build: bump oqs to 0.11.0 and patch oqs-sys to bindgen 0.72 so the binding builds on rust:1.98-alpine

.github/workflows/ci.yml

@@ -102,17 +102,17 @@ jobs:
       # CI green but breaks every relay image rebuild. This job reproduces that
       # exact build so the breakage is caught here, not in production.
       #
-      # Pinned to the same rust:1.95-alpine digest the relay Dockerfile ships.
+      # Pinned to the same rust:1.98-alpine digest the relay Dockerfile ships.
       # When bumping the relay's base image, bump it here too: if this job goes
       # red, the new base cannot build the binding and must not be deployed.
-      # `--locked` forces the committed Cargo.lock (oqs 0.10.1 + vendored
-      # liboqs 0.12.0) so a silent transitive bump can't drift the build either.
+      # `--locked` forces the committed Cargo.lock (oqs 0.11.0 + vendored
+      # liboqs 0.13.0) so a silent transitive bump can't drift the build either.
       # Checkout runs on the host (the alpine image has no Node for actions), then
       # we mount the tree into the container for the build.
       - name: Build the napi binding on alpine/musl
         run: |
           docker run --rm -v "$PWD":/src -w /src \
-            rust:1.95-alpine@sha256:606fd313a0f49743ee2a7bd49a0914bab7deedb12791f3a846a34a4711db7ed2 \
+            rust:1.98-alpine@sha256:a10e64dd139b7387337c7fbe8aca31b959b57b2fd4c8ae20a02cf1d6ea424dce \
             sh -euc '
               apk add --no-cache musl-dev gcc g++ make cmake ninja clang clang-dev llvm-dev perl nasm git bash
               export LIBCLANG_PATH=/usr/lib

CHANGELOG.md

@@ -7,6 +7,21 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+### Changed
+- **`oqs` 0.10.1 -> 0.11.0 (liboqs 0.12.0 -> 0.13.0), `oqs-sys` patched to
+  upstream commit `4ca07ba` (bindgen 0.71 -> 0.72).** The relay's
+  `rust:1.98-alpine` base (Alpine 3.24, libclang 22) made the crypto binding
+  fail to compile: bindgen 0.71 emits the forward-declared `OQS_SIG` as an
+  opaque struct under libclang 22 (`E0609: no field alg_version on &OQS_SIG`),
+  reproduced with a two-line header. bindgen 0.72 resolves it; upstream bumped
+  the requirement in liboqs-rust#289 without a crates.io release, so
+  `[patch.crates-io]` pins that commit (published 0.11.0 tree + the one-line
+  bump, same liboqs 0.13.0 submodule). The `musl-node-binding` CI job moves to
+  the same `rust:1.98-alpine` digest. Algorithm identifiers (`ML-DSA-65`,
+  `ML-KEM-768`, `SPHINCS+-SHA2-128f-simple`, `Falcon-512`) are unchanged
+  between liboqs 0.12.0 and 0.13.0; the ML-DSA-65 and ML-KEM-768 KAT suites
+  and the relay crypto suite pass unchanged against the new binding.
+
 ### Removed
 - **ParaDrop envelope (`envelope::para_drop`).** The anonymous BIP-39 mnemonic
   drop primitive is removed together with the relay feature it backed:

Cargo.toml

@@ -17,7 +17,7 @@ repository   = "https://github.com/Apolloccrypt/paramant-core"
 # Post-quantum crypto via liboqs. M1 enables only ML-KEM (FIPS 203);
 # signature families (FIPS 204/205/206) are switched on at M2. No OpenSSL
 # backend  --  liboqs builds its own symmetric primitives.
-oqs        = { version = "0.10", default-features = false, features = ["ml_kem", "ml_dsa", "sphincs", "falcon", "std"] }
+oqs        = { version = "0.11", default-features = false, features = ["ml_kem", "ml_dsa", "sphincs", "falcon", "std"] }
 
 # Classical crypto (FIPS-validated AWS-LC)
 aws-lc-rs  = "1.13"
@@ -51,3 +51,14 @@ napi-build  = "2.1"
 # Testing only
 proptest   = "1.5"
 criterion  = "0.5"
+
+# oqs-sys 0.11.0 on crates.io builds its bindings with bindgen 0.71, which
+# turns the forward-declared `OQS_SIG` into an opaque struct under libclang 22
+# (rust:1.98-alpine / Alpine 3.24): "no field alg_version on type &OQS_SIG".
+# bindgen 0.72 resolves the forward declaration correctly. Upstream bumped the
+# requirement in liboqs-rust#289 but has not published a new oqs-sys, so pin
+# that exact commit: it is the published 0.11.0 tree plus the one-line
+# bindgen bump, with the same liboqs 0.13.0 submodule. Drop this patch once
+# an oqs-sys > 0.11.0 ships with bindgen >= 0.72.
+[patch.crates-io]
+oqs-sys = { git = "https://github.com/open-quantum-safe/liboqs-rust.git", rev = "4ca07bae34773cdb1ec04c7d0866345cb551914b" }

deny.toml

@@ -33,3 +33,6 @@ allow-wildcard-paths = true
 unknown-registry = "deny"
 unknown-git = "deny"
 allow-registry = ["https://github.com/rust-lang/crates.io-index"]
+# oqs-sys is patched to an upstream liboqs-rust commit (see [patch.crates-io]
+# in Cargo.toml) until a release with bindgen >= 0.72 ships; remove with it.
+allow-git = ["https://github.com/open-quantum-safe/liboqs-rust"]