commit 34c71f38970de687e1da749c6a88d59ee7cbbd60
parent 49d01b6deecb3724b83442ca3c41c89861a75fda
Author: triesap <tyson@radroots.org>
Date: Fri, 21 Aug 2026 09:26:25 +0000
build: pin hardened lib cohort
- pin every Radroots dependency to the promoted Lib revision
- refresh the exact catalog archive and lock digests
- adapt signing to the sealed request accessors
- bind the source cohort with standalone policy tests
Diffstat:
5 files changed, 32 insertions(+), 27 deletions(-)
diff --git a/Cargo.lock b/Cargo.lock
@@ -1718,7 +1718,7 @@ checksum = "f8dcc9c7d52a811697d2151c701e0d08956f92b0e24136cf4cf27b57a6a0d9bf"
[[package]]
name = "radroots_blossom"
version = "0.1.0-alpha"
-source = "git+https://github.com/radrootslabs/lib?rev=09065a610d95e57acdc895a14c07580fa099e7c3#09065a610d95e57acdc895a14c07580fa099e7c3"
+source = "git+https://github.com/radrootslabs/lib?rev=b44119fbac5985be8127ad1bf56d2950e6399427#b44119fbac5985be8127ad1bf56d2950e6399427"
dependencies = [
"mediatype",
"serde",
@@ -1730,7 +1730,7 @@ dependencies = [
[[package]]
name = "radroots_core"
version = "0.1.0-alpha"
-source = "git+https://github.com/radrootslabs/lib?rev=09065a610d95e57acdc895a14c07580fa099e7c3#09065a610d95e57acdc895a14c07580fa099e7c3"
+source = "git+https://github.com/radrootslabs/lib?rev=b44119fbac5985be8127ad1bf56d2950e6399427#b44119fbac5985be8127ad1bf56d2950e6399427"
dependencies = [
"rust_decimal",
"serde",
@@ -1739,7 +1739,7 @@ dependencies = [
[[package]]
name = "radroots_event"
version = "0.1.0-alpha"
-source = "git+https://github.com/radrootslabs/lib?rev=09065a610d95e57acdc895a14c07580fa099e7c3#09065a610d95e57acdc895a14c07580fa099e7c3"
+source = "git+https://github.com/radrootslabs/lib?rev=b44119fbac5985be8127ad1bf56d2950e6399427#b44119fbac5985be8127ad1bf56d2950e6399427"
dependencies = [
"hex",
"jiff-tzdb",
@@ -1757,7 +1757,7 @@ dependencies = [
[[package]]
name = "radroots_event_codec"
version = "0.1.0-alpha"
-source = "git+https://github.com/radrootslabs/lib?rev=09065a610d95e57acdc895a14c07580fa099e7c3#09065a610d95e57acdc895a14c07580fa099e7c3"
+source = "git+https://github.com/radrootslabs/lib?rev=b44119fbac5985be8127ad1bf56d2950e6399427#b44119fbac5985be8127ad1bf56d2950e6399427"
dependencies = [
"hex",
"radroots_blossom",
@@ -1774,7 +1774,7 @@ dependencies = [
[[package]]
name = "radroots_identity"
version = "0.1.0-alpha"
-source = "git+https://github.com/radrootslabs/lib?rev=09065a610d95e57acdc895a14c07580fa099e7c3#09065a610d95e57acdc895a14c07580fa099e7c3"
+source = "git+https://github.com/radrootslabs/lib?rev=b44119fbac5985be8127ad1bf56d2950e6399427#b44119fbac5985be8127ad1bf56d2950e6399427"
dependencies = [
"k256",
"serde",
@@ -1784,7 +1784,7 @@ dependencies = [
[[package]]
name = "radroots_nostr"
version = "0.1.0-alpha"
-source = "git+https://github.com/radrootslabs/lib?rev=09065a610d95e57acdc895a14c07580fa099e7c3#09065a610d95e57acdc895a14c07580fa099e7c3"
+source = "git+https://github.com/radrootslabs/lib?rev=b44119fbac5985be8127ad1bf56d2950e6399427#b44119fbac5985be8127ad1bf56d2950e6399427"
dependencies = [
"nostr",
"radroots_event",
@@ -1798,7 +1798,7 @@ dependencies = [
[[package]]
name = "radroots_nostr_connect"
version = "0.1.0-alpha"
-source = "git+https://github.com/radrootslabs/lib?rev=09065a610d95e57acdc895a14c07580fa099e7c3#09065a610d95e57acdc895a14c07580fa099e7c3"
