crypto: enforce lint-clean safety boundaries - #85
Merged
Conversation
Remove repository-wide lint suppression debt and make feature and target reachability explicit across portable and accelerated implementations. Harden arithmetic, bounds, secret handling, unsafe and ASM contracts, dispatch, tests, fuzz targets, and validation tooling. This intentionally breaks RSA blinding inputs, forced ChaCha20 diagnostic calls, and RISC-V CRC-64 force modes.
Pin Nextest and disable retries so test failures remain visible. Reject yanked crates against the locked dependency graph.
Activate each resolved toolchain through RUSTUP_TOOLCHAIN so repository overrides cannot substitute development Rust. Keep platform and feature-specific checks warning-free under their actual compiler contracts.
Clear caller startup hooks before launching fixture subprocesses so mocked PATH entries cannot be replaced by host shell initialization.
Write the validated exact toolchain through the repository-owned setup script so action inputs never reach GitHub environment-file syntax. Extend ownership and integrity checks for that boundary.
…305 AVX2/AVX-512 kernels to as_chunks auth: gate ed25519 AVX2/IFMA point tests behind the ed25519 feature and migrate point chunking to as_chunks clippy: document missing # Safety on ct-binsec-harness AVX2/IFMA entrypoints Restoring strict cross-target and feature-matrix validation surfaced four latent CI failures: s390x test builds referenced the fixslice AES module after it was excluded from s390x test cfg, x25519-only builds pulled in ed25519-gated point_avx2 tests that were never feature-gated, and the new clippy::chunks_exact_to_as_chunks lint plus missing_safety_doc caught real gaps in the ChaCha20/Poly1305/Ed25519 SIMD kernels and the CT harness.
…5519 The previous ed25519 test-feature gate on point_avx2's mod tests exposed a second layer of latent breakage under --features x25519 (no ed25519): several AVX2/IFMA internals (wNAF tables, cached-point builders, field squaring/shuffle helpers in point_avx2, field_avx2, and field_ifma) were gated any(test, ed25519) so they kept compiling under test alone, but their only real callers are the vartime scalar-mul and Straus verification paths, which are ed25519-only and were never reachable without it. That left them dead code once the test module required ed25519 too. Tighten those internals to feature = "ed25519" and gate the field_avx2 and field_ifma test modules the same way as point_avx2's. Traced the call graph to confirm none of this is reachable from x25519's fixed-base basepoint_mul_dispatch path, which stays available under x25519-only. Verified via a x86_64 cross-compile (zig cc) since ring/aws-lc-sys dev dependencies can't cross-link natively here: x25519-only lib+tests check and clippy are clean, ed25519+x25519 combined check is clean, and the native all-features suite still passes at 1061/1061.
auth: keep basepoint_mul_dispatch reachable under single-curve feature sets
Two more dead-code gaps surfaced by the stricter feature-matrix check.
x86_64_ni's plain encrypt_4blocks/encrypt_4blocks_128 were the only
ungated variants in that file (their _aesni and 16-block siblings already
carry the aes-gcm/aes-gcm-siv gate); under aegis256-only they had no
caller left. basepoint_mul_dispatch only had test-reachable callers via
ed25519's and x25519's own assembly-routing dispatch, and ed25519's path
lacks x25519's test escape hatch, so under ed25519-only ("signatures")
it went dead too; added direct differential tests instead of touching
that dispatch structure.
Verified via x86_64 cross-compile (zig cc): all 58 feature-matrix
profiles in scripts/lib/feature-profiles.sh now pass cargo check
--lib --tests.
clippy: fold ct-binsec-harness AVX2/IFMA digests without truncating casts x86-64 BMI2/ADX discovery is std-only, so under --no-default-features --features full caps() reports only the compile-time feature set, the assembly backend is unreachable, and the differential test's hard assert fired at profile 1 of the executable feature matrix. Gate the test and the four Montgomery helpers sharing its predicate on the condition that makes the backend observable, and keep the assertion hard inside it. The two x86_64 BINSEC entrypoints folded their u64 accumulator with an `as u8` cast while their six portable siblings use to_le_bytes()[0]. cast_possible_truncation is deny-level in the independent-workspace lint, so Quality failed on x86_64 only.
…r live callers fuzz-packages/surface-hex-parse pins rscrypto with aes-gcm but without aes-gcm-siv, and no declared feature profile covers that combination, so the independent-workspace lint was the only lane that saw it. On x86_64 that build left aes128/aes256_encrypt_blocks_ecb and both rscrypto_aes*_gcmsiv_ctr_16x_vaes512_x86_64_linux declarations without a caller, and dead_code is deny-level. Gate the two extern declarations on aes-gcm-siv, which is the only feature whose code path calls them. Gate the two ECB batch helpers on the union of their live callers: GCM-SIV key derivation on any arch, the batch CTR path on the arches carrying a block-batch kernel, and cfg(test) -- mod aes is also compiled under all(feature = "aegis256", test), where the two unit tests are what keep the aarch64 kernels reachable.
…CI pass bench: anchor perf chart bars at 1.00x parity and scale the axis from data docs: publish the 2026-08-18 aggregate and lift the HMAC equivalence caveat Extract run #32185659553 at commit 7eb44e9 into benchmark_results/2026-08-18 and regenerate every OVERVIEW section from it. The RISE RISC-V runner did not execute, so all aggregates cover eight platforms rather than nine. Linux fastest-external geomean moves 1.59x to 1.62x and checksums 5.18x to 6.18x. The RustCrypto HMAC-SHA-256 rows now hoist key setup out of the timed loop and clone the keyed state per iteration, matching the treatment given to rscrypto, ring, and AWS-LC. The archival equivalence caveat no longer applies, so the aggregate is published as an equivalent-work claim. The chart clamped bars to a hardcoded 1.60x ceiling, which saturated AEAD at 1.61x and RSA at 1.65x to identical full-width bars and collapsed the sub-parity ECDSA row to zero width, rendering it indistinguishable from missing data. Bars now grow from a labeled 1.00x parity marker with losses extending left, and the axis derives its bounds from the data.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Remove repository-wide lint suppression debt and make feature and target reachability explicit across portable and accelerated implementations.
Harden arithmetic, bounds, secret handling, unsafe and ASM contracts, dispatch, tests, fuzz targets, and validation tooling. This intentionally breaks RSA blinding inputs, forced ChaCha20 diagnostic calls, and RISC-V CRC-64 force modes.