Pin the toolchain, police the supply chain

nonos-sync commented

2026-09-11 11:23:24 -04:00

Member

Two files CI and every proof consumer should have had from the start. rust-toolchain.toml pins the exact compiler, so prover behavior cannot shift under a silent runner bump; a toolchain change becomes a deliberate commit that reruns the measurement baselines. deny.toml makes the small dependency surface a matter of policy: yanked crates, unknown sources and wildcard versions refused, licenses on an explicit allow list, in-workspace path dependencies exempted by name.

The first run paid for itself: three crates carried the deprecated AGPL-3.0 SPDX id and no publish=false guard, and the ext prover held an unused import and a dead binding. All fixed; the full test suite is green and the changes touch no proof semantics.

Opened on GitHub by eKisNonos as pull request 1. Review and merge happen there while this repository is kept in step from GitHub; this copy follows it, and is marked merged or closed when it is.

Two files CI and every proof consumer should have had from the start. rust-toolchain.toml pins the exact compiler, so prover behavior cannot shift under a silent runner bump; a toolchain change becomes a deliberate commit that reruns the measurement baselines. deny.toml makes the small dependency surface a matter of policy: yanked crates, unknown sources and wildcard versions refused, licenses on an explicit allow list, in-workspace path dependencies exempted by name. The first run paid for itself: three crates carried the deprecated AGPL-3.0 SPDX id and no publish=false guard, and the ext prover held an unused import and a dead binding. All fixed; the full test suite is green and the changes touch no proof semantics. --- Opened on GitHub by eKisNonos as [pull request 1](https://github.com/NON-OS/stark-attest/pull/1). Review and merge happen there while this repository is kept in step from GitHub; this copy follows it, and is marked merged or closed when it is.

nonos-sync added 1 commit

2026-09-11 11:23:24 -04:00

hardening: pin the toolchain, police the supply chain 2013a75dc6

rust-toolchain.toml pins the exact compiler every proof is built and
checked with, so a silent runner bump can never shift prover behavior
without a deliberate commit. deny.toml turns the deliberately tiny
dependency surface into policy: yanked crates, unknown sources and
wildcard versions are refused, licenses are an explicit allow list.
Its first run already earned its keep: three crates carried a
deprecated SPDX id and no publish guard, and two dead bindings hid in
the ext prover. Full suite green after.

This pull request can be merged automatically.

This branch is out-of-date with the base branch

You are not authorized to merge this pull request.

View command line instructions

Checkout

From your project repository, check out a new branch and test the changes.

git fetch -u origin +refs/pull/1/head:nonos-sync/gh-1

git switch nonos-sync/gh-1

Rows
Columns

Pin the toolchain, police the supply chain #1

Checkout