Subject
time 0.3.47 is a date/time library for Rust targeting both std and no_std environments. It exposes Date, Time, Duration, UtcOffset, OffsetDateTime, UtcDateTime, and PrimitiveDateTime as the main public types. All datetime arithmetic is available in checked, saturating, and panicking forms. The crate implements its own format-description parser and a strftime-style formatter, and optionally integrates with serde, rand (0.8 and 0.9), and quickcheck. Local UTC offset lookup is feature-gated behind local-offset and uses platform-specific system calls.
Methodology
Audit performed with openvet 0.6.0 on 2026-05-28. The published tarball was compared against the upstream git repository (github.com/time-rs/time commit d5144cd2874862d46466c900910cd8577d066019). The VCS checkout was obtained via openvet audit vcs git; the only diff between contents and the commit was Cargo.toml normalisation and the absence of README.md from the published subtree (explained by the include list in Cargo.toml.orig). All 24,901 lines of source in contents/src/ were read or sampled. Files receiving full reads were duration.rs, date.rs, time.rs, utc_offset.rs, utc_date_time.rs, offset_date_time.rs, util.rs, rand08.rs, rand09.rs, quickcheck.rs, sys/local_offset_at/unix.rs, sys/local_offset_at/windows.rs, sys/refresh_tz/unix.rs, parsing/component.rs, and formatting/component_provider.rs. The format-description parser directory was surveyed for unsafe (none found). Survey greps covered network, filesystem, process, environment, concurrency, crypto, and RNG patterns.
Results
The contents are byte-equivalent to the VCS commit after accounting for Cargo.toml normalisation, confirming is-benign. No binary assets are present (has-binaries), and there is no build script (has-build-exec) and no install script (has-install-exec). The crate has 572 test functions across unit and integration tests (has-unit-tests, has-integration-tests) and quickcheck property tests (has-property-tests). No fuzz harness is included in the published package (has-fuzz-tests).
The crate has no network I/O (uses-network), no filesystem access (uses-filesystem), no subprocess invocation (uses-exec), no cryptographic operations (uses-crypto), no JIT (uses-jit, impl-jit), and no interpreter (uses-interpreter). It does not implement concurrency primitives (impl-concurrency), cryptography (impl-crypto), a protocol (impl-protocol), a data structure (impl-datastructure), or an interpreter (impl-interpreter), nor does it use these features at runtime (uses-concurrency). The local-offset feature reads std::env::consts::OS at compile time to determine whether the OS has a thread-safe environment; this is not a runtime environment variable read but a const expression. uses-environment is true and environment-safe holds because the read is purely for OS detection.
The crate contains approximately 105 unsafe blocks (uses-unsafe). Every unsafe block carries a // Safety: comment (unsafe-documented). The Clippy lint undocumented-unsafe-blocks is set to deny in Cargo.toml, enforcing this at compile time. The unsafe code falls into four categories: NonZero::new_unchecked for values proven non-zero by construction, RangedI32::new_unchecked for values proven in range by preceding arithmetic, core::mem::transmute for POD-to-POD reinterpretation and for Weekday (a plain enum with variants 0-6, transmuted only after bounds-checking the index), and FFI calls to libc::localtime_r and Windows SystemTimeToTzSpecificLocalTime. All call sites were reviewed and the invariants hold (unsafe-safe, unsafe-minimal). Unsafe blocks are exercised by the 572-test integration suite and quickcheck property tests, but no Miri or sanitizer run was observed in the published package (unsafe-tested is false).
The local-offset localtime path (RUSTSEC-2020-0071 in time 0.1) is addressed: tzset is called only when num_threads::is_single_threaded() returns Some(true) or when the OS is on a compile-time whitelist (macOS, illumos, NetBSD). The Windows path uses SystemTimeToTzSpecificLocalTime, which is documented as thread-safe.
Duration arithmetic uses checked_add, checked_sub, and checked_mul for the fallible variants, with overflowing_add and overflowing_mul plus explicit saturation in the saturating variants. The try_from_secs macro handles NaN, negative overflow, and positive overflow for f32 and f64 inputs. The nanoseconds field is typed as RangedI32<-999_999_999, 999_999_999>, enforcing the invariant at the type level. Julian day arithmetic in Date::from_julian_day_unchecked uses fixed-point multiplication constants that are computed at compile time and valid for the supported year range. Date::checked_add and Date::checked_sub convert to Julian day and back with checked_add/checked_sub on the i32 Julian day number, keeping results within Date::MIN/Date::MAX. These algorithms are correct for all inputs within the documented range (impl-algorithm, algorithm-impl-safe, algorithm-impl-correct, algorithm-impl-bounds, algorithm-impl-tested).
The format-description parser and strftime parser implement parsing of format strings from untrusted input, and the datetime component parser handles user-supplied datetime strings (impl-parser). Neither parser contains unsafe code. Input is parsed as byte slices and all allocations are bounded by input length. Component parsers bounds-check all numeric fields before constructing any time type. The 572-test integration suite exercises formatting and parsing round-trips (parser-impl-safe, parser-impl-tested, parser-impl-correct).
Conclusion
time 0.3.47 is a ~25 KLOC date/time library. All 105 unsafe blocks carry safety comments and their invariants were verified. The RUSTSEC-2020-0071 localtime thread-safety issue is resolved by gating tzset on a thread-count check or an OS-level thread-safety guarantee. Arithmetic overflow is handled via checked and saturating variants throughout. No network I/O, filesystem access, cryptography, or process execution is present. The format-description and datetime parsers contain no unsafe code and pass a 572-test integration suite. No findings were identified.