loadingalias · loadingalias · Aug 19, 2026 · Aug 17, 2026 · Aug 17, 2026 · Aug 17, 2026
@@ -1,67 +1,2 @@
-# Linux x86_64
-[target.x86_64-unknown-linux-gnu]
-rustflags = ["-C", "target-cpu=native"]
-
-# Linux ARM64
-[target.aarch64-unknown-linux-gnu]
-rustflags = ["-C", "target-feature=+lse", "-C", "target-cpu=native"]
-
-# Windows x86_64
-[target.x86_64-pc-windows-msvc]
-
-# Windows ARM64
-[target.aarch64-pc-windows-msvc]
-rustflags = ["-C", "target-feature=+lse"]
-
-# Tier B
-# Linux x86_64 MUSL
-[target.x86_64-unknown-linux-musl]
-
-# Linux ARM64 MUSL
-[target.aarch64-unknown-linux-musl]
-rustflags = ["-C", "target-feature=+lse"]
-
-# Tier C - WASM
-# WASM - Browser
-[target.wasm32-unknown-unknown]
-
-# WASM/WASI - Server
-[target.wasm32-wasip1]
-
-# Tier D - Enterprise
-# IBM s390x (Z mainframes)
-[target.s390x-unknown-linux-gnu]
-
-# IBM PowerPC64 (little-endian, modern POWER systems)
-[target.powerpc64le-unknown-linux-gnu]
-
-# RISC-V 64-bit Linux (RV64GC: general + compressed)
-[target.riscv64gc-unknown-linux-gnu]
-
-# LoongArch 64-bit Linux
-[target.loongarch64-unknown-linux-gnu]
-
-# Tier E - no_std Bare Metal Sentinels
-# Cortex-M0/M0+ (minimal no_std sentinel - no FPU, no DSP)
-# If it compiles here, it compiles everywhere
-[target.thumbv6m-none-eabi]
-
-# ARM64 bare metal (modern no_std sentinel - hypervisors, TEEs)
-# No LSE: target hardware capabilities vary
-[target.aarch64-unknown-none]
-
-# RISC-V 64-bit bare metal (RV64IMAFDC)
-[target.riscv64gc-unknown-none-elf]
-
-# RISC-V 32-bit bare metal (RV32IMAC)
-[target.riscv32imac-unknown-none-elf]
-
-# x86_64 bare metal (kernels, bootloaders, hypervisors)
-[target.x86_64-unknown-none]
-
-# Build Configuration
 [build]
 rustdocflags = ["-D", "warnings"]
-
-[env]
-RUST_LOG = "info"
@@ -0,0 +1,5 @@
+---
+"rscrypto" = "patch"
+---
+
+Add Debug output for Ed25519 verification diagnostic snapshots.
@@ -0,0 +1,5 @@
+---
+"rscrypto" = "patch"
+---
+
+Add Debug output for AES-GCM nonce-counter state.
@@ -0,0 +1,5 @@
+---
+"rscrypto" = "major"
+---
+
+Group caller-supplied RSA blinding inputs in `RsaBlindingPair` and add redacted `Debug` output for borrowed RSA private-key inputs.
@@ -0,0 +1,5 @@
+---
+"rscrypto" = "patch"
+---
+
+Document checksum and digest I/O adapter state and ownership methods.
@@ -0,0 +1,5 @@
+---
+"rscrypto" = "patch"
+---
+
+Document SHAKE128 and SHAKE256 state and output-reader APIs.
@@ -0,0 +1,5 @@
+---
+"rscrypto" = "patch"
+---
+
+Harden the x86 and POWER8 AEGIS-256 backends against out-of-bounds pointer formation while preserving oracle-compatible ciphertext and tags.
@@ -0,0 +1,5 @@
+---
+"rscrypto" = "patch"
+---
+
+Harden Blake2b length handling, state cleanup, and portable diagnostics.
@@ -0,0 +1,5 @@
+---
+"rscrypto" = "patch"
+---
+
+Harden Blake2s length handling, state cleanup, and portable diagnostics.
@@ -0,0 +1,5 @@
+---
+"rscrypto" = "patch"
+---
+
+Harden BLAKE3 tree and SIMD kernel arithmetic, bounds, and assembly ABI validation.
@@ -0,0 +1,5 @@
+---
+"rscrypto" = "patch"
+---
+
+Harden ECDSA limb arithmetic, endian conversion, diagnostic documentation, and fixed-work RISC-V and s390x multiplication while preserving P-256 and P-384 signature semantics.
@@ -0,0 +1,5 @@
+---
+"rscrypto" = "patch"
+---
+
+Harden Ed25519 scalar encoding, fixed-base table validation, table selection, and AVX2/AVX-512 IFMA safety boundaries while preserving signature and verification results.
