From dd2049acc2496b0fd58f84f02e8eb3243be6f3bb Mon Sep 17 00:00:00 2001 From: Claude Date: Sun, 8 Nov 2026 01:34:28 +0000 Subject: [PATCH] Float the RustCrypto fork pins that their default branch can carry Internal pins are prohibited. A [patch] only applies when the fork carries the version crates.io would resolve, so a fork pin can float exactly when its default branch still carries that version: - ecdsa 0.17.0: signatures rev 5595c3b -> master (master is 5595c3b). - ed448-goldilocks 0.14.0-pre.15: elliptic-curves rev f5cb30e -> master (739304e, 45 commits newer, same version). - p256 0.14.0 (ogar-oidc): elliptic-curves rev 739304e -> master. ed448 and p256 now resolve to one elliptic-curves commit. A fresh generate-lockfile reports no unused patch; ogar-oidc, ogar-auth and ogar-encryption tests and clippy -D warnings pass. Still pinned, because the fork's default branch is a semver-incompatible major ahead and floating would silently fall back to crates.io: chacha20poly1305 0.10.1 (master 0.11.0), poly1305 0.8.0 (master 0.9.1), curve25519-dalek 4.1.3 (main 5.0.0), md-5 0.10.6 (master 0.11.0), des 0.8.1 (master 0.9.0). The Cargo.toml comment and docs/UPSTREAM-DEPS.md say so. Co-Authored-By: Claude Opus 5.5 Claude-Session: https://claude.ai/code/session_01XAqKMMWgnUU9g7Ldyn6sbk --- Cargo.toml | 15 +++++++++------ crates/ogar-oidc/Cargo.toml | 2 +- docs/UPSTREAM-DEPS.md | 4 ++-- 3 files changed, 12 insertions(+), 9 deletions(-) diff --git a/Cargo.toml b/Cargo.toml index 216efce..be2a9cc 100644 --- a/Cargo.toml +++ b/Cargo.toml @@ -134,10 +134,13 @@ debug = 0 # RustCrypto crates resolve to their AdaWorldAPI forks (fork-first policy). # -# Each fork's default branch is a major version ahead of what this graph uses, -# so every entry pins the fork commit whose Cargo.toml carries exactly the -# version crates.io would have resolved; a patch whose version does not match -# is silently unused. `docs/UPSTREAM-DEPS.md` lists the crates that have no +# Internal pins are prohibited (2026-11-08): an entry floats on its fork's +# default branch whenever that branch carries the version crates.io would +# resolve (ecdsa, ed448-goldilocks). The rest still pin a commit, because their +# fork's default branch is a semver-incompatible major ahead and a patch whose +# version does not match is silently unused (the crate would then come from +# crates.io). Each of those is unpinned by migrating its consumer to the new +# major, not by editing this line. `docs/UPSTREAM-DEPS.md` lists the crates that have no # matching commit in their fork and therefore still come from crates.io. # # These patches apply to builds of THIS workspace only. A consumer (a2ui-rs, @@ -145,7 +148,7 @@ debug = 0 # repeats this block: cargo never applies a dependency's [patch] downstream. [patch.crates-io] # p256's ECDSA (ogar-oidc ES256). -ecdsa = { git = "https://github.com/AdaWorldAPI/signatures", rev = "5595c3b1bfa14022b46ec3cc662a87e49b954266" } +ecdsa = { git = "https://github.com/AdaWorldAPI/signatures", branch = "master" } # XChaCha20-Poly1305 (ndarray `encryption`, via ogar-encryption). chacha20poly1305 = { git = "https://github.com/AdaWorldAPI/AEADs", rev = "c5c199953aba561261bed1c55f62b9c19d0f49cf" } # The keystream comes from ndarray's own chacha20 0.9.1 fork, which adds an @@ -155,7 +158,7 @@ chacha20 = { git = "https://github.com/AdaWorldAPI/ndarray", branch = "master" } poly1305 = { git = "https://github.com/AdaWorldAPI/universal-hashes", rev = "35de31af7396fe57fa28265e91532c816183c47f" } # Ed25519 (ndarray `encryption`) and X448's curve (elliptic-curves fork). curve25519-dalek = { git = "https://github.com/AdaWorldAPI/curve25519-dalek", rev = "5312a0311ec40df95be953eacfa8a11b9a34bc54" } -ed448-goldilocks = { git = "https://github.com/AdaWorldAPI/elliptic-curves", rev = "f5cb30ebc9c2ccdbeb56965cf0c037e250b8f9c9" } +ed448-goldilocks = { git = "https://github.com/AdaWorldAPI/elliptic-curves", branch = "master" } # ogar-auth's legacy 3DES-EDE2 / PBKDF1-MD5 transition. md-5 = { git = "https://github.com/AdaWorldAPI/hashes", rev = "026b0e81e90ba476a5d343a8e4efbc63b814737b" } des = { git = "https://github.com/AdaWorldAPI/block-ciphers", rev = "7de364ede310f1ea7080c99ddf1138aeb47f9a69" } diff --git a/crates/ogar-oidc/Cargo.toml b/crates/ogar-oidc/Cargo.toml index d94b1ba..31b00db 100644 --- a/crates/ogar-oidc/Cargo.toml +++ b/crates/ogar-oidc/Cargo.toml @@ -13,6 +13,6 @@ ogar-encryption = { path = "../ogar-encryption" } # ES256 (P-256 ECDSA). AdaWorldAPI fork of RustCrypto/elliptic-curves, the rev the # ndarray `encryption` crate already pins for x448. `ecdsa` itself is redirected to # the AdaWorldAPI/signatures fork by the workspace `[patch.crates-io]`. -p256 = { git = "https://github.com/AdaWorldAPI/elliptic-curves", rev = "739304e026fdf06cd1a31606e4db487d3f47c5ae", default-features = false, features = ["ecdsa", "alloc"] } +p256 = { git = "https://github.com/AdaWorldAPI/elliptic-curves", branch = "master", default-features = false, features = ["ecdsa", "alloc"] } base64 = "0.22" serde_json = "1" diff --git a/docs/UPSTREAM-DEPS.md b/docs/UPSTREAM-DEPS.md index 045fcd8..acd7d1e 100644 --- a/docs/UPSTREAM-DEPS.md +++ b/docs/UPSTREAM-DEPS.md @@ -22,8 +22,8 @@ | 6 (`lance-graph-ontology` cache) | manifest-watch event API for cache invalidation | LOCKED | | 7 (`lance-graph-callcenter`) | dataset transactional commit boundary; tag-based version retention | LOCKED | | `ogar-auth` (identity / federation) | `lance_graph_contract::auth::ActorContext` (canonical identity envelope) + `sla::TenantId`; git dep, branch `main`, unpinned. Measured: OGAR base `5b82ae0`; resolved lance-graph-contract at `f859d484c46dda9725ace2dc870c73e95203edde` | CURRENT-CONTRACT (unpinned `main`; re-measure the resolved rev when it matters) | -| `ogar-oidc` (OIDC ID-token verifier) | `p256` from AdaWorldAPI/elliptic-curves rev `739304e026fdf06cd1a31606e4db487d3f47c5ae` (the rev ndarray `encryption` pins); `ecdsa` 0.17.0 redirected by workspace `[patch.crates-io]` to AdaWorldAPI/signatures rev `5595c3b1bfa14022b46ec3cc662a87e49b954266`; Ed25519 via `ogar-encryption`. RS256: no RSA fork wired | CURRENT-CONTRACT (rev-pinned) | -| RustCrypto forks (workspace `[patch.crates-io]`) | Patched to the fork commit carrying the exact resolved version: `ecdsa` 0.17.0 (signatures `5595c3b`), `chacha20poly1305` 0.10.1 (AEADs `c5c1999`), `chacha20` 0.9.1 (ndarray `vendor/chacha20`, branch `master`), `poly1305` 0.8.0 (universal-hashes `35de31a`), `curve25519-dalek` 4.1.3 (curve25519-dalek `5312a03`), `ed448-goldilocks` 0.14.0-pre.15 (elliptic-curves `f5cb30e`), `md-5` 0.10.6 (hashes `026b0e8`), `des` 0.8.1 (block-ciphers `7de364e`). Still crates.io, no fork commit at the resolved version: `sha2` 0.10.9 and 0.11.1, `sha1` 0.10.7, `blake2` 0.11.0, `ed25519-dalek` 2.2.0; trait crates (`aead`, `cipher`, `digest`, `universal-hash`, `signature`) and `hmac` have no fork checked. `.cargo/config.toml` sets `curve25519_dalek_backend="serial"` and `poly1305_force_soft`. Patches and flags apply to this workspace only, never to consumers | MEASURED (fresh `cargo generate-lockfile`, no unused-patch warning; `cargo build -v` shows both cfgs on curve25519-dalek and poly1305) | +| `ogar-oidc` (OIDC ID-token verifier) | `p256` 0.14.0 from AdaWorldAPI/elliptic-curves branch `master`; `ecdsa` 0.17.0 redirected by workspace `[patch.crates-io]` to AdaWorldAPI/signatures branch `master`; Ed25519 via `ogar-encryption`. RS256: no RSA fork wired | CURRENT-CONTRACT (floating on the fork's default branch; internal pins are prohibited) | +| RustCrypto forks (workspace `[patch.crates-io]`) | Floating on the fork's default branch, which carries the resolved version: `ecdsa` 0.17.0 (signatures `master`), `ed448-goldilocks` 0.14.0-pre.15 (elliptic-curves `master`), `chacha20` 0.9.1 (ndarray `vendor/chacha20`, branch `master`). Still pinned to the fork commit carrying the resolved version, because the fork's default branch is a semver-incompatible major ahead (unpinning needs the consumer migrated to that major): `chacha20poly1305` 0.10.1 (AEADs `c5c1999`; `master` is 0.11.0), `poly1305` 0.8.0 (universal-hashes `35de31a`; `master` 0.9.1), `curve25519-dalek` 4.1.3 (curve25519-dalek `5312a03`; `main` 5.0.0), `md-5` 0.10.6 (hashes `026b0e8`; `master` 0.11.0), `des` 0.8.1 (block-ciphers `7de364e`; `master` 0.9.0). Still crates.io, no fork commit at the resolved version: `sha2` 0.10.9 and 0.11.1, `sha1` 0.10.7, `blake2` 0.11.0, `ed25519-dalek` 2.2.0; trait crates (`aead`, `cipher`, `digest`, `universal-hash`, `signature`) and `hmac` have no fork checked. `.cargo/config.toml` sets `curve25519_dalek_backend="serial"` and `poly1305_force_soft`. Patches and flags apply to this workspace only, never to consumers | MEASURED (fresh `cargo generate-lockfile`, no unused-patch warning; `cargo build -v` shows both cfgs on curve25519-dalek and poly1305) | **Coordination notes**: - OGAR's `Identity::class_identity_versioned(prefix, class, n)` MUST produce a string that `NiblePath` can split losslessly.