briansmith / webpki

WebPKI X.509 Certificate Validation in Rust
https://briansmith.org/rustdoc/webpki/
Other
464 stars 165 forks source link

Revert main branch crate contents to the 0.22.0 release contents. #272

Closed briansmith closed 1 year ago

briansmith commented 1 year ago

Reset the crate contents (sources, tests, etc.) to what they were at that commit, while retaining the newer CI configuration.

The changes since the 0.22.0 release were primarily intended to accomplish two goals:

0.21.5 was never released and will not be released. Therefore all of the noise to facilitate the 0.21.5 release can just be deleted, as long as we leave the CI changes that are necessary for GitHub Actions to work correctly now.

The exact commands I used were:

git checkout \
    6c334a2cf5853fb0aa93b5eb0318c031fc2f6f98 \
    -- \
    Cargo.toml \
    LICENSE \
    README.md \
    src \
    tests \
    third-party
git rm src/trust_anchor_util.rs

Commit 6c334a2cf5853fb0aa93b5eb0318c031fc2f6f98 was the commit from which 0.22.0 was released. It is confusing because the commit immediately prior, 0b7cbf2d327d7665d9d06072bf46b2e7ca05f065, has commit message "0.22.0". It appears that I merged the "0.22.0" commit, expecting to cargo publish from that commit, but then cargo publish failed. Then I added 6c334a2cf5853fb0aa93b5eb0318c031fc2f6f98 to fix cargo publish and did the cargo publish from that commit. That's why I added the package CI step at that time, to prevent this confusing situation from happening again.

trust_anchor_utils.rs was not in 0.22.0; the git checkout didn't delete it, so I had to do it separately.

I left the tests added subsequent to 0.22.0 in tests/ (e.g. name_tests.rs) since those tests pass with the 0.22.0 sources too.

Unfortunately, this requires disabling a bunch of Clippy lints, to avoid modifying the contents from 0.22.0.

(I know it is confusing. It took me a while to figure it out myself today.)

codecov[bot] commented 1 year ago

Codecov Report

Merging #272 (6c6b56e) into main (8330c72) will decrease coverage by 17.38%. The diff coverage is 48.31%.

@@             Coverage Diff             @@
##             main     #272       +/-   ##
===========================================
- Coverage   74.50%   57.13%   -17.38%     
===========================================
  Files          19       18        -1     
  Lines        1785     2326      +541     
===========================================
- Hits         1330     1329        -1     
- Misses        455      997      +542     
Files Changed Coverage Δ
src/calendar.rs 90.90% <0.00%> (ø)
src/error.rs 21.66% <ø> (-0.37%) :arrow_down:
src/lib.rs 1.22% <0.00%> (-9.89%) :arrow_down:
src/name/ip_address.rs 0.00% <0.00%> (ø)
src/name/verify.rs 4.11% <0.00%> (ø)
src/time.rs 100.00% <ø> (ø)
tests/dns_name_tests.rs 88.88% <ø> (ø)
src/end_entity.rs 32.00% <5.55%> (-6.10%) :arrow_down:
src/der.rs 90.17% <68.75%> (ø)
src/cert.rs 95.45% <83.33%> (ø)
... and 5 more

:mega: We’re building smart automated test selection to slash your CI/CD build times. Learn more

briansmith commented 1 year ago

@cpu @djc @ctz PTAL. My plan is to apply the actual fix for the signature DoS issue on top of this.

briansmith commented 1 year ago

To verify the package contents match, I used wget https://crates.io/api/v1/crates/webpki/0.22.0/download to fetch the crate contents. Then I extracted the tarball and used diff -ur to verify that things match.

(During packaging/publishing, Cargo rewrites Cargo.toml so it doesn't match exactly.)