libmagic-rs

Repository on GitHub, which provides public git repositories with URLs.

Repository on GitHub, which uses git. git can track the changes, who made them, and when they were made.

All development happens on feature branches with pull requests reviewed before merging to main. The full commit history and interim development state is preserved in the repository. Releases are tagged separately via cargo-dist.

Repository on GitHub, which uses git. git is distributed.

We use SemVer. Each release gets a unique vX.Y.Z git tag. cargo-dist automates release creation from tags, and crates.io enforces version uniqueness. No two releases can share the same version string.

We use git tags that match the SemVer number (e.g. "v1.2.0").

Release notes are provided via GitHub Releases, generated by cargo-dist during the automated release workflow. Each release includes a human-readable announcement title and body summarizing the changes, not raw git log output. The project has not yet published its first release (v0.1.0 is forthcoming), but the release infrastructure is fully configured and tested. (https://github.com/EvilBit-Labs/libmagic-rs/releases)

The release notes mechanism uses both GitHub Releases, with cargo-dist generated change information, as well as git-cliff. All commits are in Conventional Commit format and the CHANGELOG is organized by type (bug, feature, etc.)

The project uses GitHub issues to allow users to submit public bug reports. (https://github.com/EvilBit-Labs/libmagic-rs/issues)

The project uses GitHub issues to allow users to submit and track issue reports. (https://github.com/EvilBit-Labs/libmagic-rs/issues)

The project currently has zero bug reports filed. All 57 issues are feature requests, enhancements, or documentation tasks -- all acknowledged and triaged. The project is in early development (pre-v0.1.0), so the absence of bug reports is expected. The single maintainer actively responds to all issues.

The project currently has zero bug reports filed. All 57 issues are feature requests, enhancements, or documentation tasks -- all acknowledged and triaged. The project is in early development (pre-v0.1.0), so the absence of bug reports is expected. The single maintainer actively responds to all issues.

All issues are tracked via GitHub issues, which is public and searchable (https://github.com/EvilBit-Labs/libmagic-rs/issues)

The project publishes a comprehensive security policy with multiple reporting channels: GitHub's private vulnerability reporting (enabled), email (security@evilbitlabs.com), and GitHub Security Advisories. Public issues are explicitly discouraged for vulnerabilities. (https://raw.githubusercontent.com/EvilBit-Labs/libmagic-rs/refs/heads/main/SECURITY.md)

The project publishes a comprehensive security policy with multiple reporting channels: GitHub's private vulnerability reporting (enabled), email (security@evilbitlabs.com), and GitHub Security Advisories. Public issues are explicitly discouraged for vulnerabilities. (https://raw.githubusercontent.com/EvilBit-Labs/libmagic-rs/refs/heads/main/SECURITY.md)

While the project has a published process, there have been no vulnerability reports received in the last 6 months.

Standard Rust/Cargo build system.

The project uses Cargo, Rust's standard build system and package manager. cargo build compiles the project from source, automatically resolving and fetching dependencies from crates.io. cargo install --path . builds and installs the rmagic CLI binary. The project also uses cargo-dist for cross-platform release builds.

Cargo is the standard build tool for Rust -- equivalent to Maven for Java or npm for Node.js. No custom build tooling.

Cargo is the standard build tool for Rust. It is dual licensed under MIT and Apache-2.0.

https://github.com/EvilBit-Labs/libmagic-rs/blob/main/justfile

The project has 1,058+ automated tests run via cargo nextest (a FLOSS test runner). Tests are documented in the justfile (just test, just test-all, just test-compatibility) and run automatically in CI via GitHub Actions on every push and PR. The CI workflow is publicly visible at .github/workflows/ci.yml. Test coverage is 94%+ measured by cargo llvm-cov.

Test suite is triggered by standard cargo commands (i.e. cargo bench, cargo test) but also uses just as a task runner for simple just test.

https://evilbitlabs.io/libmagic-rs/testing-guidelines.html

Met. 94.32% line coverage measured by cargo llvm-cov. The test suite includes unit tests, integration tests, compatibility tests against the original libmagic test corpus, and doc tests.

Met. GitHub Actions CI runs on every push and PR. The pipeline includes build, clippy linting, formatting checks, test execution via cargo nextest, CodeQL analysis, and compatibility tests across Ubuntu, macOS, and Windows.

URL: https://github.com/EvilBit-Labs/libmagic-rs/blob/main/.github/workflows/ci.yml

Met. The project's AGENTS.md requires "All code changes must include comprehensive tests" with a >85% coverage target. The CONTRIBUTING.md reinforces this in the PR process: "Add tests for new functionality." CI enforces a coverage threshold gate.

Met. Every merged PR in the project's history includes tests alongside new functionality. For example:

• PR #31 (Test Infrastructure) added compatibility tests and coverage infrastructure
• PR #29 (Evaluation Enhancements) added confidence scoring, MIME, tags -- with tests
• PR #28 (Built-in Rules) added build-time compilation -- with tests
• PR #27 (CLI Enhancements) added multi-file/stdin support -- with tests
• PR #16 (Text Magic Parser) added parser -- with tests

The project currently has 1,058+ tests at 94.32% line coverage, demonstrating consistent test addition with each feature.

