESTRICT_SELF_TSYNC flag atomically applies the\nLandlock configuration (domain and logging) to all threads of the\ncalling process instead of only the calling thread.\n\nAppend ABI::V8 to every from_all() match arm f\n[…]\n7.0 to the CI kernel matrix (Landlock ABI v8). Leave the\nMSRV job's LANDLOCK_CRATE_TEST_ABI at 7 to match its runner kernel,\nwhich predates Linux 7.0.\n\nSigned-off-by: Mickaël Salaün <mic@digikod.net>",
"is_bot": false,
"headline": "ci,src: Handle Landlock ABI v8",
"author_name": "Mickaël Salaün",
"author_login": "l0kod",
"committed_at": "2026-07-23T15:09:43Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "2b56d528b1845df2ccfd58b963d53f13c8c07300",
"body": "Newer clippy versions raise the precedence lint on 1 << 63 | 1 in the\nAccessFs unknown-access test, since mixing a bit shift with a bitwise OR\nis easy to misread. The expression already groups as intended, make it\nexplicit.\n\nSee https://rust-lang.github.io/rust-clippy/master/index.html#precedence\n\nSigned-off-by: Mickaël Salaün <mic@digikod.net>",
"is_bot": false,
"headline": "access: Parenthesize the shift in the unknown-access test",
"author_name": "Mickaël Salaün",
"author_login": "l0kod",
"committed_at": "2026-07-23T14:03:40Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "749ed50d5842503b92f398924f59eadc1d393cb9",
"body": " ./src/uapi/bindgen.sh .../linux-7.0\n\nSigned-off-by: Mickaël Salaün <mic@digikod.net>",
"is_bot": false,
"headline": "uapi: Update to Linux 7.0",
"author_name": "Mickaël Salaün",
"author_login": "l0kod",
"committed_at": "2026-06-23T16:00:01Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "6b13cc4f2fb452096cf0c4b6e74341437df8b630",
"body": "Add changelog entry.\n\nSigned-off-by: Mickaël Salaün <mic@digikod.net>",
"is_bot": false,
"headline": "lib: Bump to v0.4.5",
"author_name": "Mickaël Salaün",
"author_login": "l0kod",
"committed_at": "2026-05-22T14:22:37Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "bd31957a447b9ca55a1594f3e42d3de370d67ec3",
"body": "Simplify and add links to the kernel documentation, and add introduciton\nat the crate root.\n\nSigned-off-by: Mickaël Salaün <mic@digikod.net>",
"is_bot": false,
"headline": "src: Update audit documentation",
"author_name": "Mickaël Salaün",
"author_login": "l0kod",
"committed_at": "2026-05-22T14:22:37Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "43128a137577c45085fc8e45a4907fda6d2b6b8b",
"body": "Bump the example to ABI v7 and add LL_FORCE_LOG environment variable\nsupport to enable audit logging of denied accesses after execve(2),\nmatching the kernel's sandboxer example. The setter is wrapped in\nHardRequirement so that LL_FORCE_LOG=1 fails loudly on kernels without\nthe feature.\n\nRemove LL_S\n[…]\nnsetenv() calls.\n\nFix a pre-existing bug: LL_SCOPED was not being removed from the child\nprocess environment, leaking the variable to spawned commands.\n\nSigned-off-by: Mickaël Salaün <mic@digikod.net>",
"is_bot": false,
"headline": "sandboxer: Sync with kernel's sandboxer.c",
"author_name": "Mickaël Salaün",
"author_login": "l0kod",
"committed_at": "2026-05-20T17:35:40Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "5487d8f17bd36667c9375452090aaf38b96244df",
"body": "Add the RestrictSelf builder for calling landlock_restrict_self(-1,\nflags) without creating a Landlock domain. This enables setting\nrestrict_self flags (e.g., muting subdomain audit logs) without creating\na ruleset.\n\nRestrictSelf uses the same RestrictSelfAttr trait as RulesetCreated,\nsharing the l\n[…]\nsupport() helper, generic over the builder and status types,\nfactors out the iteration, thread::spawn, and can_emulate dispatch\nshared by both helpers.\n\nSigned-off-by: Mickaël Salaün <mic@digikod.net>",
"is_bot": false,
"headline": "restrict_self: Add RestrictSelf builder for domain-less flag application",
"author_name": "Mickaël Salaün",
"author_login": "l0kod",
"committed_at": "2026-05-20T17:35:40Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "1ab0f9f1c01d1bf567672b8bc60d763c96c34af5",
"body": "Add ABI::V7 for restrict_self log flags introduced with Linux 6.15.\n\nAdd the syscall flag compatibility framework in a new flags module,\nparallel to but simpler than the Access/TryCompat machinery. Access\ntypes operate on sets of rights with Full/Partial/No compat results;\nsyscall flags are set ind\n[…]\n() and errata_up_to_date test for ABI v7.\n\nRe-add LANDLOCK_CRATE_TEST_ABI=7 to the MSRV CI job (previously\nremoved because ABI v7 was not yet defined).\n\nSigned-off-by: Mickaël Salaün <mic@digikod.net>",
"is_bot": false,
"headline": "ci,src: Handle Landlock ABI v7",
"author_name": "Mickaël Salaün",
"author_login": "l0kod",
"committed_at": "2026-05-20T17:35:40Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "a1a8a63e16a144399da46bee7379a1ef3b7b0d29",
"body": "Bump libc and strum.\n\nSigned-off-by: Mickaël Salaün <mic@digikod.net>",
"is_bot": false,
"headline": "cargo: Update dependencies",
"author_name": "Mickaël Salaün",
"author_login": "l0kod",
"committed_at": "2026-05-20T13:41:04Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "1ca46f568d2bb303dde82c8a2bfaa6599a36da31",
"body": "Update to Node 24, see\nhttps://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/\n\nSigned-off-by: Mickaël Salaün <mic@digikod.net>",
"is_bot": false,
"headline": "ci: Bump actions",
"author_name": "Mickaël Salaün",
"author_login": "l0kod",
"committed_at": "2026-05-20T13:34:51Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "f10ab05e9166b9659e20eb1ee99a6d9a7da9f16c",
"body": "Print /proc/version in the errata_up_to_date test so failed CI runs\ninclude the kernel version of the test environment. Helpful when\ndiagnosing whether a mismatch is caused by an unexpected kernel\nbuild.\n\nRefactor not_backported_yet to be keyed by the (major, minor, patch,\nsuffix) kernel version tu\n[…]\non, covered by a parse_kernel_version_cases\nunit test that exercises stable releases, distro-suffixed kernels,\nrelease candidates, and malformed input.\n\nSigned-off-by: Mickaël Salaün <mic@digikod.net>",
"is_bot": false,
"headline": "errata: Improve errata_up_to_date debuggability",
"author_name": "Mickaël Salaün",
"author_login": "l0kod",
"committed_at": "2026-05-20T13:24:08Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "7c90836aa43a7fa1d57e3000827f4e641a163745",
"body": "Wrap bare matches!() expressions with assert!() in ruleset_unsupported\nand unsupported_handled_access tests. Without assert!(), the matches!()\nmacro returns a bool that is silently discarded, making the assertions\nno-ops.\n\nFix the expected error patterns that were previously hidden by the\nno-op assertions: HardRequirement on Unsupported returns\nIncompatible access/scope errors, not MissingHandledAccess.\n\nSigned-off-by: Mickaël Salaün <mic@digikod.net>",
"is_bot": false,
"headline": "tests: Fix bare matches!() assertions",
"author_name": "Mickaël Salaün",
"author_login": "l0kod",
"committed_at": "2026-05-20T09:55:47Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "b6eb422f64b32ac793bcdb579b7e4977b965c675",
"body": "The Rust builder pattern is meant to read as a declarative list of\nconfigurations rather than a sequence of imperative commands, see\nhttps://rust-lang.github.io/api-guidelines/type-safety.html?#builders-enable-construction-of-complex-values-c-builder\nhttps://rust-lang.github.io/rfcs/0344-conventions\n[…]\nps all prctl(2) plumbing into one file\nand prepares the helper for sharing with a future caller (the\nRestrictSelf builder added in a following commit).\n\nSigned-off-by: Mickaël Salaün <mic@digikod.net>",
"is_bot": false,
"headline": "ruleset: Rename set_no_new_privs() and extract NNP helper",
"author_name": "Mickaël Salaün",
"author_login": "l0kod",
"committed_at": "2026-05-20T09:48:06Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "1e3a00440333f7ec1635922d49037c6429e22820",
"body": "Add the Erratum bitflags enum in a new errata.rs module, enabling\nprograms to query which kernel bug fixes have been backported before\nbuilding their Landlock ruleset.\n\nErratum::current() is a standalone method rather than a field on\nLandlockStatus because programs need errata information before bui\n[…]\np_to_date test verifies the crate's From<ABI> mapping\nmatches the running CI kernel's errata, catching both missing backports\nand stale crate mappings.\n\nSigned-off-by: Mickaël Salaün <mic@digikod.net>",
"is_bot": false,
"headline": "errata: Add errata query interface",
"author_name": "Mickaël Salaün",
"author_login": "l0kod",
"committed_at": "2026-04-10T19:56:19Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "e93e5972efbe4f1b54cf8968f37409ddfe927789",
"body": " ./src/uapi/bindgen.sh .../linux-6.15\n\nSigned-off-by: Mickaël Salaün <mic@digikod.net>",
"is_bot": false,
"headline": "uapi: Update to Linux 6.15",
"author_name": "Mickaël Salaün",
"author_login": "l0kod",
"committed_at": "2026-04-10T19:56:19Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "38893a13217827fbac80b8bceabe82835d097a23",
"body": "Add a missing test case for scope() with SoftRequirement on an\nunsupported ABI. Verifies the flag is silently dropped and the\ncompat state transitions to Dummy.\n\nThis complements the existing BestEffort and HardRequirement tests.\n\nSigned-off-by: Mickaël Salaün <mic@digikod.net>",
"is_bot": false,
"headline": "tests: Add SoftRequirement test for scope()",
"author_name": "Mickaël Salaün",
"author_login": "l0kod",
"committed_at": "2026-04-10T19:48:42Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "149e8c21d45f4900e6a9d2299dabf6b6152a39fd",
"body": "Dependencies (quote v1.0.45, unicode-ident v1.0.24) require rustc 1.71\nor newer.\n\nRemove LANDLOCK_CRATE_TEST_ABI from the MSRV CI job because Ubuntu\n24.04.4 bumped to Linux 6.17, a newer Landlock ABI than the crate knows\nabout. The variable will be re-added by a following ABI v7 commit.\n\nSigned-off-by: Mickaël Salaün <mic@digikod.net>",
"is_bot": false,
"headline": "cargo,ci: Bump MSRV to 1.71",
"author_name": "Mickaël Salaün",
"author_login": "l0kod",
"committed_at": "2026-04-10T19:48:42Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "89c56e2db04cf0a4d63e192e7b4371af516a1ccc",
"body": "Add changelog entry.\n\nSigned-off-by: Mickaël Salaün <mic@digikod.net>",
"is_bot": false,
"headline": "lib: Bump to v0.4.4",
"author_name": "Mickaël Salaün",
"author_login": "l0kod",
"committed_at": "2025-11-20T13:21:19Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "4fbfbbc4c7d2e6db2642ec44ef1c8a78e7048479",
"body": "Use named fields for the Available variant: effective_abi and\nkernel_abi, and improve documentation.\n\nSigned-off-by: Mickaël Salaün <mic@digikod.net>",
"is_bot": false,
"headline": "compat: Improve LandlockStatus",
"author_name": "Mickaël Salaün",
"author_login": "l0kod",
"committed_at": "2025-10-22T18:44:24Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "ec5e00b83bd2c6308967174c8910e86853e6b955",
