Closed dependabot[bot] closed 3 months ago
[puLL-Merge] - dalek-cryptography/curve25519-dalek@curve25519-4.1.2..curve25519-4.1.3
This pull request introduces several changes focused on code maintenance and optimization for the curve25519-dalek
library. It primarily aims to fix a security timing leak, update the license format, improve code organization, clean unnecessary imports, and provide additional methods for enhanced functionality.
Timing Leak Fixes:
curve25519-dalek/src/backend/serial/u32/scalar.rs
, curve25519-dalek/src/backend/serial/u64/scalar.rs
black_box
) to prevent the compiler from inserting branch instructions. This is intended to mitigate timing attacks. The use of black_box
here should be reviewed carefully to ensure it effectively provides constant-time operations.Environment Variable Handling:
curve25519-dalek/build.rs
Looks like curve25519-dalek is up-to-date now, so this is no longer needed.
@dependabot retry?
Bumps curve25519-dalek from 4.1.2 to 4.1.3.
Commits
5312a03
curve: Bump version to 4.1.3 (#660)b4f9e4d
SECURITY: fix timing variability in backend/serial/u32/scalar.rs (#661)415892a
SECURITY: fix timing variability in backend/serial/u64/scalar.rs (#659)56bf398
Updates license field to valid SPDX format (#647)9252fa5
Mitigate check-cfg until MSRV 1.77 (#652)1efe6a9
Fix a minor typo in signing.rs (#649)cc3421a
Indicate that the rand_core feature is required (#641)858c4ca
Address new nightly clippy unnecessary qualifications (#639)31ccb67
Remove platforms in favor using CARGO_CFG_TARGET_POINTER_WIDTH (#636)19c7f4a
Fix new nightly redundant import lint warns (#638)Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase
.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show