Exact

Exact Union RegExp

Repository files (latest commit first)

Filename	Latest commit message	Latest commit date
Transaction Science 4bbb4cd254 sec: answer the gate's first catch — two constant-time advisories, and pin an allowance to the version it excuses ... The advisory gate from #443 found something on its first real run, two days after landing: RUSTSEC-2026-0385 and -0387, both published 2026-10-23, neither of which existed when the sweep was done. That is the gate doing the job it was added for, so this is the answer rather than a new allowance. ctutils 0.4.2/0.4.3 -> 0.4.4 RUSTSEC-2026-0385, non-constant-time mask generation and `u128` comparisons. Reaches openpay's wallet crates through digest -> hmac/hkdf, so it sits under HMAC on payment paths. Fixed in four lockfiles. crypto-bigint 0.7.3 -> 0.7.6 RUSTSEC-2026-0387, secret-dependent branches in subtraction, zero counting, division and Montgomery multiplication — operations whose whole purpose is to be constant-time. The 0.5.5 line of crypto-bigint cannot follow: elliptic-curve 0.13 pins it, so reaching >=0.7.6 means moving the p256/elliptic-curve stack across openpay, sandbox, wai and jouleclaw. That is an upgrade, not a bump. It is allowed with that reason recorded, on paths that sign and derive keys, so it reads as debt. Writing that allowance exposed a weakness in the check itself: ALLOW was keyed by advisory id alone, so an entry excusing the stuck 0.5.5 line would have gone on excusing the advisory if a patched 0.7.x copy later regressed to an unpatched release — the same shape as sealing by name instead of by digest. An entry may now pin the exact crate/version pairs it covers: "RUSTSEC-...": {"why": "...", "only": ("crypto-bigint 0.5.5",)} Any other version of that crate fails, and a named pair that disappears makes the entry stale, so the pin cannot keep describing a tree that moved. The version-blind string form is kept for reasons that genuinely do not depend on the version, such as a call we never make, and the two forms are documented against each other. The self-test now builds its documents by importing the check's real ALLOW rather than scraping it with grep, so the two cannot drift, and covers the two new failure modes: a version-pinned allowance offered a version it does not name, and one whose named pair is gone. Also moves off every yanked dependency, each a patch bump: chacha20 0.10.0/0.10.1 -> 0.10.2 (a cipher, in six lockfiles), der 0.8.0 -> 0.8.2, spin 0.9.8 -> 0.9.9 and 0.10.0 -> 0.10.1, iroh-blobs 0.101.0 -> 0.101.1. A yank is the author withdrawing a release; none of these needed to stay on one. No yanked dependency remains anywhere in the tree. All 47 lockfiles current; the six affected workspaces check clean and `mls_keying` passes. Co-Authored-By: Claude Opus 5 <[email protected]>		2026-10-24 20:06:05 -04:00
..
check-advisories-selftest.sh	sec: answer the gate's first catch — two constant-time advisories, and pin an allowance to the version it excuses	2026-10-24 20:06:05 -04:00
check-advisories.py	sec: answer the gate's first catch — two constant-time advisories, and pin an allowance to the version it excuses	2026-10-24 20:06:05 -04:00
check-comparative-prose.sh	wai: restate the ranking phrases the retrofit left in research and extensions	2026-10-01 08:38:05 -04:00
check-fabric-errors.py	jouleclaw-omni: metal compiles — 45 -> 0, write the 21 missing kernels	2026-10-20 04:33:42 -04:00
check-lockfiles-selftest.sh	scripts: no pipe into grep -q under pipefail	2026-10-15 01:52:03 -04:00
check-lockfiles.sh	joule-code: vendor wtransport 0.7.2 as published, patched in	2026-10-20 04:54:03 -04:00
check-metal-shaders.py	check-metal-shaders: stop being coupled to raw-string style, and refuse to check almost nothing	2026-10-20 08:52:06 -04:00
check-no-vanity-metrics.sh	docs + no-vanity-metrics: reword two counts, fix scanner false positive	2026-06-13 22:14:13 -04:00
check-orphan-sources.py	jouleclaw-omni: declare 23 modules that were compiled by nothing	2026-10-18 07:19:24 -04:00
check-public-names.sh	wai-quantum WebGPU member: CI review fixes	2026-10-10 23:29:10 -04:00
check-spec-refs-selftest.sh	ci: a citation to a section that does not exist is now a failure	2026-10-13 03:07:23 -04:00
check-spec-refs.py	ci: a citation to a section that does not exist is now a failure	2026-10-13 03:07:23 -04:00
check-tests-in-ci-selftest.sh	scripts: no pipe into grep -q under pipefail	2026-10-15 01:52:03 -04:00
check-tests-in-ci.py	ci: every wai-rs test file is run by a job or listed, and none can run empty	2026-10-13 01:20:48 -04:00
check-wai-section-refs.py	check-wai-section-refs: read wai/SECURITY.md too	2026-10-09 17:15:06 -04:00
check-workflow-concurrency-selftest.sh	ci: one job for the repository's script checks	2026-10-14 12:05:46 -04:00
check-workflow-concurrency.sh	ci: guard the concurrency groups, and stop the dev Mac serving 13 of 21 contexts	2026-10-05 12:18:21 -04:00
install-hooks.sh	ci: no-vanity-metrics scanner + pre-commit hook + CHARTER policy	2026-06-02 10:39:43 -04:00
pr-touches-paths-selftest.sh	pr-touches-paths: a comment inside a path list no longer ends it	2026-10-14 04:21:43 -04:00
pr-touches-paths.py	pr-touches-paths: a comment inside a path list no longer ends it	2026-10-14 04:21:43 -04:00
standards-touched-selftest.sh	scripts: no pipe into grep -q under pipefail	2026-10-15 01:52:03 -04:00
standards-touched.py	ci: the standards build builds the workspaces a change touches	2026-10-14 03:40:08 -04:00
test-public-text-checks.sh	wai: restate the ranking phrases the retrofit left in research and extensions	2026-10-01 08:38:05 -04:00
wai-quantum-webgpu-member.sh	wai-quantum fabric: run meters, metered calibration, place_for, and the Fabric wrapper	2026-10-12 05:08:11 -04:00