[boorad]

Summary

Aligns vendored ncrypto with Node f39899d (nodejs/node#67039):

• BignumPointer::isPrime now invokes the callback between repeated BN_check_prime() rounds, so trial-division primes (e.g. 311) can be cancelled.
• WriteEncryptedTraditionalPEM takes an encoder selection: PKCS#1 keeps OSSL_KEYMGMT_SELECT_KEYPAIR, SEC1 empty-passphrase export passes OSSL_KEYMGMT_SELECT_ALL.

Changes

• ncrypto submodule ef5d829 → 14d6023: still one RNQC compat commit (EVP-only profile + these fixes) on upstream c954a1a, now on fork branch boorad/ncrypto:rnqc/evp-only. New gtests: cancel between Miller-Rabin rounds (2^127-1, 65 checks), cancel trial-division prime (311, INT_MAX checks → one callback, -1), explicit-curve SEC1 empty-passphrase round-trip.
• Fork hygiene (architecture.md mirror rule): boorad/ncrypto main reset to mirror nodejs/ncrypto:main (c954a1a); old pin preserved at backup/ef5d829 so existing main checkouts still fetch.
• Example app: create_keys.ts SEC1 encrypted-PEM test now also rejects missing and wrong passphrases (binary passphrase with NUL; empty-passphrase case round-trips).
• Plan: plans/done/1094-align-ncrypto-prime-sec1.md.

Note: on OpenSSL 3.6.2, SELECT_KEYPAIR already emits explicit-curve parameters for SEC1 type-specific encoding (the new explicit-curve gtest passes pre-fix). SELECT_ALL is kept for Node parity; the gtest is a regression guard. HybridPrime passes no callback, so the cancel path is not reachable from JS.

Testing

• 14d6023 — ncrypto gtest (NCRYPTO_SHARED_LIBS=ON NCRYPTO_EVP_ONLY=ON, openssl@3 3.6.2, googletest 1.18.0) — 37/37 pass; both new prime-cancel tests fail on the pre-fix source — macOS host.
• 14d6023 — clang-format --dry-run --Werror on changed ncrypto files — pass.
• 14d6023 — OPENSSL_ROOT_DIR=/opt/homebrew/opt/openssl@3 scripts/check-ncrypto-openssl-deprecations.sh — pass.
• 15a3fc91 — bun tsc, bun lint, prettier, pre-commit hooks — pass.
• Independent review (fresh reviewer): no correctness defects; reviewer rerun of the new gtests 7/7, cancel tests 0 ms.
• Native iOS + Android at a1912d1b (rebased onto main after fix(ios): unblock iOS E2E on Xcode 27 / iOS 27 and any checkout path #1096): signed AgentSCM attestation 46a39821…, 41 suites / 2,208 tests / 0 failures on each platform, including the new SEC1 passphrase-rejection checks; attestation and screenshots posted as comments.

Delivery

Native C++ change: reaches consumers after an npm release and an app rebuild.

Closes #1094

🤖 Generated with Claude Code

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
react-native-quick-crypto	Ready	Preview	Nov 10, 2026 12:37pm UTC

[boorad]

Local validation: reported pass

Source: github.com/margelo/react-native-quick-crypto at a1912d1b346d

Worker-reported; the verifier checks the signature and source bindings, not whether commands ran.

Coverage: 2/2 checks reported; 7 omissions.

⚠️ Missing services: PostgreSQL, S3. Coverage is incomplete.

Coverage omissions (7)

• ignored tests
• windows
• container smoke
• hub end-to-end
• live execution
• postgres tests
• s3 tests

Source and environment

• Repository: github.com/margelo/react-native-quick-crypto
• Commit: a1912d1b346dcdef9483098f85aa78fc8744103c
• Tree: 77ad2183d458b00dc6cfe1e1139b0388ba8b6174
• Base ref: main
• Base tip: 901bdcb5626d4f0be428a2f5b4696ae0a91ed811
• Merge base: 901bdcb5626d4f0be428a2f5b4696ae0a91ed811
• Services: PostgreSQL=false, S3=false
• Platform: macos-aarch64
• Toolchain: 1.4.2, v24.21.0, git version 2.54.0 (Apple Git-157)

Command results

• ios-e2e: Exited, exit 0, 124646 ms
• android-e2e: Exited, exit 0, 83756 ms

Signed machine-readable evidence

The exact signed bytes are preserved below for verification and audit tooling.

