Repository navigation
fix(lib-q-ml-dsa, lib-q-ml-kem): stop forcing std through no_std dependency edges - #147
Merged
Merged
Conversation
…std consumers hex was declared unconditionally and non-optionally in [dependencies] while already being present in [dev-dependencies]. There are zero hex:: uses anywhere under src/ -- it is used only by the tests (wycheproof, nistkats, acvp, wire_format, avx2_independent_verify) -- so the entry was pure redundancy. It was not harmless redundancy. hex does not declare #![no_std] unless its own std feature is off, so an unconditional edge to it forced std into every no_std consumer of this crate. That is what broke GIPs bare-metal build cargo check -p gip-packet --no-default-features --target thumbv7em-none-eabihf which reaches lib-q-ml-dsa as a mandatory dependency of gip-crypto. No compiled code changes: cargo check -p lib-q-ml-dsa and --tests both clean.
…ndency edges Needed for GIP's cross-target-thumb-packet CI job (cargo check --no-default-features --target thumbv7em-none-eabihf), which depends on lib-q-ml-dsa and lib-q-ml-kem through gip-crypto in alloc-only no_std mode. lib-q-ml-dsa: - lib-q-ring/lib-q-sha3/lib-q-intrinsics/lib-q-platform/lib-q-random dependencies had no default-features = false, so they always pulled their own std defaults regardless of lib-q-ml-dsa's own feature selection. - lib-q-keccak dependency likewise had no default-features = false, unconditionally pulling lib-q-keccak's default (std + asm) even when only the `simd` feature was requested. - the `random` feature forced `lib-q-random/std` when it should only need `lib-q-random/alloc` (RNG plumbing, not full std). - `std = []` was a no-op; now properly forwards to each dependency's own std feature so std mode still links everything it used to. lib-q-ml-kem: - same `random` feature bug (forced `lib-q-random/std` instead of `/alloc`). - `lib-q-random` dependency (both the optional normal dep and the dev-dependency) had no default-features override, again pulling std unconditionally. - moved [dev-dependencies] to [target.'cfg(not(target_os = "none"))'.dev-dependencies]: Cargo does not isolate dev-dependency feature requests from normal-dependency feature requests for the same target, so this crate's own dev-deps (which needed lib-q-random/std for a host-only conformance test) were forcing std even on bare-metal (target_os = "none") builds that only check the lib. All manifest/feature-gating only; no algorithm or constant changes. Verified: cargo test -p lib-q-ml-dsa (6/6 wycheproof passed) and cargo test -p lib-q-ml-kem (all passed) at default (std) features; cargo check -p lib-q-ml-dsa, lib-q-ml-kem, lib-q-keccak, lib-q, lib-q-sig, lib-q-kem, lib-q-hpke all OK.
🔒 Security Validation ReportGenerated: Sun Sep 20 12:26:48 UTC 2026 📊 Summary
✅ Overall Security Status: PASSEDAll critical security validations passed successfully. 🔍 DetailsThis report covers:
📋 Next Steps✅ Security validation passed. Code is ready for deployment. ✅ Security validation passed! This code meets all security requirements. |
🔍 Pull Request SummaryGenerated: Sun Sep 20 12:32:01 UTC 2026 📋 Validation Results
✅ Overall Status: PASSED🔒 Security Checklist
📝 Review NotesPlease review the security implications of this change carefully. ✅ Automated validation passed! This PR is ready for review. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Drops the redundant hex dependency that forced std through the no_std lib-q-ml-dsa/lib-q-ml-kem dependency edges. Found as an orphaned branch (author: Nexlab-One, no prior PR) during overnight branch sweep -- opening this so it gets CI and a real merge decision instead of sitting untested.