libmagic-rs

Met. All releases are permanently available via crates.io and GitHub Releases. Git tags are immutable. Users can pin any version in Cargo.toml. Breaking changes will be documented in release notes generated by git-cliff, and the v1.0 milestone includes a migration guide.

The project uses GitHub issues to allow users to submit and track issue reports. (https://github.com/EvilBit-Labs/libmagic-rs/issues)

N/A. No vulnerabilities have been reported or resolved. The project's SECURITY.md documents the policy to credit reporters in advisories (unless they prefer anonymity).

URL: https://github.com/EvilBit-Labs/libmagic-rs/blob/main/SECURITY.md

Met. SECURITY.md documents the full response process: acknowledgment within 1 week, initial assessment within 2 weeks, fix target within 90 days, coordinated disclosure via GitHub Security Advisories, and reporter credit.

URL: https://github.com/EvilBit-Labs/libmagic-rs/blob/main/SECURITY.md#what-to-expect

Met. Documented in CONTRIBUTING.md (style guidelines, rustfmt config, naming conventions) and enforced by cargo fmt and cargo clippy -- -D warnings in CI.

URL: https://github.com/EvilBit-Labs/libmagic-rs/blob/main/CONTRIBUTING.md#style-guidelines

Met. cargo fmt --check and cargo clippy -- -D warnings enforce style in CI and pre-commit hooks. PRs that fail either check cannot merge.

Met. Cargo/rustc honors standard environment variables: RUSTFLAGS, CARGO_BUILD_RUSTFLAGS, CC, AR, CFLAGS (for C dependencies via cc crate), and linker configuration via CARGO_TARGET_*_LINKER. The build system extends but does not replace provided values.

Met. Cargo preserves debug info by default in dev/debug builds. Release builds strip debug info per profile configuration in Cargo.toml, but users can override with RUSTFLAGS="-g" or [profile.release] debug = true. The build system never force-strips symbols.

N/A. Cargo manages the dependency graph and build order automatically. There are no recursive subdirectory builds -- Cargo resolves all cross-dependencies at the workspace level.

Met. Reproducible builds are supported through pinned Rust toolchain (rust-toolchain.toml, version 1.91.0), committed Cargo.lock and mise.lock, and cargo-dist building releases in
defined CI environments with Sigstore build provenance attestations.

URL: https://github.com/EvilBit-Labs/libmagic-rs/blob/main/Cargo.lock

Met. Multiple standard installation methods:

• cargo install libmagic-rs (Rust ecosystem standard)
• brew install EvilBit-Labs/tap/rmagic (Homebrew)
• Shell installer script via cargo-dist releases
• Pre-built binaries on GitHub Releases for all major platforms

Met. cargo install honors CARGO_HOME and CARGO_INSTALL_ROOT for installation path. The dist-workspace.toml sets install-path = "CARGO_HOME" as the default. Homebrew follows its own standard prefix conventions (/opt/homebrew, /usr/local).

Met. Single command: just setup (runs mise install), which installs the pinned Rust toolchain and all 30+ dev tools from mise.toml. Then cargo test runs the full test suite.

URL: https://github.com/EvilBit-Labs/libmagic-rs/blob/main/CONTRIBUTING.md#quick-start

Met. Cargo.toml lists all dependencies in a standardized, machine-readable format that Cargo, cargo audit, cargo deny, and Dependabot all consume automatically.

URL: https://github.com/EvilBit-Labs/libmagic-rs/blob/main/Cargo.toml

Met. Multiple layers of automated dependency monitoring:

• cargo audit runs daily via the Security workflow and on every push
• cargo deny checks dependency licenses and advisories
• Dependabot is configured for automated dependency update PRs
• GitHub's built-in dependency graph and secret scanning are enabled

URL: https://github.com/EvilBit-Labs/libmagic-rs/blob/main/.github/workflows/security.yml

Met. All external dependencies are managed through Cargo's standard package management. Updating a vulnerable dependency is a single cargo update command. Dependabot automates this with PRs for outdated or vulnerable dependencies.

Met. cargo clippy with -D warnings and pedantic lints flags deprecated APIs and obsolete patterns. The project uses Rust edition 2024 and keeps dependencies current via Dependabot.

Met. GitHub Actions CI runs the full test suite on every push and PR to main. Results are reported as commit status checks and must pass before merging.

