clawscan 1.0.0

# Publishing ClawScan to crates.io

Complete step-by-step guide to publish ClawScan on crates.io (Rust's package registry).

## Pre-Publishing Checklist

Before publishing, ensure:

- ✅ All tests pass: `cargo test --lib`
- ✅ Code compiles in release mode: `cargo build --release`
- ✅ README_USER.md is user-friendly and complete
- ✅ Cargo.toml has required metadata (repository, license, description)
- ✅ LICENSE file exists
- ✅ .gitignore excludes build artifacts
- ✅ Git repository is clean (no uncommitted changes)

## Step 1: Create crates.io Account

1. Go to https://crates.io/
2. Click "Log in with GitHub" (top right)
3. Authorize crates.io to access your GitHub account
4. Complete your profile

## Step 2: Get API Token

1. Go to https://crates.io/me
2. Click "API Tokens" in the left sidebar
3. Click "New Token"
4. Name it: "ClawScan Publishing" (or whatever you prefer)
5. Click "Generate"
6. **IMPORTANT**: Copy the token immediately (you won't see it again!)

Example token format: `cio_xxxxxxxxxxxxxxxxxxxxxxxxxxxxx`

## Step 3: Configure Cargo with Token

```bash
# Login to crates.io (will prompt for token)
cargo login

# Paste your API token when prompted
# Token will be saved to ~/.cargo/credentials.toml
```

**Security Note**: Never commit this token to git!

## Step 4: Pre-Publish Verification

### Verify Package Contents

```bash
# See what files will be included in the package
cargo package --list

# Build the package (creates a .crate file)
cargo package

# Check for any warnings
cargo package --allow-dirty  # If you have uncommitted changes
```

Expected output:
```
   Packaging clawscan v1.0.0 (/Users/4n6h4x0r/src/clawscan)
   Verifying clawscan v1.0.0 (/Users/4n6h4x0r/src/clawscan)
   Compiling clawscan v1.0.0 (/Users/4n6h4x0r/src/clawscan/target/package/clawscan-1.0.0)
    Finished dev [unoptimized + debuginfo] target(s) in 45.32s
```

### Test the Packaged Version

```bash
# Cargo automatically tests the packaged version during `cargo package`
# If you want to be extra sure:
cd target/package/clawscan-1.0.0
cargo test
cd ../../..
```

## Step 5: Publish to crates.io

### Dry Run (Recommended First Time)

```bash
# Simulate publishing without actually uploading
cargo publish --dry-run

# This will:
# - Package the crate
# - Verify dependencies
# - Check metadata
# - Show what would be uploaded
```

### Actual Publishing

```bash
# Publish for real!
cargo publish

# If you have uncommitted changes and are confident:
cargo publish --allow-dirty
```

Expected output:
```
    Updating crates.io index
   Packaging clawscan v1.0.0 (/Users/4n6h4x0r/src/clawscan)
   Verifying clawscan v1.0.0 (/Users/4n6h4x0r/src/clawscan)
   Compiling clawscan v1.0.0 (/Users/4n6h4x0r/src/clawscan/target/package/clawscan-1.0.0)
    Finished dev [unoptimized + debuginfo] target(s) in 45.32s
   Uploading clawscan v1.0.0 (/Users/4n6h4x0r/src/clawscan)
```

## Step 6: Verify Publication

1. Go to https://crates.io/crates/clawscan
2. You should see your crate page!
3. Wait 5-10 minutes for the docs to build at https://docs.rs/clawscan

### Test Installation

```bash
# Try installing from crates.io
cargo install clawscan

# Run it
clawscan --help
```

## Step 7: Publish Release on GitHub

1. Go to https://github.com/4n6h4x0r/clawscan/releases
2. Click "Create a new release"
3. Tag version: `v1.0.0`
4. Release title: `ClawScan v1.0.0 - Initial Release`
5. Description:
```markdown
# ClawScan v1.0.0 - Initial Release

High-performance vulnerability scanner for OpenClaw/Moltbot/Clawdbot AI assistants.

## Installation

```bash
cargo install clawscan
```

## Features

✅ 9 attack modules covering OWASP LLM Top 10 & MITRE ATLAS
✅ Concurrent scanning (50 targets simultaneously)
✅ Evidence capture with remediation advice
✅ JSON report generation
✅ 51/51 tests passing - built with TDD

## What's Tested

- CVE-2026-25253: CSWSH (CRITICAL)
- CVE-2026-22708: Indirect Injection (HIGH)
- CVE-2026-25157: Command Injection (CRITICAL)
- Prompt Injection (HIGH) - 5 high-signal techniques
- RAG/Memory Poisoning (HIGH)
- Supply Chain Attacks (CRITICAL)
- MCP Tool Poisoning (HIGH)
- Elevated Mode Bypass (HIGH)
- Zero-Click RCE Chain (CRITICAL)

## Documentation

See [README_USER.md](README_USER.md) for usage guide.

## License

MIT
```
6. Attach release binary (optional):
   - Upload `target/release/clawscan` (Mac/Linux)
   - Upload `target/release/clawscan.exe` (Windows)

## Troubleshooting

### Error: "crate name is already taken"

If someone already owns "clawscan":
1. Choose a different name: `clawscan-security`, `openclaw-scanner`, etc.
2. Update `Cargo.toml`: `name = "clawscan-security"`
3. Rename binary: `[[bin]] name = "clawscan-security"`

### Error: "failed to verify"

```bash
# Check what's failing
cargo package

# Common issues:
# - Missing files in git (add them)
# - Path dependencies (use versions instead)
# - Uncommitted changes (commit or use --allow-dirty)
```

### Error: "API token not found"

```bash
# Re-login
cargo login
# Paste token again
```

### Error: "repository not found"

Make sure GitHub repo exists:
```bash
git remote -v
# Should show: https://github.com/4n6h4x0r/clawscan
```

If not, create repo first:
1. Go to https://github.com/new
2. Name: `clawscan`
3. Create repository
4. Push code:
```bash
git remote add origin https://github.com/4n6h4x0r/clawscan.git
git push -u origin main
```

## Future Updates

### Publishing New Versions

1. Update version in `Cargo.toml`: `version = "1.0.1"`
2. Update `README_USER.md` if needed
3. Commit changes:
```bash
git add -A
git commit -m "Release v1.0.1"
git tag v1.0.1
git push --tags
```
4. Publish:
```bash
cargo publish
```

### Yanking a Version (Emergency Only)

If you published a broken version:
```bash
# Remove from default installs (people can still use it explicitly)
cargo yank --vers 1.0.0

# Undo yank if you change your mind
cargo yank --vers 1.0.0 --undo
```

## Post-Publishing Checklist

- ✅ Verify crate appears on https://crates.io/crates/clawscan
- ✅ Check docs.rs built successfully: https://docs.rs/clawscan
- ✅ Test installation: `cargo install clawscan`
- ✅ Create GitHub release with binaries
- ✅ Update README with installation instructions
- ✅ Announce on social media / forums
- ✅ Monitor issues for bug reports

## Maintenance

- Respond to issues on GitHub
- Update dependencies regularly: `cargo update`
- Publish security patches promptly
- Keep README_USER.md current

## Congratulations! 🎉

Your crate is now published and available worldwide!

Users can install with: `cargo install clawscan`

---

**Questions?** Check the official guide: https://doc.rust-lang.org/cargo/reference/publishing.html