"body": "Add LandlockStatus type to query the running kernel and display\ninformation about the available Landlock features.\n\nReplace ABI in Compatibility with LandlockStatus to be able to return\nthis information with RestrictionStatus.\n\nImplement Display for ABI.\n\nUpdate the sandboxer to print hints about th\n[…]\nd version, similar to the C example.\n\nReplace ABI::new_current() with LandlockStatus::current().into().\n\nAdd a new test_current_landlock_status() test.\n\nSigned-off-by: Mickaël Salaün <mic@digikod.net>",
"is_bot": false,
"headline": "compat,sandboxer: Add LandlockStatus and print hints",
"author_name": "Mickaël Salaün",
"author_login": "l0kod",
"committed_at": "2025-10-22T15:34:46Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "f79da1808500110fd71f2b80e7ca81770b6bf2df",
"body": "Until now, we only used the x86_64 architecture, but here are the\nchanges to use this crate on any architecture.\n\nAdd the bindgen.sh script to make update simple:\n\n ./src/uapi/bindgen.sh .../linux-6.12\n\nThis call creates three binding files:\n- landlock_x86_64.rs\n- landlock_i686.rs\n- landlock_all.rs\n[…]\nindgen_test_layout_landlock_net_port_attr().\n\nExtend the CI to build and test on i686.\n\nCloses: https://github.com/landlock-lsm/rust-landlock/issues/110\nSigned-off-by: Mickaël Salaün <mic@digikod.net>",
"is_bot": false,
"headline": "uapi: Generate bindings for all architectures",
"author_name": "Mickaël Salaün",
"author_login": "l0kod",
"committed_at": "2025-10-21T09:53:27Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "d29be586a50b0278822aee84a420b0cd22607a5b",
"body": "syn v2.0.107 requires rustc 1.68 or newer:\nhttps://github.com/dtolnay/syn/commit/9dbb5b7b99711db4958d5087e75da0e99eed6462\n\nFYI, Rust 1.85 is packaged in Debian 13 Trixie (current stable release).\n\nSigned-off-by: Mickaël Salaün <mic@digikod.net>",
"is_bot": false,
"headline": "cargo: Bump MSRV to 1.68",
"author_name": "Mickaël Salaün",
"author_login": "l0kod",
"committed_at": "2025-10-21T09:53:27Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "229f152d86c37e8881ea37dd6e29668f298d9056",
"body": "Add changelog entry.\n\nBump libc.\n\nSigned-off-by: Mickaël Salaün <mic@digikod.net>",
"is_bot": false,
"headline": "lib: Bump to v0.4.3",
"author_name": "Mickaël Salaün",
"author_login": "l0kod",
"committed_at": "2025-09-14T12:43:12Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "19f01a99752607e0f6b1872edf86690982c0e920",
"body": "Implement Debug for ABI, Ruleset, RulesetCreated, PathBeneath, PathFd,\nand NetPort (and other non-public dependencies). Derived Debug formats\nare not stable:\nhttps://doc.rust-lang.org/stable/std/fmt/trait.Debug.html#stability\n\nImplement PartialEq, Eq, PartialOrd, and Ord for ABI.\n\nThis might be needed when these types are wrapped (see LandlockConfig).\n\nCloses: https://github.com/landlock-lsm/rust-landlock/issues/82\nSigned-off-by: Mickaël Salaün <mic@digikod.net>",
"is_bot": false,
"headline": "compat: Implement common traits for public types",
"author_name": "Mickaël Salaün",
"author_login": "l0kod",
"committed_at": "2025-09-10T15:29:28Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "cb60a12f9b3d7fe55839863e8746ede6c3c77290",
"body": "- Improve structure of 'Testing vs kernel ABI section'\n- Add URL to compat.rs:current_kernel_abi() reference\n- Add new 'Licensing & DCO' section.\n\nSigned-off-by: Panagiotis \"Ivory\" Vasilopoulos <git@n0toose.net>",
"is_bot": false,
"headline": "contributing: Extend documentation",
"author_name": "Panagiotis \"Ivory\" Vasilopoulos",
"author_login": "n0toose",
"committed_at": "2025-05-30T12:49:04Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "aa4029d129f5db8519027f15a1618c9d79c2e19b",
"body": "This example is shown at the homepage of rust-landlock's documentation,\nand essentially serves as some sort of an introduction to implementers.\nSince this example serves as some sort of a \"first impression\", it is\nquite easy for the reader to make a false generalization.\n\nTo fix this, some additiona\n[…]\ne the role\nof file descriptors and paths, as well as add a subtle separation between\nLandlock (the LSM) and rust-landlock (the crate).\n\nSigned-off-by: Panagiotis \"Ivory\" Vasilopoulos <git@n0toose.net>",
"is_bot": false,
"headline": "fs: Add more background to path_beneath_rules() doc",
"author_name": "Panagiotis \"Ivory\" Vasilopoulos",
"author_login": "n0toose",
"committed_at": "2025-05-19T17:59:08Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "a7c2b3fe37f2d35f2359c4b1b5152258a474dbb1",
"body": "Signed-off-by: Panagiotis \"Ivory\" Vasilopoulos <git@n0toose.net>",
"is_bot": false,
"headline": "fs: Add test case for AccessFs::from_file",
"author_name": "Panagiotis \"Ivory\" Vasilopoulos",
"author_login": "n0toose",
"committed_at": "2025-05-19T17:50:28Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "83763eb749bcbcb8f68fbdd366a007a039ebb018",
"body": "Add missing link.\n\nSigned-off-by: Mickaël Salaün <mic@digikod.net>",
"is_bot": false,
"headline": "readme: Update for v0.4.2",
"author_name": "Mickaël Salaün",
"author_login": "l0kod",
"committed_at": "2025-04-29T09:15:21Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "86051ba1de2f2fee67be7d6325da34cd1e650d03",
"body": "Add changelog entry.\n\nSigned-off-by: Mickaël Salaün <mic@digikod.net>",
"is_bot": false,
"headline": "lib: Bump to v0.4.2",
"author_name": "Mickaël Salaün",
"author_login": "l0kod",
"committed_at": "2025-04-29T08:53:03Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "c9834cfcbff6ddf0f0c66d55c20de51e179a12f5",
"body": "Improve consistency by delegating lifetime management to OwnedFd. The\nonly visible change would be that with latest Rust versions, the\nduplicated file descriptor will be greater than 2 (not with Rust 1.63).\nSee https://doc.rust-lang.org/1.63.0/std/os/unix/io/struct.OwnedFd.html\n\nRemove the explicit\n[…]\nfor OwnedFd. This is not a\nbreaking change because the IntoRawFd implementation was never released.\n\nAdd tests leveraging RulesetCreated::try_clone().\n\nSigned-off-by: Mickaël Salaün <mic@digikod.net>",
"is_bot": false,
"headline": "ruleset: Use OwnedFd instead of RawFd",
"author_name": "Mickaël Salaün",
"author_login": "l0kod",
"committed_at": "2025-04-28T16:00:38Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "fb7850f89d58e50d2b530c696b003eecc315b7ff",
"body": "It makes more sense and it makes it easier to dereference the inner\nvalue.\n\nImport c_int to lighten code.\n\nRemove use of private field in tests.\n\nSigned-off-by: Mickaël Salaün <mic@digikod.net>",
"is_bot": false,
"headline": "ruleset: Implement Deref instead of AsRef for Errno",
"author_name": "Mickaël Salaün",
"author_login": "l0kod",
"committed_at": "2025-04-24T14:36:02Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "8b8de51204d0390458f26604627b247a54923fd5",
"body": "See https://github.com/landlock-lsm/linux/commit/53b9d789df983790015ef04b0283ac5a33917cad\n\nSigned-off-by: Mickaël Salaün <mic@digikod.net>",
"is_bot": false,
"headline": "sandboxer: Synchronize help",
"author_name": "Mickaël Salaün",
"author_login": "l0kod",
"committed_at": "2025-04-24T14:13:14Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "fe68bf24751f43527837b01652f18daa10d32172",
"body": "See https://github.com/landlock-lsm/linux/commit/a17c60e533f5cd832e77e0d194e2e0bb663371b6\n\nTested with:\n LL_FS_RO=/usr LL_FS_RW=/tmp:/foo \\\n cargo run --example=sandboxer bash -i\n\nSigned-off-by: Mickaël Salaün <mic@digikod.net>",
"is_bot": false,
"headline": "sandboxer: Don't error out if a file path cannot be opened",
"author_name": "Mickaël Salaün",
"author_login": "l0kod",
"committed_at": "2025-04-24T14:13:14Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "1f55adc26239435a347cc6766b7be42d30a1fd13",
"body": "Synchronize SPDX-License-Identifier headers across all source files.\n\nSigned-off-by: Mickaël Salaün <mic@digikod.net>",
"is_bot": false,
"headline": "src: Add missing SPDX headers",
"author_name": "Mickaël Salaün",
"author_login": "l0kod",
"committed_at": "2025-04-24T14:12:17Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "f92b178c43757e16ccc6c2bc048c8212661f1a85",
"body": "With a generic HandledAccess implementation for all PrivateHandledAccess\nimplementations, the documentations does not show the actual types.\nMake these implementations explicit to improve the documentation.\n\nSigned-off-by: Mickaël Salaün <mic@digikod.net>",
"is_bot": false,
"headline": "access: Make HandledAccess implementations explicit",
"author_name": "Mickaël Salaün",
"author_login": "l0kod",
"committed_at": "2025-04-24T13:54:41Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "5ad403880ee751513bd13496a4b00ba7d93f885e",
"body": "With commit 554217dda0b7 (\"access: Make Access independant from\nHandledAccess\"), the documentation about RulesetCreated::handle_access()\nlists HandledAccess as an argument's requirement, but because this trait\nis private, there is no list of types implementing this trait, which is\nconfusing.\n\nMove p\n[…]\nivate methods to a new PrivateHandledAccess trait and use\nHandledAccess as a way to document the argument's requirement.\n\nFix AddRuleError requirement.\n\nSigned-off-by: Mickaël Salaün <mic@digikod.net>",
"is_bot": false,
"headline": "access: Document HandledAccess",
"author_name": "Mickaël Salaün",
"author_login": "l0kod",
"committed_at": "2025-04-24T13:37:38Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "41e3198e00c5983ceca98ee84a783f926bdedd37",
"body": "Bump to Landlock ABI v6.\n\nTested that we can send signals and connect to abstract UNIX sockets if\nthe related LL_SCOPED's action is not specified.\n\nTested that signal scoping works:\n LL_FS_RO=/ LL_FS_RW=/ LL_SCOPED=\"s\" \\\n cargo run --example=sandboxer kill $$\n [...]\n kill: sending signal to [.\n[…]\nRW=/ LL_SCOPED=\"a\" \\\n cargo run --example=sandboxer socat stdio abstract-connect:test\n [...] E connect(, AF=1 \"\\0test\", 7): Operation not permitted\n\nSigned-off-by: Mickaël Salaün <mic@digikod.net>",
"is_bot": false,
"headline": "sandboxer: Add abstract UNIX socket and signal scoping support",
"author_name": "Mickaël Salaün",
"author_login": "l0kod",
"committed_at": "2025-04-24T13:14:35Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "80419ff0c97517e094eddb9baacf68f9a35ee1a4",
"body": "Add ABI::V6 and the RulesetCreated::scope() method taking a Scope enum\nas argument:\n- Scope::AbstractUnixSocket\n- Scope::Signal\n\nAdd a related ScopeError and extend RulesetError with it.\n\nCreateRulesetError::MissingHandledAccess is now used either for missing\nhandled access rights or missing scope r\n[…]\nd_handle_access_fs() and\nruleset_created_handle_access_net_tcp() tests to improve coverage of\nhandled access composition.\n\nRun tests against Linux 6.12\n\nSigned-off-by: Mickaël Salaün <mic@digikod.net>",
"is_bot": false,
"headline": "ci,src: Handle Landlock ABI v6",
"author_name": "Mickaël Salaün",
"author_login": "l0kod",
"committed_at": "2025-04-24T13:14:35Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "554217dda0b775756e38db71f471dd414b199234",