@@ -0,0 +1,5 @@
+---
+"rscrypto" = "patch"
+---
+
+Harden ML-KEM encoding, arithmetic bounds, and key-layout validation.
@@ -0,0 +1,5 @@
+---
+"rscrypto" = "patch"
+---
+
+Harden PBKDF2 block indexing and document portable verification diagnostics.
@@ -0,0 +1,5 @@
+---
+"rscrypto" = "major"
+---
+
+Remove the unused RISC-V CRC-64 Zbc/Zvbc force modes and dead accelerated backend; RISC-V CRC-64 continues to use the portable slice-by-16 implementation until target evidence justifies acceleration.
@@ -0,0 +1,5 @@
+---
+"rscrypto" = "patch"
+---
+
+Return `Argon2Error::BackendUnavailable` when a forced diagnostic backend is unsupported.
@@ -0,0 +1,5 @@
+---
+"rscrypto" = "major"
+---
+
+Make the forced hardware ChaCha20 diagnostic functions `unsafe`; callers must establish the documented CPU capabilities before invoking them.
@@ -1,6 +1,6 @@
 # tool	version	os	architecture	filename	url	sha256
-wasmtime	v46.0.1	linux	x86_64	wasmtime-v46.0.1-x86_64-linux.tar.xz	https://github.com/bytecodealliance/wasmtime/releases/download/v46.0.1/wasmtime-v46.0.1-x86_64-linux.tar.xz	9ae0b17ea298bcc52277a8208d6ab7fae8e1a89579672f9d82f9d86c116edb62
-wasmtime	v46.0.1	linux	aarch64	wasmtime-v46.0.1-aarch64-linux.tar.xz	https://github.com/bytecodealliance/wasmtime/releases/download/v46.0.1/wasmtime-v46.0.1-aarch64-linux.tar.xz	071c4def2a08f0ebc95c52dfd4f2886eb697ba495804217cf76e13b09d70a1be
-wasmtime	v46.0.1	macos	x86_64	wasmtime-v46.0.1-x86_64-macos.tar.xz	https://github.com/bytecodealliance/wasmtime/releases/download/v46.0.1/wasmtime-v46.0.1-x86_64-macos.tar.xz	0513db67e7089c7e5f743a01427782bc4def83854222f4bc9b1d75f0b925240b
-wasmtime	v46.0.1	macos	aarch64	wasmtime-v46.0.1-aarch64-macos.tar.xz	https://github.com/bytecodealliance/wasmtime/releases/download/v46.0.1/wasmtime-v46.0.1-aarch64-macos.tar.xz	acee50be70dbe90b0ab2ac7db1321fc44715153a1b1cc58291c97b6d7cffc558
+wasmtime	v47.0.3	linux	x86_64	wasmtime-v47.0.3-x86_64-linux.tar.xz	https://github.com/bytecodealliance/wasmtime/releases/download/v47.0.3/wasmtime-v47.0.3-x86_64-linux.tar.xz	ca1fc56d1afc40c8782e96c297fd182a0da162f9a8f52a1e7b094e1dd648e178
+wasmtime	v47.0.3	linux	aarch64	wasmtime-v47.0.3-aarch64-linux.tar.xz	https://github.com/bytecodealliance/wasmtime/releases/download/v47.0.3/wasmtime-v47.0.3-aarch64-linux.tar.xz	497b518db00ae585f04390758eaa99ad555bee50612dce7d102602778fb46ff0
+wasmtime	v47.0.3	macos	x86_64	wasmtime-v47.0.3-x86_64-macos.tar.xz	https://github.com/bytecodealliance/wasmtime/releases/download/v47.0.3/wasmtime-v47.0.3-x86_64-macos.tar.xz	424a50f76a9dcf4d02dab326b2374be1ad404030576ee915866e4af106058b35
+wasmtime	v47.0.3	macos	aarch64	wasmtime-v47.0.3-aarch64-macos.tar.xz	https://github.com/bytecodealliance/wasmtime/releases/download/v47.0.3/wasmtime-v47.0.3-aarch64-macos.tar.xz	c2684249e5d9ef9351942cf2d315982cf201fe0300f05d63bc1527446f0cd37f
 codecov	v11.3.1	linux	x86_64	codecov	https://cli.codecov.io/v11.3.1/linux/codecov	ca1d64196d2d34771084afe76ea657d581bf628e31d993ff8e52ea09cc88a56d
@@ -1,3 +1,5 @@
+nextest-version = { required = "0.9.143", recommended = "0.9.143" }
+
 [profile.default]
 status-level = "pass"
 success-output = "never"
@@ -15,14 +17,18 @@ slow-timeout = { period = "60s", terminate-after = 8 }
 filter = 'binary(=rsa_wycheproof) & test(=wycheproof_rsaes_pkcs1v15_3072_decrypt_vectors_match_expected_results)'
 slow-timeout = { period = "60s", terminate-after = 8 }
 
