Repository publication is pending. The instructions below describe the source tree as it will be published (AGPL-3.0). Until the public repository is live, treat them as the contribution guide-in-waiting.

Contributing

Tallow is open source under the AGPL-3.0 license. Contributions are welcome.

Repository

git clone https://github.com/tallowteam/Tallow.git
cd Tallow

Build from Source

Requires Rust stable toolchain (1.86+):

# Build all crates
cargo build --workspace

# Build the CLI only
cargo build -p tallow

# Build the relay server
cargo build -p tallow-relay

# Build in release mode
cargo build --workspace --release

Test Suite

# Run all tests
cargo test --workspace

# Run a specific crate's tests
cargo test -p tallow-crypto
cargo test -p tallow-protocol
cargo test -p tallow-net

# Run a specific test
cargo test test_name

# Run with output
cargo test -- --nocapture

Code Quality

# Lint (warnings are errors)
cargo clippy --workspace -- -D warnings

# Format check
cargo fmt --check

# Security audit
cargo audit

# License and advisory checks
cargo deny check

Architecture

Tallow is organized as a 7-crate Rust workspace:

For detailed architecture, see docs/architecture.md in the repository.

Code Rules

• Result<T, E> everywhere. No .unwrap() outside #[cfg(test)].
• thiserror for library errors, anyhow only in the main binary.
• #![forbid(unsafe_code)] in all crates except where explicitly required.
• All unsafe blocks require a // SAFETY: comment.
• All key material types must implement Zeroize.
• Use subtle::ConstantTimeEq for secret-dependent comparisons.
• No println! — use tracing macros (info!, warn!, error!).
• All public items get /// doc comments.

Security Rules

These are non-negotiable:

• Never commit secrets, keys, or credentials
• Never use unsafe without documented SAFETY justification
• Never downgrade crypto algorithms without documented rationale
• Never use non-constant-time comparisons on secrets
• Never reuse AES-GCM nonces
• All key material must be zeroized on drop

Website Development

The website is an Astro 5 app in the website/ directory:

cd website
pnpm install
pnpm run dev      # Dev server at localhost:3000
pnpm run build    # Static export to dist/
pnpm run check    # Astro diagnostics

Pull Request Process

1. Fork the repository
2. Create a feature branch: feat/, fix/, security/, refactor/
3. Write tests for your changes
4. Ensure all checks pass: cargo test, cargo clippy, cargo fmt
5. Submit a pull request with a clear description
6. Squash merge to master after approval

Code of Conduct

We follow the Contributor Covenant Code of Conduct. Be respectful, inclusive, and constructive.

Reporting Security Issues

Please report security vulnerabilities responsibly via GitHub Security Advisories or email at tallowteam@proton.me. Do not open public issues for security bugs.