fix(deps): migrate ed25519-dalek v3 + rand_core 0.10 + getrandom 0.4 (supersedes #139, #135, #131) #149

Merged

vxfemboy merged 2 commits from fix/deps-rng-ecosystem into main 2026-07-29 04:11:57 +00:00

Conversation 0 Commits 2 Files changed 20 +122 -117

vxfemboy commented 2026-07-29 02:24:31 +00:00

Owner

Copy link

Migrates the RNG ecosystem together (coupled): ed25519-dalek 2→3, rand_core 0.6→0.10, getrandom 0.2→0.4 across yip-ca, yipd, yip-rendezvous, yip-membership, yip-obf, yip-utls. Supersedes Renovate #139 (ed25519-dalek), #135 (rand_core), #131 (getrandom) — close all three.

The migration

• ed25519-dalek 3's generate<R: CryptoRng> needs an OS-CSPRNG implementing the new CryptoRng. Old rand_core 0.6 OsRng is gone → replaced with getrandom::SysRng (sys_rng feature, same OS-entropy syscall path) wrapped in rand_core::UnwrapErr to bridge fallible TryCryptoRng → infallible CryptoRng. Fail-closed preserved: it panics on entropy failure (as the old OsRng did) — no path degrades to weak/zero bytes.
• getrandom::getrandom(&mut buf) → getrandom::fill(&mut buf) (same semantics), 17 call sites.
• ed25519-dalek unified at v3 across the lockfile (no v2/v3 split).

Security verification (proven, not assumed)

• Non-determinism: yip-ca genkey twice → two different keypairs (SysRng is genuinely OS-backed).
• Interop / no key or signature drift: independently signed/verified against Python cryptography (OpenSSL Ed25519) — ed25519-dalek 3 derives the byte-identical public key, produces the byte-identical deterministic signature, and its verify accepts the foreign-produced signature. So existing v2-signed Certs/RootSets still verify under v3.

cargo test --workspace all green (yipd 262/0, yip-membership 14/0, yip-rendezvous 32/0 + 91/0, yip-utls 70/0, yip-crypto 21/0); fmt + clippy clean.

⚠️ Merge-order note (interacts with ml-kem PR #147)

This PR deliberately keeps yip-utls on rand_core 0.6 (for ml-kem 0.2.3, which is what main still uses). PR #147 (ml-kem 0.3) bumps yip-utls to rand_core 0.10. So whichever of {this, #147} merges second needs a trivial rebase of crates/yip-utls/Cargo.toml's rand_core line. No logic conflict — just the version req.

Migrates the RNG ecosystem together (coupled): **ed25519-dalek 2→3, rand_core 0.6→0.10, getrandom 0.2→0.4** across yip-ca, yipd, yip-rendezvous, yip-membership, yip-obf, yip-utls. Supersedes Renovate #139 (ed25519-dalek), #135 (rand_core), #131 (getrandom) — **close all three**. ## The migration - ed25519-dalek 3's `generate<R: CryptoRng>` needs an OS-CSPRNG implementing the new `CryptoRng`. Old `rand_core 0.6 OsRng` is gone → replaced with `getrandom::SysRng` (`sys_rng` feature, same OS-entropy syscall path) wrapped in `rand_core::UnwrapErr` to bridge fallible `TryCryptoRng` → infallible `CryptoRng`. **Fail-closed preserved**: it panics on entropy failure (as the old `OsRng` did) — no path degrades to weak/zero bytes. - `getrandom::getrandom(&mut buf)` → `getrandom::fill(&mut buf)` (same semantics), 17 call sites. - ed25519-dalek unified at v3 across the lockfile (no v2/v3 split). ## Security verification (proven, not assumed) - **Non-determinism**: `yip-ca genkey` twice → two different keypairs (SysRng is genuinely OS-backed). - **Interop / no key or signature drift**: independently signed/verified against Python `cryptography` (OpenSSL Ed25519) — ed25519-dalek 3 derives the **byte-identical public key**, produces the **byte-identical deterministic signature**, and its `verify` accepts the foreign-produced signature. So existing v2-signed Certs/RootSets still verify under v3. `cargo test --workspace` all green (yipd 262/0, yip-membership 14/0, yip-rendezvous 32/0 + 91/0, yip-utls 70/0, yip-crypto 21/0); fmt + clippy clean. ## ⚠️ Merge-order note (interacts with ml-kem PR #147) This PR deliberately keeps `yip-utls` on `rand_core 0.6` (for ml-kem 0.2.3, which is what main still uses). PR #147 (ml-kem 0.3) bumps `yip-utls` to rand_core 0.10. So whichever of {this, #147} merges **second** needs a trivial rebase of `crates/yip-utls/Cargo.toml`'s rand_core line. No logic conflict — just the version req.

