publet-cli 0.2.3

0.2.3 - 2026-10-29

Commit 4f38921f47bb; release record pub:sha2-256:3bi7h5ftyvrn4glj3t42k5wrz6ozcrw2pcv7fl77gtfhozfhfoxq.

Added

• A project states the pub it needs in pub-version.txt or as pub= in .publet/config; pub finds it in the current directory or a parent and, before running any command, stops with exit 2 naming the release to install when it is not met (PUB_IGNORE_VERSION=1 skips this). pub require [REQUIREMENT] checks one for scripts. An unknown command now says which release this is and how to install another.

Fixed

• pub reads a version requirement only from a regular file, at most 4 KiB of it, skips a byte-order mark and comments after the requirement, and refuses something that is not a requirement by name, quoted, instead of reporting it as unmet; the README documents exit status 2 and the files and variable involved

Security checks

• advisories, licences, bans and sources: cargo deny --locked check --hide-inclusion-graph (cargo-deny 0.20.2) -- advisories ok, bans ok, licenses ok, sources ok
• supply-chain audits: cargo vet --locked (cargo-vet 0.10.2) -- Vetting Succeeded (68 fully audited, 4 partially audited, 157 exempted)
• supply-chain reports current: .venv/bin/pubkit supply-chain --check publet-core publet-algorithms (pubkit 0.9.1) -- SUPPLY-CHAIN.md current for publet-core, publet-algorithms
• quality audit current: .venv/bin/pubkit audit --check (pubkit 0.9.1) -- audit/publet-cli-0.2.3.md: publet-cli 0.2.3 audited on 2026-10-29 by rust-crate-quality against the current standard (bc3c5b6eeba4); 0 findings block a release
• RustSec advisory database revision: 40f5be6fb12ed93fc591bf4ab23b7d793b3f2239 (2026-10-28)
• audits imported from: bytecode-alliance, embark-studios, google, isrg, mozilla, pubunit, zcash

Install:

cargo install --locked --git https://github.com/schryer/publet --tag v0.2.3 publet-cli

publet-cli 0.2.2

0.2.2 - 2026-10-28

Commit 1ee769a56d75; release record pub:sha2-256:ckgcxsxmtgt2cdmxmy3bwpnggc5k66nujynluwhoinpcthmrjqdq.