eyJ2ZXJzaW9uIjoxLCJhbGdvcml0aG0iOiJlZDI1NTE5IiwicGF5bG9hZCI6eyJ2ZXJzaW9uIjox
LCJyZXF1aXJlbWVudF9pZCI6ImxvY2FsLXZhbGlkYXRpb24iLCJjaGVja19raW5kIjoiY29tbWFu
ZC92MSIsInN1YmplY3QiOnsicmVwb3NpdG9yeSI6ImdpdGh1Yi5jb20vbWFyZ2Vsby9yZWFjdC1u
YXRpdmUtcXVpY2stY3J5cHRvIiwiY2hhbmdlIjp7InJlcG9zaXRvcnkiOiJnaXRodWIuY29tL21h
cmdlbG8vcmVhY3QtbmF0aXZlLXF1aWNrLWNyeXB0byIsImlkIjoiZ2l0LWNvbW1pdDphMTkxMmQx
YjM0NmRjZGVmOTQ4MzA5OGY4NWFhNzhmYzg3NDQxMDNjIn0sImNoYW5nZV92ZXJzaW9uIjoxLCJj
b250ZXh0X2RpZ2VzdCI6IjhiZjBjMGY1MGNhYTBjNzdmNzkwNjMzODkxYzZlMWRhNjJmZWQ4MzQy
MTM1ZjAzMmQyYjQ0ZTZiZWUyNzIxYWQiLCJyZXZpc2lvbiI6IjQ3MTBmMTQ2N2Q1YzcwNGZmY2Q5
NmI5NjI4NTAwYjkzNzRjZWQ2MTZkNjVkOGNiNGUwNzg3YTU0NjA0YzlkNzciLCJyZWNpcGVfc2hh
MjU2IjoiMjZmMDQ5YmJhZTkwYTNlZDdhOGUxMzM2N2QyMGQzZTY1YzUxMzVjMDZjNzA3Zjg1YTVj
MTAzZDNkODAzNTJkZCIsInRvb2xjaGFpbl9zaGEyNTYiOiI5YzhiZDQ5YTM5OTNhMDhmMDI0ZGFh
ZDMzNGU1OGRhOGFlNjAyZmEzOWY5ZWZiYzBiNDdjYTNjZDRmNTU1MzczIiwiZW52aXJvbm1lbnRf
c2hhMjU2IjoiNTBlZDhkOWY1ODBhMzZiZGE2MDhkYWZlMDViZjU4NjgwNGRiNmYzN2Q2MGMyYzkz
ZjZkYTU2ZDMwNThkYjkxMCJ9LCJpbnN0YWxsZWRfcG9saWN5X3NoYTI1NiI6ImQyNjM2YWYwMThh
NWQ3NTYxZTI3YTNiODAxMDZlYjQwMGJkZjljZmZjNzY5YzVkNjliOWEwMmE4NzJlNzJiN2UiLCJp
bnN0YWxsZWRfcG9saWN5X2Vwb2NoIjoxLCJpc3N1ZXJfcmVnaXN0cnlfc2hhMjU2IjoiYjJhMWFj
NjMxYzRkYjRhYjk2ZmI1ODg5NTAxZDljZGUyNzljNTk2MzcxZjgzMDRlMmVlMjZjY2FmZGJhYmY2
ZCIsImF0dGVtcHRfaWQiOiI2MzM2MDllMzVlZDEzNTRjMDY1MmE1NzE4MzE4M2IzMSIsInJ1bl9n
ZW5lcmF0aW9uIjoxLCJyZXF1ZXN0X3NoYTI1NiI6IjI2ZjA0OWJiYWU5MGEzZWQ3YThlMTMzNjdk
MjBkM2U2NWM1MTM1YzA2YzcwN2Y4NWE1YzEwM2QzZDgwMzUyZGQiLCJsaW1pdHNfc2hhMjU2Ijoi
MjZmMDQ5YmJhZTkwYTNlZDdhOGUxMzM2N2QyMGQzZTY1YzUxMzVjMDZjNzA3Zjg1YTVjMTAzZDNk
ODAzNTJkZCIsInRlcm1pbmFsX3JlY29yZF9zaGEyNTYiOiJkNWNkMWNkNWM4OWZkMjNlZTJmMzY4
OTc3OGI4YjdiOGIwMDhjZTJhMDhjMTQ3YzI4MjYyZjc1N2MwN2E0YjY2IiwiaXNzdWVyX2lkIjoi
