feat: add signet-sign Rust crate + migrate to Taskfile (#95) * feat: add signet-sign Rust crate + migrate Makefile to Taskfile Extract leyline-sign from ley-line into signet as rs/crates/sign/ (signet-sign). Ed25519 CMS/PKCS#7 signing + verification in Rust, targeting native (rlib), C FFI (cdylib/staticlib behind `ffi` feature), and wasm32-unknown-unknown (CF Workers). - Rename all leyline_* FFI symbols to signet_* - Feature-gate libc/FFI behind `ffi` feature - Dual license Apache-2.0 OR MIT (Rust convention) - Migrate Makefile to Taskfile.yml with rs:* tasks - 12 tests passing (10 default + 2 FFI) Addresses #67 (zeroization) architecturally: Rust signer backend keeps key material in Rust-managed memory (deterministic Drop + zeroize), never in Go's GC heap. Co-Authored-By: Claude Opus 4.6 (1M context) * ci: add Rust CI, release workflow, and melange package for signet-sign - rust-ci.yml: test, lint, Wasm build check (500KB size gate) on rs/ changes - rust-release.yml: build staticlib (linux-musl x86_64/arm64, darwin-arm64), Wasm, and C header on rs-v* tags → GitHub Release - melange-signet-sign.yaml: APK package that downloads pre-built artifacts from GitHub release (staticlib + header + Wasm subpackage) rig consumes pre-built artifacts instead of building from source. Co-Authored-By: Claude Opus 4.6 (1M context) * fix: address Copilot review — FFI safety, key zeroization, DER robustness FFI (ffi.rs): - Add safe_slice() helper: null-check pointers, handle zero-length inputs without UB from from_raw_parts - write_out(): null-check out_buf, guard i32 overflow, short-circuit on zero-length - Zeroize key copy on stack (key.fill(0)) before returning from sign fns - Remove unused libc dependency from ffi feature CMS (cms.rs): - encode_utc_time_now(): use real SystemTime in non-test builds, keep fixed time under cfg(test) for determinism - find_signer_cert(): use if-let per certificate instead of ok()? which short-circuits the entire search on any parse failure - verify(): reject opts with skip_chain_validation=false explicitly instead of silently ignoring the parameter - encode_der_length(): support arbitrary usize lengths (minimal big-endian), not just up to 0x83 (16MB) - parse_der_length(): accept up to size_of::() length octets Co-Authored-By: Claude Opus 4.6 (1M context) * fix: replace make references in CI with direct go/docker commands, fmt Rust CI was failing because Makefile was deleted. Replace make build/ make integration-test with direct go build and docker commands. Also run cargo fmt on ffi.rs. Co-Authored-By: Claude Opus 4.6 (1M context) * fix: use task as golden path in CI (install via arduino/setup-task) CI should use Taskfile.yml, same as local dev. Replaces raw go/docker commands with task build, task test, task lint, task integration-test. Co-Authored-By: Claude Opus 4.6 (1M context) * fix: install golangci-lint in CI, cargo fmt cms.rs - Install golangci-lint via official install script so task lint works - Format cms.rs (civil_from_days was unformatted after previous edit) Co-Authored-By: Claude Opus 4.6 (1M context) * fix: scope golangci-lint to changed files in PRs Pre-existing lint violations in files outside this PR's scope. Use --new-from-rev=origin/main to only lint new/changed code. Full repo lint cleanup tracked separately. Co-Authored-By: Claude Opus 4.6 (1M context) * fix: resolve all golangci-lint violations across repo (72 issues) Categories fixed: - errcheck (35): unchecked Close(), Write(), Fprintf(), Setenv() returns - staticcheck (7): deprecated grpc.DialContext → grpc.NewClient, capitalized error strings, redundant nil checks, De Morgan simplification - unused (9): dead vars, types, fields, functions removed - ineffassign (3): dead assignments removed Also reverts CI lint to `task lint` (full repo, not scoped to PR). golangci-lint now passes with zero issues. Co-Authored-By: Claude Opus 4.6 (1M context) --------- Co-authored-by: Claude Opus 4.6 (1M context)

Security: Incomplete Private Key Zeroization for ML-DSA-44 #67

Description

Metadata

Metadata

Assignees

Labels

Type

Fields

Projects

Milestone

Relationships

Development

Issue actions