fix: qualify Matrix crypto dependencies without store migration #155

Merged

jlxq0 merged 2 commits from fix/dependency-gates-20261029 into main

2026-10-28 22:38:13 +00:00

jlxq0 commented

2026-10-28 22:23:02 +00:00

Owner

Independent Python/old-Rust/new-Rust vectors protect legacy/device/recovery key derivations and directory names. CI rejects any old second block-buffer copy or non-immutable OAuth fork source.

Validation: 376 unit + 6 integration tests on Rust 1.96; strict Clippy/fmt on 1.98; 4 dependency-gate tests; fresh RustSec/OSV report zero vulnerabilities and retain two informational unmaintained-package notices (anymap2, derivative), with no advisory suppressions. Independent exact-head review and Forge CI are required before merge. This source prerequisite does not publish or deploy an image; a separately qualified runtime/release follows.

OAuth prerequisite: jlxq0/oauth2-rs#1, reviewed merged revision 3e44f8f85863c65fbac7fce732b5918bc8d5c323. Source rollback is a scoped revert; no store migration or credential changes.

The current Matrix dependency graph retains vulnerable crypto buffers through both direct HKDF and the SDK OAuth chain. This updates the full chain, including an immutable reviewed OAuth 5 compatibility fork, while retaining Matrix SDK 0.19.1, its features and encrypted-store format. RMCP and the matching OpenTelemetry family also move to fixed versions. Independent Python/old-Rust/new-Rust vectors protect legacy/device/recovery key derivations and directory names. CI rejects any old second block-buffer copy or non-immutable OAuth fork source. Validation: 376 unit + 6 integration tests on Rust 1.96; strict Clippy/fmt on 1.98; 4 dependency-gate tests; fresh RustSec/OSV report zero vulnerabilities and retain two informational unmaintained-package notices (anymap2, derivative), with no advisory suppressions. Independent exact-head review and Forge CI are required before merge. This source prerequisite does not publish or deploy an image; a separately qualified runtime/release follows. OAuth prerequisite: https://forge.oddie.app/jlxq0/oauth2-rs/pulls/1, reviewed merged revision 3e44f8f85863c65fbac7fce732b5918bc8d5c323. Source rollback is a scoped revert; no store migration or credential changes.

jlxq0 added 1 commit

2026-10-28 22:23:02 +00:00

fix: qualify complete fixed crypto dependency chain

CI / docker (pull_request) Has been cancelled

Details

CI / cargo (pull_request) Has been cancelled

Details

e77f2c053d

jlxq0 added 1 commit

2026-10-28 22:27:49 +00:00

test: cover long HKDF salt against independent derivation oracles

CI / cargo (pull_request) Successful in 4m1s