"body": "Rename PrivateAccess to HandledAccess, and inverse dependency to be able\nto support access rights which are not handled by rules.\n\nThis new light Access trait will be usable as a scope, which does not\nhave related rule.\n\nMake Access independant from HandledAccess but explicitly sealed it:\nhttps://rust-lang.github.io/api-guidelines/future-proofing.html#sealed-traits-protect-against-downstream-implementations-c-sealed\n\nSigned-off-by: Mickaël Salaün <mic@digikod.net>",
"is_bot": false,
"headline": "access: Make Access independant from HandledAccess",
"author_name": "Mickaël Salaün",
"author_login": "l0kod",
"committed_at": "2025-04-23T14:42:29Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "97fc19edefd9ec4397b24372aed2acf0d93f8f91",
"body": "bindgen --rust-target 1.63 -o src/uapi/landlock.rs .../linux-6.12/include/uapi/linux/landlock.h\n\nUpdate Ruleset::create() accordingly.\n\nSigned-off-by: Mickaël Salaün <mic@digikod.net>",
"is_bot": false,
"headline": "uapi: Update to Linux 6.12",
"author_name": "Mickaël Salaün",
"author_login": "l0kod",
"committed_at": "2025-04-23T14:42:17Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "111999a18c3ed1b567bdefd2ad48135e7657201d",
"body": "Ubuntu 24.04 switched to Linux version 6.11.0-1012-azure which supports\nLandlock ABI v5.\n\nSee https://ubuntu.com/kernel/lifecycle\n\nSigned-off-by: Mickaël Salaün <mic@digikod.net>",
"is_bot": false,
"headline": "ci: Bump Landlock ABI version for Ubuntu 24",
"author_name": "Mickaël Salaün",
"author_login": "l0kod",
"committed_at": "2025-04-23T14:34:57Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "ebf5d055d245452cf68647d2ed232f65f2acf5c9",
"body": "This is useful to debug the tested $LANDLOCK_CRATE_TEST_ABI value.\n\nSigned-off-by: Mickaël Salaün <mic@digikod.net>",
"is_bot": false,
"headline": "compat: Print current kernel version and Landlock ABI on test failure",
"author_name": "Mickaël Salaün",
"author_login": "l0kod",
"committed_at": "2025-04-23T14:29:40Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "07f2a9a7ee145884e58a8abaf315c90c5ffcca84",
"body": "Use GitHub Pages with Actions and split jobs with fine-grained\npermissions. Remove dependency on peaceiris/actions-gh-pages\n\nSee https://github.blog/news-insights/product-news/github-pages-now-uses-actions-by-default/\n\nAdd workflow_dispatch to be able to manually run this action.\n\nUpdate Ubuntu to 24.04.\n\nSigned-off-by: Mickaël Salaün <mic@digikod.net>",
"is_bot": false,
"headline": "ci: Use GitHub Pages with Actions",
"author_name": "Mickaël Salaün",
"author_login": "l0kod",
"committed_at": "2025-04-10T10:22:37Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "11d4ef1a89db09304ecc1da0dbf99c5fd27da51e",
"body": "Remove an unsafe block.\n\nSigned-off-by: Mickaël Salaün <mic@digikod.net>",
"is_bot": false,
"headline": "compat: Clean up get_errno_from_landlock_status()",
"author_name": "Mickaël Salaün",
"author_login": "l0kod",
"committed_at": "2025-04-10T09:17:38Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "0f4246a54e17eb57ee938e67c5d85a07d1f977a5",
"body": "This should fix the systemd issue on Ubuntu 24.\n\nSee https://github.com/landlock-lsm/landlock-test-tools/commit/fad769c39b42183fb2a2e1263fe00dfa5b9f2bda\n\nSigned-off-by: Mickaël Salaün <mic@digikod.net>",
"is_bot": false,
"headline": "ci: Use newer landlock-test-tools",
"author_name": "Mickaël Salaün",
"author_login": "l0kod",
"committed_at": "2025-04-09T17:15:41Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "fca3950a638efae20c1379d8cbd38e7f3306e3bb",
"body": "This is useful to test Landlock outside of this crate e.g., in\nlandlockconfig.\n\nSigned-off-by: Mickaël Salaün <mic@digikod.net>",
"is_bot": false,
"headline": "compat: Expose From<i32> for ABI",
"author_name": "Mickaël Salaün",
"author_login": "l0kod",
"committed_at": "2025-04-09T15:49:43Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "beecdf819b85f3401b057d3872d97dc8b0710904",
"body": "This helper is useful for FFI to easily translate a Landlock error into\nan errno value.\n\nExtend check_ruleset_support() with errno translation tests.\n\nAdd the unsupported_handled_access_errno() test.\n\nSigned-off-by: Mickaël Salaün <mic@digikod.net>",
"is_bot": false,
"headline": "ruleset: Add the Errno helper",
"author_name": "Mickaël Salaün",
"author_login": "l0kod",
"committed_at": "2025-04-08T13:51:55Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "6d18345d7f798178fa3537bedd7bb8c13902ae2c",
"body": "Switch from Ubuntu 20.04 to 22.04, and from 22.04 to 24.04\n\nSee https://github.com/actions/runner-images/issues/11101\n\nSigned-off-by: Mickaël Salaün <mic@digikod.net>",
"is_bot": false,
"headline": "ci: Bump Ubuntu",
"author_name": "Mickaël Salaün",
"author_login": "l0kod",
"committed_at": "2025-04-08T13:49:42Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "de9a167ffe62a22c7f1aaa619f88405d540feb33",
"body": "This helps low-level and FFI use cases, especially landlockconfig.\n\nSigned-off-by: Mickaël Salaün <mic@digikod.net>",
"is_bot": false,
"headline": "ruleset: Implement IntoRawFd for RulesetCreated",
"author_name": "Mickaël Salaün",
"author_login": "l0kod",
"committed_at": "2025-04-05T17:45:09Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "fd46eafba889e004eacbb5e0eb6db406382b0408",
"body": "Ubuntu 22.04 switched to Linux 6.8 which supports Landlock ABI v4.\n\nhttps: //ubuntu.com/kernel/lifecycle\nSigned-off-by: Mickaël Salaün <mic@digikod.net>",
"is_bot": false,
"headline": "ci: Bump Landlock ABI version for Ubuntu 22",
"author_name": "Mickaël Salaün",
"author_login": "l0kod",
"committed_at": "2025-04-05T17:45:07Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "8f5af24d167f9f2fc6a10896112e9d369f54fc60",
"body": "This may be required to avoid this issue:\n error: no such command: `fmt`\n\nSee https://rust-lang.github.io/rustup/basics.html#keeping-rustup-up-to-date\n\nSigned-off-by: Mickaël Salaün <mic@digikod.net>",
"is_bot": false,
"headline": "ci: Update rustup",
"author_name": "Mickaël Salaün",
"author_login": "l0kod",
"committed_at": "2025-04-05T17:19:55Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "aaccff53ecb0fb3c4d2e8125bc9e8913fbf92424",
"body": "Explain LANDLOCK_CRATE_TEST_ABI and how it affects local and CI testing\nscenarios.\n\nSigned-off-by: Daniel Burgener <Daniel.Burgener@microsoft.com>",
"is_bot": false,
"headline": "contributing: Add CONTRIBUTING.md doc",
"author_name": "Daniel Burgener",
"author_login": "dburgener",
"committed_at": "2025-02-11T10:37:50Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "50240ff03b2b929644872654fd2b237b085a8e37",
"body": "…nel.\n\nIf the user doesn't specify a version, run the tests applicable to their\nactual kernel rather than defaulting to the latest version available.\nThis makes local smoke testing easier.\n\nSigned-off-by: Daniel Burgener <Daniel.Burgener@microsoft.com>",
"is_bot": false,
"headline": "compat: Change the default LANDLOCK_CRATE_TEST_ABI to the current ker…",
"author_name": "Daniel Burgener",
"author_login": "dburgener",
"committed_at": "2025-02-11T10:37:50Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "a751123a4fc7c3bf69147a2c27699072a52321c4",
"body": "Signed-off-by: Marcin S. <marcin@realemail.net>",
"is_bot": false,
"headline": "docs: Add clarifying notes: AccessFs::WriteFile, path_beneath_rules",
"author_name": "Marcin S.",
"author_login": "mrcnski",
"committed_at": "2025-01-17T21:39:14Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "049ef733186d7e131ae151849e4f5a24cb4ba9d7",
"body": "The breaking changes between version 1 and 2 do not affect\nrust-landlock's usage of thiserror.\n\nSigned-off-by: Daniel Burgener <Daniel.Burgener@microsoft.com>",
"is_bot": false,
"headline": "cargo: Update to thiserror version 2",
"author_name": "Daniel Burgener",
"author_login": "dburgener",
"committed_at": "2024-12-17T16:39:53Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "94721d26b2fd1151e71bd7a3aa5a43c463a22347",
"body": "Add changelog entry.\n\nSigned-off-by: Mickaël Salaün <mic@digikod.net>",
"is_bot": false,
"headline": "lib: Bump to v0.4.1",
"author_name": "Mickaël Salaün",
"author_login": "l0kod",
"committed_at": "2024-09-13T17:56:50Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "c8f1a29617298c6b47f7d31d24ba8edbdee15f3c",
"body": "Add the AccessFs::IoctlDev right.\n\nAdd Linux 6.10 for Landlock ABI v5 and automatically create a config.\n\nSigned-off-by: Mickaël Salaün <mic@digikod.net>",
"is_bot": false,
"headline": "ci,src: Handle Landlock ABI v5",
"author_name": "Mickaël Salaün",
"author_login": "l0kod",
"committed_at": "2024-09-10T18:56:05Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "1b195e910423eb3b756279dc16344b08dae17b43",
"body": "bindgen -o src/uapi/landlock.rs .../linux/include/uapi/linux/landlock.h\n\nSigned-off-by: Mickaël Salaün <mic@digikod.net>",
"is_bot": false,
"headline": "uapi: Update to Linux 6.10",
"author_name": "Mickaël Salaün",
"author_login": "l0kod",
"committed_at": "2024-09-10T18:46:38Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "e51ba0b695c20ea5dce7dc629b887a5af8efe314",
"body": "Instead of using the pre-defined configuration from landlock-test-tools,\ncreate a dynamic configuration with the new make-uml.sh tool.\n\nInclude landlock-test-tools commit in the cache key to take into account\nrelated tool and configuration changes.\n\nSigned-off-by: Mickaël Salaün <mic@digikod.net>",
"is_bot": false,
"headline": "ci: Use dynamic kernel configurations",
"author_name": "Mickaël Salaün",
"author_login": "l0kod",
"committed_at": "2024-09-10T18:20:02Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "922d6c91d3dc48c9d14a08614dce5c42d2b8070f",
"body": "Signed-off-by: rusty-snake <41237666+rusty-snake@users.noreply.github.com>",
"is_bot": false,
"headline": "net: Fix typo in doc-comment",
"author_name": "rusty-snake",
"author_login": "rusty-snake",
"committed_at": "2024-09-05T13:59:58Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "4936d52e55b9bb6277960fb37bd89fd10cb4a838",
"body": "Use anyhow's context() and inline variables with eprintln!().\n\nSigned-off-by: Björn Roy Baron <bjorn3_gh@protonmail.com>",
"is_bot": false,
"headline": "sandboxer: Slightly rework the error handling",
"author_name": "Björn Roy Baron",
"author_login": "bjorn3",
"committed_at": "2024-09-05T13:39:43Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "57006aeaaafb81a5d0b7c121afd520f3bffec813",
"body": "Cargo already builds the Landlock crate as library before compiling any\nexamples or tests.\n\nSigned-off-by: Björn Roy Baron <bjorn3_gh@protonmail.com>",
"is_bot": false,
"headline": "cargo: Remove unnecessary dev-dependency on our own crate",
"author_name": "Björn Roy Baron",
"author_login": "bjorn3",
"committed_at": "2024-09-05T13:39:43Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "e95e9f8b8125f803b09fb62923ddc657de843bcf",
"body": "Ease maintenance of landlock-test-tools and avoid adding new built\nartifacts for each major kernel release.\n\nWe now use the latest versions according to landlock-lsm/linux branches\nfor each meaningful kernel.\n\nTo simplify the new ubuntu_22_rust_stable, don't run tests against the\nlocal kernel, which is already done with ubuntu_22_rust_msrv.\n\nReorder install, clone and build steps in ubuntu_22_rust_stable to clean\nup the working directory.\n\nSigned-off-by: Mickaël Salaün <mic@digikod.net>",
