c2pa-fonts

gh repo view writerslogic/c2pa-fonts reports visibility=PUBLIC, isPrivate=false, at https://github.com/writerslogic/c2pa-fonts.

Git repository; git log --format='%an <%ae> %ad' shows author, email, and date for every commit (e.g. David Condrey davidcondrey@me.com, dependabot[bot]).

34 commits exist between the two tagged releases v0.2.0 (2026-07-13) and v0.3.0 (2026-08-03), and further interim commits after v0.3.0 up to 343a144 (2026-08-22); not squashed to release-only commits.

Repository uses git, a distributed VCS (.git/ directory present, git remote origin git@github.com:writerslogic/c2pa-fonts.git).

Cargo.toml version = "0.3.0"; git tags v0.2.0 and v0.3.0 correspond to distinct, unique released versions on crates.io per the README crates.io badge.

Version 0.3.0 and tags v0.2.0/v0.3.0 follow strict SemVer (MAJOR.MINOR.PATCH), consistent with Cargo/crates.io convention.

git tag lists v0.2.0 and v0.3.0, matching Cargo.toml history and GitHub Releases (gh release list shows both).

No publicly known vulnerabilities have been fixed in any release to date (gh api .../security-advisories returns an empty list, no CVEs associated with this project); N/A per criterion.

GitHub Issues (has_issues=true) is the issue tracker used for individual bug/feature items, evidenced by .github/ISSUE_TEMPLATE/ configs.

GitHub Issues provides a public, searchable, permanently archived history of reports and responses at https://github.com/writerslogic/c2pa-fonts/issues.

SECURITY.md documents the process: GitHub Security Advisories (https://github.com/writerslogic/c2pa-fonts/security/advisories/new) or email admin@writerslogic.com; linked from README.md '## Security' section.

No vulnerability reports have been received (gh api .../security-advisories returns an empty list; no security-advisory GitHub issues found); N/A per criterion, no reports to measure response time against.

Standard Cargo build: cargo build (documented in CONTRIBUTING.md and README.md); .github/workflows/ci.yml runs cargo check --all-features on every push/PR, and release.yml builds crates.io/wasm/PyO3 artifacts.

Uses Cargo, the standard Rust build tool, plus wasm-bindgen/wasm-pack and maturin for the wasm and Python bindings respectively — all conventional tools for this language ecosystem.

Cargo, rustc, wasm-bindgen, and maturin are all FLOSS; no proprietary build tool is required (verified via Cargo.toml dependencies and .github/workflows/*.yml build steps).

FLOSS test suite: unit tests embedded in src/*.rs (#[cfg(test)] modules in reader.rs, sfnt.rs, table.rs, writer.rs, verify.rs, error.rs) plus tests/roundtrip.rs integration test. CONTRIBUTING.md documents cargo test and cargo test --all-features to run them.

Tests are run with the standard cargo test invocation for Rust, as documented in CONTRIBUTING.md and executed identically in .github/workflows/ci.yml.

grep -c '#[test]' across src/*.rs and tests/roundtrip.rs shows tests in every core module (sfnt.rs: 9, writer.rs: 11, table.rs: 6, reader.rs: 4, verify.rs: 4, error.rs: 2) plus a real-font round-trip integration test (tests/roundtrip.rs, 169 lines) covering embed/reserve/fill/validate against actual .ttf/.otf files installed in CI (ci.yml installs fonts-dejavu-core, fonts-freefont-otf).

.github/workflows/ci.yml 'test' job runs cargo test and cargo test --features validation on every push to main and every pull request.

CONTRIBUTING.md 'Submitting Changes' step 2 explicitly instructs contributors to 'Make changes, add tests, run cargo test --all-features.'

Recent commits show tests accompanying functional changes, e.g. commit 42e1d64 'feat: uniform Error::code, verified MSRV, and integration tests' added tests/roundtrip.rs alongside the feature.

CONTRIBUTING.md documents the test-addition policy directly in the contribution instructions (step 2 of 'Submitting Changes').

.github/workflows/ci.yml runs cargo clippy --all-features -- -D warnings (Rust's standard FLOSS linter) and cargo fmt --all -- --check on every push/PR; src/lib.rs also sets #![warn(missing_docs)] and #![forbid(unsafe_code)].

CI enforces clippy -- -D warnings, which fails the build on any warning, so warnings cannot merge unaddressed; current main (commit 343a144) passes CI per the README CI badge.

clippy is run with -D warnings (deny, the strictest common setting) across --all-features, plus #![forbid(unsafe_code)] and #![warn(missing_docs)] in src/lib.rs for additional strictness beyond default lints.

src/lib.rs:24 #![forbid(unsafe_code)] rules out memory-unsafe code by construction. SECURITY.md's Supply-chain security section documents mitigations for common attack classes: GitHub Actions pinned to full commit SHAs (against tag-mutation attacks), OpenSSF Scorecard, Dependency Review, and Dependabot running in CI, and build provenance on releases where the registry supports it.

