// the find
enarx/ciborium
CBOR utilities
Ciborium is a CBOR serialization library for Rust built on serde, maintained by the Enarx project (confidential computing). It handles the full CBOR spec including tags, indefinite-length encoding, and `no_std` environments. If you need CBOR in Rust, this is the most actively maintained option since `serde_cbor` was abandoned.
The three-crate split (ciborium-io, ciborium-ll, ciborium) is well-structured: the low-level layer is usable without serde, which matters for embedded/wasm targets. Smallest-size numeric encoding is the correct default for wire compatibility with dynamic languages and is lossless for floats. Map is `Vec<(Value, Value)>` rather than a hash map, which preserves insertion order and avoids silent key deduplication bugs. The test suite includes fuzz tests and a dedicated recursion test, which is exactly where CBOR parsers tend to blow up.
387 stars for a library that's essentially the only maintained CBOR option in Rust is low — adoption is narrow outside the Enarx/WebAuthn/COSE ecosystems. The low-level `basic` module is still private, so you can't build a zero-copy parser on top of it without forking. CBOR tag handling is present but the API is awkward: `Tag<T>` is a wrapper type that pushes the complexity onto you. No async reader/writer support — everything goes through synchronous `Read`/`Write` traits, which requires bridging in async contexts.