Added

• Quantities (spec Section 5.9): a definitional claim may carry defines, stating a units system, base dimension, unit, quantity kind or statistical measure; a column may cite unit_defs, kind and measure, each also in depends; a measured column holds quantity cells; a procedural claim may carry computes; and an empirical claim's values may be computed, naming their calculation with role derivation instead of a method
• pub compose takes --defines, --computes and --derivation, adds what a table's columns cite to depends, and pub read lists each column's unit definitions, kind and measure
• publet-quantity, the adapter to pubunit 0.1.0 (pinned, at its git tag until it is on crates.io): pub compose checks each column's unit against UCUM 2.2 and the dimension, unit and kind claims it cites, checks each quantity cell's keys and values against its measure, refuses what spec Section 5.9 refuses, and says when a unit is left unchecked because it is undefined or in another system
• pub bundle writes the reading data a theme turns into pages, from a workspace or a directory of objects: a JSON bundle per object at o/.json (the object decoded, what it rests on and why, its dependency closure, what cites it and how, its critiques, its lineage, its measures' parameters, and a summary of every object it mentions), one per name a definition goes by at def/.json (a name two definitions share lists both), an index, and each object's canonical bytes at pub/v1/object/
• Concepts (spec Section 5.9.1): a definitional claim may define a concept at a required PDC code, which is its term: a subject concept such as a UDC class, a quantity concept naming the kind it narrows and a boundary of includes and excludes lines, or a relation concept relating slots, each a role bound to a quantity concept or a kind, as a product solvable for any slot or as explicit; the kinds and concepts it binds must be in depends (pub compose adds the kinds)
• Triage (spec Section 7.4) gains the findings groups-under and quoted-from and an optional candidate blob of unsigned draft objects, which publet-graph's Triage reads; anchors may have up to 12 stewards, and an expert group is an anchor over a PDC code's subtree (Section 9.3)
• A calculation's computes may carry solves (spec Section 5.9.5): the relation concept and slot it solves for, the roles it requires, and optional roles each with the claim stating its default, which must be in depends; pub compose refuses a code with no concept in depends or a role the relation has no slot for
• pub bundle gives each object the concepts it is classified under and the triage suggestions naming it, and each concept its PDC code, form, broader and narrower concepts, members, the calculations solving it, the concepts competing for its code, and the anchors covering it; a name with a slash, such as the PDC code 631/635, is served under a segment with an underscore (def/631_635.json), listed in the index's name_paths
• Singulars (spec Section 5.9.1 and 5.9.6): a definitional claim may define one particular thing with defines.sort singular, a name, the PDC code of its class, and optionally part_of, the singular it is part of, and location.h3, the H3 cell it is in; its class must have a subject concept in depends, part_of must name a singular and be in depends, and a singular has no term, so two of one name are never a divergence
• Facts (spec Section 5.9.6): a table's about column holds the CIDs of the singulars its rows are about, each in depends (pub compose adds them, and a singular's part_of), and a column may name its quantity concept by PDC code in concept, which must have a quantity concept in depends
• pub get PATH finds a fact by its path key, such as place.site.tallinn.basement.floor_area, computed from the names in the claims held: the head of each matching fact lineage (or the member every anchor over it recommends) with its value, unit, measure, evidence roles, and the status they imply by the convention of spec Section 5.9.7 (confirmed, estimate or to-verify); a path whose segment is an H3 cell, such as place.87089b1a2ffffff, finds the facts about every singular located in the cell by H3's identifier hierarchy
• Evidence roles statement and quote (spec Section 5.5), for what someone in a position to know stated and what a supplier offered; pub compose and pub revise take --statement=REF and --quote=REF
• publet-graph: Graph::singulars, class_path, singular_path, singular_location, facts_about, singular_versions, lineage_heads, anchors and annotations_of, and segment, the path segment of a name
• Spec Section 5.9.1 fixes the PDC separator: a narrower class is the code it extends, ~, and a number, such as (1/9)~1; Section 5.9.6 documents the Sustenaut usage pattern, with places under the concept Place at UDC (1/9), so place paths begin place.

Fixed

• pub revise applies --defines and --computes, adding what they cite to depends, instead of keeping the old fields: a concept's boundary is reframed as a new version
• pub get no longer counts an annotation or dispute its author has retracted as leaving a fact open (spec Section 5.9.7): withdrawing a to-verify note once the check is made changes the status it implies
• pub annotate writes --aspect into the annotation's body, where spec Section 7 puts it and the graph reads it, not into value; a provenance verdict on an attributive or archival claim is no longer refused, and pub read shows an annotation's aspect
• pub --version names its version from publet-cli's own vX.Y.Z tags only, so a publet-core or publet-algorithms tag on the same commit no longer makes a release build call itself unreleased

Security

• rustls 0.23.46 fixes RUSTSEC-2026-0346, -0347, -0348 and -0349 in pub's network client (pub sync, pub serve), through reqwest; its cargo vet exemption moves from 0.23.45 to 0.23.46
• pub's HTTPS connections (pub sync, pub serve) no longer trust the distrusted emSign ECC Root CA - G3 or certificate paths through its distrusted intermediates: rustls-webpki 0.103.16, webpki-roots 1.0.10 and webpki-root-certs 1.0.10 (RUSTSEC-2026-0381, RUSTSEC-2026-0382, RUSTSEC-2026-0383)
• tokio 1.54.1 fixes RUSTSEC-2026-0386 and quinn-proto 0.11.19 fixes RUSTSEC-2026-0338, -0340 and -0343 in pub's network client and server (pub sync, pub serve); their cargo vet exemptions move to the fixed versions
• pub no longer builds block-buffer 0.10.4 (GHSA-qwgh-2vcv-g2f7): publet-core moves to ed25519-dalek 3 and sha2 0.11, and publet-algorithms to sha2 0.11