"is_bot": false,
"headline": "ci: Build and add kernels to cache",
"author_name": "Mickaël Salaün",
"author_login": "l0kod",
"committed_at": "2024-09-04T18:44:48Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "3c0665c829c8efe826adc4464c4cfc0bd3422fc7",
"body": "Use action/checkout@v4 and fix fetch-depth for landlock-test-tools. See\nhttps://github.blog/changelog/2024-03-07-github-actions-all-actions-will-run-on-node20-instead-of-node16-by-default/\n\nSigned-off-by: Mickaël Salaün <mic@digikod.net>",
"is_bot": false,
"headline": "ci: Bump actions/checkout to v4",
"author_name": "Mickaël Salaün",
"author_login": "l0kod",
"committed_at": "2024-09-03T07:01:29Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "537d293e782bfdcd9a72f49ee4b0287b4fb5784c",
"body": "Add changelog entry.\n\nSigned-off-by: Mickaël Salaün <mic@digikod.net>",
"is_bot": false,
"headline": "lib: Bump to v0.4.0",
"author_name": "Mickaël Salaün",
"author_login": "l0kod",
"committed_at": "2024-06-19T09:02:49Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "6deec9d10b3e2af615aff116c6fc7a1c5fe53aaf",
"body": "Signed-off-by: Mickaël Salaün <mic@digikod.net>",
"is_bot": false,
"headline": "cargo: Bump strum to v0.26",
"author_name": "Mickaël Salaün",
"author_login": "l0kod",
"committed_at": "2024-06-19T08:52:10Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "d645052d3279a3224a1e3bbab9ecdb3b62382b70",
"body": "Bump to Landlock ABI v4.\n\nTested that this sandbox doesn't restrict TCP:\n LL_FS_RO=/ LL_FS_RW=/ \\\n cargo run --example=sandboxer bash -i\n\nTested that this sandbox restrict bind and connect ports:\n LL_FS_RO=/ LL_FS_RW=/ LL_TCP_BIND=\"2000\" LL_TCP_CONNECT=\"3000:4000\" \\\n cargo run --example=sandboxer bash -i\n\nTest commands (with different ports):\n socat tcp-listen:2000 stdio\n date | socat stdio tcp-connect:127.1:2000\n\nSigned-off-by: Mickaël Salaün <mic@digikod.net>",
"is_bot": false,
"headline": "sandboxer: Add TCP bind and connect support",
"author_name": "Mickaël Salaün",
"author_login": "l0kod",
"committed_at": "2024-06-12T07:43:48Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "f112bf8f006519a7f3d3b6c496640ef0716b4efe",
"body": "The NetPort type enables us to create network port rules leveraging\nLandlock ABI 4.\n\nOnly 16-bit ports are allowed by the type system, which remove the need\nfor overflow check and error.\n\nAdd related tests, and handle E2BIG when the handled_access_net field is\nset and the running kernel does not support it.\n\nSigned-off-by: Mickaël Salaün <mic@digikod.net>",
"is_bot": false,
"headline": "net: Add NetPort rule",
"author_name": "Mickaël Salaün",
"author_login": "l0kod",
"committed_at": "2024-06-11T17:43:06Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "5e8b4a40572d393832c59c49c49e3962d9a62c6e",
"body": "Add the AccessNet::BindTcp and AccessNet::ConnectTcp rights.\n\nAdd ruleset_created_handle_access_net test to check that handled and\nactual access rights are consistent according to the Landlock ABI.\n\nRename the ruleset_created_handle_access_or test to\nruleset_created_handle_access_fs.\n\nIt should be noted that handle_access(AccessNet::from_all(ABI::V3))\nreturns an error because of the empty access bitflags.\n\nSigned-off-by: Mickaël Salaün <mic@digikod.net>",
"is_bot": false,
"headline": "net: Handle TCP bind and connect access rights",
"author_name": "Mickaël Salaün",
"author_login": "l0kod",
"committed_at": "2024-06-11T15:21:47Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "c1fef294217cdef52f4102d76d1c5ece1b8e0cf6",
"body": "Prepare crate for networking support, and run all tests against Linux\n6.7.1 that supports Landlock ABI 4\n\nSigned-off-by: Mickaël Salaün <mic@digikod.net>",
"is_bot": false,
"headline": "src,ci: Handle Landlock ABI v4",
"author_name": "Mickaël Salaün",
"author_login": "l0kod",
"committed_at": "2024-06-11T15:01:01Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "d8c4cadc9d9693088485da6b84906225e459e332",
"body": "We should never try to add real rules to a ruleset that wasn't really\ncreated (i.e. with a -1 file descriptor).\n\nFix the From implementation for Compatibilty to always use\nCompatState::Init as an initial state. This is now possible because of\nthe changes in create(), especially the new handling of \n[…]\nnd the abi_v3_truncate() test to check with a new rule which may be\nincompatible.\n\nFixes: ccb5a588a99c (\"compat: Prioritize error over incompatibility\")\nSigned-off-by: Mickaël Salaün <mic@digikod.net>",
"is_bot": false,
"headline": "lib: Fix and test unsupported rule",
"author_name": "Mickaël Salaün",
"author_login": "l0kod",
"committed_at": "2024-06-11T14:07:40Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "ccb5a588a99c732050ad146276de86b0ec0ad95e",
"body": "Reorder TryCompat::try_compat() checks to first call try_compat_inner()\nand then also always call try_compat_children(). This ensures that\ninner and children potential errors are always returned even if the\ncurrent object is incompatible.\n\nFor instance, this makes NetPort (see a following commit) a\n[…]\nd then\n try_compat_children().\n\nThis is now more consistent because the inner error is always returned\nwhatever there is a compatibility error or not.\n\nSigned-off-by: Mickaël Salaün <mic@digikod.net>",
"is_bot": false,
"headline": "compat: Prioritize error over incompatibility",
"author_name": "Mickaël Salaün",
"author_login": "l0kod",
"committed_at": "2024-06-03T12:43:22Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "f0e55e2eb2e2c7619f765b8603c8bfc801562b29",
"body": "Add path_beneath_try_compat_children() tests to check error ordering\nwith both children and inner errors. This enables us to identify the\nbehavior change introduced with the upcoming error priority change.\n\nSigned-off-by: Mickaël Salaün <mic@digikod.net>",
"is_bot": false,
"headline": "fs: Test try_compat_children()",
"author_name": "Mickaël Salaün",
"author_login": "l0kod",
"committed_at": "2024-06-03T12:43:22Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "d99f75155bec2040cf4ce1532007cd3b8a23e2fb",
"body": "When adding a rule to a ruleset created with ABI::Unsupported, its\ncompatibility state could change from CompatLevel::No to\nCompatLevel::Partial, which is wrong and could lead to an unexpected\nerror when trying to restrict the caller with -1 as a ruleset file\ndescriptor. This is especially visible \n[…]\ne\nexecution, and no error should be returned by the kernel.\n\nAdd tests to check theses changes, and change some existing tests\nto follow the new logic.\n\nSigned-off-by: Mickaël Salaün <mic@digikod.net>",
"is_bot": false,
"headline": "ruleset: Fix compatibility inconsistency",
"author_name": "Mickaël Salaün",
"author_login": "l0kod",
"committed_at": "2024-06-03T12:43:07Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "68f066eba571c1f9212f5a07016aac9ffb0d1c27",
"body": "The from_read() and from_write() methods make sense for AccessFs but not\nfor the upcoming AccessNet.\n\nThis is a breaking change because the Access trait's signature is\nmodified. In practice, it should not be an issue for most users. Only\nthose implementing helpers explicitly using Access::from_read() or\nAccess::from_write() should be concerned. In this case, they should\njust use AccessFs instead.\n\nFix a typo in the from_all() comment.\n\nSigned-off-by: Mickaël Salaün <mic@digikod.net>",
"is_bot": false,
"headline": "access: Move from_read() and from_write() into AccessFs",
"author_name": "Mickaël Salaün",
"author_login": "l0kod",
"committed_at": "2024-05-31T15:51:30Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "3abd779890bc4da99b4d7fb6f02a41156babde80",
"body": "This is simpler and more idiomatic.\n\nSigned-off-by: Mickaël Salaün <mic@digikod.net>",
"is_bot": false,
"headline": "rulelet: Use constant attribute for rule's type ID",
"author_name": "Mickaël Salaün",
"author_login": "l0kod",
"committed_at": "2024-05-31T15:11:14Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "158ac6eb7fd2c5d5d1449ed6c0bea429662d16f5",
"body": "Flags are not used for now.\n\nSigned-off-by: Mickaël Salaün <mic@digikod.net>",
"is_bot": false,
"headline": "ruleset: Remove PrivateRule::get_flags()",
"author_name": "Mickaël Salaün",
"author_login": "l0kod",
"committed_at": "2024-05-31T15:11:14Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "443817029567c46b92b17621f5a6284718be9b16",
"body": "Move PathBeneath::sync_attr() in the PathBenath::as_ptr() to avoid\npotential inconsistencies or race conditions.\n\nSigned-off-by: Mickaël Salaün <mic@digikod.net>",
"is_bot": false,
"headline": "fs: Improve inner attr buffer synchronization",
"author_name": "Mickaël Salaün",
"author_login": "l0kod",
"committed_at": "2024-05-31T15:11:14Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "8d473dff02c02c47fd2a61f2608f782714a564ab",
"body": "Add changelog entry for v0.3.1\n\nSigned-off-by: Mickaël Salaün <mic@digikod.net>",
"is_bot": false,
"headline": "lib: Bump to v0.3.1",
"author_name": "Mickaël Salaün",
"author_login": "l0kod",
"committed_at": "2024-03-22T10:08:44Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "34752a25fe05159cc0fc41b0159da4d84a5d0860",
"body": "This enables the sharing of a parent ruleset that can be passed to\nmultiple processes/threads without the need to reconstruct the ruleset.\n\nSigned-off-by: Carl Petty <carlpetty@microsoft.com>",
"is_bot": false,
"headline": "ruleset: Add RulsetCreated::try_clone()",
"author_name": "Carl Petty",
"author_login": null,
"committed_at": "2024-03-22T10:01:56Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "89797a0b4353315938d0cc0dcab6dc9922198349",
"body": "bindgen -o src/uapi/landlock.rs .../linux/include/uapi/linux/landlock.h\n\nUpdate Ruleset::create() accordingly.\n\nSigned-off-by: Mickaël Salaün <mic@digikod.net>",
"is_bot": false,
"headline": "uapi: Update to Linux 6.7",
"author_name": "Mickaël Salaün",
"author_login": "l0kod",
"committed_at": "2024-01-24T16:06:15Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "5765d06fe914932bcd7bc313d9531d87cf83b4fd",
"body": "Add changelog entry for v0.3.0 and explain the main changes brought by\nthis version.\n\nSigned-off-by: Mickaël Salaün <mic@digikod.net>",
"is_bot": false,
"headline": "lib: Bump to v0.3.0",
"author_name": "Mickaël Salaün",
"author_login": "l0kod",
"committed_at": "2023-10-09T09:10:39Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "e4f28ea6023b21a6c7a5a8d6dbd15896e8150f80",
"body": "List some use cases, point to code examples, and rearrange the readme.\n\nSigned-off-by: Mickaël Salaün <mic@digikod.net>",
"is_bot": false,
"headline": "lib,readme: Extend documentation",
"author_name": "Mickaël Salaün",
"author_login": "l0kod",
"committed_at": "2023-10-09T09:10:26Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "880bfb008aaf2a83b83afad03ac63a1726d47cf0",
"body": "Signed-off-by: Mickaël Salaün <mic@digikod.net>",
