hardening

Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "multi-sig"
-version = "1.0.5"
+version = "1.0.6"
 edition = "2021"
 authors = ["Dave Grantham <dwg@linuxprogrammer.org>"]
 description = "Multisig self-describing multicodec implementation for digital signatures"
@@ -12,18 +12,23 @@ categories = ["cryptography", "encoding"]
 
 [features]
 default = ["serde"]
+# `serde` is now a required dependency because the core `threshold_meta`
+# module (always compiled) derives `Serialize`/`Deserialize` for its CBOR
+# blob types. The feature flag is retained for backward compatibility and
+# controls only the public `serde` impl module.
+serde = []
 
 [dependencies]
 ciborium = "0.2"
-chacha20poly1305 = "0.10"
+chacha20poly1305 = "0.11"
 elliptic-curve = "0.14"
-getrandom = { version = "0.2" }
+getrandom = { version = "0.4" }
 # blsful configured per-target below (blst for native, rust for wasm)
 multi-base = "1.0"
 multi-codec = "1.0"
 multi-trait = "1.0"
 multi-util = "1.0"
-serde = { version = "1.0", default-features = false, features = ["alloc", "derive"], optional = true }
+serde = { version = "1.0", default-features = false, features = ["alloc", "derive"] }
 ssh-encoding = "0.3"
 thiserror = { version = "2.0" }
 unsigned-varint = { version = "0.8", features = ["std"] }

src/error.rs

@@ -1,7 +1,6 @@
-use std::fmt::Display;
-
 // SPDX-License-Identifier: Apache-2.0
 /// Errors created by this library
+#[must_use]
 #[derive(Debug, thiserror::Error)]
 #[non_exhaustive]
 pub enum Error {
@@ -161,39 +160,20 @@ pub enum ConversionsError {
 }
 
 /// SSH Errors
-#[derive(Debug)]
+#[derive(Debug, thiserror::Error)]
+#[non_exhaustive]
 pub enum SshError {
     /// SSH Sig
-    Sig(ssh_key::Error),
+    #[error("SSH Sig error: {0}")]
+    Sig(#[from] ssh_key::Error),
     /// SSH Sig label
-    SigLabel(ssh_encoding::LabelError),
-}
-
-impl Display for SshError {
-    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
-        match self {
-            SshError::Sig(e) => write!(f, "SSH Sig error: {}", e),
-            SshError::SigLabel(e) => write!(f, "SSH Sig label error: {}", e),
-        }
-    }
-}
-
-impl std::error::Error for SshError {}
-
-impl From<ssh_key::Error> for SshError {
-    fn from(e: ssh_key::Error) -> Self {
-        SshError::Sig(e)
-    }
-}
-
-impl From<ssh_encoding::LabelError> for SshError {
-    fn from(e: ssh_encoding::LabelError) -> Self {
-        SshError::SigLabel(e)
-    }
+    #[error("SSH Sig label error: {0}")]
+    SigLabel(#[from] ssh_encoding::LabelError),
 }
 
 impl Error {
     /// Get the error kind as a string
+    #[must_use]
     pub fn kind(&self) -> &str {
         match self {
             Self::Attributes(_) => "Attributes",

src/lib.rs

@@ -61,6 +61,7 @@
 
 #![warn(missing_docs)]
 #![deny(
+    unsafe_code,
     trivial_casts,
     trivial_numeric_casts,
     unused_import_braces,

src/views/threshold_meta.rs

@@ -232,7 +232,7 @@ pub fn encrypt_threshold_meta(
     let plaintext = meta.to_cbor_bytes()?;
 
     let mut nonce_bytes = vec![0u8; 12];
-    getrandom::getrandom(&mut nonce_bytes).map_err(|e| {
+    getrandom::fill(&mut nonce_bytes).map_err(|e| {
         Error::Shares(crate::error::SharesError::MetaEncryption(format!(
             "RNG failure: {e}"
         )))
@@ -309,7 +309,7 @@ pub fn decrypt_threshold_meta(
 /// Generate a random 32-byte ChaCha20-Poly1305 key.
 pub fn generate_meta_key() -> Zeroizing<Vec<u8>> {
     let mut key = Zeroizing::new(vec![0u8; 32]);
-    getrandom::getrandom(key.as_mut_slice()).expect("getrandom failure during meta key generation");
+    getrandom::fill(key.as_mut_slice()).expect("getrandom failure during meta key generation");
     key
 }