+source = "git+https://github.com/radrootslabs/lib?rev=b44119fbac5985be8127ad1bf56d2950e6399427#b44119fbac5985be8127ad1bf56d2950e6399427"
dependencies = [
"nostr",
"radroots_event",
@@ -1814,7 +1814,7 @@ dependencies = [
[[package]]
name = "radroots_protocol"
version = "0.1.0-alpha"
-source = "git+https://github.com/radrootslabs/lib?rev=09065a610d95e57acdc895a14c07580fa099e7c3#09065a610d95e57acdc895a14c07580fa099e7c3"
+source = "git+https://github.com/radrootslabs/lib?rev=b44119fbac5985be8127ad1bf56d2950e6399427#b44119fbac5985be8127ad1bf56d2950e6399427"
dependencies = [
"serde",
]
@@ -1822,7 +1822,7 @@ dependencies = [
[[package]]
name = "radroots_secrets"
version = "0.1.0-alpha"
-source = "git+https://github.com/radrootslabs/lib?rev=09065a610d95e57acdc895a14c07580fa099e7c3#09065a610d95e57acdc895a14c07580fa099e7c3"
+source = "git+https://github.com/radrootslabs/lib?rev=b44119fbac5985be8127ad1bf56d2950e6399427#b44119fbac5985be8127ad1bf56d2950e6399427"
dependencies = [
"chacha20poly1305",
"keyring",
@@ -1835,7 +1835,7 @@ dependencies = [
[[package]]
name = "radroots_signing"
version = "0.1.0-alpha"
-source = "git+https://github.com/radrootslabs/lib?rev=09065a610d95e57acdc895a14c07580fa099e7c3#09065a610d95e57acdc895a14c07580fa099e7c3"
+source = "git+https://github.com/radrootslabs/lib?rev=b44119fbac5985be8127ad1bf56d2950e6399427#b44119fbac5985be8127ad1bf56d2950e6399427"
dependencies = [
"hex",
"radroots_event",
diff --git a/Cargo.toml b/Cargo.toml
@@ -38,12 +38,12 @@ hex = "0.4"
keyring = { version = "3.6", default-features = false, features = ["apple-native", "windows-native", "sync-secret-service"] }
nostr = { version = "0.44.2", features = ["nip04", "nip44", "nip46", "nip49"] }
nostr-sdk = { version = "0.44.1" }
-radroots_identity = { git = "https://github.com/radrootslabs/lib", rev = "09065a610d95e57acdc895a14c07580fa099e7c3", version = "=0.1.0-alpha" }
-radroots_event = { git = "https://github.com/radrootslabs/lib", rev = "09065a610d95e57acdc895a14c07580fa099e7c3", version = "=0.1.0-alpha", features = ["serde"] }
-radroots_nostr = { git = "https://github.com/radrootslabs/lib", rev = "09065a610d95e57acdc895a14c07580fa099e7c3", version = "=0.1.0-alpha", features = ["events"] }
-radroots_nostr_connect = { git = "https://github.com/radrootslabs/lib", rev = "09065a610d95e57acdc895a14c07580fa099e7c3", version = "=0.1.0-alpha" }
-radroots_secrets = { git = "https://github.com/radrootslabs/lib", rev = "09065a610d95e57acdc895a14c07580fa099e7c3", version = "=0.1.0-alpha", features = ["std", "keyring"] }
-radroots_signing = { git = "https://github.com/radrootslabs/lib", rev = "09065a610d95e57acdc895a14c07580fa099e7c3", version = "=0.1.0-alpha", features = ["std"] }
+radroots_identity = { git = "https://github.com/radrootslabs/lib", rev = "b44119fbac5985be8127ad1bf56d2950e6399427", version = "=0.1.0-alpha" }
+radroots_event = { git = "https://github.com/radrootslabs/lib", rev = "b44119fbac5985be8127ad1bf56d2950e6399427", version = "=0.1.0-alpha", features = ["serde"] }
+radroots_nostr = { git = "https://github.com/radrootslabs/lib", rev = "b44119fbac5985be8127ad1bf56d2950e6399427", version = "=0.1.0-alpha", features = ["events"] }
+radroots_nostr_connect = { git = "https://github.com/radrootslabs/lib", rev = "b44119fbac5985be8127ad1bf56d2950e6399427", version = "=0.1.0-alpha" }