"is_bot": false,
"headline": "cargo: Bump strum to v0.25",
"author_name": "Mickaël Salaün",
"author_login": "l0kod",
"committed_at": "2023-10-09T09:00:14Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "e9e1ead66cd5d788e0e98945ac6983c233a1a8b9",
"body": "Explain more clearly why sticking to a specific Landlock ABI version to\ninfer access rights is highly recommended.\n\nAdd links to the landlock-test-tools repository and related CI changes.\n\nSigned-off-by: Mickaël Salaün <mic@digikod.net>",
"is_bot": false,
"headline": "compat: Improve the ABI documentation",
"author_name": "Mickaël Salaün",
"author_login": "l0kod",
"committed_at": "2023-10-09T08:52:14Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "a0da8c0432728c9e182dce9d36260b14b95df581",
"body": "Remove AsMut<Option<CompatLevel>> from the public API to avoid ambiguous types\nthat can lead to:\n error[E0283]: type annotations needed for `&mut T`\n --> src/ruleset.rs:306:9\n |\n 306 | let _ = ruleset.as_mut();\n | ^ ------ type must be known at this point\n \n[…]\n_>` found\n\nAdd tests to detect potential future change.\n\nThis is less elegant that the AsMut autoderivated implementations, but\nit is safer.\n\nFixes #48\n\nSigned-off-by: Mickaël Salaün <mic@digikod.net>",
"is_bot": false,
"headline": "src: Make AsMut<Ruleset> and AsMut<RulesetCreated> unambiguous",
"author_name": "Mickaël Salaün",
"author_login": "l0kod",
"committed_at": "2023-09-14T18:03:55Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "83da4b590c87494456884e2956e739209eae3198",
"body": "GitHub CI updated the Ubuntu kernel with Linux 6.2:\nhttps://ubuntu.com/about/release-cycle#ubuntu-kernel-release-cycle\n\nReflect this Landlock ABI bump in the tests.\n\nWe could only rely on the new landlock-test-tools UML kernels, but this\nkind of Ubuntu update should not be frequent, and I'd still like to test\nwith an Ubuntu kernel. Let's keep it for now, we'll update this CI\nconfiguration from time to time.\n\nSigned-off-by: Mickaël Salaün <mic@digikod.net>",
"is_bot": false,
"headline": "ci: Update Ubunty 22.04.3 kernel",
"author_name": "Mickaël Salaün",
"author_login": "l0kod",
"committed_at": "2023-09-14T11:09:11Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "fc5cff18cec507931859fed9bb0f456222e4f80e",
"body": "Run all tests against Linux 6.4.9 that supports Landlock ABI 3.\n\nSigned-off-by: Mickaël Salaün <mic@digikod.net>",
"is_bot": false,
"headline": "ci: Test with Landlock ABI 3",
"author_name": "Mickaël Salaün",
"author_login": "l0kod",
"committed_at": "2023-09-07T06:57:09Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "9fe121021ef7fabcf9e7d94765e125b51a3a50fa",
"body": "The new() function is planned to be changed and take parameters.\nThis also align with Rust best practice:\nhttps://rust-lang.github.io/rust-clippy/stable/index.html#new_without_default\n\nDeprecate Ruleset::new() and implement the Default trait for Ruleset.\n\nSigned-off-by: Mickaël Salaün <mic@digikod.net>",
"is_bot": false,
"headline": "ruleset: Use Ruleset::default() instead of Ruleset::new()",
"author_name": "Mickaël Salaün",
"author_login": "l0kod",
"committed_at": "2023-08-31T13:01:18Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "7a13afeafcbaa4c97e1c681967c252ce056d421a",
"body": "This is useful to detect test inconsistencies between Rust versions.\n\nThis new MSRV/UML test would have failed without commit dbd4105e0bed\n(\"src: Execute each restrict_self() test in a dedicated thread\").\n\nUse Ubuntu 22.04 to run MSRV and UML tests.\n\nSort steps to move all the checkout actions early.\n\nSigned-off-by: Mickaël Salaün <mic@digikod.net>",
"is_bot": false,
"headline": "ci: Run tests built with Rust MSRV",
"author_name": "Mickaël Salaün",
"author_login": "l0kod",
"committed_at": "2023-08-31T12:48:23Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "dbd4105e0bed546dcd49328fc1e1bb36ce08f761",
"body": "Ensures restrict_self() is called on a dedicated thread to avoid\ninconsistent tests.\n\nThe visible effect (with Rust 1.63) was for restrict_self() to sometime\nreturn E2BIG because of too many stacked domains. This inconsistency was\nrelated to the number of tests (i.e. the number of successful\nrestrict_self() calls), but not directly related to their content.\n\nSigned-off-by: Mickaël Salaün <mic@digikod.net>",
"is_bot": false,
"headline": "src: Execute each restrict_self() test in a dedicated thread",
"author_name": "Mickaël Salaün",
"author_login": "l0kod",
"committed_at": "2023-08-31T12:27:55Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "ce5727ee36d1244d564484a478d90af0a3c7a2e2",
"body": "Set and export the CARGO environment variable to make sure the\nubuntu_22_rust_stable job uses a consistent Cargo version for\nlandlock-test-tools/test-rust.sh tests and the native test.\n\nSigned-off-by: Mickaël Salaün <mic@digikod.net>",
"is_bot": false,
"headline": "ci: Make sure the same Cargo version is used",
"author_name": "Mickaël Salaün",
"author_login": "l0kod",
"committed_at": "2023-08-31T10:53:52Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "e44d5391f34ed89fc3133608c784aaa2d0a9540b",
"body": "Add the AccessFs::Truncate right.\n\nSigned-off-by: Mickaël Salaün <mic@digikod.net>",
"is_bot": false,
"headline": "src: Handle Landlock ABI v3",
"author_name": "Mickaël Salaün",
"author_login": "l0kod",
"committed_at": "2023-08-30T15:13:22Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "aadd18a9ad3de706729a4fe421531fa625eb8939",
"body": "bindgen -o src/uapi/landlock.rs .../linux/include/uapi/linux/landlock.h\n\nSigned-off-by: Mickaël Salaün <mic@digikod.net>",
"is_bot": false,
"headline": "uapi: Update to Linux 6.2",
"author_name": "Mickaël Salaün",
"author_login": "l0kod",
"committed_at": "2023-08-30T15:13:22Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "a53f04a7ceabf6467b1c169aa6d85f0685e629a1",
"body": "Use the merge commits that introduced each specific Landlock ABI.\n\nSigned-off-by: Mickaël Salaün <mic@digikod.net>",
"is_bot": false,
"headline": "compat: Update Linux links",
"author_name": "Mickaël Salaün",
"author_login": "l0kod",
"committed_at": "2023-08-30T15:13:22Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "7c7aee112790deb409ff9750ca154ec561d71e88",
"body": "It is possible to implement try_compat() in an inconsistent way compared\nto other implementations. Instead, implement the whole compatibility\nlogic in the default try_compat() implementation, and create tailored\nmethod to be implemented by objects: try_compat_inner() and\ntry_compat_children().\n\nThe\n[…]\nloredCompatLevel for each\nCompatible implementation (only PathBeneath for now), which helps avoid\nmissing an implementation for a new Compatible types.\n\nSigned-off-by: Mickaël Salaün <mic@digikod.net>",
"is_bot": false,
"headline": "compat: Improve TryCompat trait type safety and fix consistency issue",
"author_name": "Mickaël Salaün",
"author_login": "l0kod",
"committed_at": "2023-08-30T15:05:49Z",
"body_truncated": true,
"is_coding_agent": false
}
],
"releases_count": 9,
"commits_last_year": 27,
"latest_release_at": "2026-05-22T14:33:37Z",
"latest_release_tag": "v0.4.5",
"releases_from_tags": false,
"days_since_last_push": 1,
"active_weeks_last_year": 10,
"days_since_latest_release": 65,
"mean_days_between_releases": 151
},
"community": {
"has_readme": true,
"has_license": true,
"has_description": true,
"has_contributing": true,
"health_percentage": 50,
"has_issue_template": false,
"has_code_of_conduct": false,
"has_pull_request_template": false
},
"ecosystem": {
"packages": [
{
"name": "landlock",
"exists": true,
"license": "MIT OR Apache-2.0",
"keywords": [
"access-control",
"linux",
"sandbox",
"security",
"os::linux-apis",
"virtualization",
"api-bindings",
"filesystem"
],
"ecosystem": "crates",
"matches_repo": true,
"registry_url": "https://crates.io/crates/landlock",
"is_deprecated": false,
"latest_version": "0.4.6",
"repository_url": "https://github.com/landlock-lsm/rust-landlock",
"versions_count": 11,
"total_downloads": 13000824,
"dependents_count": null,
"deprecation_note": null,
"maintainers_count": null,
"monthly_downloads": 1665559,
"first_published_at": "2021-04-14T07:26:02.079539Z",
"latest_published_at": "2026-07-25T14:54:52.305858Z",
"latest_version_yanked": false,
"days_since_latest_publish": 1
}
]
},
"popularity": {
"forks": 24,
"stars": 285,
"watchers": 5,
"fork_history": {
"days": [
{
"date": "2021-04-15",
"count": 1
},
{
"date": "2021-12-01",
"count": 1
},
{
"date": "2021-12-09",
"count": 1
},
{
"date": "2022-08-18",
"count": 1
},
{
"date": "2022-09-28",
"count": 1
},
{
"date": "2022-12-24",
"count": 1
},
{
"date": "2023-08-02",
"count": 1
},
{
"date": "2024-06-08",
"count": 1
},
{
"date": "2024-10-22",
"count": 1
},
{
"date": "2025-01-17",
"count": 1
},
{
"date": "2025-02-11",
"count": 1
},
{
"date": "2025-03-23",
"count": 1
},
{
"date": "2025-04-16",
"count": 1
},
{
"date": "2025-04-30",
"count": 1
},
{
"date": "2025-09-30",
"count": 1
},
{
"date": "2026-01-23",
"count": 1
},
{
"date": "2026-02-17",
"count": 1
},
{
"date": "2026-03-29",
"count": 1
},
{
"date": "2026-05-14",
"count": 1
},
{
"date": "2026-05-15",
"count": 1
},
{
"date": "2026-05-25",
"count": 1
},
{
"date": "2026-06-10",
"count": 1
},
{
"date": "2026-07-11",
"count": 1
},
{
"date": "2026-07-24",
"count": 1
}
],
"complete": true,
"collected": 24,
"total_forks": 24
},
"star_history": null,
"open_issues_and_prs": 14
},
"ai_readiness": {
"has_nix": false,
"example_dirs": [
"examples"
],
"has_llms_txt": false,
"has_dockerfile": false,
"has_mcp_signal": false,
"bootstrap_files": [],
"api_schema_files": [],
"has_devcontainer": false,
"typecheck_configs": [],
"toolchain_manifests": [
"Cargo.toml"
],
"largest_source_bytes": 54053,
"source_files_sampled": 17,
"oversized_source_files": 0,
"agent_instruction_files": [],
"agent_instruction_max_bytes": null
},
"dependencies": {
"manifests": [
"Cargo.toml"
],
"advisories": {
"error": null,
"scope": "published_package",
"source": "osv",
"findings": [],
"collected": true,
"malicious": [],
"truncated": false,
"by_severity": {},
"advisory_count": 0,
"affected_count": 0,
"assessed_count": 15,
"malicious_count": 0,
"assessed_package": "crates:landlock@0.4.6",
"unassessed_count": 0,
"direct_affected_count": 0
},
"ecosystems": [
"crates"
],
"dependencies": [
{
"name": "enumflags2",
"manifest": "Cargo.toml",
"ecosystem": "crates",
"version_constraint": "0.7"
},
{
"name": "libc",
"manifest": "Cargo.toml",
"ecosystem": "crates",
"version_constraint": "0.2.186"
},
{
"name": "thiserror",
"manifest": "Cargo.toml",
"ecosystem": "crates",
"version_constraint": "2.0"
}
],
"all_dependencies": {
"error": null,
"source": "github-sbom",
"packages": [
{
"name": "enumflags2",
"direct": true,
"version": null,
"ecosystem": "crates"
},
{
"name": "libc",
"direct": true,
"version": null,
"ecosystem": "crates"
},
{
"name": "thiserror",
"direct": true,
"version": null,
"ecosystem": "crates"
},
{
"name": "anyhow",
"direct": false,
"version": null,
"ecosystem": "crates"
},
{
"name": "lazy_static",
"direct": false,
"version": null,
"ecosystem": "crates"
