test(entropy,hmac,ed25519): cover fixture invariants by EffortlessSteven · Pull Request #727 · EffortlessMetrics/uselesskey

EffortlessSteven · 2026-05-16T07:12:52Z

Summary

Ports the useful entropy/HMAC/Ed25519 confidence coverage from stale test(entropy,hmac,ed25519): cover domain constants, JWK shapes, clone/debug invariants #703 onto current main.
Covers domain constants, deterministic clone/debug invariants, JWK/JWKS public/secret material shapes, and zeroization-sensitive HMAC behavior.
Converts the new tests to no-panic-family style with uselesskey-test-support helpers.

Files added/changed

crates/uselesskey-entropy/tests/entropy_extra_coverage.rs
crates/uselesskey-ed25519/tests/ed25519_extra_coverage.rs
crates/uselesskey-hmac/tests/hmac_extra_coverage.rs
crates/uselesskey-ed25519/Cargo.toml
crates/uselesskey-hmac/Cargo.toml
Cargo.lock

Validation

cargo xtask fmt
cargo test -p uselesskey-ed25519 --test ed25519_extra_coverage --no-default-features
cargo test -p uselesskey-ed25519 --test ed25519_extra_coverage --features jwk
cargo test -p uselesskey-hmac --test hmac_extra_coverage --no-default-features
cargo test -p uselesskey-hmac --test hmac_extra_coverage --features jwk
cargo test -p uselesskey-entropy --test entropy_extra_coverage --all-features
cargo test -p uselesskey-ed25519 --all-features
cargo test -p uselesskey-hmac --all-features
cargo clippy -p uselesskey-ed25519 --tests --all-features -- -D warnings
cargo clippy -p uselesskey-entropy --tests --all-features -- -D warnings
cargo clippy -p uselesskey-hmac --tests --all-features -- -D warnings
cargo xtask check-no-panic-family: no new entropy/HMAC/Ed25519 debt; still reports the three pre-existing X.509 sites already on main
cargo +nightly xtask pr-lite
git diff --check HEAD~1..HEAD

Non-goals

No new fixture families.
No scanner-safe claim changes.
No public API changes.
No release machinery changes.

What this enables next

Replaces the stale test(entropy,hmac,ed25519): cover domain constants, JWK shapes, clone/debug invariants #703 draft with a current-main coverage slice that supports the adoption-correctness lane without reopening broad product or infrastructure work.

…/debug invariants entropy: - Pin DOMAIN_ENTROPY_FIXTURE constant (part of every consumer's cache key). - bytes(0) returns empty; fill_bytes(&mut []) is a no-op. - fill_bytes_with_variant matches bytes_with_variant for the same variant. - Clone preserves bytes, label, variant. - Debug includes label/variant but never byte material (hex form check). - Default variant on the fixture handle propagates through bytes() and variant-bound fixtures produce the same material as explicit variant calls on the default fixture. hmac: - Pin DOMAIN_HMAC_SECRET constant. - Clone preserves secret_bytes, label, spec (single + chained clones). - Debug must not contain raw secret bytes (hex form check). - JWK use_ field is exactly "sig" across HS256/HS384/HS512. - JWKS keys array has exactly one entry. ed25519: - Pin DOMAIN_ED25519_KEYPAIR constant. - PKCS#8 / SPKI DER outputs meet minimum length invariants. - PEM outputs have correct BEGIN headers. - public_jwk() exercises every OKP field shape and the x base64url decodes to 32 bytes; private_key_jwk() d decodes to 32 bytes. - public_jwks() cardinality is exactly 1; public_jwks_json() matches public_jwks().to_value(). - Clone preserves private/public DER and label.

chatgpt-codex-connector · 2026-05-16T07:12:56Z

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.
To continue using code reviews, add credits to your account and enable them for code reviews in your settings.

coderabbitai · 2026-05-16T07:12:58Z

Warning

Rate limit exceeded

@EffortlessSteven has exceeded the limit for the number of commits that can be reviewed per hour. Please wait 59 minutes and 17 seconds before requesting another review.

You’ve run out of usage credits. Purchase more in the billing tab.

⌛ How to resolve this issue?

After the wait time has elapsed, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

We recommend that you space out your commits to avoid hitting the rate limit.

🚦 How do rate limits work?

CodeRabbit enforces hourly rate limits for each developer per organization.

Our paid plans have higher rate limits than the trial, open-source and free plans. In all cases, we re-allow further reviews after a brief timeout.

Please see our FAQ for further information.

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro

Run ID: a40a28cb-b2c7-4b03-9091-d0e7ad49c02c

📥 Commits

Reviewing files that changed from the base of the PR and between 9e8f12c and 1e83be0.

