Repository navigation
build: wire the AdaWorldAPI RustCrypto forks and keep foreign SIMD out - #369
Merged
Merged
Conversation
[patch.crates-io] now resolves chacha20poly1305, chacha20 (ndarray's ndarray::simd fork), poly1305, curve25519-dalek, ed448-goldilocks, md-5 and des to their AdaWorldAPI forks, each at the fork commit carrying the exact version the registry would resolve (fork default branches are a major ahead; a mismatched patch is silently unused). sha2, sha1 0.10.7, blake2 0.11.0 and ed25519-dalek 2.2.0 have no matching fork commit and stay on crates.io; docs/UPSTREAM-DEPS.md records both lists. .cargo/config.toml sets curve25519_dalek_backend="serial" and poly1305_force_soft, as ndarray does, so the crypto crates compile no AVX2 intrinsics of their own. Fresh generate-lockfile: no unused-patch warning. cargo check --workspace --all-targets clean; ogar-encryption/-auth/-oidc/-rbac tests green. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01XAqKMQJzQD5KvNm8BtbsWG
|
Important
This repository does not receive automatic reviews because it has fewer than 10 stars.
 |
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
OGAR's crypto crates (
ogar-encryption,ogar-auth,ogar-oidc) resolved almost every RustCrypto crate from crates.io, even though AdaWorldAPI forks of most of them exist. This PR points them at the forks and stops these crates from compiling their own AVX intrinsics.chacha20poly13050.11 against 0.10.1,curve25519-dalek5 against 4.1.3, and so on. Cargo silently ignores a patch whose version doesn't match, so each entry is pinned to the fork commit whoseCargo.tomlhas exactly the version the registry would resolve.chacha20comes from ndarray's own fork (vendor/chacha20), which adds anndarray::simd::U32x16backend. ndarray already uses it inside its own workspace, but OGAR builds never got it until now..cargo/config.tomlsets two flags, as ndarray does:curve25519_dalek_backend="serial"stops curve25519-dalek's build script from auto-selecting its AVX2 backend;poly1305_force_softstops poly1305 from selecting its AVX2 backend.ecdsa0.17.05595c3b(unchanged, from #367)chacha20poly13050.10.1c5c1999chacha200.9.1vendor/chacha20, branchmasterpoly13050.8.035de31acurve25519-dalek4.1.35312a03ed448-goldilocks0.14.0-pre.15f5cb30emd-50.10.6026b0e8des0.8.17de364eStill crates.io, because no fork commit carries the resolved version:
sha20.10.9 and 0.11.1,sha10.10.7,blake20.11.0 anded25519-dalek2.2.0. These were most likely released from upstream maintenance branches that the forks did not copy.aead,cipher,digest,universal-hashandsignature(the trait crates) andhmac. These have no fork that I checked.Both lists are recorded in
docs/UPSTREAM-DEPS.md.Measured
cargo generate-lockfilegives no "patch was not used" warning, andcargo treeshows every patched crate at its fork source.cargo build -v -p ogar-encryptionpasses--cfg curve25519_dalek_backend="serial"to curve25519-dalek and--cfg poly1305_force_softto poly1305.cargo check --workspace --all-targets: clean.cargo test -p ogar-encryption -p ogar-auth -p ogar-oidc -p ogar-rbac: green. This includes the envelope seal/open round trips over the patched XChaCha20-Poly1305.cargo clippyon the same four crates with-D warnings: clean.cargo fmt --all -- --check: clean.Scope limit
Cargo never applies a dependency's
[patch]or.cargo/config.tomldownstream. a2ui-rs, report-rs and every other consumer of OGAR crates still get the registry versions, and dalek's AVX2 backend, unless they repeat this block and these flags. That is a follow-up in each consumer repo.One more caution: a
RUSTFLAGSenvironment variable replaces the config's flags instead of adding to them. OGAR's CI sets none.Generated by Claude Code