Pin all dependencies to exact versions for 0.6.1#90
Closed
greg0x wants to merge 1 commit into
Closed
Conversation
Document voting-circuits 0.6.1 pin release
greg0x
force-pushed
the
greg/valar-supply-chain-pins
branch
from
ea254cf to
968fd22
Compare
ValarDragon
reviewed
May 21, 2026
Comment on lines
-34
to
-36
| # Reference IMT implementation used by integration tests to cross-check the | ||
| # in-tree provider. Keep exact-pinned so patch releases cannot silently move | ||
| # tree semantics without updating the equivalence tests. |
Contributor
There was a problem hiding this comment.
Lets keep the comment?
Contributor
Author
|
ok, during iteration this has become a noop |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Pin every dependency to an exact
=x.y.zversion so the published 0.6.1artifact has a fully deterministic resolution surface, and patch releases
of upstream crates cannot move the verifying-key shape or any in-circuit
primitive without a corresponding voting-circuits release.
Why
Part of the supply-chain hardening pass following a supply-chain review of
the valar-* dependency chain. The review flagged that caret pins on crypto-
and circuit-shaping dependencies allow any 0.x.* patch to land silently via
cargo update. For circuits, that risk is doubled — a patch bump tohalo2_proofs, halo2_gadgets, halo2_poseidon, pasta_curves, sinsemilla, ff,
or group can move in-circuit behaviour even when the public Rust API is
stable.
With exact pins, any movement on those crates becomes a deliberate
voting-circuits release, which makes auditing the verifying key easy to
gate on.
Changes
version = "0.6.0"→"0.6.1""x.y"/"x.y.z"constraints to
"=x.y.z"