⛔ Files ignored due to path filters (1)

Cargo.lock is excluded by !**/*.lock

📒 Files selected for processing (5)

crates/uselesskey-ed25519/Cargo.toml
crates/uselesskey-ed25519/tests/ed25519_extra_coverage.rs
crates/uselesskey-entropy/tests/entropy_extra_coverage.rs
crates/uselesskey-hmac/Cargo.toml
crates/uselesskey-hmac/tests/hmac_extra_coverage.rs

✨ Finishing Touches

🧪 Generate unit tests (beta)

Create PR with unit tests
Commit unit tests in branch test/entropy-hmac-ed25519-coverage

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

gemini-code-assist

Code Review

This pull request introduces comprehensive test coverage for the ed25519, entropy, and hmac crates, focusing on domain constant stability, clone semantics, and ensuring Debug implementations do not leak sensitive material. Feedback suggests tightening length assertions for Ed25519 DER outputs to use exact equality and strengthening the Debug leak checks in the entropy tests to include standard byte slice representations, ensuring consistency with the HMAC implementation and the repository's security guidelines.

gemini-code-assist · 2026-05-16T07:14:41Z

+    let kp = fx.ed25519("svc", Ed25519Spec::new());
+
+    // PKCS#8 v1 Ed25519 PrivateKeyInfo is fixed length (48 bytes).
+    assert!(kp.private_key_pkcs8_der().len() >= 48);


Since the comment explicitly states that Ed25519 PKCS#8 v1 is fixed length (48 bytes), this assertion should use equality to provide a stronger invariant check and catch any unexpected structural changes.

Suggested change

assert!(kp.private_key_pkcs8_der().len() >= 48);

assert_eq!(kp.private_key_pkcs8_der().len(), 48);

gemini-code-assist · 2026-05-16T07:14:41Z

+    // PKCS#8 v1 Ed25519 PrivateKeyInfo is fixed length (48 bytes).
+    assert!(kp.private_key_pkcs8_der().len() >= 48);
+    // SPKI for Ed25519 is fixed length (44 bytes).
+    assert!(kp.public_key_spki_der().len() >= 44);


Similarly, Ed25519 SPKI is fixed length (44 bytes). Tightening this assertion to an equality check ensures the test accurately reflects the documented invariant.

Suggested change

assert!(kp.public_key_spki_der().len() >= 44);

assert_eq!(kp.public_key_spki_der().len(), 44);

gemini-code-assist · 2026-05-16T07:14:41Z

+
+    // Debug must not contain the materialized byte stream as contiguous hex.
+    let hex = bytes.iter().map(|b| format!("{b:02x}")).collect::<String>();
+    assert!(!dbg.contains(&hex), "debug leaked hex bytes: {dbg}");


The current Debug leak check only verifies the absence of a contiguous hex string. To more thoroughly enforce the security requirement that Debug implementations must never leak material (Repository Style Guide, line 49), it should also check for the standard Debug representation of the byte slice (e.g., [1, 2, 3]). This aligns with the more robust check implemented in hmac_extra_coverage.rs.

assert!(!dbg.contains(&hex), "debug leaked hex bytes: {dbg}"); let bytes_dbg = format!("{bytes:?}"); assert!(!dbg.contains(&bytes_dbg), "debug leaked byte array: {dbg}");

References

Debug implementations must never leak key material. ^(link)

gemini-code-assist Bot reviewed May 16, 2026

View reviewed changes

EffortlessSteven merged commit b7f4758 into main May 16, 2026
6 checks passed

EffortlessSteven mentioned this pull request May 16, 2026

test(entropy,hmac,ed25519): cover domain constants, JWK shapes, clone/debug invariants #703

Closed

3 tasks

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

test(entropy,hmac,ed25519): cover fixture invariants#727

test(entropy,hmac,ed25519): cover fixture invariants#727
EffortlessSteven merged 1 commit into
mainfrom
test/entropy-hmac-ed25519-coverage

EffortlessSteven commented May 16, 2026

Uh oh!

chatgpt-codex-connector Bot commented May 16, 2026

Uh oh!

coderabbitai Bot commented May 16, 2026

Rate limit exceeded

Uh oh!

gemini-code-assist Bot left a comment

Uh oh!

gemini-code-assist Bot May 16, 2026

Uh oh!

gemini-code-assist Bot May 16, 2026

Uh oh!

gemini-code-assist Bot May 16, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

	assert!(kp.private_key_pkcs8_der().len() >= 48);
	assert_eq!(kp.private_key_pkcs8_der().len(), 48);

	assert!(kp.public_key_spki_der().len() >= 44);
	assert_eq!(kp.public_key_spki_der().len(), 44);

Uh oh!

Conversation

EffortlessSteven commented May 16, 2026

Uh oh!

chatgpt-codex-connector Bot commented May 16, 2026

Uh oh!

coderabbitai Bot commented May 16, 2026

Rate limit exceeded

Uh oh!

gemini-code-assist Bot left a comment

Choose a reason for hiding this comment

Code Review

Uh oh!

gemini-code-assist Bot May 16, 2026

Choose a reason for hiding this comment

Uh oh!

gemini-code-assist Bot May 16, 2026

Choose a reason for hiding this comment

Uh oh!

gemini-code-assist Bot May 16, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants