From 354067dae3e27db22a23701056e9e35e4eaa6e7f Mon Sep 17 00:00:00 2001 From: LoadingALIAS Date: Thu, 6 Aug 2026 11:02:14 -0400 Subject: [PATCH] release: repair public readiness signals Update canonical 0.8.0 install and security support documentation.\n\nGive only the two slow RSA cases a larger nextest timeout budget, and restore verifiable OpenSSF Scorecard publication through the official immutable action. --- .../align-canonical-install-examples-30b9.md | 5 +++ .config/nextest.toml | 8 +++++ .github/actions/scorecard/action.yaml | 34 ------------------- .github/workflows/scorecard.yaml | 2 +- README.md | 4 +-- SECURITY.md | 4 +-- scripts/ci/check-ci-ownership-test.sh | 11 +++--- scripts/ci/check-ci-ownership.sh | 16 ++++----- src/lib.rs | 2 +- 9 files changed, 31 insertions(+), 55 deletions(-) create mode 100644 .changes/align-canonical-install-examples-30b9.md delete mode 100644 .github/actions/scorecard/action.yaml diff --git a/.changes/align-canonical-install-examples-30b9.md b/.changes/align-canonical-install-examples-30b9.md new file mode 100644 index 00000000..61da88fa --- /dev/null +++ b/.changes/align-canonical-install-examples-30b9.md @@ -0,0 +1,5 @@ +--- +"rscrypto" = "patch" +--- + +Align canonical install examples and the security support matrix with rscrypto 0.8.0. diff --git a/.config/nextest.toml b/.config/nextest.toml index c8ab5f41..2635257e 100644 --- a/.config/nextest.toml +++ b/.config/nextest.toml @@ -7,6 +7,14 @@ test-threads = "num-cpus" slow-timeout = { period = "30s", terminate-after = 4 } retries = 0 +[[profile.default.overrides]] +filter = 'binary(=rsa_public_key) & test(=generated_modern_private_key_outputs_verify_and_decrypt_with_external_oracles)' +slow-timeout = { period = "60s", terminate-after = 8 } + +[[profile.default.overrides]] +filter = 'binary(=rsa_wycheproof) & test(=wycheproof_rsaes_pkcs1v15_3072_decrypt_vectors_match_expected_results)' +slow-timeout = { period = "60s", terminate-after = 8 } + [profile.commit] status-level = "fail" success-output = "never" diff --git a/.github/actions/scorecard/action.yaml b/.github/actions/scorecard/action.yaml deleted file mode 100644 index ce8dbb4c..00000000 --- a/.github/actions/scorecard/action.yaml +++ /dev/null @@ -1,34 +0,0 @@ -name: Run OpenSSF Scorecard -description: Run the exact OpenSSF Scorecard container authenticated by its OCI digest. - -inputs: - results_file: - description: Path to the result file. - required: true - results_format: - description: Result format (json or sarif). - required: true - repo_token: - description: GitHub token with read access. - required: false - default: ${{ github.token }} - publish_results: - description: Publish results to the Scorecard API. - required: false - default: "false" - file_mode: - description: Method used to fetch repository files. - required: false - default: archive - internal_publish_base_url: - description: Scorecard publication endpoint. - required: false - default: https://api.scorecard.dev - internal_default_token: - description: Default token used by the Scorecard image. - required: false - default: ${{ github.token }} - -runs: - using: docker - image: docker://ghcr.io/ossf/scorecard-action@sha256:2dd6a6d60100f78ef24e14a47941d0087a524b4d3642041558239b1c6097c941 # v2.4.3 diff --git a/.github/workflows/scorecard.yaml b/.github/workflows/scorecard.yaml index ad849d7e..f476a0fa 100644 --- a/.github/workflows/scorecard.yaml +++ b/.github/workflows/scorecard.yaml @@ -28,7 +28,7 @@ jobs: persist-credentials: false - name: Run Scorecard - uses: ./.github/actions/scorecard + uses: ossf/scorecard-action@4eaacf0543bb3f2c246792bd56e8cdeffafb205a # v2.4.3 with: results_file: scorecard.sarif results_format: sarif diff --git a/README.md b/README.md index afdb91d1..d7271097 100644 --- a/README.md +++ b/README.md @@ -39,14 +39,14 @@ Minimal `no_std` SHA-2 build: ```toml [dependencies] -rscrypto = { version = "0.7.8", default-features = false, features = ["sha2"] } +rscrypto = { version = "0.8.0", default-features = false, features = ["sha2"] } ``` Full primitive stack with OS randomness enabled: ```toml [dependencies] -rscrypto = { version = "0.7.8", features = ["full", "getrandom"] } +rscrypto = { version = "0.8.0", features = ["full", "getrandom"] } ``` Use `default-features = false` for `no_std` builds. Enable `getrandom` only for diff --git a/SECURITY.md b/SECURITY.md index 79a45fa7..d4cf5d7e 100644 --- a/SECURITY.md +++ b/SECURITY.md @@ -51,10 +51,10 @@ Out of scope: | Version | Supported | | ------- | --------- | -| `0.7.x` | Yes | +| `0.8.x` | Yes | Only the latest patch release in the current minor line receives security -fixes. Upgrade to the latest published `0.7.x` release before reporting an issue +fixes. Upgrade to the latest published `0.8.x` release before reporting an issue that may already be fixed. ## Security posture diff --git a/scripts/ci/check-ci-ownership-test.sh b/scripts/ci/check-ci-ownership-test.sh index 7afd4ea4..44591996 100755 --- a/scripts/ci/check-ci-ownership-test.sh +++ b/scripts/ci/check-ci-ownership-test.sh @@ -185,12 +185,11 @@ yq eval '(.jobs."rail-plan".steps[] | select(.id == "rail") | .with.since) = "or "$mutable_rail_base/.github/workflows/ci.yaml" expect_failure "$mutable_rail_base" "cargo-rail-action plans from a mutable base" -unpinned_scorecard="$TMP_ROOT/unpinned-scorecard" -make_fixture "$unpinned_scorecard" -sed -i.bak 's#@sha256:[0-9a-f]*#:v2.4.3#' \ - "$unpinned_scorecard/.github/actions/scorecard/action.yaml" -rm -f "$unpinned_scorecard/.github/actions/scorecard/action.yaml.bak" -expect_failure "$unpinned_scorecard" "Scorecard container uses a mutable tag" +indirect_scorecard="$TMP_ROOT/indirect-scorecard" +make_fixture "$indirect_scorecard" +yq eval '(.jobs.scorecard.steps[] | select(.name == "Run Scorecard") | .uses) = "./.github/actions/scorecard"' -i \ + "$indirect_scorecard/.github/workflows/scorecard.yaml" +expect_failure "$indirect_scorecard" "Scorecard publication does not call the official action directly" floating_codecov="$TMP_ROOT/floating-codecov" make_fixture "$floating_codecov" diff --git a/scripts/ci/check-ci-ownership.sh b/scripts/ci/check-ci-ownership.sh index a3c821b5..e01de748 100755 --- a/scripts/ci/check-ci-ownership.sh +++ b/scripts/ci/check-ci-ownership.sh @@ -29,7 +29,6 @@ RELEASE="$WORKFLOWS/release.yaml" RSA="$WORKFLOWS/rsa.yaml" SETUP_ACTION="$ACTIONS/setup/action.yaml" TOOLCHAIN_ACTION="$ACTIONS/setup-toolchain/action.yaml" -SCORECARD_ACTION="$ACTIONS/scorecard/action.yaml" MANIFEST="$ROOT/.config/target-matrix.json" TOOL_ARCHIVES="$ROOT/.config/ci-tool-archives.tsv" CARGO_CONFIG="$ROOT/.cargo/config.toml" @@ -129,7 +128,6 @@ require_file "$RELEASE" require_file "$RSA" require_file "$SETUP_ACTION" require_file "$TOOLCHAIN_ACTION" -require_file "$SCORECARD_ACTION" require_file "$MANIFEST" require_file "$TOOL_ARCHIVES" require_file "$CARGO_CONFIG" @@ -267,7 +265,7 @@ fi bash -eu -o pipefail -c 'source "$1"; ci_tool_validate_manifest' _ "$TOOL_INTEGRITY" \ || fail "direct CI tool archive manifest is invalid" -if grep -ERn 'uses:[[:space:]]+(dtolnay/rust-toolchain|ossf/scorecard-action)@' \ +if grep -ERn 'uses:[[:space:]]+dtolnay/rust-toolchain@' \ "$WORKFLOWS" "$ACTIONS" >/dev/null; then fail "CI must not delegate installation to an action with an unauthenticated executable fallback" fi @@ -394,12 +392,12 @@ grep -Fq 'ci_tool_download codecov' "$INSTALL_CODECOV" \ # shellcheck disable=SC2016 # GitHub expression is an intentional literal contract. grep -Fq 'binary: ${{ steps.codecov.outputs.binary }}' "$WEEKLY" \ || fail "Codecov action must use the repository-verified CLI" -[[ $(yq eval '.jobs.scorecard.steps[] | select(.name == "Run Scorecard") | .uses' "$SCORECARD") \ - == "./.github/actions/scorecard" ]] \ - || fail "Scorecard must use the repository-owned digest-pinned action" -scorecard_image=$(yq eval -r '.runs.image' "$SCORECARD_ACTION") -[[ "$scorecard_image" =~ ^docker://ghcr\.io/ossf/scorecard-action@sha256:[0-9a-f]{64}$ ]] \ - || fail "Scorecard container must use an OCI digest" +scorecard_action=$(yq eval '.jobs.scorecard.steps[] | select(.name == "Run Scorecard") | .uses' "$SCORECARD") +[[ "$scorecard_action" =~ ^ossf/scorecard-action@[0-9a-f]{40}$ ]] \ + || fail "Scorecard publication must call the official action at an immutable commit" +[[ $(yq eval '.jobs.scorecard.steps[] | select(.name == "Run Scorecard") | .with.publish_results' "$SCORECARD") \ + == "true" ]] \ + || fail "Scorecard must publish results" [[ $(count_feature_sets "$FEATURE_PROFILES" COMPILE_FEATURE_SETS) -eq 58 ]] \ || fail "compile feature matrix must retain all 58 profiles" diff --git a/src/lib.rs b/src/lib.rs index 96456286..30b2e250 100644 --- a/src/lib.rs +++ b/src/lib.rs @@ -14,7 +14,7 @@ //! //! ```toml //! [dependencies] -//! rscrypto = { version = "0.6.4", default-features = false, features = ["sha2"] } +//! rscrypto = { version = "0.8.0", default-features = false, features = ["sha2"] } //! ``` //! //! # Guides