docs: add contributing guidelines by tziemek · Pull Request #700 · csaf-rs/csaf

tziemek · 2026-06-23T13:36:09Z

resolves #692

tziemek · 2026-06-23T13:36:34Z

@tschmidtb51 Can you take a look at the guidelines?

github-actions

CSAF Validation Benchmark

Details

Benchmark suite	Current: `89a7d28`	Previous: `4db5667`	Ratio
`csaf_2_0_tests/6.1.1`	`123777` ns/iter (`± 888`)	`131230` ns/iter (`± 265`)	`0.94`
`csaf_2_0_tests/6.1.2`	`48445` ns/iter (`± 425`)	`51507` ns/iter (`± 129`)	`0.94`
`csaf_2_0_tests/6.1.3`	`12609` ns/iter (`± 121`)	`13023` ns/iter (`± 17`)	`0.97`
`csaf_2_0_tests/6.1.4`	`26786` ns/iter (`± 268`)	`27669` ns/iter (`± 44`)	`0.97`
`csaf_2_0_tests/6.1.5`	`13705` ns/iter (`± 182`)	`13955` ns/iter (`± 29`)	`0.98`
`csaf_2_0_tests/6.1.6`	`35156` ns/iter (`± 138`)	`37409` ns/iter (`± 78`)	`0.94`
`csaf_2_0_tests/6.1.7`	`31674` ns/iter (`± 93`)	`33608` ns/iter (`± 1661`)	`0.94`
`csaf_2_0_tests/6.1.8`	`80677` ns/iter (`± 546`)	`87989` ns/iter (`± 957`)	`0.92`
`csaf_2_0_tests/6.1.9`	`80734` ns/iter (`± 170`)	`84641` ns/iter (`± 197`)	`0.95`
`csaf_2_0_tests/6.1.10`	`147539` ns/iter (`± 753`)	`149403` ns/iter (`± 258`)	`0.99`
`csaf_2_0_tests/6.1.11`	`14054` ns/iter (`± 83`)	`14294` ns/iter (`± 28`)	`0.98`
`csaf_2_0_tests/6.1.12`	`32650` ns/iter (`± 271`)	`30006` ns/iter (`± 43`)	`1.09`
`csaf_2_0_tests/6.1.13`	`32478` ns/iter (`± 122`)	`33243` ns/iter (`± 47`)	`0.98`
`csaf_2_0_tests/6.1.15`	`12357` ns/iter (`± 57`)	`12376` ns/iter (`± 15`)	`1.00`
`csaf_2_0_tests/6.1.16`	`43116` ns/iter (`± 114`)	`47342` ns/iter (`± 45`)	`0.91`
`csaf_2_0_tests/6.1.17`	`13725` ns/iter (`± 133`)	`13759` ns/iter (`± 69`)	`1.00`
`csaf_2_0_tests/6.1.18`	`15454` ns/iter (`± 114`)	`15597` ns/iter (`± 20`)	`0.99`
`csaf_2_0_tests/6.1.19`	`15426` ns/iter (`± 182`)	`15511` ns/iter (`± 70`)	`0.99`
`csaf_2_0_tests/6.1.20`	`13392` ns/iter (`± 97`)	`13397` ns/iter (`± 19`)	`1.00`
`csaf_2_0_tests/6.1.21`	`41298` ns/iter (`± 328`)	`44703` ns/iter (`± 86`)	`0.92`
`csaf_2_0_tests/6.1.22`	`51439` ns/iter (`± 302`)	`56465` ns/iter (`± 151`)	`0.91`
`csaf_2_0_tests/6.1.23`	`15333` ns/iter (`± 106`)	`16339` ns/iter (`± 417`)	`0.94`
`csaf_2_0_tests/6.1.24`	`15724` ns/iter (`± 123`)	`17800` ns/iter (`± 93`)	`0.88`
`csaf_2_0_tests/6.1.25`	`35452` ns/iter (`± 180`)	`36236` ns/iter (`± 317`)	`0.98`
`csaf_2_0_tests/6.1.26`	`19853` ns/iter (`± 207`)	`20224` ns/iter (`± 22`)	`0.98`
`csaf_2_0_tests/6.1.27.1`	`13189` ns/iter (`± 111`)	`13382` ns/iter (`± 12`)	`0.99`
`csaf_2_0_tests/6.1.27.2`	`13165` ns/iter (`± 113`)	`13424` ns/iter (`± 20`)	`0.98`
`csaf_2_0_tests/6.1.27.3`	`12710` ns/iter (`± 207`)	`13154` ns/iter (`± 23`)	`0.97`
`csaf_2_0_tests/6.1.27.4`	`13610` ns/iter (`± 86`)	`13518` ns/iter (`± 329`)	`1.01`
`csaf_2_0_tests/6.1.27.5`	`13972` ns/iter (`± 188`)	`14027` ns/iter (`± 12`)	`1.00`
`csaf_2_0_tests/6.1.27.6`	`13321` ns/iter (`± 149`)	`13580` ns/iter (`± 180`)	`0.98`
`csaf_2_0_tests/6.1.27.7`	`12395` ns/iter (`± 146`)	`12721` ns/iter (`± 12`)	`0.97`
`csaf_2_0_tests/6.1.27.8`	`12458` ns/iter (`± 124`)	`12768` ns/iter (`± 13`)	`0.98`
`csaf_2_0_tests/6.1.27.9`	`25244` ns/iter (`± 160`)	`25625` ns/iter (`± 73`)	`0.99`
`csaf_2_0_tests/6.1.27.10`	`13797` ns/iter (`± 58`)	`14844` ns/iter (`± 119`)	`0.93`
`csaf_2_0_tests/6.1.27.11`	`12949` ns/iter (`± 19`)	`13245` ns/iter (`± 15`)	`0.98`
`csaf_2_0_tests/6.1.28`	`24651` ns/iter (`± 210`)	`23436` ns/iter (`± 21`)	`1.05`
`csaf_2_0_tests/6.1.29`	`13064` ns/iter (`± 343`)	`12822` ns/iter (`± 38`)	`1.02`
`csaf_2_0_tests/6.1.30`	`42507` ns/iter (`± 254`)	`47098` ns/iter (`± 132`)	`0.90`
