From e93238cb4a9501cffd9951e91112709964d6233d Mon Sep 17 00:00:00 2001 From: "glm-5.3-flash" Date: Thu, 10 Sep 2026 03:51:31 +0000 Subject: [PATCH] adopt ecosystem MSRV floor 1.88; drop the time pin MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit - rust-version 1.85 -> 1.88 (ecosystem-wide resolution from the audit sessions; matches noq 1.2's floor, sits below iroh 1.91) - Cargo.lock: time 0.3.36 pin removed (existed only to keep the 1.85 claim satisfiable); tree re-floated to current - phase-0: MSRV thread marked RESOLVED; OQ-TLS-08 narrowed to the quinn->noq feature-rename half; lesson recorded (rust-version is passive metadata — claims must be compile-checked, not assumed) Verified: cargo test, test --all-features, clippy -D warnings, fmt --check, rustup run 1.88 cargo check --- Cargo.lock | 26 +++++++--------- Cargo.toml | 2 +- docs/research/phase-0.md | 66 +++++++++++++++++++--------------------- 3 files changed, 44 insertions(+), 50 deletions(-) diff --git a/Cargo.lock b/Cargo.lock index 50cb71d..342c7d6 100644 --- a/Cargo.lock +++ b/Cargo.lock @@ -445,12 +445,9 @@ dependencies = [ [[package]] name = "deranged" -version = "0.3.11" +version = "0.5.8" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "b42b6fa04a440b495c8b04d0e71b707c585f83cb9cb28cf8cd0d976c315e31b4" -dependencies = [ - "powerfmt", -] +checksum = "7cd812cc2bc1d69d4764bd80df88b4317eaef9e773c75226407d9bc0876b211c" [[package]] name = "digest" @@ -942,9 +939,9 @@ dependencies = [ [[package]] name = "num-conv" -version = "0.1.0" +version = "0.2.2" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "51d515d32fb182ee37cda2ccdcb92950d6a3c2893aa280e540671c2cd0f3b1d9" +checksum = "521739c6d2bac4aa25192232afe6841231376b2b26d4d9fae5ecf8ca5772e441" [[package]] name = "num-integer" @@ -1672,30 +1669,29 @@ dependencies = [ [[package]] name = "time" -version = "0.3.36" +version = "0.3.55" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "5dfd88e563464686c916c7e46e623e520ddc6d79fa6641390f2e3fa86e83e885" +checksum = "cdb87b95ec50ddfa440816d227a17b2ccbdda963a316a727fda0fc4334f7d134" dependencies = [ "deranged", - "itoa", "num-conv", "powerfmt", - "serde", + "serde_core", "time-core", "time-macros", ] [[package]] name = "time-core" -version = "0.1.2" +version = "0.1.9" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "ef927ca75afb808a4d64dd374f00a2adf8d0fcff8e7b184af886c3c87ec4a3f3" +checksum = "9e1c906769ad99c88eaa54e728060edef082f8e358ff32030cb7c7d315e81109" [[package]] name = "time-macros" -version = "0.2.18" +version = "0.2.32" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "3f252a68540fde3a3877aeea552b832b40ab9a69e318efd078774a01ddee1ccf" +checksum = "7e689342a48d2ea927c87ea50cabf8594854bf940e9310208848d680d668ed85" dependencies = [ "num-conv", "time-core", diff --git a/Cargo.toml b/Cargo.toml index d963576..209c813 100644 --- a/Cargo.toml +++ b/Cargo.toml @@ -2,7 +2,7 @@ name = "alktls" version = "0.1.0" edition = "2021" -rust-version = "1.85" +rust-version = "1.88" license = "MIT OR Apache-2.0" description = "Shared TLS setup types: server and client rustls configs, cert resolvers, verifiers, and ACME state-machine wiring, transport-agnostic and shareable across transports." repository = "https://git.alk.dev/alkdev/alktls" diff --git a/docs/research/phase-0.md b/docs/research/phase-0.md index cf52bb2..6dceb27 100644 --- a/docs/research/phase-0.md +++ b/docs/research/phase-0.md @@ -313,32 +313,33 @@ library); `quinn`/`tcp`/`acme` feature-gated; needed by any client dialing public X.509 endpoints regardless of transport); `futures` acme-gated (the event loop's `StreamExt`). -**MSRV verification (2026-09-09).** The sibling crates declare +**MSRV verification (2026-09-09).** The sibling crates declared `rust-version = "1.85"`, but that claim was never compile-checked against the TLS dependency tree: with default resolution, `rcgen → yasna/time` pulls `time 0.3.5x` which requires rustc 1.88, and both this crate's fresh lock *and alknet's own `alknet-tls`* fail -`rustup run 1.85 cargo check` for exactly that reason. Resolution here: -pin `time` to `0.3.36` (the last release with an MSRV ≤ 1.85) in -`Cargo.lock` and commit the lock — `cargo check` verified under the -real 1.85 toolchain. Two standing consequences: (1) the lock is -repo-state — `Cargo.toml` alone does not carry the MSRV guarantee, and -a future `cargo update` that re-floats `time` silently breaks the -1.85 claim; (2) the honest MSRV for the *dependency tree* is 1.85 only -with the pin — if Phase 1 later decides `rust-version` should track -reality (e.g. 1.88+), that is a one-line change plus unpinning. Either -way, the decision is recorded here rather than inherited silently. +`rustup run 1.85 cargo check` for exactly that reason. Interim +resolution: pin `time` to `0.3.36` and verify under the real 1.85 +toolchain. -**MSRV pressure from the noq/iroh direction.