+[[profile.default.overrides]]
+filter = 'binary(=rsa_wycheproof) & (test(=wycheproof_oaep_mgf1sha1_vectors_are_rejected_by_sha2_mgf1sha2_profiles) | test(=wycheproof_pkcs1v15_sha2_sig_gen_vectors_match_expected_signatures))'
+slow-timeout = { period = "60s", terminate-after = 4 }
+
 [profile.commit]
 status-level = "fail"
 success-output = "never"
 failure-output = "immediate-final"
 fail-fast = false
 test-threads = "num-cpus"
 slow-timeout = { period = "60s", terminate-after = 4 }
-retries = { backoff = "exponential", count = 2, delay = "1s", jitter = true }
+retries = 0
 
 [profile.commit.junit]
 path = "junit.xml"

@@ -4,23 +4,21 @@
 # Targets
 targets = [
   "aarch64-apple-darwin",
+  "aarch64-pc-windows-msvc",
   "aarch64-unknown-linux-gnu",
-  "x86_64-apple-darwin",
-  "x86_64-pc-windows-msvc",
-  "x86_64-unknown-linux-gnu",
   "aarch64-unknown-linux-musl",
-  "wasm32-unknown-unknown",
-  "wasm32-wasip1",
-  "x86_64-unknown-linux-musl",
-  "aarch64-pc-windows-msvc",
   "aarch64-unknown-none",
-  "loongarch64-unknown-linux-gnu",
   "powerpc64le-unknown-linux-gnu",
   "riscv32imac-unknown-none-elf",
   "riscv64gc-unknown-linux-gnu",
-  "riscv64gc-unknown-none-elf",
   "s390x-unknown-linux-gnu",
   "thumbv6m-none-eabi",
+  "wasm32-unknown-unknown",
+  "wasm32-wasip1",
+  "x86_64-apple-darwin",
+  "x86_64-pc-windows-msvc",
+  "x86_64-unknown-linux-gnu",
+  "x86_64-unknown-linux-musl",
   "x86_64-unknown-none",
 ]
 

@@ -1,28 +1,28 @@
 {
   "groups": {
     "win": [
-      "x86_64-pc-windows-msvc",
-      "aarch64-pc-windows-msvc"
+      "aarch64-pc-windows-msvc",
+      "x86_64-pc-windows-msvc"
     ],
     "macos": [
       "aarch64-apple-darwin",
       "x86_64-apple-darwin"
     ],
     "linux": [
-      "x86_64-unknown-linux-gnu",
       "aarch64-unknown-linux-gnu",
+      "aarch64-unknown-linux-musl",
       "riscv64gc-unknown-linux-gnu",
-      "x86_64-unknown-linux-musl",
-      "aarch64-unknown-linux-musl"
+      "x86_64-unknown-linux-gnu",
+      "x86_64-unknown-linux-musl"
     ],
     "ibm": [
-      "s390x-unknown-linux-gnu",
-      "powerpc64le-unknown-linux-gnu"
+      "powerpc64le-unknown-linux-gnu",
+      "s390x-unknown-linux-gnu"
     ],
     "no_std": [
-      "thumbv6m-none-eabi",
-      "riscv32imac-unknown-none-elf",
       "aarch64-unknown-none",
+      "riscv32imac-unknown-none-elf",
+      "thumbv6m-none-eabi",
       "x86_64-unknown-none"
     ],
     "wasm": [
@@ -31,9 +31,9 @@
     ]
   },
   "ci": [
-    { "name": "x86_64-unknown-linux-gnu",  "type": "runson", "pool": "linux-x64-ci" },
+    { "name": "aarch64-pc-windows-msvc",   "type": "gha",    "runner": "windows-11-arm" },
     { "name": "aarch64-unknown-linux-gnu", "type": "runson", "pool": "linux-arm64-ci" },
     { "name": "x86_64-pc-windows-msvc",    "type": "gha",    "runner": "windows-latest" },
-    { "name": "aarch64-pc-windows-msvc",   "type": "gha",    "runner": "windows-11-arm" }
+    { "name": "x86_64-unknown-linux-gnu",  "type": "runson", "pool": "linux-x64-ci" }
   ]
 }
@@ -0,0 +1 @@
+nightly = "nightly-2026-08-12"
@@ -1,17 +1,20 @@
-name: Setup Rust Toolchain (Dynamic)
+name: Setup Rust Toolchain
 description: |
-  Install Rust toolchain reading version from rust-toolchain.toml.
-  Single source of truth for toolchain version.
+  Install the stable development toolchain, MSRV, or pinned nightly contract.
 
