bitrep 0.4.1

Order-invariant, bit-identical floating-point reductions. Any order. Any hardware. Same bits.
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70

# cargo-deny: supply-chain gate for the bitrep workspace.

#   advisories -> RustSec CVE / unmaintained / yanked scan (security)

#   licenses   -> permissive, redistribution-safe licenses only (bitrep ships

#                 MIT OR Apache-2.0; every dependency must be compatible with that)

#   bans       -> catch duplicate versions and anything explicitly disallowed

#   sources    -> crates.io only; no unvetted git or alternate-registry pulls

#

# Run locally: cargo deny check

#   (or scope it: cargo deny check advisories | licenses | bans | sources)

#

# Scope note: this vets the root crate + the wasm/python binding workspace

# members and their full (incl. dev-) dependency trees. fuzz/ and demo/ are

# standalone crates excluded from the workspace, so their extra tooling deps

# are not gated here.



[advisories]

version = 2

# RustSec advisory DB: known vulnerabilities and unmaintained crates fail the

# check (the v2 default). Yanked crates are a hard stop — a reproducibility

# project must not depend on a pulled release.

yanked = "deny"

# Add IDs here only with a written justification and a tracking issue if a

# transitive advisory ever needs a temporary, documented waiver.

#

# PyO3 advisories below: bitrep-python (the Python binding) transitively depends

# on pyo3 0.22.6, which carries these two advisories. VERIFIED bitrep does NOT

# call either vulnerable API — no use of PyString::from_object or

# PyCFunction::new_closure anywhere in bindings/python/src/. Neither code path is

# reachable from bitrep. Tracked follow-up: upgrade to PyO3 0.24+ (removes both

# and lets this ignore list return to empty).

ignore = [

  { id = "RUSTSEC-2025-0020", reason = "PyString::from_object buffer overflow — API unused by bitrep-python; upgrade to PyO3 0.24+ pending." },

  { id = "RUSTSEC-2026-0177", reason = "PyCFunction::new_closure Sync bound — API unused by bitrep-python; upgrade to PyO3 0.24+ pending." },

]



[licenses]

version = 2

# Permissive, redistribution-safe licenses only. Every crate in the tree today

# is MIT / Apache-2.0 / BSD / ISC / Unicode-3.0 / Zlib / MPL-2.0(file-level).

# A copyleft (GPL/AGPL/LGPL) or unknown license landing here is a hard stop —

# exactly the supply-chain surprise this gate exists to catch.

allow = [

    "MIT",

    "Apache-2.0",

    "Apache-2.0 WITH LLVM-exception",

    "BSD-2-Clause",

    "BSD-3-Clause",

    "ISC",

    "Unicode-3.0",

    "Zlib",

]

confidence-threshold = 0.9

# The allow-list above is deliberately broader than what the current tree uses

# (only MIT / Apache-2.0 today) so a routine dependency bump into another

# permissive license doesn't fail the build; don't warn about the unused ones.

unused-allowed-license = "allow"



[bans]

# Duplicate versions of the same crate bloat the tree and muddy provenance;

# surface them as warnings (they are common via dev-deps and not worth failing

# the build over). Wildcard version requirements are a reproducibility hazard.

multiple-versions = "warn"

wildcards = "warn"

# Explicitly banned crates (known-bad or license-incompatible) would go here.

deny = []



[sources]

unknown-registry = "deny"

unknown-git = "deny"

allow-registry = ["https://github.com/rust-lang/crates.io-index"]