Ym9vcmFkIiwia2V5X2lkIjoiNmMxYzgxNjk4MjA4ZTZjMjg0OGQ3YTEwYWMyZWM4NTA0NjhhNjVj
MzZkMWFhYjUzNTQwZDhmOGM4NmNhMjViOCIsImlzc3VlZF9hdF9tcyI6MTc5NDMxNDM5Njg2Niwi
ZXhwaXJlc19hdF9tcyI6MTc5NjkwNjM5Njg2NiwidGVybWluYWxfc3RhdGUiOiJzdWNjZXNzIiwi
cmVjb3Zlcnlfc3RhdGUiOiJub3RfcmVxdWlyZWQiLCJvdXRjb21lIjoicGFzcyIsImV4ZWN1dGlv
bl9iYXNpcyI6Indvcmtlcl9hc3NlcnRlZCIsImNvdmVyYWdlIjp7InNjb3BlIjpbImlvcy1lMmUi
LCJhbmRyb2lkLWUyZSJdLCJleHBlY3RlZF9jb3VudCI6Miwib2JzZXJ2ZWRfY291bnQiOjIsImlu
dmVudG9yeV9jb21wbGV0ZSI6ZmFsc2UsIm9taXNzaW9ucyI6WyJpZ25vcmVkIHRlc3RzIiwid2lu
ZG93cyIsImNvbnRhaW5lciBzbW9rZSIsImh1YiBlbmQtdG8tZW5kIiwibGl2ZSBleGVjdXRpb24i
LCJwb3N0Z3JlcyB0ZXN0cyIsInMzIHRlc3RzIl19LCJkZXBlbmRlbmNpZXMiOlt7ImlkZW50aXR5
IjoiYnVuLmxvY2siLCJzdGF0ZSI6eyJzdGF0ZSI6InJlc29sdmVkIiwicmV2aXNpb24iOiJmMzdk
YWY4ZDU0YTNjNWExMWE2MmFmYTQ5MzRiNTIzZmY2MWRmZTk2OWU3M2U4YjBiYTEwMTdlMzVkZjRi
MTcxIn19LHsiaWRlbnRpdHkiOiJwYWNrYWdlLmpzb24iLCJzdGF0ZSI6eyJzdGF0ZSI6InJlc29s
dmVkIiwicmV2aXNpb24iOiI4OThlZDZjZWZkMTQwN2UzYjJiZTAyZTNlZmY5YWVlNDJiM2RhNTll
Y2FjZDg1NGMxMGNkZTVmMmM0ODRhNmJjIn19XSwiYXJ0aWZhY3RzIjpbeyJhcnRpZmFjdF9pZCI6
InJlY29yZCIsIm1lZGlhX3R5cGUiOiJhcHBsaWNhdGlvbi9qc29uIiwic2hhMjU2IjoiZDVjZDFj
ZDVjODlmZDIzZWUyZjM2ODk3NzhiOGI3YjhiMDA4Y2UyYTA4YzE0N2MyODI2MmY3NTdjMDdhNGI2
NiIsImJ5dGVzIjoxMTQ5LCJjbGFpbWVkX2F2YWlsYWJpbGl0eSI6ImZ1bGwifV0sIm91dHB1dCI6
eyJzdGRvdXRfc2hhMjU2IjoiZTNiMGM0NDI5OGZjMWMxNDlhZmJmNGM4OTk2ZmI5MjQyN2FlNDFl
NDY0OWI5MzRjYTQ5NTk5MWI3ODUyYjg1NSIsInN0ZG91dF9ieXRlcyI6MCwic3RkZXJyX3NoYTI1
NiI6ImUzYjBjNDQyOThmYzFjMTQ5YWZiZjRjODk5NmZiOTI0MjdhZTQxZTQ2NDliOTM0Y2E0OTU5
OTFiNzg1MmI4NTUiLCJzdGRlcnJfYnl0ZXMiOjAsInRydW5jYXRlZCI6ZmFsc2V9fSwic2lnbmF0
dXJlX2hleCI6IjJmMzQwZmI4ZWI0ZmQ3OGRhZDBiZjExNDIyMTIyMjZjMTQwNDVmOTY1NTUzZDdi
OWEwYjE0MDk4ZTliMTZmZTMzYmQwNDFkOWEwM2NjZGQ0OGNlOWUxNTg2MzdjMDMxOTBhYWVjYmEw
ZmFkZTQ1ZjE3ZDU0NmU3NWFhNzljODA4In0=