`csaf_2_0_tests/6.1.31`	`32536` ns/iter (`± 526`)	`34107` ns/iter (`± 66`)	`0.95`
`csaf_2_0_tests/6.1.32`	`12636` ns/iter (`± 80`)	`13003` ns/iter (`± 14`)	`0.97`
`csaf_2_0_tests/6.1.33`	`18643` ns/iter (`± 120`)	`19688` ns/iter (`± 30`)	`0.95`
`csaf_2_0_tests/6.2.1`	`150140` ns/iter (`± 1368`)	`158366` ns/iter (`± 252`)	`0.95`
`csaf_2_0_tests/6.2.2`	`21494` ns/iter (`± 105`)	`21517` ns/iter (`± 45`)	`1.00`
`csaf_2_0_tests/6.2.3`	`20931` ns/iter (`± 100`)	`20885` ns/iter (`± 353`)	`1.00`
`csaf_2_0_tests/6.2.4`	`20075` ns/iter (`± 256`)	`20360` ns/iter (`± 23`)	`0.99`
`csaf_2_0_tests/6.2.5`	`52435` ns/iter (`± 594`)	`58848` ns/iter (`± 168`)	`0.89`
`csaf_2_0_tests/6.2.6`	`52018` ns/iter (`± 201`)	`58763` ns/iter (`± 325`)	`0.89`
`csaf_2_0_tests/6.2.7`	`17384` ns/iter (`± 121`)	`17508` ns/iter (`± 17`)	`0.99`
`csaf_2_0_tests/6.2.8`	`38577` ns/iter (`± 373`)	`39020` ns/iter (`± 116`)	`0.99`
`csaf_2_0_tests/6.2.9`	`38763` ns/iter (`± 451`)	`38760` ns/iter (`± 67`)	`1.00`
`csaf_2_0_tests/6.2.10`	`28192` ns/iter (`± 228`)	`28809` ns/iter (`± 43`)	`0.98`
`csaf_2_0_tests/6.2.11`	`121002` ns/iter (`± 1257`)	`154341` ns/iter (`± 547`)	`0.78`
`csaf_2_0_tests/6.2.12`	`35973` ns/iter (`± 184`)	`35096` ns/iter (`± 28`)	`1.02`
`csaf_2_0_tests/6.2.13`	`783541` ns/iter (`± 7949`)	`819883` ns/iter (`± 1713`)	`0.96`
`csaf_2_0_tests/6.2.14`	`48215` ns/iter (`± 442`)	`44593` ns/iter (`± 194`)	`1.08`
`csaf_2_0_tests/6.2.15`	`37941` ns/iter (`± 213`)	`35909` ns/iter (`± 220`)	`1.06`
`csaf_2_0_tests/6.2.16`	`46369` ns/iter (`± 257`)	`47187` ns/iter (`± 39`)	`0.98`
`csaf_2_0_tests/6.2.17`	`17797` ns/iter (`± 112`)	`18146` ns/iter (`± 21`)	`0.98`
`csaf_2_0_tests/6.2.18`	`29456` ns/iter (`± 199`)	`29910` ns/iter (`± 43`)	`0.98`
`csaf_2_0_tests/6.2.19`	`21759` ns/iter (`± 144`)	`21537` ns/iter (`± 50`)	`1.01`
`csaf_2_0_tests/6.2.20`	`1525653` ns/iter (`± 4250`)	`1665510` ns/iter (`± 2537`)	`0.92`
`csaf_2_0_tests/6.3.1`	`43016` ns/iter (`± 180`)	`43475` ns/iter (`± 310`)	`0.99`
`csaf_2_0_tests/6.3.2`	`29268` ns/iter (`± 361`)	`29914` ns/iter (`± 78`)	`0.98`
`csaf_2_0_tests/6.3.3`	`29106` ns/iter (`± 375`)	`28655` ns/iter (`± 34`)	`1.02`
`csaf_2_0_tests/6.3.4`	`31465` ns/iter (`± 90`)	`31699` ns/iter (`± 21`)	`0.99`
`csaf_2_0_tests/6.3.5`	`45788` ns/iter (`± 607`)	`45872` ns/iter (`± 76`)	`1.00`
`csaf_2_0_tests/6.3.6`	`21244` ns/iter (`± 136`)	`20806` ns/iter (`± 74`)	`1.02`
`csaf_2_0_tests/6.3.7`	`21219` ns/iter (`± 411`)	`22645` ns/iter (`± 85`)	`0.94`
`csaf_2_0_tests/6.3.8`	`21077` ns/iter (`± 171`)	`20855` ns/iter (`± 41`)	`1.01`
`csaf_2_0_tests/6.3.9`	`37544` ns/iter (`± 337`)	`36433` ns/iter (`± 89`)	`1.03`
`csaf_2_0_tests/6.3.10`	`34254` ns/iter (`± 342`)	`33312` ns/iter (`± 37`)	`1.03`
`csaf_2_0_tests/6.3.11`	`35944` ns/iter (`± 57`)	`36611` ns/iter (`± 40`)	`0.98`
`csaf_2_1_tests/6.1.1`	`608089` ns/iter (`± 15722`)	`649190` ns/iter (`± 1169`)	`0.94`
`csaf_2_1_tests/6.1.2`	`237365` ns/iter (`± 962`)	`256364` ns/iter (`± 377`)	`0.93`
`csaf_2_1_tests/6.1.3`	`68424` ns/iter (`± 256`)	`73014` ns/iter (`± 553`)	`0.94`
`csaf_2_1_tests/6.1.4`	`116998` ns/iter (`± 407`)	`129973` ns/iter (`± 245`)	`0.90`
`csaf_2_1_tests/6.1.5`	`49553` ns/iter (`± 218`)	`50584` ns/iter (`± 92`)	`0.98`
`csaf_2_1_tests/6.1.6`	`111150` ns/iter (`± 561`)	`122134` ns/iter (`± 250`)	`0.91`
`csaf_2_1_tests/6.1.7`	`78712` ns/iter (`± 854`)	`75943` ns/iter (`± 104`)	`1.04`
`csaf_2_1_tests/6.1.8`	`77743` ns/iter (`± 794`)	`75923` ns/iter (`± 760`)	`1.02`
`csaf_2_1_tests/6.1.9`	`537865` ns/iter (`± 992`)	`564715` ns/iter (`± 4180`)	`0.95`
`csaf_2_1_tests/6.1.10`	`721713` ns/iter (`± 3161`)	`703021` ns/iter (`± 1825`)	`1.03`