URL: https://github.com/EvilBit-Labs/libmagic-rs/blob/main/.github/workflows/ci.yml

Met. No bugs have been filed against the project (zero issues labeled "bug"). All development has been feature work, and each feature PR includes comprehensive tests. When bugs are found during development, they are fixed with accompanying tests in the same PR.

Met. 94.32% line coverage measured by cargo llvm-cov.

URL: https://github.com/EvilBit-Labs/libmagic-rs/blob/main/.github/workflows/ci.yml

Met. CONTRIBUTING.md mandates "Add tests for new functionality" in the PR process, and AGENTS.md states "All code changes must include comprehensive tests." CI enforces a coverage threshold gate via just coverage-check.

URL: https://github.com/EvilBit-Labs/libmagic-rs/blob/main/CONTRIBUTING.md

Met. Documented in CONTRIBUTING.md under the Pull Request Process: "Add tests for new functionality" (line 237), with a full Writing Tests section (lines 145-174) providing guidance on test structure, placement, and expectations.

URL: https://github.com/EvilBit-Labs/libmagic-rs/blob/main/CONTRIBUTING.md

Met. Zero warnings. The CI enforces -D warnings which treats all warnings as errors -- the build fails if any warning exists. The project currently passes with zero clippy warnings across the entire codebase.

Met. The project implements secure design principles throughout:

• Economy of mechanism: Pure Rust, minimal dependencies, simple parser-evaluator architecture
• Fail-safe defaults: #![forbid(unsafe_code)], bounds-checked buffer access via .get()
• Complete mediation: All file input validated before processing, magic file syntax validated before parsing
• Open design: Open source, no security through obscurity
• Least privilege: Read-only file access for evaluation, no network or filesystem writes
• Input validation with allowlists: Parser accepts only known-valid magic file syntax
• Limited attack surface: CLI tool with no network exposure, no IPC, no plugins

URL: https://github.com/EvilBit-Labs/libmagic-rs/blob/main/SECURITY.md

Met. All release artifacts are cryptographically signed via Sigstore keyless signing through GitHub Attestations (github-attestations = true in dist-workspace.toml). Private keys are ephemeral and never stored on distribution infrastructure. Users can verify with gh attestation verify <artifact> --repo EvilBit-Labs/libmagic-rs. The verification process is documented in the README and a detailed guide in the project documentation.
URL: https://github.com/EvilBit-Labs/libmagic-rs/blob/main/README.md#verifying-releases

Met. Git is configured with tag.gpgSign = true, ensuring all version tags are GPG-signed. Both maintainers use YubiKey hardware security keys for signing. Release artifacts are additionally attested via Sigstore through GitHub Attestations.

Met. The library validates all external inputs: magic file syntax is validated during parsing (invalid rules are rejected with descriptive errors), file buffers are bounds-checked on every access via .get(), offset specifications are validated before evaluation, and malformed/truncated files are handled gracefully without panics. The CLI validates arguments via clap. The project does not accept arbitrary user data that would require allowlisting -- it processes structured magic rules and binary file contents, both of which are validated at their respective entry points.

Met. The project employs multiple hardening mechanisms:

• #![forbid(unsafe_code)] -- eliminates entire classes of memory vulnerabilities at compile time
• Rust's ownership/borrowing system -- prevents use-after-free, double-free, and data races
• Bounds-checked buffer access via .get() methods -- prevents buffer overflows
• cargo clippy -- -D warnings with pedantic lints -- catches undefined behavior patterns
• Release builds include Rust's default hardening: stack unwinding on panic, integer overflow checks in debug mode
• cargo-auditable embeds dependency metadata for post-deployment vulnerability scanning
• All dependencies audited via cargo audit and cargo deny

URL: https://github.com/EvilBit-Labs/libmagic-rs/blob/main/src/lib.rs

Met. The project provides a formal security assurance case as Appendix E of the project documentation, covering: threat model with identified actors and attack vectors, trust boundary diagram, mapping of all eight Saltzer and Schroeder secure design principles to implementation, CWE/SANS Top 25 countermeasures, OWASP Top 10 applicability analysis, and supply chain security measures. The document is maintained as a living document updated alongside feature development.
URL: https://evilbitlabs.io/libmagic-rs/security-assurance.html

Met. CodeQL specifically targets common vulnerabilities (injection, buffer overflows, insecure data handling). cargo audit checks dependencies against the RustSec Advisory Database for known CVEs. Clippy includes correctness lints that catch potential undefined behavior and unsafe patterns.

N/A. The project is pure Rust with #![forbid(unsafe_code)]. No memory-unsafe languages are used.