Internal

• Update other crates the supply-chain audits cover
• pubunit 0.1.0 comes from crates.io instead of its git tag; cargo deny allows no git source again, and cargo vet trusts pubunit's publisher
• Documentation: SECURITY.md says cargo deny, cargo vet and OSV-Scanner also run every night, and names pubunit among the imported audit sets; publet-core's verify documents each error it returns
• The functional suite's lock adds h3 4.5.0 for the H3 test vectors, and moves parse to 1.22.4 and pycparser to 3.12
• A golden test composes the Tallinn fixtures under a fixed author and time and compares every identifier with tests/golden/tallinn.json, so a change to the bytes pub compose writes for the same input, which would re-mint every gathered fact, fails CI unless it is made on purpose (PUBLET_UPDATE_GOLDEN=1)
• Documentation of publet-algorithms, which pub compiles in, from its 0.2.2 audit (audit/publet-algorithms-0.2.2.md)
• Documentation: the README has a runnable example, the commands main.rs dispatches, exit codes and an MSRV policy; usage text and module docs no longer claim what the code does not do; SECURITY.md says which untrusted-input code is fuzzed (audit/publet-cli-0.2.2.md)

Security checks

• advisories, licences, bans and sources: cargo deny --locked check --hide-inclusion-graph (cargo-deny 0.20.2) -- advisories ok, bans ok, licenses ok, sources ok
• supply-chain audits: cargo vet --locked (cargo-vet 0.10.2) -- Vetting Succeeded (68 fully audited, 4 partially audited, 157 exempted)
• supply-chain reports current: .venv/bin/pubkit supply-chain --check publet-core publet-algorithms (pubkit 0.9.1) -- SUPPLY-CHAIN.md current for publet-core, publet-algorithms
• quality audit current: .venv/bin/pubkit audit --check (pubkit 0.9.1) -- audit/publet-cli-0.2.2.md: publet-cli 0.2.2 audited on 2026-10-28 by rust-crate-quality against the current standard (bc3c5b6eeba4); 0 findings block a release
• RustSec advisory database revision: 40f5be6fb12ed93fc591bf4ab23b7d793b3f2239 (2026-10-28)
• audits imported from: bytecode-alliance, embark-studios, google, isrg, mozilla, pubunit, zcash

Install:

cargo install --locked --git https://github.com/schryer/publet --tag v0.2.2 publet-cli

publet-core 0.1.4

0.1.4 - 2026-10-28

Commit 48792bdcf53d; release record pub:sha2-256:wnhuk73crnxldph5bdstyla2zd3py6mtepiiaq45y3p534o7i6ma.

Security

• ed25519-dalek 3.0.0 and sha2 0.11 replace ed25519-dalek 2 and sha2 0.10, so block-buffer 0.10.4 (GHSA-qwgh-2vcv-g2f7) is no longer in publet-core's dependency tree; the public API, which takes and returns bytes, is unchanged, as are the signatures and identifiers it produces, and the MSRV stays 1.85

Internal

• TESTING.md is now generated by pubkit doc-coverage (pubkit 0.6.0) instead of tools/doc-coverage.py; only its header line changed
• Update other crates the supply-chain audits cover
• SUPPLY-CHAIN.md names pubunit among the organisations whose audits are imported, since the workspace now imports pubunit's
• Documentation: SECURITY.md says cargo deny, cargo vet and OSV-Scanner also run every night (it said advisory checks ran only when code changed), and names pubunit among the imported audit sets; verify's # Errors lists each error and when it is returned; its example shows where its seed comes from; the cid row of Related crates names the version checked (0.11.3)