`csaf_2_1_tests/6.1.11`	`82220` ns/iter (`± 877`)	`84349` ns/iter (`± 95`)	`0.97`
`csaf_2_1_tests/6.1.12`	`89569` ns/iter (`± 761`)	`83206` ns/iter (`± 642`)	`1.08`
`csaf_2_1_tests/6.1.13`	`192606` ns/iter (`± 916`)	`199238` ns/iter (`± 1174`)	`0.97`
`csaf_2_1_tests/6.1.15`	`43385` ns/iter (`± 110`)	`43935` ns/iter (`± 59`)	`0.99`
`csaf_2_1_tests/6.1.16`	`126822` ns/iter (`± 1170`)	`168108` ns/iter (`± 671`)	`0.75`
`csaf_2_1_tests/6.1.17`	`47636` ns/iter (`± 338`)	`49952` ns/iter (`± 214`)	`0.95`
`csaf_2_1_tests/6.1.18`	`53085` ns/iter (`± 216`)	`57759` ns/iter (`± 107`)	`0.92`
`csaf_2_1_tests/6.1.19`	`53079` ns/iter (`± 281`)	`56380` ns/iter (`± 1078`)	`0.94`
`csaf_2_1_tests/6.1.20`	`47257` ns/iter (`± 147`)	`49654` ns/iter (`± 53`)	`0.95`
`csaf_2_1_tests/6.1.21`	`126173` ns/iter (`± 8595`)	`157125` ns/iter (`± 529`)	`0.80`
`csaf_2_1_tests/6.1.22`	`153398` ns/iter (`± 1610`)	`190776` ns/iter (`± 2294`)	`0.80`
`csaf_2_1_tests/6.1.23`	`52679` ns/iter (`± 199`)	`55696` ns/iter (`± 90`)	`0.95`
`csaf_2_1_tests/6.1.24`	`50740` ns/iter (`± 150`)	`53227` ns/iter (`± 307`)	`0.95`
`csaf_2_1_tests/6.1.25`	`167689` ns/iter (`± 1803`)	`173990` ns/iter (`± 8650`)	`0.96`
`csaf_2_1_tests/6.1.26`	`71596` ns/iter (`± 1484`)	`75366` ns/iter (`± 108`)	`0.95`
`csaf_2_1_tests/6.1.27.1`	`48647` ns/iter (`± 344`)	`49178` ns/iter (`± 76`)	`0.99`
`csaf_2_1_tests/6.1.27.2`	`48204` ns/iter (`± 71`)	`48903` ns/iter (`± 125`)	`0.99`
`csaf_2_1_tests/6.1.27.3`	`49590` ns/iter (`± 120`)	`50041` ns/iter (`± 43`)	`0.99`
`csaf_2_1_tests/6.1.27.4`	`50098` ns/iter (`± 260`)	`50263` ns/iter (`± 46`)	`1.00`
`csaf_2_1_tests/6.1.27.5`	`50216` ns/iter (`± 313`)	`51031` ns/iter (`± 257`)	`0.98`
`csaf_2_1_tests/6.1.27.6`	`49430` ns/iter (`± 221`)	`54141` ns/iter (`± 102`)	`0.91`
`csaf_2_1_tests/6.1.27.7`	`44806` ns/iter (`± 438`)	`46755` ns/iter (`± 39`)	`0.96`
`csaf_2_1_tests/6.1.27.8`	`45113` ns/iter (`± 360`)	`47054` ns/iter (`± 48`)	`0.96`
`csaf_2_1_tests/6.1.27.9`	`65844` ns/iter (`± 304`)	`70000` ns/iter (`± 546`)	`0.94`
`csaf_2_1_tests/6.1.27.10`	`45903` ns/iter (`± 242`)	`48893` ns/iter (`± 136`)	`0.94`
`csaf_2_1_tests/6.1.27.11`	`47996` ns/iter (`± 671`)	`49793` ns/iter (`± 113`)	`0.96`
`csaf_2_1_tests/6.1.27.12`	`45917` ns/iter (`± 741`)	`47538` ns/iter (`± 188`)	`0.97`
`csaf_2_1_tests/6.1.27.13`	`72412` ns/iter (`± 757`)	`72390` ns/iter (`± 296`)	`1.00`
`csaf_2_1_tests/6.1.27.14`	`48734` ns/iter (`± 411`)	`50157` ns/iter (`± 76`)	`0.97`
`csaf_2_1_tests/6.1.27.15`	`50161` ns/iter (`± 147`)	`52264` ns/iter (`± 39`)	`0.96`
`csaf_2_1_tests/6.1.27.16`	`48654` ns/iter (`± 323`)	`49686` ns/iter (`± 53`)	`0.98`
`csaf_2_1_tests/6.1.27.17`	`52736` ns/iter (`± 1309`)	`53525` ns/iter (`± 170`)	`0.99`
`csaf_2_1_tests/6.1.27.18`	`54980` ns/iter (`± 301`)	`55916` ns/iter (`± 48`)	`0.98`
`csaf_2_1_tests/6.1.27.19`	`54966` ns/iter (`± 3946`)	`54977` ns/iter (`± 66`)	`1.00`
`csaf_2_1_tests/6.1.28`	`72323` ns/iter (`± 589`)	`72060` ns/iter (`± 283`)	`1.00`
`csaf_2_1_tests/6.1.29`	`46907` ns/iter (`± 185`)	`48766` ns/iter (`± 177`)	`0.96`
`csaf_2_1_tests/6.1.30`	`134157` ns/iter (`± 2892`)	`171767` ns/iter (`± 1461`)	`0.78`
`csaf_2_1_tests/6.1.31`	`158312` ns/iter (`± 594`)	`164464` ns/iter (`± 251`)	`0.96`
`csaf_2_1_tests/6.1.32`	`46863` ns/iter (`± 99`)	`49044` ns/iter (`± 59`)	`0.96`
`csaf_2_1_tests/6.1.33`	`84058` ns/iter (`± 256`)	`91607` ns/iter (`± 89`)	`0.92`
`csaf_2_1_tests/6.1.34`	`55943` ns/iter (`± 122`)	`59965` ns/iter (`± 80`)	`0.93`
`csaf_2_1_tests/6.1.35`	`74990` ns/iter (`± 4771`)	`80818` ns/iter (`± 254`)	`0.93`