** noq 1.2 declares -rust-version 1.88 and iroh 1.1 declares 1.91 (both edition 2024). The -quinn 0.11 path today keeps the tree at 1.85; the noq path raises the -crate's de facto floor to 1.88+ for consumers that enable the quic -feature. Since quic/iroh consumers (the rewrite) sit on iroh 1.91 -anyway, this argues for Phase 1 setting `rust-version = 1.88` -crate-wide (matching noq's floor, below iroh's) and unpinning `time` — -see OQ-TLS-08. The alknet-tls extraction source (quinn-only, no iroh -dep) can stay at its own floor; the floors only unify at the -assembly layer. +**RESOLVED 2026-09-10 — ecosystem floor raised to 1.88.** The finding +was audited across the whole ecosystem (3 published + 1 unpublished +crate, dedicated audit sessions): the 1.85 claim failed in all of +them; every crate has now adopted `rust-version = "1.88"` with the +lock re-floated. alktls follows: `rust-version = "1.88"`, `time` pin +dropped (it existed only to keep the 1.85 claim satisfiable), +`rustup run 1.88 cargo check` verified. The lesson recorded for the +ecosystem: `rust-version` claims are passive metadata — nothing fails +at build time on modern toolchains, so the claim must be +*compile-checked* against the resolved tree, not assumed; a committed +`Cargo.lock` is what makes an MSRV claim reproducible either way. + +**MSRV pressure from the noq/iroh direction — subsumed.** noq 1.2 +declares rust-version 1.88 and iroh 1.1 declares 1.91 (both edition +2024). The 2026-09-10 ecosystem floor of 1.88 (above) matches noq's +exactly and sits below iroh's, so the noq/iroh MSRV pressure that +motivated the Phase 1 lean is already absorbed — what remains of +OQ-TLS-08 is only the feature-rename half (`quinn` → `noq`). ## Prior art: noq and the quinn→noq shift (2026-09-09) @@ -544,13 +545,10 @@ The extracted `quinn` feature + `for_quinn()` accessors face a decision: rewrite is the only one — so this doubles the accessor surface for nothing. -Leaning A. Sub-decision: with the noq feature as the QUIC path, the -crate's de facto MSRV floor rises to noq's 1.88 (iroh consumers sit at -1.91 anyway). Phase 1 should set `rust-version = 1.88` crate-wide and -unpin `time` (the 1.85 pin exists only to keep the aspirational 1.85 -claim — with an honest 1.88 floor, default resolution is fine and one -less pin to maintain). The `tcp` feature (tokio-rustls) has no 1.88 -pressure of its own; a unified 1.88 crate floor is the simple shape. +Leaning A. MSRV sub-decision RESOLVED 2026-09-10: the ecosystem floor +is 1.88 crate-wide (matching noq's; `time` unpinned — see §Version and +dependency posture), so the only open half of this OQ is the feature +rename itself. Also record in the Phase 1 ADR: noq 1.2's `rustls-aws-lc-rs` feature is the wiring for ADR-084's provider posture on the QUIC path, and iroh @@ -558,10 +556,10 @@ the wiring for ADR-084's provider posture on the QUIC path, and iroh feature-select the *same* rustls 0.23 + aws-lc-rs stack this crate already pins, so no new provider decision is needed. -**Status:** open — needs a Phase 1 ADR (feature-gate + accessor naming -is one-way-door API surface). Lean A with the 1.88 floor; final call -belongs to the Phase 1 ADR alongside OQ-TLS-04's accessor-shape -decision. +**Status:** open (feature-rename half only) — needs a Phase 1 ADR +(feature-gate + accessor naming is one-way-door API surface). Lean A; +final call belongs to the Phase 1 ADR alongside OQ-TLS-04's +accessor-shape decision. ## Survey / prior-art list @@ -607,8 +605,8 @@ All internal; this crate has no external research debt: caller-owned ALPNs, iroh key-not-config - [x] Version/dependency posture recorded (§Version and dependency posture) — rustls 0.23 line current; feature-gate shape per spec; - MSRV verified under the real 1.85 toolchain (`time` pin) with the - honest-floor decision deferred to OQ-TLS-08 + MSRV verified and resolved 2026-09-10 (ecosystem floor 1.88, + `time` pin dropped, verified under the real 1.88 toolchain) - [x] noq/iroh investigation (2026-09-09) — noq 1.2 published, iroh 1.1 built on it; TLS seam API-compatible with quinn 0.11 (mechanical port); one rustls 0.23 tree across all QUIC paths; key-not-config