},
{
"name": "strum",
"direct": false,
"version": null,
"ecosystem": "crates"
},
{
"name": "strum_macros",
"direct": false,
"version": null,
"ecosystem": "crates"
}
],
"collected": true,
"truncated": false,
"total_count": 7,
"direct_count": 3,
"indirect_count": 4
}
},
"maintainership": {
"issues": {
"open_prs": 4,
"merged_prs": 97,
"open_issues": 10,
"closed_ratio": 0.63,
"closed_issues": 17,
"closed_unmerged_prs": 8
},
"bus_factor": 1,
"bot_contributors": 0,
"top_contributors": [
{
"type": "User",
"login": "l0kod",
"commits": 211,
"avatar_url": "https://avatars.githubusercontent.com/u/1286585?v=4"
},
{
"type": "User",
"login": "bjorn3",
"commits": 7,
"avatar_url": "https://avatars.githubusercontent.com/u/17426603?v=4"
},
{
"type": "User",
"login": "dburgener",
"commits": 3,
"avatar_url": "https://avatars.githubusercontent.com/u/4738703?v=4"
},
{
"type": "User",
"login": "n0toose",
"commits": 3,
"avatar_url": "https://avatars.githubusercontent.com/u/30193966?v=4"
},
{
"type": "User",
"login": "vdagonneau",
"commits": 2,
"avatar_url": "https://avatars.githubusercontent.com/u/40261096?v=4"
},
{
"type": "User",
"login": "cd-work",
"commits": 1,
"avatar_url": "https://avatars.githubusercontent.com/u/102963075?v=4"
},
{
"type": "User",
"login": "mrcnski",
"commits": 1,
"avatar_url": "https://avatars.githubusercontent.com/u/6035856?v=4"
},
{
"type": "User",
"login": "rusty-snake",
"commits": 1,
"avatar_url": "https://avatars.githubusercontent.com/u/41237666?v=4"
}
],
"contributors_sampled": 8,
"top_contributor_share": 0.921
},
"quality_signals": {
"has_ci": true,
"has_tests": false,
"ci_workflows": [
"pages.yml",
"rust.yml"
],
"has_docs_dir": false,
"linter_configs": [],
"has_editorconfig": false,
"has_linter_config": false,
"has_precommit_config": false
},
"security_signals": {
"lockfiles": [],
"scorecard": {
"checks": [
{
"name": "Binary-Artifacts",
"score": 10,
"reason": "no binaries found in the repo",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#binary-artifacts"
},
{
"name": "Branch-Protection",
"score": null,
"reason": "internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#branch-protection"
},
{
"name": "CI-Tests",
"score": 9,
"reason": "22 out of 24 merged PRs checked by a CI test -- score normalized to 9",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#ci-tests"
},
{
"name": "CII-Best-Practices",
"score": 0,
"reason": "no effort to earn an OpenSSF best practices badge detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#cii-best-practices"
},
{
"name": "Code-Review",
"score": 1,
"reason": "Found 3/24 approved changesets -- score normalized to 1",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#code-review"
},
{
"name": "Contributors",
"score": 10,
"reason": "project has 7 contributing companies or organizations",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#contributors"
},
{
"name": "Dangerous-Workflow",
"score": 10,
"reason": "no dangerous workflow patterns detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#dangerous-workflow"
},
{
"name": "Dependency-Update-Tool",
"score": 0,
"reason": "no update tool detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#dependency-update-tool"
},
{
"name": "Fuzzing",
"score": 0,
"reason": "project is not fuzzed",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#fuzzing"
},
{
"name": "License",
"score": 9,
"reason": "license file detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#license"
},
{
"name": "Maintained",
"score": 10,
"reason": "17 commit(s) and 3 issue activity found in the last 90 days -- score normalized to 10",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#maintained"
},
{
"name": "Packaging",
"score": null,
"reason": "packaging workflow not detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#packaging"
},
{
"name": "Pinned-Dependencies",
"score": 0,
"reason": "dependency not pinned by hash detected -- score normalized to 0",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#pinned-dependencies"
},
{
"name": "SAST",
"score": 0,
"reason": "SAST tool is not run on all commits -- score normalized to 0",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#sast"
},
{
"name": "Security-Policy",
"score": 0,
"reason": "security policy file not detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#security-policy"
},
{
"name": "Signed-Releases",
"score": null,
"reason": "no releases found",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#signed-releases"
},
{
"name": "Token-Permissions",
"score": 9,
"reason": "detected GitHub workflow tokens with excessive permissions",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#token-permissions"
},
{
"name": "Vulnerabilities",
"score": 10,
"reason": "0 existing vulnerabilities detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#vulnerabilities"
}
],
"commit": "2ff9281776b039fccc6075c46ccabe1acdb7ba6e",
"ran_at": "2026-07-26T20:45:24Z",
"aggregate_score": 5.5,
"scorecard_version": "v5.5.0"
},
"has_codeql_workflow": false,
"has_security_policy": false,
"has_dependabot_config": false
},
"contribution_flow": {
"collected": true,
"ci_last_run_at": "2026-07-25T14:59:54Z",
"oldest_open_prs": [
{
"number": 23,
"created_at": "2022-12-24T18:06:04Z",
"last_comment_at": "2025-02-10T13:37:06Z",
"last_comment_author": "l0kod"
},
{
"number": 58,
"created_at": "2024-02-21T14:12:49Z",
"last_comment_at": "2024-03-08T16:31:11Z",
"last_comment_author": "l0kod"
},
{
"number": 115,
"created_at": "2026-02-21T15:02:08Z",
"last_comment_at": null,
"last_comment_author": null
},
{
"number": 135,
"created_at": "2026-07-23T15:40:25Z",
"last_comment_at": "2026-07-23T22:24:21Z",
"last_comment_author": "eslerm"
}
],
"last_merged_pr_at": "2026-07-25T14:58:46Z",
"ci_last_conclusion": "SUCCESS",
"oldest_open_issues": [
{
"number": 17,
"created_at": "2022-08-26T13:56:06Z",
"last_comment_at": "2022-08-29T11:34:26Z",
"last_comment_author": "cd-work"
},
{
"number": 36,
"created_at": "2023-05-26T22:03:54Z",
"last_comment_at": "2024-02-21T14:36:52Z",
"last_comment_author": "mrcnski"
},
{
"number": 43,
"created_at": "2023-08-25T19:39:17Z",
"last_comment_at": "2024-04-02T10:52:58Z",
"last_comment_author": "l0kod"
},
{
"number": 57,
"created_at": "2024-02-21T11:11:32Z",
"last_comment_at": "2025-06-05T10:56:35Z",
"last_comment_author": "n0toose"
},
{
"number": 59,
"created_at": "2024-02-21T14:23:25Z",
"last_comment_at": null,
"last_comment_author": null
},
{
"number": 60,
"created_at": "2024-02-21T14:33:07Z",
"last_comment_at": null,
"last_comment_author": null
},
{
"number": 61,
"created_at": "2024-02-21T17:28:47Z",
"last_comment_at": null,
"last_comment_author": null
},
{
"number": 62,
"created_at": "2024-02-21T17:33:03Z",
"last_comment_at": "2025-04-17T06:28:54Z",
"last_comment_author": "l0kod"
},
{
"number": 93,
"created_at": "2025-04-16T17:06:02Z",
"last_comment_at": "2025-04-28T18:43:30Z",
"last_comment_author": "n0toose"
},
{
"number": 121,
"created_at": "2026-05-14T07:59:39Z",
"last_comment_at": "2026-05-26T06:24:02Z",
"last_comment_author": "lukehinds"
}
]
}
},
"config": {
"disabled_metrics": [],
"disabled_categories": [],
"disabled_components": {}
},
"source": {
"url": "https://github.com/landlock-lsm/rust-landlock",
"host": "github.com",
"name": "rust-landlock",
"owner": "landlock-lsm"
},
"metrics": {
"overall": {
"key": "overall",
"band": "moderate",
"name": "Overall health",
"note": null,
"notes": [],
"value": 64,
"inputs": {
"security": 64,
"vitality": 73,
"community": 69,
"governance": 62,
"engineering": 51
},
"components": []
},
"categories": [
{
"key": "vitality",
"band": "good",
"name": "Vitality",
"value": 73,
"weight": 0.22,
"metrics": [
{
"key": "development_activity",
"band": "moderate",
"name": "Development activity",
"note": null,
"notes": [],
"value": 66,
"inputs": {
"commits_last_year": 27,
"human_commit_share": 1,
"days_since_last_push": 1,
"active_weeks_last_year": 10
},
"components": [
{
"key": "push_recency",
"name": "Push recency",
"detail": "last push 1 days ago",
"points": 36,
"status": "met",
"details": [
{
"code": "push_recency",
"params": {
"days": 1
}
}
],
"max_points": 36
},
{
"key": "commit_cadence",
"name": "Commit cadence",
"detail": "10/52 weeks with commits",
"points": 6.9,
"status": "partial",
"details": [
{
"code": "commit_cadence_weeks",
"params": {
"weeks": 10
}
}
],
"max_points": 36
},
{
"key": "commit_volume",
"name": "Commit volume",
"detail": "27 commits in the last year",
"points": 13,
"status": "partial",
"details": [
{
"code": "commits_last_year",
"params": {
"count": 27
}
}
],
"max_points": 18
},
{
"key": "openssf_scorecard_maintained",
"name": "OpenSSF Scorecard: Maintained",
"detail": "17 commit(s) and 3 issue activity found in the last 90 days -- score normalized to 10",
"points": 10,
"status": "met",
"details": [],
"max_points": 10
}
]
},
{
"key": "release_discipline",
"band": "good",
"name": "Release discipline",
"note": "Excluded from scoring (no data or not applicable): OpenSSF Scorecard: Signed-Releases. Remaining weights renormalized.",
"notes": [
{
"code": "excluded_no_data",
"params": {
"components": [
"openssf_scorecard_signed_releases"
]
}
},
{
"code": "weights_renormalized",
"params": {}
}
],
"value": 84,
"inputs": {
"releases_count": 9,
"latest_release_tag": "v0.4.5",
"releases_from_tags": false,
"days_since_latest_release": 65,
"mean_days_between_releases": 151
},
"components": [
{
"key": "ships_releases",
"name": "Ships releases",
"detail": "9 releases published",
"points": 27,
"status": "met",
"details": [
{
"code": "releases_published",
"params": {
"count": 9
}
}
],
"max_points": 27
},
{
"key": "release_recency",
"name": "Release recency",
"detail": "latest release 65 days ago",
"points": 36,
"status": "met",
"details": [
{
"code": "release_recency",
"params": {
"days": 65
}
}
],
"max_points": 36
},
{
"key": "release_cadence",
"name": "Release cadence",
"detail": "a release every ~151 days",
"points": 12.6,
"status": "partial",
"details": [
{
"code": "release_cadence",
"params": {
"gap": 151
}
}
],
"max_points": 27
},
{
"key": "openssf_scorecard_signed_releases",
"name": "OpenSSF Scorecard: Signed-Releases",
"detail": "no releases found",
"points": 0,
"status": "excluded",
"details": [
{
"code": "no_data",
"params": {}
}
],
"max_points": 10
}
]
},
{
"key": "abandonment",
"band": "excellent",
"name": "Abandonment",
"note": null,
"notes": [],
"value": 100,
"inputs": {
"cap": null,
"state": "maintained",
"guards": [],
"signals": [],
"red_flag": false,
"multiplier_pct": 100,
"declared_reason": null,
"unverified_reason": null,
"unanswered_open_prs": null,
"unanswered_open_issues": null,
"days_since_last_merged_pr": null,
"days_since_last_human_commit": 1,
"days_since_last_human_commit_is_floor": false
},
"components": [
{
"key": "project_is_still_maintained",
"name": "Project is still maintained",
"detail": "last human commit 1 days ago",
"points": 100,
"status": "met",
"details": [
{
"code": "abandonment_maintained",
"params": {
"days": 1
}
}
],
"max_points": 100
}
]
}
],
"description": "Is the project alive — is code being written and are releases shipping?"
