base64-ng 2.0.0

no_std-first Base64 encoding and decoding with strict APIs and a security-heavy release process
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66

# Base64-Family Multibase Companion

`base64-ng-multibase` implements the Base64 subset of the multiformats
multibase registry pinned at commit
`d7406cdea189b82a0b3937f5737b440f5fa92f92`. It deliberately does not claim
the complete open-world registry.

## Exact Scope

The admitted, case-sensitive prefixes are:

| Prefix | Registry name | RFC 4648 policy | Registry status |
| --- | --- | --- | --- |
| `m` | `base64` | Standard alphabet, no padding | final |
| `M` | `base64pad` | Standard alphabet, canonical padding | experimental |
| `u` | `base64url` | URL-safe alphabet, no padding | final |
| `U` | `base64urlpad` | URL-safe alphabet, canonical padding | final |

Every other prefix returns `UnsupportedPrefix`. Decoding dispatches only after
the exact prefix has been classified and uses the corresponding strict 2.0
core codec. Mixed alphabets, missing or surplus padding, noncanonical trailing
bits, and trailing data are rejected.

The `M` registration remains public because it is present in the pinned
registry and official vectors, but `registry_status()` preserves its
`Experimental` status so callers cannot mistake it for a final registration.

## Resource and Mutation Contracts

`Base64MultibaseLimits` independently bounds input, output, and source work.
Encode output and decode input include the one-byte prefix. One-shot operations
preflight exact lengths and leave caller-owned output unchanged on every
error. Allocating decode validates and sizes the complete value before
allocation or plaintext materialization.

`Base64MultibaseEncoder` and `Base64MultibaseDecoder` are heapless incremental
states built on the shared 2.0 core states. They expose exact consumed/produced
progress, retain only quantum-sized core state plus prefix state, latch every
failure, and require explicit reset or clear before reuse.

## Security Boundary

This is an ordinary protocol encoding. Errors can identify a rejected prefix
and invalid payload position. Incremental state derives `Debug` and makes no
secret cleanup or constant-time claim. Secret-bearing inputs must use the
core bounded secret capability with an application-owned protocol tag rather
than this ordinary companion.

## Evidence

`spec/multibase/` contains exact upstream registry and official vector bytes,
their source URLs, commit identifier, and SHA-256 inventory. The corpus is
repository evidence and is excluded from Rust packages.

`scripts/check-2.0-multibase.sh` enforces:

- offline source hashes and exact Base64-family registry semantics;
- fail-closed source mutation cases;
- byte-identical official vector fixtures;
- no-default, alloc, and all-feature conformance tests;
- all one-byte incremental partition schedules and finite-limit behavior;
- Python standard-library differential encode/decode evidence;
- fuzz-target compilation, lint, documentation, dependency, and package scope
  checks. The dedicated `scripts/check-2.0-msrv.sh` matrix checks this package
  under Rust 1.90.0; the focused script repeats that evidence when the MSRV
  toolchain is installed locally.