`csaf_2_1_tests/6.1.36`	`84771` ns/iter (`± 198`)	`92543` ns/iter (`± 117`)	`0.92`
`csaf_2_1_tests/6.1.37`	`85036` ns/iter (`± 185`)	`89925` ns/iter (`± 104`)	`0.95`
`csaf_2_1_tests/6.1.38`	`45225` ns/iter (`± 52`)	`48582` ns/iter (`± 59`)	`0.93`
`csaf_2_1_tests/6.1.39`	`46205` ns/iter (`± 239`)	`48623` ns/iter (`± 70`)	`0.95`
`csaf_2_1_tests/6.1.40`	`44822` ns/iter (`± 403`)	`49311` ns/iter (`± 74`)	`0.91`
`csaf_2_1_tests/6.1.41`	`45208` ns/iter (`± 381`)	`51056` ns/iter (`± 83`)	`0.89`
`csaf_2_1_tests/6.1.42`	`198228` ns/iter (`± 3487`)	`212983` ns/iter (`± 584`)	`0.93`
`csaf_2_1_tests/6.1.43`	`167044` ns/iter (`± 703`)	`178584` ns/iter (`± 349`)	`0.94`
`csaf_2_1_tests/6.1.44`	`167044` ns/iter (`± 927`)	`179700` ns/iter (`± 805`)	`0.93`
`csaf_2_1_tests/6.1.45`	`128725` ns/iter (`± 1025`)	`168684` ns/iter (`± 343`)	`0.76`
`csaf_2_1_tests/6.1.46`	`264580` ns/iter (`± 5063`)	`281288` ns/iter (`± 937`)	`0.94`
`csaf_2_1_tests/6.1.47`	`466559` ns/iter (`± 2408`)	`530309` ns/iter (`± 868`)	`0.88`
`csaf_2_1_tests/6.1.48`	`88996` ns/iter (`± 129`)	`93558` ns/iter (`± 83`)	`0.95`
`csaf_2_1_tests/6.1.49`	`87440` ns/iter (`± 580`)	`93900` ns/iter (`± 116`)	`0.93`
`csaf_2_1_tests/6.1.50`	`87406` ns/iter (`± 628`)	`94256` ns/iter (`± 176`)	`0.93`
`csaf_2_1_tests/6.1.51`	`135771` ns/iter (`± 300`)	`173613` ns/iter (`± 350`)	`0.78`
`csaf_2_1_tests/6.1.52`	`142973` ns/iter (`± 212`)	`177204` ns/iter (`± 603`)	`0.81`
`csaf_2_1_tests/6.1.53`	`55027` ns/iter (`± 59`)	`59820` ns/iter (`± 191`)	`0.92`
`csaf_2_1_tests/6.1.54`	`61297` ns/iter (`± 263`)	`67953` ns/iter (`± 71`)	`0.90`
`csaf_2_1_tests/6.1.55`	`62428` ns/iter (`± 270`)	`68604` ns/iter (`± 180`)	`0.91`
`csaf_2_1_tests/6.1.56`	`87252` ns/iter (`± 870`)	`101564` ns/iter (`± 251`)	`0.86`
`csaf_2_1_tests/6.1.57`	`125564` ns/iter (`± 1268`)	`136837` ns/iter (`± 587`)	`0.92`
`csaf_2_1_tests/6.1.58`	`91599` ns/iter (`± 175`)	`96620` ns/iter (`± 433`)	`0.95`
`csaf_2_1_tests/6.1.59`	`93068` ns/iter (`± 276`)	`97527` ns/iter (`± 100`)	`0.95`
`csaf_2_1_tests/6.1.60.1`	`76259` ns/iter (`± 715`)	`73017` ns/iter (`± 97`)	`1.04`
`csaf_2_1_tests/6.1.60.2`	`76080` ns/iter (`± 452`)	`72915` ns/iter (`± 96`)	`1.04`
`csaf_2_1_tests/6.1.60.3`	`76172` ns/iter (`± 300`)	`75516` ns/iter (`± 100`)	`1.01`
`csaf_2_1_tests/6.1.61`	`168975` ns/iter (`± 466`)	`184902` ns/iter (`± 452`)	`0.91`
`csaf_2_1_tests/6.2.1`	`676756` ns/iter (`± 4088`)	`728388` ns/iter (`± 2655`)	`0.93`
`csaf_2_1_tests/6.2.2`	`81918` ns/iter (`± 334`)	`83434` ns/iter (`± 646`)	`0.98`
`csaf_2_1_tests/6.2.3`	`77117` ns/iter (`± 849`)	`81220` ns/iter (`± 216`)	`0.95`
`csaf_2_1_tests/6.2.4`	`69377` ns/iter (`± 369`)	`72082` ns/iter (`± 168`)	`0.96`
`csaf_2_1_tests/6.2.5`	`168207` ns/iter (`± 982`)	`217197` ns/iter (`± 353`)	`0.77`
`csaf_2_1_tests/6.2.6`	`171844` ns/iter (`± 1142`)	`222154` ns/iter (`± 315`)	`0.77`
`csaf_2_1_tests/6.2.7`	`64777` ns/iter (`± 477`)	`64452` ns/iter (`± 436`)	`1.01`
`csaf_2_1_tests/6.2.8`	`180535` ns/iter (`± 1992`)	`190507` ns/iter (`± 434`)	`0.95`
`csaf_2_1_tests/6.2.9`	`179351` ns/iter (`± 993`)	`190458` ns/iter (`± 536`)	`0.94`
`csaf_2_1_tests/6.2.11`	`451180` ns/iter (`± 2339`)	`555484` ns/iter (`± 826`)	`0.81`
`csaf_2_1_tests/6.2.12`	`130599` ns/iter (`± 344`)	`138088` ns/iter (`± 217`)	`0.95`
`csaf_2_1_tests/6.2.13`	`3821843` ns/iter (`± 39241`)	`3725675` ns/iter (`± 132141`)	`1.03`
`csaf_2_1_tests/6.2.14`	`135764` ns/iter (`± 608`)	`131548` ns/iter (`± 176`)	`1.03`
`csaf_2_1_tests/6.2.15`	`116598` ns/iter (`± 419`)	`115714` ns/iter (`± 342`)	`1.01`
