[heemankv]

Summary

• Add an OSS Verify cargo-fuzz target for Madara's event Bloom filter primitive.
• Check that inserted keys remain present through both direct and precomputed-hash queries.
• Add the pinned Rust dependency lock and build recipe for Theorem's static riscv64 builder.

Validation

• cargo build --manifest-path .oss-verify/fuzz/Cargo.toml --bin event_bloom — passed.
• Native libFuzzer run with two seed inputs — passed.
• Rust coverage showed add and both query methods executed four times each; finalize executed three times.
• Flipping each membership check separately made the ff 01 5a seed abort, confirming that both checks can detect a violation.
• cargo fmt --manifest-path .oss-verify/fuzz/Cargo.toml -- --check — passed.
• Theorem's tools/validate.py projects/madara — passed with a temporary test manifest. The security contact is still required for the real manifest.
• Theorem's source layout and locked crate vendoring — passed locally (67 crates).
• Theorem's tools/check --no-shell --twice madara — passed: plain, UB-check, AddressSanitizer, and combined binaries were byte identical across two clean builds.

Enrollment follow-up

The OSS Verify enrollment instructions require a separate PR to theorem-labs/oss-verify with projects/madara/project.yaml. That manifest needs a maintainer security contact and the enrolling maintainer's acceptance of the program terms. This PR supplies the Madara-hosted build files for it.

[greptile-apps]

Confidence Score: 5/5

[Low impact] The changes since the previous review appear safe to merge.

_{Reviews (2) · Last reviewed commit: "Document bloom property mutation witness..." · Reviewed by Greptile}