vxfemboy added 1 commit 2026-07-29 02:24:31 +00:00

fix(deps): migrate ed25519-dalek v3 + rand_core 0.10 + getrandom 0.4 ... 39473e5023

These three crates are entangled (ed25519-dalek 3's signer bound needs the
new rand_core CryptoRng; rand_core 0.10 dropped the getrandom feature the
workspace relied on; getrandom 0.4 removed the top-level getrandom() fn),
so Renovate's separate PRs (#139, #135, #131) can't land independently.

- ed25519-dalek 2.1 -> 3 everywhere it appears (bin/yip-ca, bin/yipd,
  yip-membership, yip-rendezvous), keeping a single unified version across
  the workspace.
- rand_core 0.6 -> 0.10 wherever it gates ed25519-dalek's `rand_core`
  feature. yip-utls keeps rand_core 0.6 deliberately: it's ml-kem 0.2's
  Encapsulate/Decapsulate RngCore+CryptoRng bound, a separate major version
  of the crate unrelated to ed25519-dalek (yip-utls has no ed25519-dalek
  dependency at all).
- getrandom 0.2 -> 0.4 everywhere (yip-obf, yip-utls, yipd,
  bin/yip-rendezvous), swapping the removed top-level getrandom::getrandom()
  for getrandom::fill() at every call site.
- Every `SigningKey::generate(&mut OsRng)` (rand_core 0.6's OsRng, now gone)
  becomes `SigningKey::generate(&mut UnwrapErr(SysRng))`: getrandom 0.4's
  `SysRng` (added as a new dependency with the `sys_rng` feature) is the
  OS-CSPRNG source, and rand_core 0.10's `UnwrapErr` adapts its fallible
  TryCryptoRng into the infallible CryptoRng ed25519-dalek 3 requires.
  Verified non-deterministic (two `yip-ca genkey` runs differ) and, via an
  independent Ed25519 implementation (Python cryptography/OpenSSL) for a
  fixed seed+message, byte-identical keygen/sign output.

vxfemboy added 1 commit 2026-07-29 04:11:48 +00:00

Merge remote-tracking branch 'origin/main' into fix/deps-rng-ecosystem ... 7c43db52bb

# Conflicts:
#	Cargo.lock
#	crates/yip-utls/Cargo.toml

vxfemboy merged commit 91eb38ab8e into main 2026-07-29 04:11:57 +00:00

vxfemboy referenced this pull request from a commit 2026-07-29 04:11:59 +00:00

Merge pull request 'fix(deps): migrate ed25519-dalek v3 + rand_core 0.10 + getrandom 0.4 (supersedes #139, #135, #131)' (#149) from fix/deps-rng-ecosystem into main

vxfemboy referenced this pull request from a commit 2026-08-02 21:46:25 +00:00

fix(ci): set YIP_SKIP_PRIVILEGED_TESTS in the coverage job

Sign in to join this conversation.

Reviewers

No reviewers

Labels

Clear labels   

bug

Something isn't working

  

documentation

Improvements or additions to documentation

  

duplicate

This issue or pull request already exists

  

enhancement

New feature or request

  

good first issue

Good for newcomers

  

help wanted

Extra attention is needed

  

invalid

This doesn't seem right

  

question

Further information is requested

  

wontfix

This will not be worked on

No labels

bug

documentation

duplicate

enhancement

good first issue

help wanted

invalid

question

wontfix

Milestone

Clear milestone

No items

No milestone

Projects

Clear projects

No items

No project

Assignees

Clear assignees

No assignees

1 participant

Notifications

Subscribe

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference

femboy/yip!149

No description provided.