Security checks

• advisories, licences, bans and sources: cargo deny --locked check --hide-inclusion-graph (cargo-deny 0.20.2) -- advisories ok, bans ok, licenses ok, sources ok
• supply-chain audits: cargo vet --locked (cargo-vet 0.10.2) -- Vetting Succeeded (68 fully audited, 4 partially audited, 157 exempted)
• supply-chain reports current: .venv/bin/pubkit supply-chain --check publet-core publet-algorithms (pubkit 0.9.1) -- SUPPLY-CHAIN.md current for publet-core, publet-algorithms
• quality audit current: .venv/bin/pubkit audit --check (pubkit 0.9.1) -- audit/publet-core-0.1.4.md: publet-core 0.1.4 audited on 2026-10-28 by Claude Code, following the rust-crate-quality agent (pubkit 0.14.0) against the current standard (bc3c5b6eeba4); 0 findings block
• RustSec advisory database revision: 40f5be6fb12ed93fc591bf4ab23b7d793b3f2239 (2026-10-28)
• audits imported from: bytecode-alliance, embark-studios, google, isrg, mozilla, pubunit, zcash

publet-algorithms 0.2.2

0.2.2 - 2026-10-28

Commit 927e6187bb3b; release record pub:sha2-256:2mxdnxn2hbxhdbe67sadtso63fqmhlii7dbd7pqsz6yxrqadbdfa.

Added

• The h3 module: H3 cell identifiers, validated as H3 does (mode, reserved bits, base cell, digits, and pentagons' deleted direction), with each cell's parent at a coarser resolution and whether one cell is inside another by identifier, without geometry or floating point; tested against vectors from h3-py 4.5.0

Security

• sha2 0.11 replaces sha2 0.10, so block-buffer 0.10.4 (GHSA-qwgh-2vcv-g2f7) is no longer in publet-algorithms' dependency tree; the Merkle log's hashes are unchanged, and the MSRV stays 1.85

Internal

• TESTING.md is now generated by pubkit doc-coverage (pubkit 0.6.0) instead of tools/doc-coverage.py; only its header line changed
• Update other crates the supply-chain audits cover
• SUPPLY-CHAIN.md names pubunit among the organisations whose audits are imported, since the workspace now imports pubunit's
• Documentation: SECURITY.md says cargo deny, cargo vet and OSV-Scanner also run every night (it said advisory checks ran only when code changed), and names pubunit among the imported audit sets
• Documentation: examples show their setup, and the docs state what panics, saturates, fails and costs (audit/publet-algorithms-0.2.2.md)

Security checks

• advisories, licences, bans and sources: cargo deny --locked check --hide-inclusion-graph (cargo-deny 0.20.2) -- advisories ok, bans ok, licenses ok, sources ok
• supply-chain audits: cargo vet --locked (cargo-vet 0.10.2) -- Vetting Succeeded (68 fully audited, 4 partially audited, 157 exempted)
• supply-chain reports current: .venv/bin/pubkit supply-chain --check publet-core publet-algorithms (pubkit 0.9.1) -- SUPPLY-CHAIN.md current for publet-core, publet-algorithms
• quality audit current: .venv/bin/pubkit audit --check (pubkit 0.9.1) -- audit/publet-algorithms-0.2.2.md: publet-algorithms 0.2.2 audited on 2026-10-28 by rust-crate-quality against the current standard (bc3c5b6eeba4); 0 findings block a release
• RustSec advisory database revision: 40f5be6fb12ed93fc591bf4ab23b7d793b3f2239 (2026-10-28)
• audits imported from: bytecode-alliance, embark-studios, google, isrg, mozilla, pubunit, zcash

publet-cli 0.2.1

0.2.1 - 2026-10-13

Commit a67aa89d7f93; release record pub:sha2-256:l3lwjvee3svhmkrla5crpndvorz5mioifpxcf77ojemjwz2lhrja.

Added

• pub sign --rotate --principal=P [--label=L] rotates the workspace's key as Section 10.5 says: a new key object with rotates naming the current key, signed by both keys for the purpose "rotation"; the old secret is kept under .publet/retired/ and author names the new key
• A key rotated from an object's author continues it: its supersedes is a revision, not a proposal, and heads the authoritative lineage (Graph::rotated_from, Graph::continues_key, ROTATION_PURPOSE)

Internal

• The published crates' SUPPLY-CHAIN.md is generated by pubkit 0.5.0's pubkit supply-chain, which replaces tools/supply-chain-report.py.
• TESTING.md is now generated by pubkit doc-coverage (pubkit 0.6.0) instead of tools/doc-coverage.py; only its header line changed