`csaf_2_1_tests/6.2.16`	`221724` ns/iter (`± 1081`)	`239668` ns/iter (`± 982`)	`0.93`
`csaf_2_1_tests/6.2.17`	`71735` ns/iter (`± 1011`)	`76673` ns/iter (`± 129`)	`0.94`
`csaf_2_1_tests/6.2.18`	`151794` ns/iter (`± 1491`)	`164400` ns/iter (`± 256`)	`0.92`
`csaf_2_1_tests/6.2.19`	`84834` ns/iter (`± 272`)	`88330` ns/iter (`± 63`)	`0.96`
`csaf_2_1_tests/6.2.20`	`7881807` ns/iter (`± 434507`)	`7912182` ns/iter (`± 65678`)	`1.00`
`csaf_2_1_tests/6.2.21`	`317369` ns/iter (`± 1310`)	`373121` ns/iter (`± 675`)	`0.85`
`csaf_2_1_tests/6.2.22`	`152788` ns/iter (`± 307`)	`177256` ns/iter (`± 453`)	`0.86`
`csaf_2_1_tests/6.2.23`	`85340` ns/iter (`± 184`)	`89164` ns/iter (`± 99`)	`0.96`
`csaf_2_1_tests/6.2.24`	`84764` ns/iter (`± 475`)	`89299` ns/iter (`± 141`)	`0.95`
`csaf_2_1_tests/6.2.25`	`85102` ns/iter (`± 332`)	`89668` ns/iter (`± 80`)	`0.95`
`csaf_2_1_tests/6.2.26`	`85174` ns/iter (`± 203`)	`89621` ns/iter (`± 96`)	`0.95`
`csaf_2_1_tests/6.2.27`	`85063` ns/iter (`± 617`)	`89909` ns/iter (`± 133`)	`0.95`
`csaf_2_1_tests/6.2.28`	`68584` ns/iter (`± 2279`)	`76739` ns/iter (`± 1753`)	`0.89`
`csaf_2_1_tests/6.2.29`	`69449` ns/iter (`± 245`)	`76830` ns/iter (`± 2602`)	`0.90`
`csaf_2_1_tests/6.2.30`	`75308` ns/iter (`± 118`)	`81020` ns/iter (`± 478`)	`0.93`
`csaf_2_1_tests/6.2.31`	`86117` ns/iter (`± 254`)	`91656` ns/iter (`± 162`)	`0.94`
`csaf_2_1_tests/6.2.32`	`85923` ns/iter (`± 212`)	`91394` ns/iter (`± 99`)	`0.94`
`csaf_2_1_tests/6.2.33`	`209114` ns/iter (`± 346`)	`252576` ns/iter (`± 1642`)	`0.83`
`csaf_2_1_tests/6.2.34`	`86062` ns/iter (`± 397`)	`91778` ns/iter (`± 94`)	`0.94`
`csaf_2_1_tests/6.2.35`	`86958` ns/iter (`± 437`)	`92073` ns/iter (`± 254`)	`0.94`
`csaf_2_1_tests/6.2.36`	`87414` ns/iter (`± 158`)	`92365` ns/iter (`± 200`)	`0.95`
`csaf_2_1_tests/6.2.37`	`88067` ns/iter (`± 335`)	`92637` ns/iter (`± 110`)	`0.95`
`csaf_2_1_tests/6.2.38`	`95621` ns/iter (`± 476`)	`112620` ns/iter (`± 119`)	`0.85`
`csaf_2_1_tests/6.2.39.1`	`76583` ns/iter (`± 270`)	`73544` ns/iter (`± 440`)	`1.04`
`csaf_2_1_tests/6.2.39.2`	`76285` ns/iter (`± 361`)	`72953` ns/iter (`± 203`)	`1.05`
`csaf_2_1_tests/6.2.39.3`	`75871` ns/iter (`± 376`)	`72976` ns/iter (`± 51`)	`1.04`
`csaf_2_1_tests/6.2.39.4`	`76207` ns/iter (`± 675`)	`73171` ns/iter (`± 90`)	`1.04`
`csaf_2_1_tests/6.2.39.5`	`76579` ns/iter (`± 377`)	`73734` ns/iter (`± 257`)	`1.04`
`csaf_2_1_tests/6.2.40`	`88052` ns/iter (`± 447`)	`96564` ns/iter (`± 125`)	`0.91`
`csaf_2_1_tests/6.2.41`	`163419` ns/iter (`± 695`)	`206487` ns/iter (`± 555`)	`0.79`
`csaf_2_1_tests/6.2.42`	`90738` ns/iter (`± 1741`)	`98071` ns/iter (`± 210`)	`0.93`
`csaf_2_1_tests/6.2.43`	`90883` ns/iter (`± 1599`)	`94648` ns/iter (`± 69`)	`0.96`
`csaf_2_1_tests/6.2.44`	`91093` ns/iter (`± 1048`)	`95355` ns/iter (`± 104`)	`0.96`
`csaf_2_1_tests/6.2.45`	`90647` ns/iter (`± 351`)	`94272` ns/iter (`± 476`)	`0.96`
`csaf_2_1_tests/6.2.46`	`91905` ns/iter (`± 555`)	`95940` ns/iter (`± 112`)	`0.96`
`csaf_2_1_tests/6.2.47`	`91564` ns/iter (`± 316`)	`96267` ns/iter (`± 183`)	`0.95`
`csaf_2_1_tests/6.2.48`	`165311` ns/iter (`± 1132`)	`180024` ns/iter (`± 1432`)	`0.92`
`csaf_2_1_tests/6.2.49`	`92451` ns/iter (`± 769`)	`96749` ns/iter (`± 98`)	`0.96`
`csaf_2_1_tests/6.2.50.1`	`76621` ns/iter (`± 246`)	`72965` ns/iter (`± 162`)	`1.05`
`csaf_2_1_tests/6.2.50.2`	`76205` ns/iter (`± 324`)	`73180` ns/iter (`± 335`)	`1.04`
`csaf_2_1_tests/6.2.50.3`	`76345` ns/iter (`± 185`)	`73168` ns/iter (`± 456`)	`1.04`
`csaf_2_1_tests/6.2.51`	`93043` ns/iter (`± 241`)	`97133` ns/iter (`± 144`)	`0.96`
`csaf_2_1_tests/6.2.52`	`200423` ns/iter (`± 705`)	`216008` ns/iter (`± 658`)	`0.93`
