NativeLink

Repository on GitHub, which provides public git repositories with URLs.

Repository on GitHub, which uses git. git can track the changes, who made them, and when they were made.

You can view the current project history at https://github.com/TraceMachina/native-link/commits/main.

Repository on GitHub, which uses git. git is distributed.

NativeLink uses SemVer as version scheme. Releases are tagged on github at https://github.com/TraceMachina/nativelink/releases.

Releases are tagged. The list of tags is at https://github.com/TraceMachina/nativelink/tags.

Release notes are published with releases at https://github.com/TraceMachina/nativelink/releases. Additional extensive changelogs are at https://github.com/TraceMachina/nativelink/blob/main/CHANGELOG.md.

This hasn't happened yet.

Please use GitHub issues https://github.com/TraceMachina/nativelink/issues for bug reports.

The issue tracker is GitHub issues https://github.com/TraceMachina/nativelink/issues.

Bug reports at https://github.com/TraceMachina/nativelink/issues are generally swiftly addressed.

The project is still young. Enhancements at https://github.com/TraceMachina/nativelink/issues?q=is%3Aopen+is%3Aissue+label%3Aenhancement are being addressed at the moment. Note that we might dismiss feature requests if they're out of scope for the project. In such cases, we'll provide a rationale behind the rejection.

Past issues are at https://github.com/TraceMachina/nativelink/issues?q=is%3Aissue+is%3Aclosed.

Please see https://github.com/TraceMachina/nativelink/blob/main/SECURITY.md for the vulnerability reporting process and contact information.

Prefer GitHub's private vulnerability reporting at https://github.com/TraceMachina/nativelink/security. Otherwise, the security policy contains contact emails for reports.

You can use GitHub's vulnerability reporting at https://github.com/TraceMachina/nativelink/security or contact the emails in the security policy directly.

This is met.

The project supports Bazel, Cargo and Nix. See https://github.com/TraceMachina/nativelink/blob/main/README.md for build instructions.

Bazel, Cargo and Nix are standard tools to build Rust projects.

Bazel, Cargo and Nix are FLOSS software.

Unit tests are contained in subdirectories. There is an additional integration test suite at https://github.com/TraceMachina/nativelink/tree/main/integration_tests.

The project uses GitHub actions. You can review the current CI at https://github.com/TraceMachina/nativelink/tree/main/.github/workflows.

You can use Bazel or Cargo to run the testsuite. See https://github.com/TraceMachina/nativelink/tree/main/.github/workflows for invocation examples.

The project uses GitHub actions. You can review the current CI at https://github.com/TraceMachina/nativelink/tree/main/.github/workflows.

Contributions that contain new features are required to be tested. This is ensured during code review.

You can view the past commit history for examples.

The testing requirement is part of the contribution guidelines at https://github.com/TraceMachina/nativelink/blob/main/CONTRIBUTING.md and in the pull request template at https://github.com/TraceMachina/nativelink/blob/main/.github/pull_request_template.md.

It is a requirements for the Rust code to not emit warnings during compilation.

The Rust codebase is required to not raise any compiler warnings. External dependencies may emit warnings that are addressed on a best-effort basis.

Additionally to regular warnings from the Rust compiler we use clippy to increase strictness.

A number of developers are working full-time on the codebase. The team has extensive knowledge about distributed architectures, cloud, CI and build system design.

Turbo-cache's design aims to follow best practices and secure defaults wherever possible. However, mistakes can always happen. If something doesn't look right, please file an issue on GitHub.

In addition to the team's experience, turbo-cache uses automated vulnerability scanning and enforcement of security best practices to minimize the risk of vulnerabilities occurring. However, if you spot any vulnerabilities or notice problematic design flaws, please reach out as described in the security policy.

Some features establish network connections to external sources, such as cloud storage providers. In such cases, well-known crates are used to implement those connections.

Turbo-cache uses SHA2 and BLAKE3 internally, as well as various hashing algorithms for in-memory hash maps. The implementations of those algorithms are not guaranteed to be secure since they're used to index build artifacts where performance is the primary concern. The occurrences of these algorithms are irrelevant to network-related functionality.

Turbo-cache strongly prefers well-known dependencies. It does not implement it's own hashing algorithms.

All dependencies are open source. The full SBOM is available at https://github.com/TraceMachina/nativelink/network/dependencies.

Turbo-cache sources security mechanisms from well-known, maintained crates and keeps those up to date.

Turbo-cache sources security mechanisms from well-known, maintained crates and keeps those up to date.

On a "to the best of our knowledge" basis, Nativelink does not use outdated cryptographic algorithms.

The project does not produce passwords or authentication credentials.

To the best of the author's knowledge, the dependencies that implement such functionality are widely used and considered secure.

GitHub implements HTTPS and SSH access.

This is handled by GitHub.

At the moment there are no known vulnerabilities.

There were no known critical vulnerabilities yet.

This is met and additionally checked with the detect-private-key pre-commit hook. Keys tracked in the repository for testing are clearly labeled as such.

Clippy is used for static analysis: https://github.com/rust-lang/rust-clippy.

This is part of clippy's warnings.

There were no such vulnerabilities yet.

Clippy is enforced in CI on every commit.

The project has a dedicated ASAN workflow that runs the sanitizeds testsuite on every commit.

There were no known issues yet.