},
{
"key": "community",
"band": "moderate",
"name": "Community & Adoption",
"value": 69,
"weight": 0.18,
"metrics": [
{
"key": "popularity",
"band": "moderate",
"name": "Popularity & adoption",
"note": null,
"notes": [],
"value": 54,
"inputs": {
"forks": 24,
"stars": 285,
"watchers": 5,
"growth_state": "unverified",
"growth_factor_pct": 100,
"growth_unverified_reason": "no_history"
},
"components": [
{
"key": "stars",
"name": "Stars",
"detail": "285 stars",
"points": 39.8,
"status": "partial",
"details": [
{
"code": "stars",
"params": {
"count": 285
}
}
],
"max_points": 60
},
{
"key": "forks",
"name": "Forks",
"detail": "24 forks",
"points": 11.3,
"status": "partial",
"details": [
{
"code": "forks",
"params": {
"count": 24
}
}
],
"max_points": 25
},
{
"key": "watchers",
"name": "Watchers",
"detail": "5 watchers",
"points": 3.3,
"status": "partial",
"details": [
{
"code": "watchers",
"params": {
"count": 5
}
}
],
"max_points": 15
}
]
},
{
"key": "community_health",
"band": "moderate",
"name": "Community health",
"note": null,
"notes": [],
"value": 64,
"inputs": {
"has_readme": true,
"has_license": true,
"has_contributing": true,
"has_issue_template": false,
"has_code_of_conduct": false,
"has_pull_request_template": false
},
"components": [
{
"key": "readme",
"name": "README",
"detail": null,
"points": 22.5,
"status": "met",
"details": [],
"max_points": 22.5
},
{
"key": "license",
"name": "License",
"detail": "license file present, not a recognized license",
"points": 16.9,
"status": "partial",
"details": [
{
"code": "license_custom",
"params": {}
}
],
"max_points": 22.5
},
{
"key": "contributing_guide",
"name": "CONTRIBUTING guide",
"detail": null,
"points": 18,
"status": "met",
"details": [],
"max_points": 18
},
{
"key": "code_of_conduct",
"name": "Code of conduct",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 13.5
},
{
"key": "issue_template",
"name": "Issue template",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 7.2
},
{
"key": "pr_template",
"name": "PR template",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 6.3
}
]
},
{
"key": "ecosystem_adoption",
"band": "excellent",
"name": "Ecosystem adoption (downloads)",
"note": "Excluded from scoring (no data or not applicable): Registry dependents. Remaining weights renormalized.",
"notes": [
{
"code": "excluded_no_data",
"params": {
"components": [
"registry_dependents"
]
}
},
{
"code": "weights_renormalized",
"params": {}
}
],
"value": 100,
"inputs": {
"packages": [
"landlock"
],
"dependents": null,
"ecosystems": "crates",
"total_downloads": 13000824,
"monthly_downloads": 1665559
},
"components": [
{
"key": "monthly_downloads",
"name": "Monthly downloads",
"detail": "1,665,559 downloads/month across crates",
"points": 80,
"status": "met",
"details": [
{
"code": "downloads_monthly",
"params": {
"count": 1665559,
"ecosystems": "crates"
}
}
],
"max_points": 80
},
{
"key": "registry_dependents",
"name": "Registry dependents",
"detail": "not reported by this ecosystem",
"points": 0,
"status": "excluded",
"details": [
{
"code": "not_reported_by_this_ecosystem",
"params": {}
}
],
"max_points": 20
}
]
}
],
"description": "Does the project have users, downloads, attention, and a welcoming setup for contributors?"
},
{
"key": "governance",
"band": "moderate",
"name": "Sustainability & Governance",
"value": 62,
"weight": 0.24,
"metrics": [
{
"key": "maintainer_resilience",
"band": "at_risk",
"name": "Maintainer resilience (bus factor)",
"note": null,
"notes": [],
"value": 32,
"inputs": {
"bus_factor": 1,
"contributors_sampled": 8,
"top_contributor_share": 0.921
},
"components": [
{
"key": "bus_factor",
"name": "Bus factor",
"detail": "1 contributor(s) cover half of all commits",
"points": 9,
"status": "partial",
"details": [
{
"code": "bus_factor",
"params": {
"count": 1
}
}
],
"max_points": 54
},
{
"key": "commit_distribution",
"name": "Commit distribution",
"detail": "top contributor authored 92% of commits",
"points": 1.8,
"status": "partial",
"details": [
{
"code": "top_contributor_share",
"params": {
"share": 92
}
}
],
"max_points": 22.5
},
{
"key": "contributor_breadth",
"name": "Contributor breadth",
"detail": "8 contributors",
"points": 10.8,
"status": "partial",
"details": [
{
"code": "contributors_sampled",
"params": {
"count": 8
}
}
],
"max_points": 13.5
},
{
"key": "openssf_scorecard_contributors",
"name": "OpenSSF Scorecard: Contributors",
"detail": "project has 7 contributing companies or organizations",
"points": 10,
"status": "met",
"details": [],
"max_points": 10
}
]
},
{
"key": "responsiveness",
"band": "moderate",
"name": "Issue & PR responsiveness",
"note": null,
"notes": [],
"value": 66,
"inputs": {
"merged_prs": 97,
"open_issues": 10,
"closed_issues": 17,
"issue_closed_ratio": 0.63,
"closed_unmerged_prs": 8
},
"components": [
{
"key": "issue_resolution",
"name": "Issue resolution",
"detail": "63% of issues closed",
"points": 29.5,
"status": "partial",
"details": [
{
"code": "issues_closed_share",
"params": {
"share": 63
}
}
],
"max_points": 46.75
},
{
"key": "pr_acceptance",
"name": "PR acceptance",
"detail": "97/105 decided PRs merged",
"points": 35.3,
"status": "partial",
"details": [
{
"code": "decided_prs_merged",
"params": {
"merged": 97,
"decided": 105
}
}
],
"max_points": 38.25
},
{
"key": "openssf_scorecard_code_review",
"name": "OpenSSF Scorecard: Code-Review",
"detail": "Found 3/24 approved changesets -- score normalized to 1",
"points": 1.5,
"status": "partial",
"details": [],
"max_points": 15
}
]
},
{
"key": "stewardship",
"band": "moderate",
"name": "Ownership & stewardship",
"note": null,
"notes": [],
"value": 64,
"inputs": {
"followers": 91,
"owner_type": "Organization",
"is_verified": null,
"owner_login": "landlock-lsm",
"public_repos": 12,
"account_age_days": 3628
},
"components": [
{
"key": "ownership_backing",
"name": "Ownership backing",
"detail": "organization-owned",
"points": 30,
"status": "met",
"details": [
{
"code": "owner_organization",
"params": {}
}
],
"max_points": 30
},
{
"key": "verified_domain",
"name": "Verified domain",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 20
},
{
"key": "owner_reach",
"name": "Owner reach",
"detail": "91 followers of landlock-lsm",
"points": 14.1,
"status": "partial",
"details": [
{
"code": "owner_followers",
"params": {
"count": 91,
"login": "landlock-lsm"
}
}
],
"max_points": 25
},
{
"key": "track_record",
"name": "Track record",
"detail": "12 public repos, account ~9 yr old",
"points": 20.1,
"status": "partial",
"details": [
{
"code": "public_repos",
"params": {
"count": 12
}
},
{
"code": "account_age_years",
"params": {
"years": 9
}
}
],
"max_points": 25
}
]
},
{
"key": "package_maintenance",
"band": "excellent",
"name": "Package maintenance",
"note": null,
"notes": [],
"value": 100,
"inputs": {
"packages": [
"landlock"
],
"ecosystems": "crates",
"any_deprecated": false,
"min_days_since_publish": 1
},
"components": [
{
"key": "published_resolvable",
"name": "Published & resolvable",
"detail": "1 package(s) on crates",
"points": 25,
"status": "met",
"details": [
{
"code": "packages_published",
"params": {
"count": 1,
"ecosystems": "crates"
}
}
],
"max_points": 25
},
{
"key": "publish_recency",
"name": "Publish recency",
"detail": "latest publish 1 days ago",
"points": 35,
"status": "met",
"details": [
{
"code": "publish_recency",
"params": {
"days": 1
}
}
],
"max_points": 35
},
{
"key": "version_history",
"name": "Version history",
"detail": "11 published versions",
"points": 20,
"status": "met",
"details": [
{
"code": "published_versions",
"params": {
"count": 11
}
}
],
"max_points": 20
},
{
"key": "not_deprecated",
"name": "Not deprecated",
"detail": "active, not deprecated or yanked",
"points": 20,
"status": "met",
"details": [
{
"code": "package_not_deprecated",
"params": {}
}
],
"max_points": 20
}
]
}
],
"description": "Will the project survive its people — bus factor, responsiveness, who backs it, and package upkeep?"
},
{
"key": "engineering",
"band": "moderate",
"name": "Engineering Quality",
"value": 51,
"weight": 0.2,
"metrics": [
{
"key": "engineering_practices",
"band": "at_risk",
"name": "Engineering practices",
"note": null,
"notes": [],
"value": 42,
"inputs": {
"has_ci": true,
"has_tests": false,
"has_editorconfig": false,
"has_linter_config": false,
"has_precommit_config": false
},
"components": [
{
"key": "ci_workflows",
"name": "CI workflows",
"detail": "2 workflow(s)",
"points": 24,
"status": "met",
"details": [
{
"code": "ci_workflows",
"params": {
"count": 2
}
}
],
"max_points": 24
},
{
"key": "tests_present",
"name": "Tests present",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 24
},
{
"key": "linter_config",
"name": "Linter config",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 16
},
{
"key": "pre_commit_hooks",
"name": "Pre-commit hooks",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 9.6
},
{
"key": "editorconfig",
"name": ".editorconfig",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 6.4
},
{
"key": "openssf_scorecard_ci_tests",
"name": "OpenSSF Scorecard: CI-Tests",
"detail": "22 out of 24 merged PRs checked by a CI test -- score normalized to 9",
"points": 18,
"status": "partial",
"details": [],
"max_points": 20
}
]
},
{
"key": "documentation",
"band": "moderate",
"name": "Documentation",
"note": null,
"notes": [],
"value": 65,
"inputs": {
"topics": [
"landlock",
"linux",
"sandboxing",
"security"
],
"has_wiki": false,
"homepage": "https://crates.io/crates/landlock",
"has_readme": true,
"has_docs_dir": false,
"has_description": true
},
"components": [
{
"key": "readme",
"name": "README",
"detail": null,
"points": 30,
"status": "met",
"details": [],
"max_points": 30
},
{
"key": "documentation_directory",
"name": "Documentation directory",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 25
},
{
"key": "documentation_homepage_site",
"name": "Documentation / homepage site",
"detail": "https://crates.io/crates/landlock",
"points": 15,
"status": "met",
"details": [],
"max_points": 15
},
{
"key": "repository_description",
"name": "Repository description",
"detail": null,
"points": 10,
"status": "met",
"details": [],
"max_points": 10
},
{
"key": "topics",
"name": "Topics",
"detail": "4 topics",
"points": 10,
"status": "met",
"details": [
{
"code": "topics_count",
"params": {
"count": 4
}
}
],
"max_points": 10
},
{
"key": "wiki",
"name": "Wiki",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 10
}
]
}
],
"description": "Are baseline engineering and documentation practices in place?"