SECURITY.md's Supply-chain security section documents specific mitigations for common attack classes: GitHub Actions pinned to full commit SHAs (against tag-mutation attacks), OpenSSF Scorecard, Dependency Review, and Dependabot running in CI to catch known-vulnerable dependencies, and build provenance on releases.

This crate implements no cryptography itself; it only embeds/extracts opaque C2PA manifest bytes. Signature verification is delegated to the optional c2pa crate (Cargo.toml: c2pa = { version = "0.89", features = ["rust_native_crypto"] }), which is out of this repo's scope.

No cryptographic operations are performed in this crate's own code; all COSE/X.509 crypto is delegated to the external c2pa crate via the optional 'validation' feature (see README.md 'What this crate does — and does not' table, steps 3-4 owned by c2pa-rs).

No cryptography is implemented in this repository.

No cryptographic key generation or key-length defaults exist in this repository; delegated entirely to the optional c2pa dependency.

No cryptographic algorithm selection occurs in this repository's code.

No cryptographic algorithm selection occurs in this repository's code.

This crate performs no key agreement or network handshake; not applicable.

This crate has no authentication or password-storage functionality; it is a font-file manipulation library.

This crate generates no cryptographic keys or nonces; not applicable.

Package is distributed via crates.io, npm, and PyPI, all served over HTTPS; the GitHub source repo is cloned over https/ssh. No plain-http distribution channel exists (verified via README.md install instructions).

No hash-only integrity check delivered over plain HTTP is used; distribution is exclusively via HTTPS-backed registries (crates.io, npm, PyPI) and .github/workflows/release.yml uses actions/attest-build-provenance for build provenance attestation rather than a bare unsigned hash.

gh api repos/writerslogic/c2pa-fonts/security-advisories returns an empty list and gh api .../vulnerability-alerts returns HTTP 204 (Dependabot security alerts enabled); no known unpatched medium+ vulnerability has been reported against this project. Dependabot (.github/dependabot.yml) files weekly dependency-update PRs and several have already been merged promptly (e.g. PR #7 'Aikido AI Fix for 3rd party Github Actions should be pinned', merged 2026-08-03, and commit 46ef9bd 'ci(security): pin actions by SHA and drop GITHUB_TOKEN to read').

No critical vulnerability has been reported against this project to date (empty security-advisories list); the one security-flagged finding on record (unpinned third-party GitHub Actions, PR #7) was fixed the same day it was raised (2026-08-03), evidencing a fast response pattern.

git log -p --all | grep -iE 'AKIA|BEGIN (RSA|EC|OPENSSH) PRIVATE KEY|api[_-]?key|secret' across full history returned no matches. release.yml documents required secrets (CARGO_REGISTRY_TOKEN, NPM_TOKEN) as GitHub Actions repository secrets, not committed values.

clippy (a FLOSS static analysis tool for Rust) is run in .github/workflows/ci.yml on --all-features before merge, and again as part of release.yml's validate/gate job before every tagged release.

clippy's default and pedantic lint groups include checks for common correctness/soundness issues (e.g. arithmetic overflow patterns, indexing panics via clippy::indexing_slicing when enabled, suspicious casts); combined with #![forbid(unsafe_code)] in src/lib.rs eliminating the memory-unsafety class outright, and OpenSSF Scorecard (.github/workflows/scorecard.yml) additionally analyzing the repo for supply-chain risk patterns.

CI runs clippy with -D warnings, which blocks merge on any finding, so medium+ findings cannot land unaddressed; commit cde4c7a 'chore: harden lints, docs, and CI' shows lint findings being fixed directly.

.github/workflows/ci.yml runs clippy on every push to main and every pull request (not just before releases), satisfying 'every commit'.

A cargo-fuzz target (fuzz/fuzz_targets/parse_untrusted.rs) drives the crate's untrusted-input parsers with libFuzzer; fuzz/README.md documents how to run it.

src/lib.rs declares #![forbid(unsafe_code)] and grep -rn unsafe src/*.rs finds only that one forbid directive; no memory-unsafe (C/C++) code exists in this crate, so dynamic memory-safety tooling is not applicable.

The fuzz target builds with cargo-fuzz's default dev profile, which enables debug assertions and overflow checks, so Rust's integer-overflow and bounds checks act as assertions during fuzzing.

No dynamic analysis tool is run against this project, so there are no dynamic-analysis findings to have fixed or left unfixed.