publet-cli 0.2.0

0.2.0 - 2026-10-09

Commit 7d6d6ef4d9e0; release record pub:sha2-256:semsjfm5mu3us7bpe3425f3sitwb7eg6ciredldw2vptm4xxiyuq.

Changed

• A render pipeline's tool requirement ^X.Y means what it means to Cargo: below 1.0 it admits only the same minor version (^0.1 admits 0.1.9, not 0.2.0).

Security

• pub compiles in three fixes found by fuzzing: the CBOR decoder no longer accepts null in a two-byte form (a second encoding and identifier for the same object), identifier parsing refuses non-zero base32 padding bits (many spellings of one identifier), and Merkle proof checking no longer loops forever, or panics (pub's release builds check overflow), on a log size above 2^63.

Internal

• graphset's code moved into the workspace as the publet-algorithms crate, and publet-merkle's re-exports were replaced by it; nothing pub does changed (every scenario passes, and the evaluation digest is unchanged).
• The graph traversals (publet-graph's cycle check, depends closure, equivalence classes and lineage walks, and pub build's topological sort) and the delta checkpoint schedule now share one implementation in publet-algorithms; their results are unchanged.
• Version requirement matching (^X.Y, X.Y+, prefixes) moved from pub render into publet-algorithms' version module, with Version parsing and bump arithmetic; pub render and pub env behave as before.
• publet-core and publet-algorithms are released on version tracks of their own; publet-core's manifest states its version instead of inheriting the workspace's.
• cargo-deny is stricter (0.20.2; unmaintained and unsound crates fail; crates.io only) and cargo-vet records supply-chain audits; nothing pub does changed.
• The published crates' documentation is reworked; a guard checks every public function has an example. Nothing pub does changed.
• Test vectors from independent sources, property tests, and two independent implementations as test oracles (ciborium for CBOR, ct-merkle for RFC 6962). Tests only; nothing users run changed.
• CI builds publet-core and publet-algorithms on their minimum Rust version, 1.85; nothing pub does changed.
• Each change to the public API of publet-core and publet-algorithms is checked against the crate's last release by cargo-semver-checks, and the crate docs gain a Versioning section saying so.
• tree::Node's docs say why it is exhaustive.
• The log's absurd-size regression tests also build and run on 32-bit targets.
• publet-algorithms checks proofs with u64 sizes on every target.
• The crates' include patterns are anchored with /, so a file of the same name deeper in a crate can never be packaged by accident; each package's contents are unchanged.

Security checks

• advisories, licences, bans and sources: cargo deny --locked check --hide-inclusion-graph (cargo-deny 0.20.2) -- advisories ok, bans ok, licenses ok, sources ok
• supply-chain audits: cargo vet --locked (cargo-vet 0.10.2) -- Vetting Succeeded (54 fully audited, 183 exempted)
• supply-chain reports current: ./tools/supply-chain-report.py --check && echo 'SUPPLY-CHAIN.md current for every published crate' -- SUPPLY-CHAIN.md current for every published crate
• RustSec advisory database revision: 7eebec69c352c7191b1f13eb95dd510eeca5d1de (2026-10-09)
• audits imported from: bytecode-alliance, embark-studios, google, isrg, mozilla, zcash

Install:

cargo install --locked --git https://github.com/schryer/publet --tag v0.2.0 publet-cli