},
{
"key": "security",
"band": "moderate",
"name": "Security",
"value": 64,
"weight": 0.16,
"metrics": [
{
"key": "security_posture",
"band": "moderate",
"name": "Security posture",
"note": "Excluded from scoring (no data or not applicable): Branch-Protection, Packaging, Signed-Releases. Remaining weights renormalized.",
"notes": [
{
"code": "excluded_no_data",
"params": {
"components": [
"branch_protection",
"packaging",
"signed_releases"
]
}
},
{
"code": "weights_renormalized",
"params": {}
}
],
"value": 55,
"inputs": {
"source": "openssf_scorecard",
"checks_evaluated": 15,
"scorecard_version": "v5.5.0",
"checks_inconclusive": 3,
"scorecard_aggregate": 5.5
},
"components": [
{
"key": "binary_artifacts",
"name": "Binary-Artifacts",
"detail": "no binaries found in the repo",
"points": 7.5,
"status": "met",
"details": [],
"max_points": 7.5
},
{
"key": "branch_protection",
"name": "Branch-Protection",
"detail": "internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md",
"points": 0,
"status": "excluded",
"details": [
{
"code": "no_data",
"params": {}
}
],
"max_points": 7.5
},
{
"key": "ci_tests",
"name": "CI-Tests",
"detail": "22 out of 24 merged PRs checked by a CI test -- score normalized to 9",
"points": 2.2,
"status": "partial",
"details": [],
"max_points": 2.5
},
{
"key": "cii_best_practices",
"name": "CII-Best-Practices",
"detail": "no effort to earn an OpenSSF best practices badge detected",
"points": 0,
"status": "missed",
"details": [],
"max_points": 2.5
},
{
"key": "code_review",
"name": "Code-Review",
"detail": "Found 3/24 approved changesets -- score normalized to 1",
"points": 0.8,
"status": "partial",
"details": [],
"max_points": 7.5
},
{
"key": "contributors",
"name": "Contributors",
"detail": "project has 7 contributing companies or organizations",
"points": 2.5,
"status": "met",
"details": [],
"max_points": 2.5
},
{
"key": "dangerous_workflow",
"name": "Dangerous-Workflow",
"detail": "no dangerous workflow patterns detected",
"points": 10,
"status": "met",
"details": [],
"max_points": 10
},
{
"key": "dependency_update_tool",
"name": "Dependency-Update-Tool",
"detail": "no update tool detected",
"points": 0,
"status": "missed",
"details": [],
"max_points": 7.5
},
{
"key": "fuzzing",
"name": "Fuzzing",
"detail": "project is not fuzzed",
"points": 0,
"status": "missed",
"details": [],
"max_points": 5
},
{
"key": "license",
"name": "License",
"detail": "license file detected",
"points": 2.2,
"status": "partial",
"details": [],
"max_points": 2.5
},
{
"key": "maintained",
"name": "Maintained",
"detail": "17 commit(s) and 3 issue activity found in the last 90 days -- score normalized to 10",
"points": 7.5,
"status": "met",
"details": [],
"max_points": 7.5
},
{
"key": "packaging",
"name": "Packaging",
"detail": "packaging workflow not detected",
"points": 0,
"status": "excluded",
"details": [
{
"code": "no_data",
"params": {}
}
],
"max_points": 5
},
{
"key": "pinned_dependencies",
"name": "Pinned-Dependencies",
"detail": "dependency not pinned by hash detected -- score normalized to 0",
"points": 0,
"status": "missed",
"details": [],
"max_points": 5
},
{
"key": "sast",
"name": "SAST",
"detail": "SAST tool is not run on all commits -- score normalized to 0",
"points": 0,
"status": "missed",
"details": [],
"max_points": 5
},
{
"key": "security_policy",
"name": "Security-Policy",
"detail": "security policy file not detected",
"points": 0,
"status": "missed",
"details": [],
"max_points": 5
},
{
"key": "signed_releases",
"name": "Signed-Releases",
"detail": "no releases found",
"points": 0,
"status": "excluded",
"details": [
{
"code": "no_data",
"params": {}
}
],
"max_points": 7.5
},
{
"key": "token_permissions",
"name": "Token-Permissions",
"detail": "detected GitHub workflow tokens with excessive permissions",
"points": 6.8,
"status": "partial",
"details": [],
"max_points": 7.5
},
{
"key": "vulnerabilities",
"name": "Vulnerabilities",
"detail": "0 existing vulnerabilities detected",
"points": 7.5,
"status": "met",
"details": [],
"max_points": 7.5
}
]
},
{
"key": "dependency_advisories",
"band": "excellent",
"name": "Dependency advisories",
"note": "Excluded from scoring (no data or not applicable): No advisories left outstanding. Remaining weights renormalized. Matched the crates:landlock@0.4.6 runtime dependency closure — what installing the published package pulls in — 15 packages. Reachability is not analyzed.",
"notes": [
{
"code": "excluded_no_data",
"params": {
"components": [
"no_advisories_left_outstanding"
]
}
},
{
"code": "weights_renormalized",
"params": {}
},
{
"code": "advisories_scope_published",
"params": {
"package": "crates:landlock@0.4.6",
"assessed": 15
}
},
{
"code": "advisories_reachability",
"params": {}
}
],
"value": 100,
"inputs": {
"source": "osv",
"advisories": 0,
"affected_packages": 0,
"assessed_packages": 15,
"unassessed_packages": 0,
"affected_by_severity": "none",
"direct_affected_packages": 0
},
"components": [
{
"key": "direct_dependencies_free_of_known_advisories",
"name": "Direct dependencies free of known advisories",
"detail": "no direct dependency carries a known advisory",
"points": 35,
"status": "met",
"details": [
{
"code": "no_direct_advisories",
"params": {}
}
],
"max_points": 35
},
{
"key": "indirect_dependencies_free_of_known_advisories",
"name": "Indirect dependencies free of known advisories",
"detail": "no indirect dependency carries a known advisory",
"points": 25,
"status": "met",
"details": [
{
"code": "no_indirect_advisories",
"params": {}
}
],
"max_points": 25
},
{
"key": "no_advisories_left_outstanding",
"name": "No advisories left outstanding",
"detail": "no advisory carries a publication date",
"points": 0,
"status": "excluded",
"details": [
{
"code": "advisories_no_publication_date",
"params": {}
}
],
"max_points": 40
}
]
},
{
"key": "malicious_dependencies",
"band": "excellent",
"name": "Malicious dependencies",
"note": null,
"notes": [],
"value": 100,
"inputs": {
"source": "osv",
"meaning": "reported as a malicious package by the OpenSSF corpus; the remedy is removal or moving off the compromised name, never an upgrade of the same artifact. Versions the registry has since pulled are listed but not scored",
"packages": [],
"red_flag": false,
"assessed_packages": 15,
"malicious_packages": 0,
"direct_malicious_packages": 0,
"withdrawn_malicious_packages": 0,
"installable_malicious_packages": 0
},
"components": [
{
"key": "no_dependency_reported_as_a_malicious_package",
"name": "No dependency reported as a malicious package",
"detail": "no dependency is reported as a malicious package",
"points": 100,
"status": "met",
"details": [
{
"code": "no_malicious_dependencies",
"params": {}
}
],
"max_points": 100
}
]
},
{
"key": "high_risk_jurisdiction_exposure",
"band": "excellent",
"name": "High-Risk Jurisdiction Exposure",
"note": "Only high-confidence self-published location evidence affects this multiplier. Ambiguous matches are review-only; country evidence is not proof of nationality, citizenship, legal registration, malicious intent, or sanctions status.",
"notes": [
{
"code": "jurisdiction_evidence_limits",
"params": {}
}
],
"value": 100,
"inputs": {
"meaning": "self-published location evidence; not nationality or citizenship",
"red_flag": false,
"exposures": [],
"policy_countries": [
"Russia",
"Iran",
"North Korea"
],
"review_only_matches": 0,
"assessed_self_published_locations": 6
},
"components": [
{
"key": "policy_exposure_multiplier",
"name": "Policy exposure multiplier",
"detail": "no confirmed policy-scope location match",
"points": 100,
"status": "met",
"details": [
{
"code": "jurisdiction_no_match",
"params": {}
}
],
"max_points": 100
}
]
}
],
"description": "Are visible security and supply-chain practices strong, with no malicious dependency and no unresolved high-risk jurisdiction exposure?"
},
{
"key": "ai_readiness",
"band": "at_risk",
"name": "AI Readiness",
"value": 43,
"weight": 0,
"metrics": [
{
"key": "ai_agent_context",
"band": "at_risk",
"name": "Agent context & guidance",
"note": null,
"notes": [],
"value": 40,
"inputs": {
"has_llms_txt": false,
"legible_history_share": 1,
"agent_instruction_files": [],
"agent_instruction_max_bytes": null
},
"components": [
{
"key": "agent_instructions",
"name": "Agent instructions",
"detail": "no CLAUDE.md / AGENTS.md / editor rules",
"points": 0,
"status": "missed",
"details": [
{
"code": "no_agent_instructions",
"params": {}
}
],
"max_points": 45
},
{
"key": "machine_readable_docs_llms_txt",
"name": "Machine-readable docs (llms.txt)",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 15
},
{
"key": "legible_commit_history",
"name": "Legible commit history",
"detail": "100 of 100 human commits state their intent (structured subject or explanatory body)",
"points": 40,
"status": "met",
"details": [
{
"code": "legible_history",
"params": {
"legible": 100,
"sampled": 100
}
}
],
"max_points": 40
}
]
},
{
"key": "ai_verify_loop",
"band": "critical",
"name": "Verify loop (build / test / typecheck)",
"note": null,
"notes": [],
"value": 24,
"inputs": {
"has_nix": false,
"has_tests": false,
"lockfiles": [],
"has_dockerfile": false,
"typed_language": true,
"bootstrap_files": [],
"has_devcontainer": false,
"has_linter_config": false,
"typecheck_configs": [],
"agent_commit_share": 0,
"toolchain_manifests": [
"Cargo.toml"
],
"dependency_bot_commit_share": 0
},
"components": [
{
"key": "one_command_bootstrap",
"name": "One-command bootstrap",
"detail": "Cargo.toml (toolchain convention, no task runner)",
"points": 12.6,
"status": "partial",
"details": [
{
"code": "toolchain_convention",
"params": {
"files": "Cargo.toml"
}
}
],
"max_points": 18
},
{
"key": "automated_tests",
"name": "Automated tests",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 22
},
{
"key": "lint_format_config",
"name": "Lint / format config",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 11
},
{
"key": "static_type_checking",
"name": "Static type checking",
"detail": "Rust (statically typed)",
"points": 11,
"status": "met",
"details": [
{
"code": "statically_typed_language",
"params": {
"language": "Rust"
}
}
],
"max_points": 11
},
{
"key": "reproducible_environment",
"name": "Reproducible environment",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 10
},
{
"key": "demonstrated_agent_practice",
"name": "Demonstrated agent practice",
"detail": "no agent-authored commits among the last 100",
"points": 0,
"status": "missed",
"details": [
{
"code": "no_agent_authored_commits",
"params": {
"sampled": 100
}
}
],
"max_points": 10
},
{
"key": "automated_maintenance",
"name": "Automated maintenance",
"detail": "no automated dependency updates observed",
"points": 0,
"status": "missed",
"details": [
{
"code": "no_dependency_automation",
"params": {}
}
],
"max_points": 8
},
{
"key": "openssf_scorecard_pinned_dependencies",
"name": "OpenSSF Scorecard: Pinned-Dependencies",
"detail": "dependency not pinned by hash detected -- score normalized to 0",
"points": 0,
"status": "missed",
"details": [],
"max_points": 10
}
]
},
{
"key": "ai_code_legibility",
"band": "excellent",
"name": "Code legibility for models",
"note": null,
"notes": [],
"value": 100,
"inputs": {
"primary_language": "Rust",
"largest_source_bytes": 54053,
"source_files_sampled": 17,
"oversized_source_files": 0
},
"components": [
{
"key": "type_checkable_code",
"name": "Type-checkable code",
"detail": "Rust (statically typed)",
"points": 45,
"status": "met",
"details": [
{
"code": "statically_typed_language",
"params": {
"language": "Rust"
}
}
],
"max_points": 45
},
{
"key": "manageable_file_sizes",
"name": "Manageable file sizes",
"detail": "0/17 source files over 60KB",
"points": 55,
"status": "met",
"details": [
{
"code": "oversized_source_files",
"params": {
"kb": 60,
"sampled": 17,
"oversized": 0
}
}
],
"max_points": 55
}
]
},
{
"key": "ai_interfaces",
"band": "at_risk",
"name": "Machine-readable interfaces",
"note": null,
"notes": [],
"value": 40,
"inputs": {
"example_dirs": [
"examples"
],
"has_mcp_signal": false,
"api_schema_files": []
},
"components": [
{
"key": "api_schema_openapi_graphql_proto",
"name": "API schema (OpenAPI/GraphQL/proto)",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 40
},
{
"key": "mcp_server",
"name": "MCP server",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 20
},
{
"key": "runnable_examples",
"name": "Runnable examples",
"detail": "examples",
"points": 40,
"status": "met",
"details": [
{
"code": "file_list",
"params": {
"files": "examples"
}
}
],
"max_points": 40
}
]
}
],
"description": "How well is the repo equipped to be developed and maintained with AI coding agents? An independent, experimental badge — weight 0.0, so it is surfaced on its own and does not affect the overall health score."
}
],
"metrics_version": "1.13.0"
},
"warnings": [
"Star history unavailable: GitHub GraphQL error: Resource not accessible by personal access token"
],
"report_type": "repository",
"generated_at": "2026-07-26T20:45:42.026326Z",
"schema_version": "0.27.0",
"badge_url": "https://raw.githubusercontent.com/inspect-software/badges/main/v1/l/landlock-lsm/rust-landlock.svg",
"full_name": "landlock-lsm/rust-landlock",
"license_state": "custom",
"license_spdx": null
}