Security checks

• advisories, licences, bans and sources: cargo deny --locked check --hide-inclusion-graph (cargo-deny 0.20.2) -- advisories ok, bans ok, licenses ok, sources ok
• supply-chain audits: cargo vet --locked (cargo-vet 0.10.2) -- Vetting Succeeded (54 fully audited, 183 exempted)
• supply-chain reports current: .venv/bin/pubkit supply-chain --check publet-core publet-algorithms (pubkit 0.6.0) -- SUPPLY-CHAIN.md current for publet-core, publet-algorithms
• RustSec advisory database revision: 57dcc0f2192e025138907a495c1ac9a7e1e3e123 (2026-10-12)
• audits imported from: bytecode-alliance, embark-studios, google, isrg, mozilla, zcash

Install:

cargo install --locked --git https://github.com/schryer/publet --tag v0.2.1 publet-cli

publet-core 0.1.3

0.1.3 - 2026-10-11

Commit 469194c1ee31; release record pub:sha2-256:7suszdzxt3twcjanzp43rm5tyq7gs5et4p6mpffqngu5rseov63a.

Fixed

• The release's signed security record gives cargo deny's summary. 0.1.2's record gave a fragment of a cargo deny warning in its place, through a pubrel bug since fixed; the check itself passed.
• SUPPLY-CHAIN.md lists every dependency built for any target. It omitted libc and fiat-crypto, which are built only on some targets and were already vetted, and libc's exemption now records its evidence.

Internal

• The crates' include patterns are anchored with /, so a file of the same name deeper in a crate can never be packaged by accident; each package's contents are unchanged.

Security checks

• advisories, licences, bans and sources: cargo deny --locked check --hide-inclusion-graph (cargo-deny 0.20.2) -- advisories ok, bans ok, licenses ok, sources ok
• supply-chain audits: cargo vet --locked (cargo-vet 0.10.2) -- Vetting Succeeded (54 fully audited, 183 exempted)
• supply-chain reports current: .venv/bin/pubkit supply-chain --check publet-core publet-algorithms (pubkit 0.5.0) -- SUPPLY-CHAIN.md current for publet-core, publet-algorithms
• RustSec advisory database revision: 7eebec69c352c7191b1f13eb95dd510eeca5d1de (2026-10-09)
• audits imported from: bytecode-alliance, embark-studios, google, isrg, mozilla, zcash

publet-algorithms 0.2.1

0.2.1 - 2026-10-11

Commit e46cc0c4ba80; release record pub:sha2-256:452veuc3ttg5jn3umar3tbno23vgygpjfeiukcwgevubyk3kim3a.

Fixed

• SUPPLY-CHAIN.md lists every dependency built for any target. It omitted libc, which is built only on some targets and was already vetted, and libc's exemption now records its evidence.

Security checks

• advisories, licences, bans and sources: cargo deny --locked check --hide-inclusion-graph (cargo-deny 0.20.2) -- advisories ok, bans ok, licenses ok, sources ok
• supply-chain audits: cargo vet --locked (cargo-vet 0.10.2) -- Vetting Succeeded (54 fully audited, 183 exempted)
• supply-chain reports current: .venv/bin/pubkit supply-chain --check publet-core publet-algorithms (pubkit 0.5.0) -- SUPPLY-CHAIN.md current for publet-core, publet-algorithms
• RustSec advisory database revision: 7eebec69c352c7191b1f13eb95dd510eeca5d1de (2026-10-09)
• audits imported from: bytecode-alliance, embark-studios, google, isrg, mozilla, zcash

publet-cli 0.2.0

0.2.0 - 2026-10-09

Commit 7d6d6ef4d9e0; release record pub:sha2-256:semsjfm5mu3us7bpe3425f3sitwb7eg6ciredldw2vptm4xxiyuq.

Changed

• A render pipeline's tool requirement ^X.Y means what it means to Cargo: below 1.0 it admits only the same minor version (^0.1 admits 0.1.9, not 0.2.0).

Security

• pub compiles in three fixes found by fuzzing: the CBOR decoder no longer accepts null in a two-byte form (a second encoding and identifier for the same object), identifier parsing refuses non-zero base32 padding bits (many spellings of one identifier), and Merkle proof checking no longer loops forever, or panics (pub's release builds check overflow), on a log size above 2^63.