+radroots_secrets = { git = "https://github.com/radrootslabs/lib", rev = "b44119fbac5985be8127ad1bf56d2950e6399427", version = "=0.1.0-alpha", features = ["std", "keyring"] }
+radroots_signing = { git = "https://github.com/radrootslabs/lib", rev = "b44119fbac5985be8127ad1bf56d2950e6399427", version = "=0.1.0-alpha", features = ["std"] }
serde = { version = "1.0", features = ["derive"] }
serde_json = "1.0"
sha2 = "0.10"
diff --git a/radroots.lib.source-lock.v1.toml b/radroots.lib.source-lock.v1.toml
@@ -1,9 +1,9 @@
schema = "radroots.lib.source-lock.v1"
repository = "https://github.com/radrootslabs/lib"
-revision = "09065a610d95e57acdc895a14c07580fa099e7c3"
+revision = "b44119fbac5985be8127ad1bf56d2950e6399427"
architecture = "radroots.crates.release.v2"
-workspace_catalog_sha256 = "8c27cebf6825f9ed74e122513c661f6dd31837dddb39d0988014121d8ab05e75"
+workspace_catalog_sha256 = "deca0c080deae187ff8186c0708903e42f41ea57f77c5f91581e23aa561164a4"
version = "0.1.0-alpha"
-source_archive_sha256 = "68badd1fb02d9396682d368e62dfe79969d8da48529760789c823fb4ab54aea3"
+source_archive_sha256 = "975474804e6358b9228981add0a23181dbdd1afddf5ae12579c82220876bc379"
lockfile = "Cargo.lock"
-lockfile_sha256 = "3a26058ad786e73e88b04a505d56845c5cdc6bf6d3d8216f03d1b1593dba2ea7"
+lockfile_sha256 = "395d6703fdd37ba43558475ac739d6878d27d305c479ac1c07b19afe4c5d5867"
diff --git a/src/signing_adapter.rs b/src/signing_adapter.rs
@@ -36,25 +36,23 @@ impl Signer for MycActiveIdentity {
Box::pin(async move {
let now = now_unix_ms();
request.ensure_active(now)?;
- let plan = request.plan();
- if plan.author() != &self.public_identity().public_key() {
+ if request.expected_author() != &self.public_identity().public_key() {
return Err(Error::new(SigningErrorKind::AuthorizationDenied));
}
report_progress(&request, SignProgressStage::Validating)?;
- let kind = u16::try_from(plan.body().kind())
+ let kind = u16::try_from(request.kind())
.map_err(|_| Error::new(SigningErrorKind::InvalidArgument))?;
- let tags = plan
- .body()
+ let tags = request
.tags()
.iter()
.cloned()
.map(Tag::parse)
.collect::<Result<Vec<_>, _>>()
.map_err(|source| Error::with_source(SigningErrorKind::InvalidArgument, source))?;
- let unsigned = EventBuilder::new(Kind::Custom(kind), plan.body().content())
+ let unsigned = EventBuilder::new(Kind::Custom(kind), request.content())
.tags(tags)
- .custom_created_at(Timestamp::from(plan.created_at()))
+ .custom_created_at(Timestamp::from(request.created_at()))
.build(self.public_key());
let event = self
.sign_unsigned_event(unsigned, "final signing request")
diff --git a/tests/build_policy.rs b/tests/build_policy.rs
@@ -41,4 +41,11 @@ fn release_acceptance_checks_both_feature_profiles() {
fn source_lock_binds_the_current_cargo_lock() {
let digest = hex::encode(Sha256::digest(include_bytes!("../Cargo.lock")));
assert!(SOURCE_LOCK.contains(&format!("lockfile_sha256 = \"{digest}\"")));
+ assert!(SOURCE_LOCK.contains("revision = \"b44119fbac5985be8127ad1bf56d2950e6399427\""));
+ assert!(SOURCE_LOCK.contains(
+ "workspace_catalog_sha256 = \"deca0c080deae187ff8186c0708903e42f41ea57f77c5f91581e23aa561164a4\""
+ ));
+ assert!(SOURCE_LOCK.contains(
+ "source_archive_sha256 = \"975474804e6358b9228981add0a23181dbdd1afddf5ae12579c82220876bc379\""
+ ));
}
