diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index a5a73a7..aaf1d64 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -102,17 +102,17 @@ jobs: # CI green but breaks every relay image rebuild. This job reproduces that # exact build so the breakage is caught here, not in production. # - # Pinned to the same rust:1.95-alpine digest the relay Dockerfile ships. + # Pinned to the same rust:1.98-alpine digest the relay Dockerfile ships. # When bumping the relay's base image, bump it here too: if this job goes # red, the new base cannot build the binding and must not be deployed. - # `--locked` forces the committed Cargo.lock (oqs 0.10.1 + vendored - # liboqs 0.12.0) so a silent transitive bump can't drift the build either. + # `--locked` forces the committed Cargo.lock (oqs 0.11.0 + vendored + # liboqs 0.13.0) so a silent transitive bump can't drift the build either. # Checkout runs on the host (the alpine image has no Node for actions), then # we mount the tree into the container for the build. - name: Build the napi binding on alpine/musl run: | docker run --rm -v "$PWD":/src -w /src \ - rust:1.95-alpine@sha256:606fd313a0f49743ee2a7bd49a0914bab7deedb12791f3a846a34a4711db7ed2 \ + rust:1.98-alpine@sha256:a10e64dd139b7387337c7fbe8aca31b959b57b2fd4c8ae20a02cf1d6ea424dce \ sh -euc ' apk add --no-cache musl-dev gcc g++ make cmake ninja clang clang-dev llvm-dev perl nasm git bash export LIBCLANG_PATH=/usr/lib diff --git a/CHANGELOG.md b/CHANGELOG.md index 5c03476..8724f06 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -7,6 +7,21 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0 ## [Unreleased] +### Changed +- **`oqs` 0.10.1 -> 0.11.0 (liboqs 0.12.0 -> 0.13.0), `oqs-sys` patched to + upstream commit `4ca07ba` (bindgen 0.71 -> 0.72).** The relay's + `rust:1.98-alpine` base (Alpine 3.24, libclang 22) made the crypto binding + fail to compile: bindgen 0.71 emits the forward-declared `OQS_SIG` as an + opaque struct under libclang 22 (`E0609: no field alg_version on &OQS_SIG`), + reproduced with a two-line header. bindgen 0.72 resolves it; upstream bumped + the requirement in liboqs-rust#289 without a crates.io release, so + `[patch.crates-io]` pins that commit (published 0.11.0 tree + the one-line + bump, same liboqs 0.13.0 submodule). The `musl-node-binding` CI job moves to + the same `rust:1.98-alpine` digest. Algorithm identifiers (`ML-DSA-65`, + `ML-KEM-768`, `SPHINCS+-SHA2-128f-simple`, `Falcon-512`) are unchanged + between liboqs 0.12.0 and 0.13.0; the ML-DSA-65 and ML-KEM-768 KAT suites + and the relay crypto suite pass unchanged against the new binding. + ### Removed - **ParaDrop envelope (`envelope::para_drop`).** The anonymous BIP-39 mnemonic drop primitive is removed together with the relay feature it backed: diff --git a/Cargo.lock b/Cargo.lock index 33034c2..87d1c21 100644 --- a/Cargo.lock +++ b/Cargo.lock @@ -107,16 +107,14 @@ checksum = "2af50177e190e07a26ab74f8b1efbfe2ef87da2116221318cb1c2e82baf7de06" [[package]] name = "bindgen" -version = "0.69.5" +version = "0.72.1" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "271383c67ccabffb7381723dea0672a673f292304fcb45c01cc648c7a8d58088" +checksum = "993776b509cfb49c750f11b8f07a46fa23e0a1386ffc01fb1e7d343efc387895" dependencies = [ "bitflags", "cexpr", "clang-sys", "itertools", - "lazy_static", - "lazycell", "log", "prettyplease", "proc-macro2", @@ -125,7 +123,6 @@ dependencies = [ "rustc-hash", "shlex", "syn", - "which", ] [[package]] @@ -436,7 +433,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "39cab71617ae0d63f51a36d69f866391735b51691dbda63cf6f96d042b63efeb" dependencies = [ "libc", - "windows-sys 0.61.2", + "windows-sys", ] [[package]] @@ -586,15 +583,6 @@ dependencies = [ "digest 0.10.7", ] -[[package]] -name = "home" -version = "0.5.12" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "cc627f471c528ff0c4a49e1d5e60450c8f6461dd6d10ba9dcd3a61d3dff7728d" -dependencies = [ - "windows-sys 0.61.2", -] - [[package]] name = "hybrid-array" version = "0.4.12" @@ -677,18 +665,6 @@ dependencies = [ "rand_core 0.10.1", ] -[[package]] -name = "lazy_static" -version = "1.5.0" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "bbd2bcb4c963f2ddae06a2efc7e9f3591312473c50c6685e1f298068316e66fe" - -[[package]] -name = "lazycell" -version = "1.3.0" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "830d08ce1d1d941e6b30645f1a0eb5643013d835ce3779a5fc208261dbe10f55" - [[package]] name = "leb128fmt" version = "0.1.0" @@ -711,12 +687,6 @@ dependencies = [ "windows-link", ] -[[package]] -name = "linux-raw-sys" -version = "0.4.15" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "d26c52dbd32dccf2d10cac7725f8eae5296885fb5703b261f7d0a0739ec807ab" - [[package]] name = "linux-raw-sys" version = "0.12.1" @@ -872,9 +842,9 @@ checksum = "c08d65885ee38876c4f86fa503fb49d7b507c2b62552df7c70b2fce627e06381" [[package]] name = "oqs" -version = "0.10.1" +version = "0.11.0" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "828f06d734c93f9ba75f0ae8075a7eb25d71c59705f2a7bf426ed997fe62beb5" +checksum = "48caac02cf42ba00b865a747e332828a75341d97ae35ad1ae9785e56de212e78" dependencies = [ "cstr_core", "libc", @@ -883,9 +853,8 @@ dependencies = [ [[package]] name = "oqs-sys" -version = "0.10.1+liboqs-0.12.0" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "b4084714b15c8545e7dd2e9d1e4a5482547ece7476d07f4b5e96b5babb78c4dd" +version = "0.11.0+liboqs-0.13.0" +source = "git+https://github.com/open-quantum-safe/liboqs-rust.git?rev=4ca07bae34773cdb1ec04c7d0866345cb551914b#4ca07bae34773cdb1ec04c7d0866345cb551914b" dependencies = [ "bindgen", "build-deps", @@ -1119,22 +1088,9 @@ checksum = "dc897dd8d9e8bd1ed8cdad82b5966c3e0ecae09fb1907d58efaa013543185d0a" [[package]] name = "rustc-hash" -version = "1.1.0" +version = "2.1.3" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "08d43f7aa6b08d49f382cde6a7982047c3426db949b1424bc4b7ec9ae12c6ce2" - -[[package]] -name = "rustix" -version = "0.38.44" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "fdb5bc1ae2baa591800df16c9ca78619bf65c0488b41b96ccec5d11220d8c154" -dependencies = [ - "bitflags", - "errno", - "libc", - "linux-raw-sys 0.4.15", - "windows-sys 0.59.0", -] +checksum = "6b1e7f9a428571be2dc5bc0505c13fb6bf936822b894ec87abf8a08a4e51742d" [[package]] name = "rustix" @@ -1145,8 +1101,8 @@ dependencies = [ "bitflags", "errno", "libc", - "linux-raw-sys 0.12.1", - "windows-sys 0.61.2", + "linux-raw-sys", + "windows-sys", ] [[package]] @@ -1299,8 +1255,8 @@ dependencies = [ "fastrand", "getrandom 0.4.2", "once_cell", - "rustix 1.1.4", - "windows-sys 0.61.2", + "rustix", + "windows-sys", ] [[package]] @@ -1466,33 +1422,12 @@ dependencies = [ "semver", ] -[[package]] -name = "which" -version = "4.4.2" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "87ba24419a2078cd2b0f2ede2691b6c66d8e47836da3b6db8265ebad47afbfc7" -dependencies = [ - "either", - "home", - "once_cell", - "rustix 0.38.44", -] - [[package]] name = "windows-link" version = "0.2.1" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "f0805222e57f7521d6a62e36fa9163bc891acd422f971defe97d64e70d0a4fe5" -[[package]] -name = "windows-sys" -version = "0.59.0" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "1e38bc4d79ed67fd075bcc251a1c39b32a1776bbe92e5bef1f0bf1f8c531853b" -dependencies = [ - "windows-targets", -] - [[package]] name = "windows-sys" version = "0.61.2" @@ -1502,70 +1437,6 @@ dependencies = [ "windows-link", ] -[[package]] -name = "windows-targets" -version = "0.52.6" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "9b724f72796e036ab90c1021d4780d4d3d648aca59e491e6b98e725b84e99973" -dependencies = [ - "windows_aarch64_gnullvm", - "windows_aarch64_msvc", - "windows_i686_gnu", - "windows_i686_gnullvm", - "windows_i686_msvc", - "windows_x86_64_gnu", - "windows_x86_64_gnullvm", - "windows_x86_64_msvc", -] - -[[package]] -name = "windows_aarch64_gnullvm" -version = "0.52.6" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "32a4622180e7a0ec044bb555404c800bc9fd9ec262ec147edd5989ccd0c02cd3" - -[[package]] -name = "windows_aarch64_msvc" -version = "0.52.6" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "09ec2a7bb152e2252b53fa7803150007879548bc709c039df7627cabbd05d469" - -[[package]] -name = "windows_i686_gnu" -version = "0.52.6" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "8e9b5ad5ab802e97eb8e295ac6720e509ee4c243f69d781394014ebfe8bbfa0b" - -[[package]] -name = "windows_i686_gnullvm" -version = "0.52.6" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "0eee52d38c090b3caa76c563b86c3a4bd71ef1a819287c19d586d7334ae8ed66" - -[[package]] -name = "windows_i686_msvc" -version = "0.52.6" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "240948bc05c5e7c6dabba28bf89d89ffce3e303022809e73deaefe4f6ec56c66" - -[[package]] -name = "windows_x86_64_gnu" -version = "0.52.6" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "147a5c80aabfbf0c7d901cb5895d1de30ef2907eb21fbbab29ca94c5b08b1a78" - -[[package]] -name = "windows_x86_64_gnullvm" -version = "0.52.6" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "24d5b23dc417412679681396f2b49f3de8c1473deb516bd34410872eff51ed0d" - -[[package]] -name = "windows_x86_64_msvc" -version = "0.52.6" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "589f6da84c646204747d1270a2a5661ea66ed1cced2631d546fdfb155959f9ec" - [[package]] name = "wit-bindgen" version = "0.51.0" diff --git a/Cargo.toml b/Cargo.toml index 30d5558..8208289 100644 --- a/Cargo.toml +++ b/Cargo.toml @@ -17,7 +17,7 @@ repository = "https://github.com/Apolloccrypt/paramant-core" # Post-quantum crypto via liboqs. M1 enables only ML-KEM (FIPS 203); # signature families (FIPS 204/205/206) are switched on at M2. No OpenSSL # backend -- liboqs builds its own symmetric primitives. -oqs = { version = "0.10", default-features = false, features = ["ml_kem", "ml_dsa", "sphincs", "falcon", "std"] } +oqs = { version = "0.11", default-features = false, features = ["ml_kem", "ml_dsa", "sphincs", "falcon", "std"] } # Classical crypto (FIPS-validated AWS-LC) aws-lc-rs = "1.13" @@ -51,3 +51,14 @@ napi-build = "2.1" # Testing only proptest = "1.5" criterion = "0.5" + +# oqs-sys 0.11.0 on crates.io builds its bindings with bindgen 0.71, which +# turns the forward-declared `OQS_SIG` into an opaque struct under libclang 22 +# (rust:1.98-alpine / Alpine 3.24): "no field alg_version on type &OQS_SIG". +# bindgen 0.72 resolves the forward declaration correctly. Upstream bumped the +# requirement in liboqs-rust#289 but has not published a new oqs-sys, so pin +# that exact commit: it is the published 0.11.0 tree plus the one-line +# bindgen bump, with the same liboqs 0.13.0 submodule. Drop this patch once +# an oqs-sys > 0.11.0 ships with bindgen >= 0.72. +[patch.crates-io] +oqs-sys = { git = "https://github.com/open-quantum-safe/liboqs-rust.git", rev = "4ca07bae34773cdb1ec04c7d0866345cb551914b" } diff --git a/deny.toml b/deny.toml index 391e484..5143907 100644 --- a/deny.toml +++ b/deny.toml @@ -33,3 +33,6 @@ allow-wildcard-paths = true unknown-registry = "deny" unknown-git = "deny" allow-registry = ["https://github.com/rust-lang/crates.io-index"] +# oqs-sys is patched to an upstream liboqs-rust commit (see [patch.crates-io] +# in Cargo.toml) until a release with bindgen >= 0.72 ships; remove with it. +allow-git = ["https://github.com/open-quantum-safe/liboqs-rust"]