Internal

• graphset's code moved into the workspace as the publet-algorithms crate, and publet-merkle's re-exports were replaced by it; nothing pub does changed (every scenario passes, and the evaluation digest is unchanged).
• The graph traversals (publet-graph's cycle check, depends closure, equivalence classes and lineage walks, and pub build's topological sort) and the delta checkpoint schedule now share one implementation in publet-algorithms; their results are unchanged.
• Version requirement matching (^X.Y, X.Y+, prefixes) moved from pub render into publet-algorithms' version module, with Version parsing and bump arithmetic; pub render and pub env behave as before.
• publet-core and publet-algorithms are released on version tracks of their own; publet-core's manifest states its version instead of inheriting the workspace's.
• cargo-deny is stricter (0.20.2; unmaintained and unsound crates fail; crates.io only) and cargo-vet records supply-chain audits; nothing pub does changed.
• The published crates' documentation is reworked; a guard checks every public function has an example. Nothing pub does changed.
• Test vectors from independent sources, property tests, and two independent implementations as test oracles (ciborium for CBOR, ct-merkle for RFC 6962). Tests only; nothing users run changed.
• CI builds publet-core and publet-algorithms on their minimum Rust version, 1.85; nothing pub does changed.
• Each change to the public API of publet-core and publet-algorithms is checked against the crate's last release by cargo-semver-checks, and the crate docs gain a Versioning section saying so.
• tree::Node's docs say why it is exhaustive.
• The log's absurd-size regression tests also build and run on 32-bit targets.
• publet-algorithms checks proofs with u64 sizes on every target.
• The crates' include patterns are anchored with /, so a file of the same name deeper in a crate can never be packaged by accident; each package's contents are unchanged.

Security checks

• advisories, licences, bans and sources: cargo deny --locked check --hide-inclusion-graph (cargo-deny 0.20.2) -- advisories ok, bans ok, licenses ok, sources ok
• supply-chain audits: cargo vet --locked (cargo-vet 0.10.2) -- Vetting Succeeded (54 fully audited, 183 exempted)
• supply-chain reports current: ./tools/supply-chain-report.py --check && echo 'SUPPLY-CHAIN.md current for every published crate' -- SUPPLY-CHAIN.md current for every published crate
• RustSec advisory database revision: 7eebec69c352c7191b1f13eb95dd510eeca5d1de (2026-10-09)
• audits imported from: bytecode-alliance, embark-studios, google, isrg, mozilla, zcash

Install:

cargo install --locked --git https://github.com/schryer/publet --tag v0.2.0 publet-cli

publet-algorithms 0.2.0

0.2.0 - 2026-10-09

Commit e97457ef710d; release record pub:sha2-256:tke3fnms5df4yjwuipdnhk323syslmiqyreokre5fn4wfqzmdypq.

Changed

• version::satisfies reads ^X.Y as Cargo does: below 1.0 the minor part is fixed, so ^0.1 no longer admits 0.3.2. Version and Bump are removed; release arithmetic belongs to the semver crate.
• log::verify_inclusion and log::verify_consistency take sizes and indexes as u64, and membership::Proof carries them as u64, on every target. They come with proofs from peers, whose logs and sets may be larger than a 32-bit or wasm32 machine's usize; a verifier there can now check them. The functions that build proofs keep usize, as they index leaves in memory.

Fixed

• The crate ships what distribution needs: the Apache-2.0 licence text, crates.io metadata, an include list, and documentation with examples run as doctests, including the crates considered instead and why.
• The package ships SUPPLY-CHAIN.md: every dependency, whether it runs code at build time, and how its code is vouched for (an imported audit, a trusted publisher, or an exemption with the evidence beside it).
• Every public function's documentation has an example run as a test, the crate root has an overview, a cookbook and why this crate exists, and docs.rs renders how every item is tested, how each dependency is vouched for, the security policy and the changelog.
• The crate declared Rust 1.98, the toolchain publet is developed with, though it builds on 1.85, the first release with the 2024 edition. It now declares 1.85, and CI builds it there. docs.rs links the rendered source to definitions.

