test(ecdsa): pin DOMAIN constant and EcdsaSpec derive invariants#735
test(ecdsa): pin DOMAIN constant and EcdsaSpec derive invariants#735EffortlessSteven wants to merge 1 commit into
Conversation
`uselesskey-ecdsa` already has a `tests/mutant_killers.rs` pinning the alg/curve/stable-byte tables, but `DOMAIN_ECDSA_KEYPAIR` was not pinned anywhere in the workspace and `EcdsaSpec`'s `Copy`/`Hash` derives were only exercised through call-site convenience, not asserted. Adds `tests/ecdsa_extra_coverage.rs` (tests-only) matching the existing pattern in `uselesskey-hmac`, `uselesskey-ed25519`, `uselesskey-entropy`, and `uselesskey-jwk`: - `domain_constant_is_stable` — pins `DOMAIN_ECDSA_KEYPAIR` value. - `spec_is_copy_and_usable_after_move` — pins `Copy` semantics so a future field addition that drops `Copy` fails compilation in tests rather than silently breaking call sites. - `spec_participates_in_hash_collections` — pins `Hash`/`Eq` integration with `HashSet` so deduplication continues to work. - `constructor_and_variant_compare_equal` — pins `PartialEq` round-trip between constructors and variants. - `coordinate_lengths_match_curve_bit_sizes_div_eight` — pins the curve-size invariant the existing `coordinate_len_exact` only spot- checks as raw bytes. Adds `uselesskey-test-support` as a dev-dep for consistency with the other extra_coverage files (no `TestResult` returns required for these small synchronous tests).
|
Warning You have reached your daily quota limit. Please wait up to 24 hours and I will start processing your requests again! |
|
Warning Rate limit exceeded
You’ve run out of usage credits. Purchase more in the billing tab. ⌛ How to resolve this issue?After the wait time has elapsed, a review can be triggered using the We recommend that you space out your commits to avoid hitting the rate limit. 🚦 How do rate limits work?CodeRabbit enforces hourly rate limits for each developer per organization. Our paid plans have higher rate limits than the trial, open-source and free plans. In all cases, we re-allow further reviews after a brief timeout. Please see our FAQ for further information. ℹ️ Review info⚙️ Run configurationConfiguration used: Organization UI Review profile: ASSERTIVE Plan: Pro Run ID: ⛔ Files ignored due to path filters (1)
📒 Files selected for processing (2)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
|
Closing as parked for this adoption-confidence pass. The useful ECDSA fixture-confidence surface is better covered by #738, while this draft mostly adds lower-value derive/domain-shape assertions that overlap existing coverage. Bring back a smaller focused slice if a specific ECDSA contract gap remains. |
Replaces the derive/shape pins flagged in #735 with behavioural tests focused on fixture invariants, mirroring the structure that landed in #738 for ECDSA: - Mismatched public key is deterministic across separate factories (not just stable within one factory's cache). - Repeated mismatch calls return identical bytes — pins that the `"mismatch"` variant is cached, not regenerated per call. - Distinct labels produce distinct mismatched keys — variant entropy flows through `label`, the variant string itself is shared. - Mismatched key differs from the keypair's own public key. - Mismatched SPKI parses as an RSA public key — kills a hypothetical "swap key type" mutant on the variant load path. - JWK `n`/`e`/`d` are emitted with base64url no-padding. - JWKS-embedded `kid` matches the standalone `kid()` accessor. - JWKS public entry preserves `kty`/`use`/`alg` and omits `d`. - `DOMAIN_RSA_KEYPAIR` pin is retained (also pinned in #738) since changing it silently re-keys every cached and deterministic RSA fixture downstream. `rsa` 0.10 RC is already in the dep tree via the existing `uselesskey-rsa` crate, so the new `RsaPublicKey::from_public_key_der` import does not add any island.
Summary
uselesskey-ecdsaalready has atests/mutant_killers.rspinning the alg/curve/stable-byte tables, butDOMAIN_ECDSA_KEYPAIRwas not pinned anywhere in the workspace andEcdsaSpec'sCopy/Hashderives were only exercised through call-site convenience, never asserted.Adds
tests/ecdsa_extra_coverage.rsmatching the established<crate>_extra_coverage.rspattern fromuselesskey-hmac,uselesskey-ed25519,uselesskey-entropy, anduselesskey-jwk. Tests-only — no production code changes.Pins
domain_constant_is_stable—DOMAIN_ECDSA_KEYPAIR == "uselesskey:ecdsa:keypair".spec_is_copy_and_usable_after_move— pinsCopysemantics so a future field addition that dropsCopyfails compilation in tests rather than silently breaking call sites.spec_participates_in_hash_collections— pinsHash/Eqintegration withHashSetso deduplication continues to work.constructor_and_variant_compare_equal— pinsPartialEqround-trip betweenEcdsaSpec::es256()↔EcdsaSpec::Es256, etc.coordinate_lengths_match_curve_bit_sizes_div_eight— pins the curve-size invariant the existingcoordinate_len_exactonly spot-checks as raw bytes.Adds
uselesskey-test-supportas a dev-dep for consistency with the other extra_coverage files (no panic-family debt).Test plan
cargo test -p uselesskey-ecdsa --test ecdsa_extra_coverage— all 5 new tests passcargo clippy -p uselesskey-ecdsa --all-targets --all-features -- -D warningscleancargo fmt -p uselesskey-ecdsacleanGenerated by Claude Code