Repository navigation
Conversation
Signed-off-by: Frederico Araujo <frederico.araujo@ibm.com>
Preserve binding credentials and request context, adopt typed credential sources and CMF history, and migrate maintained configs. Reject Rust-only inputs at unsupported host boundaries. BREAKING CHANGE: CIBA requires an explicit store and conversation history uses CMF messages. Go and native artifacts must use FFI ABI 4. Signed-off-by: Frederico Araujo <frederico.araujo@ibm.com>
Describe RustCrypto, ABI 4, live request state and worker support boundaries. Refresh current examples and audit-sink guidance, record validation results, and retain the Biscuit advisory as a release blocker. Signed-off-by: Frederico Araujo <frederico.araujo@ibm.com>
Keep crates.io-only dependencies until the upstream fix is published. Record the release follow-up and confirm that CPEX has no FIPS implementation or runtime dependencies. Signed-off-by: Frederico Araujo <frederico.araujo@ibm.com>
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Upgrade CPEX to PPE 0.6.0 with an explicit RustCrypto backend and prepare CPEX 0.4.0 / FFI ABI 4. Preserve credential headers and request context across the bindings as PPE changes its serialized inputs and credential types.
Changes
Checks
make lintmake audit: existing Biscuit dependency still resolves vulnerablecrypto-bigint0.5.5 (RUSTSEC-2026-0387)Notes
Release blocker: retain crates.io-only Biscuit dependencies until upstream publishes the fix tracked in eclipse-biscuit/biscuit-rust#351. No new advisory waiver, Git dependency or vendored crypto patch is added.
RustCrypto is the selected backend; CPEX adds no FIPS support or experimental limiter. The separate SPIRE overlay and cross-target release CI were not run locally. Full evidence and support boundaries are recorded in the upgrade plan.