`csaf_2_1_tests/6.2.53`	`81528` ns/iter (`± 725`)	`89145` ns/iter (`± 89`)	`0.91`
`csaf_2_1_tests/6.2.54.1`	`75881` ns/iter (`± 438`)	`73010` ns/iter (`± 67`)	`1.04`
`csaf_2_1_tests/6.2.54.2`	`75761` ns/iter (`± 583`)	`73014` ns/iter (`± 170`)	`1.04`
`csaf_2_1_tests/6.2.54.3`	`76586` ns/iter (`± 1846`)	`72969` ns/iter (`± 43`)	`1.05`
`csaf_2_1_tests/6.2.54.4`	`76433` ns/iter (`± 391`)	`73206` ns/iter (`± 747`)	`1.04`
`csaf_2_1_tests/6.3.1`	`78109` ns/iter (`± 289`)	`75357` ns/iter (`± 43`)	`1.04`
`csaf_2_1_tests/6.3.2`	`103472` ns/iter (`± 664`)	`105670` ns/iter (`± 738`)	`0.98`
`csaf_2_1_tests/6.3.3`	`77794` ns/iter (`± 772`)	`75368` ns/iter (`± 60`)	`1.03`
`csaf_2_1_tests/6.3.4`	`78353` ns/iter (`± 566`)	`75469` ns/iter (`± 68`)	`1.04`
`csaf_2_1_tests/6.3.5`	`78876` ns/iter (`± 314`)	`75626` ns/iter (`± 90`)	`1.04`
`csaf_2_1_tests/6.3.6`	`78817` ns/iter (`± 1183`)	`75631` ns/iter (`± 69`)	`1.04`
`csaf_2_1_tests/6.3.7`	`78737` ns/iter (`± 643`)	`75632` ns/iter (`± 74`)	`1.04`
`csaf_2_1_tests/6.3.8`	`78776` ns/iter (`± 332`)	`75865` ns/iter (`± 90`)	`1.04`
`csaf_2_1_tests/6.3.9`	`196047` ns/iter (`± 1603`)	`192162` ns/iter (`± 640`)	`1.02`
`csaf_2_1_tests/6.3.10`	`91731` ns/iter (`± 643`)	`95763` ns/iter (`± 225`)	`0.96`
`csaf_2_1_tests/6.3.11`	`92364` ns/iter (`± 1174`)	`96048` ns/iter (`± 111`)	`0.96`
`csaf_2_1_tests/6.3.12`	`229375` ns/iter (`± 1079`)	`258635` ns/iter (`± 721`)	`0.89`
`csaf_2_1_tests/6.3.13`	`91630` ns/iter (`± 1125`)	`96451` ns/iter (`± 159`)	`0.95`
`csaf_2_1_tests/6.3.14`	`91805` ns/iter (`± 623`)	`96742` ns/iter (`± 113`)	`0.95`
`csaf_2_1_tests/6.3.15`	`104629` ns/iter (`± 352`)	`101259` ns/iter (`± 373`)	`1.03`
`csaf_2_1_tests/6.3.16`	`92342` ns/iter (`± 4588`)	`97073` ns/iter (`± 83`)	`0.95`
`csaf_2_1_tests/6.3.17`	`92655` ns/iter (`± 1275`)	`97445` ns/iter (`± 279`)	`0.95`
`csaf_2_1_tests/6.3.18`	`104700` ns/iter (`± 436`)	`109016` ns/iter (`± 193`)	`0.96`
`csaf_2_1_tests/6.3.19.1`	`74497` ns/iter (`± 857`)	`72936` ns/iter (`± 83`)	`1.02`
`csaf_2_1_tests/6.3.19.2`	`75534` ns/iter (`± 675`)	`74013` ns/iter (`± 136`)	`1.02`
`csaf_2_1_tests/6.3.19.3`	`75954` ns/iter (`± 832`)	`73223` ns/iter (`± 504`)	`1.04`
`csaf_2_1_tests/6.3.19.4`	`75580` ns/iter (`± 462`)	`72950` ns/iter (`± 82`)	`1.04`
`csaf_2_1_tests/6.3.19.5`	`75771` ns/iter (`± 843`)	`72955` ns/iter (`± 75`)	`1.04`
`csaf_2_1_tests/6.3.20`	`101878` ns/iter (`± 1536`)	`111258` ns/iter (`± 211`)	`0.92`
`csaf_2_1_tests/6.3.21.1`	`75468` ns/iter (`± 994`)	`72957` ns/iter (`± 61`)	`1.03`
`csaf_2_1_tests/6.3.21.2`	`76334` ns/iter (`± 494`)	`73758` ns/iter (`± 126`)	`1.03`
`csaf_2_1_tests/6.3.21.3`	`75404` ns/iter (`± 567`)	`73029` ns/iter (`± 463`)	`1.03`
`csaf_2_1_tests/6.3.21.4`	`75959` ns/iter (`± 414`)	`72994` ns/iter (`± 95`)	`1.04`
`csaf_2_1_tests/6.3.21.5`	`76052` ns/iter (`± 573`)	`72955` ns/iter (`± 94`)	`1.04`
`csaf_2_1_tests/6.3.21.6`	`75189` ns/iter (`± 435`)	`72975` ns/iter (`± 79`)	`1.03`
`csaf_2_1_tests/6.3.21.7`	`75575` ns/iter (`± 767`)	`72939` ns/iter (`± 41`)	`1.04`
`csaf_2_1_tests/6.3.21.8`	`75493` ns/iter (`± 494`)	`73036` ns/iter (`± 424`)	`1.03`
`csaf_2_1_tests/6.3.21.9`	`75706` ns/iter (`± 579`)	`72960` ns/iter (`± 55`)	`1.04`
`csaf_2_1_tests/6.3.22`	`93206` ns/iter (`± 536`)	`97997` ns/iter (`± 130`)	`0.95`
`full_validation/csaf_2_0_full_preset`	`7161967` ns/iter (`± 65953`)	`7517906` ns/iter (`± 54613`)	`0.95`
`full_validation/csaf_2_1_full_preset`	`50585986` ns/iter (`± 1904395`)	`52523777` ns/iter (`± 623465`)	`0.96`
`parse_only/csaf_2_0`	`1114872` ns/iter (`± 7452`)	`1168286` ns/iter (`± 2903`)	`0.95`

