Subject
uuid is a Rust library for generating, parsing, and formatting Universally Unique Identifiers per RFC 9562 (the successor to RFC 4122). It exposes a #[repr(transparent)] Uuid([u8; 16]) type, four textual formats (simple, hyphenated, braced, URN), parsers for each, and constructors for UUID versions 1 through 8 behind individual Cargo features. Optional integrations cover serde, borsh, bytemuck, zerocopy, slog, and arbitrary. The crate is #![no_std] by default; the std feature adds SystemTime-based timestamps and thread-local clock-sequence contexts.
The auxiliary NonNilUuid type (#[repr(transparent)] over NonZeroU128) provides a niche-optimised representation so Option<NonNilUuid> is the same 16 bytes as Uuid.
Methodology
The published crate was downloaded by openvet audit new and unpacked into contents/; the upstream Git repository (https://github.com/uuid-rs/uuid) was cloned and checked out at the commit recorded in .cargo_vcs_info.json.
Tools used:
openvet audit (workspace creation, annotations, claims, findings, dependency narratives, report).
diff -rq (GNU diffutils 3.x) to compare contents/src/ against vcs/src/.
grep to enumerate unsafe blocks, extern "C" declarations, standard-library I/O patterns (std::net::, std::env::, std::process::, std::fs::, std::thread::spawn), and concurrency primitives (atomics, mutexes, locks).
wc -l for line counts.
All 20 hand-written source files under src/ (~8700 LOC) were read in full or surveyed for the patterns above. Every unsafe block was reviewed individually. The optional-feature surface (v1-v8, serde, borsh, bytemuck, zerocopy, slog, arbitrary, js, fast-rng, rng-rand, rng-getrandom) was enumerated from the Cargo.toml manifest. The upstream repository's tests/, fuzz/, and benches/ directories were surveyed to confirm the existence and shape of out-of-crate tests.
Results
The diff between published contents and upstream shows that all source files match byte-for-byte. The differences are limited to cargo's standard Cargo.toml normalisation (header banner, key reordering, dependency table reformatting), the cargo-generated Cargo.lock and .cargo_vcs_info.json, and the upstream-only .github/, benches/, examples/, fuzz/, rng/, tests/, CODE_OF_CONDUCT.md, CONTRIBUTING.md, COPYRIGHT, SECURITY.md paths (none expected in the published crate; the manifest's include = [...] list explicitly restricts publication to src/, README.md, and the two licence files).
The crate ships no binary artefacts (justifying has-binaries), no build.rs (justifying has-build-exec), no installer hook (justifying has-install-exec), and no proc-macro entry point. Two #[wasm_bindgen] extern "C" blocks are present and active only on wasm32-unknown-unknown builds: one for Date.now() in src/timestamp.rs and one for crypto.getRandomValues in src/rng.rs (the latter is a vendored copy of getrandom's wasm-bindgen backend with its licence preserved inline). Neither is reachable on a non-wasm target.
The codebase was searched for std::net, std::env, std::process, std::fs, std::thread::spawn, and HTTP-client crates; none were found. This is the basis for uses-network, uses-filesystem, uses-exec, uses-environment, uses-jit, and uses-interpreter. The corresponding implementation claims impl-interpreter, impl-jit, impl-protocol, impl-datastructure, impl-algorithm, impl-crypto, and impl-concurrency are all false: the crate is a thin user of md-5, sha1_smol, getrandom/rand, atomic, and std::sync::Mutex, not an implementer of those primitives.
Nine unsafe blocks were found across the crate, justifying uses-unsafe. Four are calls to str::from_utf8_unchecked_mut in src/fmt.rs (lines 237, 247, 272, 285) over buffers that were just written with the ASCII-only hex tables (LOWER/UPPER) plus -, {, }, urn:uuid:; one is core::mem::transmute of a repr(C) { u8, [u8; 36], u8 } to [u8; 38] for the braced encoding (src/macros.rs:54, used at src/fmt.rs:269); two are NonZeroU128::new_unchecked in src/non_nil.rs (the public pub const unsafe fn new_unchecked and its test); one is std::str::from_utf8_unchecked in src/error.rs:108 over bytes already validated by a successful std::str::from_utf8 four lines earlier; the last is the test-only new_unchecked call. Each unsafe block in the hot paths is annotated with a // SAFETY: comment. Together these support unsafe-safe, unsafe-documented, unsafe-minimal, and unsafe-tested.
Cryptography is used in two places: src/md5.rs wraps md-5 for the v3 namespace-name hash, and src/sha1.rs wraps sha1_smol for the v5 namespace-name hash, both as RFC 9562 mandates. Random bytes for v4 UUIDs come from getrandom, rand, or crypto.getRandomValues (WebCrypto), selected by feature and target. MD5 and SHA-1 are collision-broken cryptographically but their use here is for identifier derivation (where collision resistance is not a security property of the application), not signing or authentication; this is the basis for uses-crypto = true with crypto-safe.
Concurrency primitives appear in the v1/v6/v7 clock-sequence contexts: Atomic<u16> (from the atomic crate) for the v1/v6 14-bit counter, std::sync::Mutex<ContextV7> for the v7 shared state, and ThreadLocalContext wrapping thread::LocalKey for thread-local contexts under the std feature. Justifies uses-concurrency, concurrency-safe, and concurrency-documented.
The parser (src/parser.rs) accepts the four textual UUID formats via const lookup tables (HEX_TABLE, SHL4_TABLE), and is paired with a detailed-diagnostics path in src/error.rs. It is exercised by ~25 in-tree unit tests, four upstream trybuild UI tests, and a fuzz target (vcs/fuzz/fuzz_targets/fuzz_target_parse.rs). Justifies impl-parser, parser-impl-safe, parser-impl-tested, parser-impl-correct, has-unit-tests, has-integration-tests, and has-fuzz-tests (the fuzz harness lives upstream, not in the published crate, but its existence is part of the project's testing posture). No property-test harness was found in either the published crate or the upstream tree, justifying has-property-tests.
One low-severity quality finding (FINDING-1) was recorded: src/error.rs:108 contains a redundant unsafe { from_utf8_unchecked(...) } call — the same bytes are validated by a from_utf8 call four lines earlier, so the unsafe block could be replaced by reusing the already-validated &str. No correctness or safety impact.
No malicious code, no obfuscated payloads, no target-conditional code beyond the documented wasm32 paths, and no supply-chain anomalies were observed; this is the basis for is-benign.
Conclusion
uuid is a mature, well-maintained, broadly used library with a tight scope and a careful test posture. The unsafe surface is small, focused, documented, and confined to ASCII-only string formatting plus the NonNilUuid niche optimisation. Cryptographic use is delegated to vetted external crates and is appropriate for RFC 9562's identifier-derivation semantics. The wasm32 FFI paths are clearly scoped behind feature gates and target predicates. The single finding is a documentation-grade refactor opportunity rather than a defect.