1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
# The instrument package. The workspace root manifest (../../Cargo.toml) is
# VIRTUAL and carries the members, the shared lint tables and the profiles;
# this file carries only the package (#55). The legal set the crates.io
# `include` list names (README, CHANGELOG, LICENSE, LICENSES, NOTICE,
# REUSE.toml) lives once at the repository root and is reached from here by
# relative symlinks, which `cargo package` dereferences into real files —
# verified against `cargo package --list`.
[]
= "veredictum"
= "0.1.4"
# Two binaries exist in the workspace since the console (#53), so a bare
# `cargo run --` is ambiguous without this; every documented invocation is
# `cargo run -- <subcommand>` and must keep meaning the instrument.
= "veredictum"
= "2024"
= "1.96"
= "Apache-2.0"
= "The independent conformance instrument for openEHR clinical data repositories: a machine-readable catalogue of spec-cited test cases, executed against any running CDR, judged by pure-function verdicts"
= "https://github.com/rubentalstra/Veredictum"
= "README.md"
= ["openehr", "conformance", "testing", "ehr", "cdr"]
= ["development-tools::testing", "command-line-utilities", "science"]
# No `authors`, deliberately. The cargo manifest reference opens that section
# with "Warning: This field is deprecated"
# (https://doc.rust-lang.org/cargo/reference/manifest.html#the-authors-field),
# and it cannot be corrected after publication. Attribution is the repository
# link above plus CITATION.cff, which IS editable and is what GitHub's citation
# box and the Zenodo deposit read.
# WHAT SHIPS TO crates.io, and why it is an allowlist rather than an exclude
# list. The catalogue and the vendored specification oracle are 347 MB of data
# in this repository — far past what a registry accepts, and nothing the crate
# needs in order to COMPILE: every catalogue root is a path the caller passes at
# run time. The ONE exception is `src/bench/fixtures/**`, which the benchmark
# packs embed with `include_str!` so a bench run needs no artifact root at all;
# those few kilobytes are listed below and are the only data the package
# carries. Everything else is obtained from the repository or a release.
#
# `include` wins over `exclude` here on the failure direction: a new vendored
# tree lands in this repository regularly, and with an exclude list one that
# nobody remembered to add would silently blow the package size on the next
# publish. An allowlist fails the other way — a new SOURCE directory would be
# missing and the build verification catches it immediately.
#
# NOTICE travels because Apache-2.0 §4(d) requires it to: the whole point of
# choosing that licence for this instrument is that attribution follows every
# copy and derivative.
= [
"src/**/*.rs",
"src/bench/fixtures/**",
"Cargo.toml",
"README.md",
"CHANGELOG.md",
"LICENSE",
"LICENSES/**",
"NOTICE",
"REUSE.toml",
]
[[]]
= "veredictum"
= "src/bin/veredictum.rs"
[]
= { = "1", = ["derive", "rc"] }
= { = "1", = ["preserve_order"] }
# The executor: blocking HTTP driver realized from the operation bindings.
= { = "0.13.4", = false, = ["rustls", "json", "gzip", "brotli"] }
# YAML authoring front-end for the schedule artifacts: pure Rust, no RUSTSEC
# advisories, alias-expansion Budget against untrusted case files.
= "1.0.0-rc.1"
# The published artifact schemas are the norm; every loaded artifact validates
# against them before typed parsing.
= "0.49.3"
# `applies` spec-version ranges use the Cargo/semver requirement grammar.
= "1.0.28"
= "1"
# Wall-clock time (token `iat`/`exp`, run stamps) comes from the pinned time
# library, never `std::time::SystemTime` (clippy.toml `disallowed-methods`);
# elapsed-time measurement stays on `std::time::Instant`.
= { = "0.2.31", = ["serde"] }
# Canonical-XML response assertions (`xml_root`): the served document's root
# element name and the namespace its prefix resolves to. A namespace-aware
# parser is required — a regex cannot tell the root from a descendant, nor
# relate a prefix to the URI in scope for it.
= { = "0.41.0", = ["serialize"] }
# Percent-encode path/query segments — never hand-roll a percent codec.
= "2.1.3"
= "2"
= { = "4", = ["derive", "env"] }
# The measurement machinery: coordinated-omission-corrected latency with the
# standard V2 serialization so thresholds are re-checkable from the artifact.
= { = "7.5.4", = ["serialization"] }
= "0.23"
# Deterministic case-scoped ids (UUIDv5) for the recipe machinery.
= { = "1", = ["v4", "v5", "v7", "serde", "fast-rng"] }
# Version-signature verification (SIG-VERSION cases): reconstruct the agreed
# signed canonical form (RFC 8785 JCS of the ORIGINAL_VERSION minus signature),
# recompute the digest (digest mode), or verify the RFC 9580 detached signature
# (pgp mode). Spec: RM common master06 §Digital Signature.
= "0.2.0"
= "0.11.0"
# rPGP — pure-Rust OpenPGP (RFC 9580). `default-features = false` drops the
# bzip2 (libbz2-rs-sys) dependency: a detached signature needs no compression,
# and that crate fails the cargo-deny license gate.
= { = "0.20.0", = false }
# The RNG the signed run record's detached-signature call takes. NOT rand 0.10:
# `pgp 0.20`'s signing call wants an RNG from rand 0.8's rand_core generation,
# so the types must come from that major or they do not unify.
= "0.8"
# The SMART lane's per-step token mint: a CDR is a SMART resource server and
# never issues tokens (ITS-REST docs/smart_app_launch/master06-authentication
# §Supported Authentication Flows), and the conformance stack runs no
# Authorization Server, so the runner signs RS256 access tokens carrying the
# scope claim each case declares. Never hand-roll JWT signing.
= { = "11.0.0", = ["aws_lc_rs"] }
[]
= "1"
# The fake SUT the wire-speaking modules are tested against: a real HTTP
# server on a real socket, so the driver, the probe and the stress ladder are
# exercised over the same reqwest path a live run uses.
= "0.6.5"
# wiremock's control surface (start, register, received_requests) is async
# while every client here is `reqwest::blocking`, so the harness owns one
# current-thread runtime for setup and readback. Already in the lock through
# reqwest, so this adds no crate to the graph.
= { = "1.53.1", = false, = ["rt", "time"] }
[]
= true