Security

• Merkle log proof checking looped forever on a proof claiming more than 2^63 entries, and a consistency proof between sizes above 2^63 shifted a u64 by 64 bits, panicking where overflow is checked; either let a peer stop anyone checking its proofs. Both are fixed. Found by fuzzing.

Internal

• Test vectors from independent sources, property tests, and two independent implementations as test oracles (ciborium for CBOR, ct-merkle for RFC 6962). Tests only; nothing users run changed.
• Each change to the public API of publet-core and publet-algorithms is checked against the crate's last release by cargo-semver-checks, and the crate docs gain a Versioning section saying so.
• tree::Node's docs say why it is exhaustive.
• The log's absurd-size regression tests also build and run on 32-bit targets.
• The crates' include patterns are anchored with /, so a file of the same name deeper in a crate can never be packaged by accident; each package's contents are unchanged.

Security checks

• advisories, licences, bans and sources: cargo deny --locked check --hide-inclusion-graph (cargo-deny 0.20.2) -- advisories ok, bans ok, licenses ok, sources ok
• supply-chain audits: cargo vet --locked (cargo-vet 0.10.2) -- Vetting Succeeded (54 fully audited, 183 exempted)
• supply-chain reports current: ./tools/supply-chain-report.py --check && echo 'SUPPLY-CHAIN.md current for every published crate' -- SUPPLY-CHAIN.md current for every published crate
• RustSec advisory database revision: 7eebec69c352c7191b1f13eb95dd510eeca5d1de (2026-10-09)
• audits imported from: bytecode-alliance, embark-studios, google, isrg, mozilla, zcash

publet-core 0.1.2

0.1.2 - 2026-10-08

Commit 435f26eb0e99; release record pub:sha2-256:m7jrr3wf5gg3owwgpibtldj3w56324gac4qcv4pldvunw4tvh25a.

Fixed

• The crate ships what distribution needs: the Apache-2.0 licence text, crates.io metadata, an include list, and documentation with examples run as doctests, including the crates considered instead and why.
• The package ships SUPPLY-CHAIN.md: every dependency, whether it runs code at build time, and how its code is vouched for (an imported audit, a trusted publisher, or an exemption with the evidence beside it).
• Every public function's documentation has an example run as a test, the crate root has an overview, a cookbook and why this crate exists, and docs.rs renders how every item is tested, how each dependency is vouched for, the security policy and the changelog.
• The crate declared Rust 1.98, the toolchain publet is developed with, though it builds on 1.85, the first release with the 2024 edition. It now declares 1.85, and CI builds it there. docs.rs links the rendered source to definitions.

Security

• The CBOR decoder accepted a simple value below 32 in the two-byte form (null as f8 16), giving the same object a second encoding and a second identifier; it is now refused as not shortest form. Identifier parsing ignored the base32 padding bits after the digest, so one identifier had many spellings; non-zero padding bits are now refused. Both found by fuzzing.

Internal

• Test vectors from independent sources, property tests, and two independent implementations as test oracles (ciborium for CBOR, ct-merkle for RFC 6962). Tests only; nothing users run changed.
• Each change to the public API of publet-core and publet-algorithms is checked against the crate's last release by cargo-semver-checks, and the crate docs gain a Versioning section saying so.

Security checks

• advisories, licences, bans and sources: cargo deny --locked check --hide-inclusion-graph (cargo-deny 0.20.2) -- │ ╰────────────────────────────────────────────────────────────────────────┘ lock entries
• supply-chain audits: cargo vet --locked (cargo-vet 0.10.2) -- Vetting Succeeded (54 fully audited, 183 exempted)
• supply-chain reports current: ./tools/supply-chain-report.py --check && echo 'SUPPLY-CHAIN.md current for every published crate' -- SUPPLY-CHAIN.md current for every published crate
• RustSec advisory database revision: 5701a6d2a6158d5d4a933df5141a0415c285075d (2026-10-08)
• audits imported from: bytecode-alliance, embark-studios, google, isrg, mozilla, zcash