URL: https://github.com/EvilBit-Labs/libmagic-rs/pulls?q=is%3Apr+is%3Amerged

Met. Documented in CONTRIBUTING.md under the Pull Request Process: "Add tests for new functionality" (line 237), with a full Writing Tests section (lines 145-174) providing guidance on test structure, placement, and expectations.

URL: https://github.com/EvilBit-Labs/libmagic-rs/blob/main/CONTRIBUTING.md

Met. The project enforces multiple layers:

• cargo clippy -- -D warnings (all warnings treated as errors) in CI and locally
• Clippy pedantic lints are active
• #![forbid(unsafe_code)] enforced in the crate
• cargo fmt --check for formatting consistency
• cargo deny for dependency license/security linting
• actionlint for GitHub Actions workflow linting

URL: https://github.com/EvilBit-Labs/libmagic-rs/blob/main/.github/workflows/ci.yml

Met. Zero warnings. The CI enforces -D warnings which treats all warnings as errors -- the build fails if any warning exists. The project currently passes with zero clippy warnings across the entire codebase.

Met. Zero warnings. The CI enforces -D warnings which treats all warnings as errors -- the build fails if any warning exists. The project currently passes with zero clippy warnings across the entire codebase.

Met. Both primary developers hold CISSP certifications and Master's degrees in Cybersecurity. The project reflects secure design principles in practice: economy of mechanism (pure Rust, minimal dependencies), fail-safe defaults (#![forbid(unsafe_code)]), input validation (bounds-checked buffer access), and limited attack surface (no network exposure, read-only file evaluation).

The primary developer has decades of experience developing secure software for high-security, government, and military environments

Met. Multiple layers:

• Source code delivered via GitHub over HTTPS/SSH
• Releases built by GitHub Actions with build provenance attestations (actions/attest-build-provenance)
• Crate published to crates.io over HTTPS
• Dependencies fetched by Cargo over HTTPS from crates.io
• Homebrew formula delivered via the tap repository over HTTPS

URL: https://github.com/EvilBit-Labs/libmagic-rs

N/A. The project doesn't retrieve or verify cryptographic hashes over HTTP. All dependency resolution is handled by Cargo over HTTPS, and release artifacts include build provenance attestations via Sigstore.

Met. Zero known vulnerabilities. cargo audit and cargo deny run daily in CI via the Security workflow, and on every push. No CVEs have been filed against the project. Dependabot is configured for automated dependency updates.

URL: https://github.com/EvilBit-Labs/libmagic-rs/blob/main/.github/workflows/security.yml

Met. No critical vulnerabilities have been reported. The project has a documented security policy with response timelines (1 week acknowledgment, 2 weeks assessment, 90 days fix target), private vulnerability reporting enabled, and automated dependency scanning running daily.

URL: https://github.com/EvilBit-Labs/libmagic-rs/blob/main/SECURITY.md

Met. GitHub secret scanning and push protection are both enabled on the repository. No credentials are stored in the codebase. The .gitignore excludes sensitive files. Pre-commit hooks check for common credential patterns.

URL: https://github.com/EvilBit-Labs/libmagic-rs/settings/security_analysis (visible to repo admins)

Met. Multiple static analysis tools run on every PR and pre-release:

• Clippy (beyond compiler warnings -- includes hundreds of lint rules for correctness, complexity, performance, and style)
• CodeQL via GitHub Actions for semantic security analysis
• cargo audit for known vulnerability detection in dependencies
• cargo deny for dependency license and security policy enforcement
• cargo machete for unused dependency detection
• OSSF Scorecard for supply chain security analysis

URL: https://github.com/EvilBit-Labs/libmagic-rs/blob/main/.github/workflows/ci.yml

Met. CodeQL specifically targets common vulnerabilities (injection, buffer overflows, insecure data handling). cargo audit checks dependencies against the RustSec Advisory Database for known CVEs. Clippy includes correctness lints that catch potential undefined behavior and unsafe patterns.

Met. CI enforces cargo clippy -- -D warnings (zero tolerance) and CodeQL runs on every push. Both block merging if issues are found. No outstanding static analysis findings exist.

URL: https://github.com/EvilBit-Labs/libmagic-rs/blob/main/.github/workflows/ci.yml

Met. CI enforces cargo clippy -- -D warnings (zero tolerance) and CodeQL runs on every push.

URL: https://github.com/EvilBit-Labs/libmagic-rs/blob/main/.github/workflows/ci.yml

Met. The project uses cargo test and cargo nextest which exercise code at runtime, including property-based fuzz testing via proptest that generates randomized inputs to probe for runtime failures. cargo llvm-cov instruments runtime execution for coverage analysis.

N/A. The project is pure Rust with #![forbid(unsafe_code)]. No memory-unsafe languages are used.

Met. Debug assertions are enabled by default in cargo test and cargo nextest builds (Rust's standard behavior). debug_assert! macros are active during testing but compiled out in release builds. Property-based tests via proptest generate randomized inputs that exercise assertion paths.

Met. No dynamic analysis vulnerabilities have been discovered. All test suites pass with zero failures.