This comment was automatically generated by workflow using github-action-benchmark.

tschmidtb51

Please see my comments and suggestions.

I'm reaching out to a few colleagues to see whether we missed something. This will allow us to have the same scheme over all repos.

oxisto

In general, I understand why this is written the way it is - partially because we helped in the initial maintainance of this project and because I maintain a large open-source project myself personally.

But, overall the language and procedures are not very engaging or welcoming. I would suggest that the language should be improved on that. At least if the intention is to open up this project to a potentially larger crowd of people contributing. It currently reads more like a "closed group" open-source project.

oxisto · 2026-07-10T08:02:05Z

+
+## AI usage
+
+We can't be bothered to merge what you didn't bother to write. If a PR is made that is obviously AI we'll probably close without response, unless it's a small change that is easy to review. Of course in that case, why not write it yourself?


This text is not very engaging.

Also this project uses AI-based reviews so obviously some kind of AI is at least used on the project side, so this is a bit of a double standard. It should be made clear that at least AI for review purposes is mostly ok and not sure if there are other exceptions.

What about:

Assistance from LLMs or other artificial neural network tools should help our developers to create better results. Experiences in recent months (up to 2026-07) show that there is a real danger that use of so called "AI tools" for contributions creates significant more work than it saves. In addition there is the question of who is responsible for the code. Our current approach is: You - as a human contributor - are fully responsible for your contribution and the potential review work it causes. Thus we require: Indicate the extend of LLM or ANN assistance. Check the contents fully. (And as corollary: do not let agents generate contributions automatically.)

The motivation behind not allowing AI is a slightly different one, maybe @tschmidtb51 can provide a good explanation here.

bernhardreiter · 2026-07-10T10:52:44Z

Hi, here is more feedback to the current proposal.
This is from @s-l-teichmann and myself, who got asked by @tschmidtb51, because he also aims to use this as a template for other repos and development communities.

First: Thanks for working on this - there is much value in improving our all collaboration.
My feedback is written frank and short - please ask, if I should explain more.

Reviewing https://github.com/csaf-rs/csaf/blob/397efd4d056d7aa9e06c1694df8c4c1224614cd4/CONTRIBUTING.md

Summary

In sum, the amount of rules and their phrasing strikes as too bureaucratic, and thus will have a chilling effect on possible new contributors. For this small product with a few commits and potential developers we recommend to simply and remove many rules. We shall be grateful for any feedback and having the least entry requirements for it.

Ideally people should look how the current development community
works and contribute something that is in line with it.
However that is self-evident and mentioning this does not help much.
It is more important to live a good example.

We see all points that @oxisto made as well, if the sections are kept.

The information in the coding standards section should be extended and potentially moved to
places closer to the code and referred to, as it is special for this repo.

For the ANN section, there is a suggestion above.

Other repos and development communities should develop their own hints what helps them to work nicely together.
Maybe with the exception of the ANN section, which is more general.

General improvements, if sections are kept:

information should only be kept once for those files
that regular devs will re-read rarely.
Otherwise the changes are high that those places get out of date
with the next update.
- link to the build and development section elsewhere, like
  in the README.md
- (this includes the prerequisites, like the minimum Rust version number)
- All CI checks seems to duplicate the section in the dev setup
- some commands in coding standards duplicate in dev setup
For more experienced contributors, there is too much general information,
which
- makes it harder to see what is special about this repository
- uses suboptimal explanations of how things should work, the general
  thinks are explained better elsewhere.
- gives a sense of completeness where other general software engineering
  methods still have to apply. (E.g. good commit messages, testing)
  Examples:
  - issue reporting
  - cloning (an example with https: is given where many use ssh)
  - when changing things in the single submodule, they cannot be
    contributed
As https://www.whyprogramsfail.com/ puts forward, the terminology
"bug" is suboptimal. Better would be "defect" for something that does
behave as specified. (Yes, github is not advancing the state of
software engineering at this point.)
What about copyright /exploitating rights? (-> too early for an CLA)

Pull Request Process

Shouldn't it be okay to have merge requests that include a single
step towards a solution? Then "closing" would not be adequate...
better is to mention and describe the issue that is improved or affected by the merge request.

Coding Standards

Some of those looks like they should be documented closer to the part
of the code they refer to, in here in the general section.

