d14f583d92
The repository tracks the latest stable Rust, pinned at the root. A
`rust-version` key states a *floor* -- the oldest toolchain a crate supports --
which is a different promise, and one this repository does not make. It also
said 1.97 while the pin was 1.98.0 and nothing verified it, so it was a claim in
the wrong direction and unchecked in both.
So it goes, everywhere:
59 rust-version = "1.97" (workspace and package declarations)
417 rust-version.workspace = true (members inheriting them)
476 files, 476 deletions, 0 insertions
The 417 are why this is not the sixty-file change it looks like from a grep for
the value. A member inheriting a key that no longer exists does not fall back to
a default -- its manifest stops resolving. Removing the declarations without the
inherits would have broken every workspace that has members.
Deliberately untouched: `joule-code-rs/vendor/wtransport/Cargo.toml`. That is a
vendored third-party crate declaring a floor about itself, not about us, and our
pin is above it. Editing vendored source to satisfy our own policy would make
the copy diverge from upstream for no benefit.
Verified rather than assumed:
- all 493 `Cargo.toml` files in the tree parse (`tomllib`)
- `cargo metadata --no-deps --locked` resolves on `joule-code-rs`, `wai-rs`,
`openpay`, `mesh-rs`, `sandbox-rs` and `jcp-rs` -- the check that actually
exercises workspace inheritance, which a TOML parse does not
- no `Cargo.lock` changed; `rust-version` is not lockfile state
`wai/wai-verify/Cargo.toml` already carried a comment saying it omits
`rust-version` on purpose, so this makes the rest of the tree agree with the one
crate that had already decided.
What this gives up, stated plainly: cargo can no longer greet an older
toolchain with "requires rustc 1.97" and will instead fail wherever the code
first needs something newer. That is the cost of not maintaining a floor, and
it is the right cost when the floor was fiction.
Co-Authored-By: Claude Opus 5 <[email protected]>
73 lines
3.1 KiB
TOML
73 lines
3.1 KiB
TOML
[package]
|
|
name = "op-3ds2"
|
|
version.workspace = true
|
|
edition.workspace = true
|
|
license.workspace = true
|
|
repository.workspace = true
|
|
description = "OpenPay 3-D Secure 2.x: full 3DS Requestor / Server / DS / ACS message stack for protocol versions 2.1.0, 2.2.0, and 2.3.0. SCA exemption evaluator covering PSD2 RTS + PSD3 (2026) update. Browser-fingerprint collection, app-based 3DS, decoupled authentication, data-only, and 3RI flows."
|
|
publish = false
|
|
|
|
[dependencies]
|
|
op-core = { path = "../op-core" }
|
|
|
|
# Core serde + JSON. EMVCo 3DS 2.x messages are JSON over HTTPS; the
|
|
# only XML-flavoured corner is a small set of legacy 2.1.0 transitional
|
|
# payloads which we round-trip through quick-xml when present.
|
|
serde = { workspace = true }
|
|
serde_json = { workspace = true }
|
|
|
|
# Time handling. Chrono is the de-facto choice in 2026 for DateTime<Utc>
|
|
# round-tripping over JSON; we use it for trusted-beneficiary
|
|
# enrolment timestamps and challenge timeouts.
|
|
chrono = { version = "0.4", default-features = false, features = ["clock", "serde", "std"] }
|
|
|
|
# UUIDs for messageVersion / threeDSServerTransID / acsTransID /
|
|
# dsTransID. EMVCo spec mandates UUIDv4 format for all transaction IDs.
|
|
uuid = { workspace = true }
|
|
|
|
# Base64 for CAVV, TAVV, deviceInfo, and the various opaque blobs that
|
|
# travel inside 3DS messages.
|
|
base64 = "0.22"
|
|
|
|
# SHA-256 for the AReq -> AReq hash used in the 3DS Method invocation
|
|
# and for CAVV verification.
|
|
sha2 = "0.11"
|
|
|
|
# NOTE: the encrypted deviceInfo block (SDK device data, AES-CBC under a
|
|
# session key established via ECDH-P-256) is not implemented yet, so no
|
|
# aes/cbc dependency is declared. Add them when that lands -- and match the
|
|
# cipher 0.4 generation the rest of the workspace uses (aes 0.8 / cbc 0.1),
|
|
# so the build keeps a single aes + cipher in the graph.
|
|
|
|
# P-256 for the ECDH-based session key establishment used by the SDK
|
|
# device-binding flow. There is deliberately no RSA here: the legacy
|
|
# issuer-ACS public-key path was never implemented, and the `rsa` crate it
|
|
# would have used carries RUSTSEC-2023-0071 (Marvin timing sidechannel) with
|
|
# no fixed version available. Reintroducing it needs a constant-time
|
|
# implementation, not a version bump.
|
|
p256 = { version = "0.13", features = ["ecdh", "ecdsa"] }
|
|
|
|
# X.509 parsing for DS / ACS certificate chain validation. Each card
|
|
# scheme issues its own DS certificate; we parse and pin against the
|
|
# scheme root.
|
|
x509-parser = "0.18"
|
|
|
|
# quick-xml for the small set of legacy XML payloads (DS version-check
|
|
# in the 2.1.0 transition window and some scheme-specific extensions).
|
|
quick-xml = { workspace = true }
|
|
|
|
# Async runtime + HTTP client for DS / ACS calls.
|
|
tokio = { workspace = true }
|
|
reqwest = { version = "0.13", default-features = false, features = ["rustls", "json"] }
|
|
|
|
# Object-safe async trait surface (DirectoryServer / AcsServer are
|
|
# trait objects). Native async-fn-in-trait is stable on 1.95 but
|
|
# the dyn-compat form still needs the macro shim.
|
|
async-trait = "0.1"
|
|
|
|
thiserror = { workspace = true }
|
|
tracing = { workspace = true }
|
|
|
|
[dev-dependencies]
|
|
tokio = { version = "1", features = ["macros", "rt-multi-thread"] }
|
|
serde_json = { workspace = true }
|