1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
[]
= "doge-runtime"
= true
= true
= true
= "Runtime for the Doge programming language — Value model, operators, builtins, and catchable errors."
= true
= true
= true
= true
= ["doge", "language", "runtime", "scripting"]
= ["compilers"]
[]
# Regex engine for the `hunt` module. A correct regex engine is large and
# security-sensitive (catastrophic backtracking / ReDoS); `regex` is pure-Rust and
# guarantees linear-time matching with no backtracking blowup, exactly matching the
# runtime's never-panics, every-failure-catchable guarantee. Hand-rolling one would
# be far more code and risk.
= "1"
# HTTP(S) client for the `howl` module. TLS cannot be hand-rolled, so `howl.get`/
# `howl.post` need a real HTTP stack; ureq is blocking/synchronous, matching the
# runtime's no-async design, and rustls keeps it pure-Rust with bundled roots.
= { = "2", = false, = ["tls"] }
# Arbitrary-precision numerics: `num-bigint` backs the `Int` value type (overflow
# just grows instead of wrapping) and `bigdecimal` backs the exact base-10 `Decimal`
# type (money/crypto). Both are pure-Rust and correctness-sensitive; hand-rolling a
# correct bignum/decimal would be far more code and risk. Same rationale as `regex`.
= "0.4"
= "0.4"
# Security primitives for the `crypto` module. These must be correct and
# side-channel-resistant — hand-rolling SHA-256, HMAC, an OS CSPRNG, or a
# constant-time compare is exactly where subtle, dangerous bugs live, so unlike the
# non-cryptographic `roll` PRNG these are not vendored. All are audited, pure-Rust,
# and the industry standard. `getrandom` in particular cannot be vendored: a secure
# random source requires OS syscalls that differ across Linux and Windows.
= "0.10" # crypto.sha256 / crypto.hmac_sha256 — SHA-256 digest
= "0.12" # crypto.hmac_sha256 — RFC 2104 HMAC over SHA-256
= "2" # crypto.same — constant-time byte equality
= "0.2" # crypto.token — OS cryptographically secure RNG