glm-5.3-flash
dbb90a87e3
Pre-fuzzing scoping pass over the untrusted-input surfaces found three overflow issues in the path/index plumbing (derivation.rs, encryption.rs): - parse_derivation_path: hardened encoding index + 0x80000000 overflowed u32 (panic in debug, silent wrap in release for m/4294967295') - encryption_path_for_version: versions above 0x80000001 produced paths the parser rejects; now InvalidPath directly, in-range paths unchanged - EncryptionKey::from_derived_bytes: panicked on material shorter than 32 bytes; now returns EncryptionError::InvalidLength (breaking API change, approved for 0.2.0) Fuzzing introduction per the family rule (docs/plans/fuzzing.md for scope decisions and tracking): - fuzz/ workspace scaffolded on the family pattern (shared invariants replayable on stable, committed seed corpora, run-detached.sh runner, nightly pinned, excluded from workspace and package) - path_parse target: no-panic/InvalidPath-only/determinism invariants, PATHS index-table pins, overflow regression pins, version- and device-path range invariants; 42 committed seeds - first detached campaign: 193 s, ~440k execs, oom/timeout/crash 0/0/0 Verification: cargo test --all-features 112 / default 105, clippy --all-features --all-targets clean, cargo doc --no-deps clean, shared replay tests pass, cargo publish --dry-run --all-features --allow-dirty clean.
40 lines
1.1 KiB
TOML
40 lines
1.1 KiB
TOML
[package]
|
|
name = "alkvault"
|
|
version = "0.2.0"
|
|
edition = "2021"
|
|
rust-version = "1.85"
|
|
license = "MIT OR Apache-2.0"
|
|
description = "Local key vault: BIP39 mnemonic generation, SLIP-0010 Ed25519 HD key derivation, AES-256-GCM encryption for securing provider keys, credentials, and identity material"
|
|
repository = "https://git.alk.dev/alkdev/alkvault"
|
|
readme = "README.md"
|
|
keywords = ["vault", "bip39", "ed25519", "slip-0010", "encryption"]
|
|
categories = ["cryptography", "authentication"]
|
|
|
|
exclude = [".opencode/", "AGENTS.md", "docs/plans/", "docs/reviews/", "docs/sdd_process.md", "fuzz/"]
|
|
|
|
[workspace]
|
|
exclude = ["fuzz"]
|
|
|
|
[lib]
|
|
name = "alkvault"
|
|
|
|
[features]
|
|
default = []
|
|
secp256k1 = ["dep:secp256k1"]
|
|
|
|
[dependencies]
|
|
bip39 = { version = "2", features = ["rand", "zeroize"] }
|
|
ed25519-bip32 = "0.4"
|
|
aes-gcm = "0.11"
|
|
sha2 = "0.10"
|
|
serde = { version = "1", features = ["derive"] }
|
|
serde_json = "1"
|
|
thiserror = "2"
|
|
zeroize = { version = "1", features = ["derive"] }
|
|
hmac = "0.12"
|
|
rand = { version = "0.10", default-features = false, features = ["sys_rng"] }
|
|
base64 = "0.23"
|
|
secp256k1 = { version = "0.29", optional = true }
|
|
|
|
[dev-dependencies]
|
|
hex = "0.4" |