#audit #supply-chain-security #openvet

openvet-client

Consumer-side primitives for OpenVet: log client, on-disk cache, project/user config, audit workspace, publish staging, subject parser

2 unstable releases

Uses new Rust 2024

new 0.5.0 May 18, 2026
0.4.0 May 13, 2026

#269 in Security


Used in openvet

MIT/Apache

4MB
20K SLoC

openvet-client

Consumer-side library for OpenVet: configuration, log fetch + cache, workspace orchestration, publish staging, subject parsing.

The openvet binary handles CLI-shaped concerns (argument parsing, formatted output, the ratatui TUI) and sits on top of this crate for the rest. Anything that doesn't involve drawing on a terminal lives here.

Audit Log

This crate implements a client for pulling data from audit logs, using the openvet-log and openvet-tree crates. It implements a sqlite-backed cache, as well as an in-memory LRU cache to make lookups fast, as those are frequent operations for openvet check. It also implements zstd compression for the cache, to keep the size manageable.

Configuration

It handles parsing user and project configuration files. The user config lives at $XDG_CONFIG_HOME/openvet/config.toml; the project config (openvet.toml) reads from the current directory by default, overridable via a --config flag in the openvet binary. Individual values resolve from CLI flags, environment variables, or the user config.

Publishing

It has helpers for assembling publish bundles. PublishStaging collects the new tree nodes and key states emitted during the local apply so the CLI can produce a Publish message given a log head and an operation.

Authoring

It has helpers for authoring audits: creating audit workspaces, bootstrapping an empty audit file, writing the manifest, and checking out the VCS.

Parsers

It contains parsers for various data types, including the Subject parser (registry:package@version[?variant][#sha256:HEX]).

Dependencies

~47–64MB
~1M SLoC