Skip to content

distribution: drop crypto/all; pin the provider to libcrypto #111

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
turinglambdaai merged 1 commit into from
Oct 1, 2026
Merged

distribution: drop crypto/all; pin the provider to libcrypto #111

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
25 changes: 12 additions & 13 deletions rivet/distribution/crypto.rkt
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,7 +1,7 @@
#lang racket/base

(require crypto
crypto/all
(only-in crypto/libcrypto libcrypto-factory)
net/base64
racket/file
racket/port
Expand All @@ -22,20 +22,19 @@
;; provider that lacks it fails closed instead of falling back to another
;; signature scheme.
;;
;; Instantiate exactly the factories that satisfy that pin. use-all-factories!
;; would also probe the gmp factory, whose FFI load kills the process at
;; module-import time on hosts without libgmp — every embedded app that
;; merely verifies a manifest would ship that landmine (found by packaging a
;; real app for macOS, where the CI-built bundle would not start).
(crypto-factories (list libcrypto-factory sodium-factory decaf-factory))
;; Rivet's manifest crypto is exactly SHA-256 digests and Ed25519
;; sign/verify, so the provider set is pinned to libcrypto alone: the
;; official Racket distributions bundle OpenSSL on every desktop target.
;; Requiring crypto/all (or instantiating more factories) would drag in
;; factory modules whose FFI loads run at module-import time — the gmp
;; factory kills the process there on hosts without libgmp, and every
;; embedded app that merely verifies a manifest shipped that landmine
;; (found by packaging a real app for macOS, where the CI-built bundle
;; would not start).
(crypto-factories (list libcrypto-factory))

;; libgcrypt advertises Ed25519 on some Linux distributions but older
;; combinations fail at signing time with "Invalid object". Rivet release
;; manifests use providers whose Ed25519 implementation is exercised by the
;; upstream crypto library on our desktop targets. This also makes an
;; unsupported host fail while importing the key, before a release is built.
(define ed25519-factories
(list libcrypto-factory sodium-factory decaf-factory))
(list libcrypto-factory))

(define (bytes->base64-string value)
(bytes->string/utf-8 (base64-encode value #"")))
Expand Down
Loading