1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
[]
= "cleanlib-client"
# 0.2.0 — CLEANLIB-813 (overnight autonomous batch, 2026-09-15): BREAKING —
# `Client::audit()` now takes an `AuditFilters<'_>` options struct
# (`{ since, until, decision, ecosystem }`) instead of 3 positional
# `Option<&str>` params, and adds the `until` filter the real server
# already accepted but this SDK never exposed. Minor bump (not patch) per
# this crate's own 0.x breaking-change precedent — see cleanlib-sdk-go's
# jump straight to v1.0.0 for CLEANLIB-610's breaking module-path rename.
# Migration: `client.audit(since, decision, ecosystem).await` becomes
# `client.audit(AuditFilters { since, decision, ecosystem, ..Default::default() }).await`.
# CLEANLIB-126 M1″ cycle-13 — per-crate version (overrides workspace 0.1.0)
# to ship crate-root re-exports (Client, Verdict, PolicyDecision). cleanlib-cli
# stays on workspace 0.1.0 (no re-publish this cycle); workspace.dependencies
# pin bumped to 0.1.1 so the next cli ship picks up automatically.
# 0.1.19 — CLEANLIB-780 (axes envelope): adds `axes: Option<Axes>` to Verdict
# (Axes / AxisAdvisory / AxisThreat / AxisAvailability), mirroring the App #477
# wire, so consumers render the advisory / threat / availability planes SEPARATELY
# (a consulted-and-empty advisory reads as honest GREEN, not an alarmist data-gap).
# Purely ADDITIVE over the published 0.1.15 (tail-appended, serde default, skip-None
# on the wire, self-healing bincode cache). Shipped in a COMBINED cleanlib 0.1.19
# release with the cleanlib-cli v1-lock fix (CLEANLIB-682) per BD direct-word "ship
# both together 0.1.19"; 0.1.16-0.1.18 skipped for the client so both crates align
# at 0.1.19. cleanlib-cli 0.1.19 consumes these types (path-1) to render axes.
# 0.1.15 — CLEANLIB-682 release train: the published 0.1.14 is stale vs source.
# Republish so cleanlib-cli 0.1.11 can build against the API it uses — remediation
# / freshness / coverage / reason_class / policy_version / attestation_status /
# customer_state on Verdict+ScanResult+ScanResponse, plus telemetry_enabled /
# migrate_telemetry_consent / ecosystem_from_path (CX-3/627/691 + siblings).
= "0.2.0"
= true
= true
= true
= true
= true
= "HTTP client SDK for the CleanLibrary verdict API — VerdictEnvelopeV1 types, derive_status logic, transport, config, and risk-acceptance YAML emitter shared between cleanlib-cli and other CleanLibrary consumers."
= ["security", "dependencies", "verdicts", "supply-chain", "sdk"]
= ["api-bindings", "development-tools"]
[]
= { = true }
= { = true }
= { = true }
= { = true }
= { = true }
= { = true }
= { = true }
# `sync` adds `tokio::sync::{OnceCell,RwLock}` — used by attestation_verify's
# lazily-built, TTL-cached `/v1/pubkeys` lookup (cosign gate 3, Q6=a).
= { = true, = ["sync"] }
= { = true }
# CLEANLIB-379 (cosign gate 3, Q6=a): verify_attestation() — ECDSA P-256 +
# SHA-256 signature verify over the App's SignedAttestation envelope. Same
# RustCrypto family + versions already pinned in workspace.dependencies for
# cleanlib-cosign-signer (the producer side) so the verifier and signer agree
# on DER/PEM encoding without a second dependency graph.
= { = true }
= { = true }
= { = true }
= { = true }
= { = true }
= { = true }
# RFC-8785 JSON Canonicalization Scheme — reconstructs the EXACT bytes
# cleanlib-cosign-signer signs (Attestation::canonical_bytes()) from the
# passthrough `serde_json::Value` the App emits on the wire, so a natural
# parse + reserialize verifies without hand-replicating field order (mirrors
# cleanlib-cosign-signer's own dependency; see its `partner_guide_7_2_method_*`
# test for the recipe this module reproduces from the consumer side).
= "0.1"