Commit Message Guidelines

We do not see that conventional-commits are helpful. The mechanisms to generate the News and new version numbers do not work that well. There is not really time or the need to really discuss all the scopes within the team for instance.

We advise against it.
Better do a human driven News compilation and versioning decision.

rramos-xx · 2026-07-15T13:34:34Z

In case AI assistance is allowed to some extent, I see for instance the approach taken by the following project, where in the contributing.md they indicate to follow their "AI Policy" linking to a dedicated document. That policy reads quite reasonably to me:

https://github.com/astral-sh/ruff/blob/main/CONTRIBUTING.md
https://github.com/astral-sh/.github/blob/main/AI_POLICY.md

bernhardreiter · 2026-07-16T08:41:02Z

That policy reads quite reasonably to me
https://github.com/astral-sh/.github/blob/main/AI_POLICY.md

The policy, coming from a company that just joined an LLM company (https://astral.sh/blog/openai), is reasonable if you want to promote and increase LLM assistance. The scope of the products and communities we are talking about here is much smaller. Thus I prefer to keep the policy part as small as possible and more give the general direction. See me suggestion above, I think it is more fitting.

tziemek · 2026-07-16T13:51:03Z

Thank you all for your suggestion, we'll change the guide accordingly and ping you again for another review.

tziemek · 2026-07-22T08:32:04Z

@oxisto @bernhardreiter @tschmidtb51 @rainer-exxcellent
I reduced the contributions file to a minimum, so it fits on one page. I wouldn't read it anyways if it were longer.
Moved coding related information to CODING_GUIDELINES and referenced those, but also kept them concise.
Added a script to help in test file generation, but omitted basic software engineering parts like speaking variable names and common behavior in Github.

bernhardreiter · 2026-08-05T12:43:19Z

+
+## Schemas and type generation
+
+We have several json schema files included in the code base from which code is generated. The most prominent being the CSAF repository which is integrated as a git submodule. If there are changes to those schemas, we have to review these changes and incorporate them into our code. This can mean regenerating code (this is here referred to as 'asset-update') and updating existing code to match the new requirements.


A small phrasing issue:

json schema files [..]
The most prominent being the CSAF repository

I suggest to add a from so it reads:

The most prominent being from the CSAF repository

bernhardreiter

Looks good to me
(after a quick read, I did not check the code or command contents at all).

tziemek requested a review from a team as a code owner June 23, 2026 13:36

github-actions Bot reviewed Jun 23, 2026

View reviewed changes

peinjoh reviewed Jun 23, 2026

View reviewed changes

Comment thread CONTRIBUTING.md Outdated

This was referenced Jun 23, 2026

Implementing 6.2.24 Usage of Non-Latest CWE Version #699

Merged

Enable validator for test 6.3.11 in CSAF 2.1 #690

Closed

tschmidtb51 reviewed Jul 3, 2026

View reviewed changes

Comment thread .github/ISSUE_TEMPLATE/defect_report.md

Comment thread CONTRIBUTING.md Outdated

tziemek added 3 commits July 6, 2026 10:07

docs: add contributing guidelines

aaa44d5

correct type-generator arguments

2088950

add log section to bug_report and link for issues to contributing guide.

397efd4

tziemek force-pushed the docs/contributing-guidelines branch from b512a50 to 397efd4 Compare July 6, 2026 08:15

oxisto reviewed Jul 10, 2026

View reviewed changes

peinjoh mentioned this pull request Jul 15, 2026

feat: Add support for Debian versioning scheme csaf-rs/vers-rs#12

Merged

rainer-exxcellent reviewed Jul 20, 2026

View reviewed changes

Comment thread CONTRIBUTING.md Outdated

rainer-exxcellent reviewed Jul 20, 2026

View reviewed changes

Comment thread CONTRIBUTING.md Outdated

rainer-exxcellent reviewed Jul 20, 2026

View reviewed changes

Comment thread CONTRIBUTING.md Outdated

tziemek added 3 commits July 21, 2026 17:04

update readme after pr review

1e890b5

fix links

d407b80

removed unnecessary lines

89a7d28

bernhardreiter reviewed Aug 5, 2026

View reviewed changes

bernhardreiter approved these changes Aug 5, 2026

View reviewed changes

tziemek mentioned this pull request Aug 24, 2026

feat(ci): add conventional commit enforcement #843

Merged


		## AI usage

		We can't be bothered to merge what you didn't bother to write. If a PR is made that is obviously AI we'll probably close without response, unless it's a small change that is easy to review. Of course in that case, why not write it yourself?


		## Schemas and type generation

		We have several json schema files included in the code base from which code is generated. The most prominent being the CSAF repository which is integrated as a git submodule. If there are changes to those schemas, we have to review these changes and incorporate them into our code. This can mean regenerating code (this is here referred to as 'asset-update') and updating existing code to match the new requirements.

Uh oh!

Conversation

tziemek commented Jun 23, 2026

Uh oh!

tziemek commented Jun 23, 2026

Uh oh!

github-actions Bot left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

CSAF Validation Benchmark

Uh oh!

Uh oh!

tschmidtb51 left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

oxisto left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

oxisto Jul 10, 2026

Choose a reason for hiding this comment

Uh oh!

bernhardreiter Jul 10, 2026

Choose a reason for hiding this comment

Uh oh!

oxisto Jul 10, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

bernhardreiter commented Jul 10, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

General improvements, if sections are kept:

Pull Request Process

Coding Standards

Commit Message Guidelines

Uh oh!

rramos-xx commented Jul 15, 2026

Uh oh!

bernhardreiter commented Jul 16, 2026

Uh oh!

tziemek commented Jul 16, 2026

Uh oh!

Uh oh!

Uh oh!

Uh oh!

tziemek commented Jul 22, 2026

Uh oh!

bernhardreiter Aug 5, 2026

Choose a reason for hiding this comment

Uh oh!

bernhardreiter left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

7 participants

github-actions Bot left a comment •

edited

Loading

oxisto Jul 10, 2026 •

edited

Loading

bernhardreiter commented Jul 10, 2026 •

edited

Loading

bernhardreiter left a comment •

edited

Loading