 inputs:
+  contract:
+    description: Toolchain contract to install (development, msrv, or nightly)
+    required: false
+    default: "development"
   components:
     description: Comma-separated list of components to install
     required: false
     default: "clippy, rustfmt"
 
 outputs:
   toolchain:
-    description: The toolchain version that was installed
+    description: Exact installed toolchain version
     value: ${{ steps.read-toolchain.outputs.toolchain }}
 
 runs:
@@ -20,8 +23,15 @@ runs:
     - name: Read Toolchain Version
       id: read-toolchain
       shell: bash
+      env:
+        TOOLCHAIN_CONTRACT: ${{ inputs.contract }}
       run: |
-        TOOLCHAIN=$(bash scripts/lib/toolchain.sh)
+        case "$TOOLCHAIN_CONTRACT" in
+          development) TOOLCHAIN=$(bash scripts/lib/toolchain.sh) ;;
+          msrv) TOOLCHAIN=$(bash scripts/lib/toolchain.sh --msrv) ;;
+          nightly) TOOLCHAIN=$(bash scripts/lib/toolchain.sh --nightly) ;;
+          *) echo "Unsupported toolchain contract: $TOOLCHAIN_CONTRACT" >&2; exit 2 ;;
+        esac
         echo "toolchain=$TOOLCHAIN" >> "$GITHUB_OUTPUT"
         echo "Using toolchain: $TOOLCHAIN"
 
@@ -30,4 +40,6 @@ runs:
       env:
         TOOLCHAIN: ${{ steps.read-toolchain.outputs.toolchain }}
         TOOLCHAIN_COMPONENTS: ${{ inputs.components }}
-      run: scripts/ci/setup-toolchain.sh "$TOOLCHAIN" "$TOOLCHAIN_COMPONENTS"
+      run: |
+        scripts/ci/setup-toolchain.sh "$TOOLCHAIN" "$TOOLCHAIN_COMPONENTS" "$GITHUB_ENV"
+        RUSTUP_TOOLCHAIN="$TOOLCHAIN" rustc --version --verbose
@@ -4,6 +4,10 @@ description: |
   Unified host setup for GHA + runs-on.com + IBM/RISC-V runners.
 
 inputs:
+  toolchain-contract:
+    description: Toolchain contract to install (development, msrv, or nightly).
+    required: false
+    default: "development"
   cache-key:
     description: Suffix for the rust-cache key (workflow + target).
     required: false
@@ -31,11 +35,12 @@ runs:
     # runs-on.com S3-backed cache intercept. No-op on non-runs-on pools.
     - name: Setup MagicCache
       if: inputs.enable-magic-cache == 'true'
-      uses: runs-on/action@4e5f72399b6b17f2e79c511c1b38a315a64d22dc  # v2.2.0
+      uses: runs-on/action@46910bf61b41721b0579f237e186afb35477007a  # v2.3.0
 
     - name: Setup Toolchain
       uses: ./.github/actions/setup-toolchain
       with:
+        contract: ${{ inputs.toolchain-contract }}
         components: ${{ inputs.toolchain-components }}
 
     - name: Install Cargo Tools
@@ -47,7 +52,7 @@ runs:
 
     - name: Setup Rust Cache
       if: inputs.enable-rust-cache == 'true'
-      uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4  # v2.9.1
+      uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6  # v2.9.2
       with:
         shared-key: "rscrypto-v1-${{ inputs.cache-key }}"
         cache-directories: ${{ inputs.tools-mode == 'rail' && 'target/cargo-rail/cache' || '' }}