eyJzdWJqZWN0Ijp7InJlcG9zaXRvcnkiOiJnaXRodWIuY29tL21hcmdlbG8vcmVhY3QtbmF0aXZl
LXF1aWNrLWNyeXB0byIsImNvbW1pdCI6ImExOTEyZDFiMzQ2ZGNkZWY5NDgzMDk4Zjg1YWE3OGZj
ODc0NDEwM2MiLCJ0cmVlIjoiNzdhZDIxODNkNDU4YjAwZGM2Y2ZlMWUxMTM5YjAzODhiYThiNjE3
NCJ9LCJjb250ZXh0Ijp7ImJhc2VfcmVmIjoibWFpbiIsIm1lcmdlX2Jhc2UiOiI5MDFiZGNiNTYy
NmQ0ZjBiZTQyOGEyZjViNDY5NmFlMGE5MWVkODExIn0sImJhc2VfdGlwIjoiOTAxYmRjYjU2MjZk
NGYwYmU0MjhhMmY1YjQ2OTZhZTBhOTFlZDgxMSIsInJlY2lwZV9zaGEyNTYiOiIyNmYwNDliYmFl
OTBhM2VkN2E4ZTEzMzY3ZDIwZDNlNjVjNTEzNWMwNmM3MDdmODVhNWMxMDNkM2Q4MDM1MmRkIiwi
cmVzdWx0cyI6W3siaWQiOiJpb3MtZTJlIiwiYXJndiI6WyJidW4iLCJydW4iLCJlMmU6aW9zIl0s
ImV4aXRfY29kZSI6MCwic3RvcCI6ImV4aXRlZCIsImR1cmF0aW9uX21zIjoxMjQ2NDYsInN0ZG91
dF9zaGEyNTYiOiI0ZmNlNDY3NTA2NzJkMzVkYWI4ZjJkNThkNDVjZDUyZDQzY2JhMmJkNWMyYjE5
ZTJkZmU2NjE3YjkwM2NmZjM3Iiwic3RkZXJyX3NoYTI1NiI6IjFiYWI1MmRiNWE3NDY1NTdjM2Zm
N2E2NGU3ZmRlYjc5ZTdmN2Y3ZDMwMTYzMjI5NTVhOTUxOTc5YmUyMjFiN2UiLCJ0cnVuY2F0ZWQi
OmZhbHNlfSx7ImlkIjoiYW5kcm9pZC1lMmUiLCJhcmd2IjpbImJ1biIsInJ1biIsImUyZTphbmRy
b2lkIl0sImV4aXRfY29kZSI6MCwic3RvcCI6ImV4aXRlZCIsImR1cmF0aW9uX21zIjo4Mzc1Niwi
c3Rkb3V0X3NoYTI1NiI6IjU4OGMxYjRlNzMyYmU3NDQ3ZTFmMjRkMWU0NWYwNmU2ZTY3NTg5ODY0
NjY2ODFiZjQzMDY2MDdhZWZkYWJmMzQiLCJzdGRlcnJfc2hhMjU2IjoiYmU2MDMxYjA2NTNlNTYw
MjU0NWY2OTk5NjNhMzI5OGQ5MzYxNjllZDY4Y2YzOThlMWYxZTFhZDYyOTRmNTg2NSIsInRydW5j
YXRlZCI6ZmFsc2V9XSwic2VydmljZXMiOnsicG9zdGdyZXMiOmZhbHNlLCJzMyI6ZmFsc2V9LCJw
bGF0Zm9ybSI6Im1hY29zLWFhcmNoNjQiLCJ0b29sY2hhaW4iOlsiMS40LjIiLCJ2MjQuMjEuMCIs
ImdpdCB2ZXJzaW9uIDIuNTQuMCAoQXBwbGUgR2l0LTE1NykiXSwidHJlZV91bmNoYW5nZWRfYWZ0
ZXIiOnRydWV9

[boorad]

Local device E2E evidence

• Head: a1912d1b346dcdef9483098f85aa78fc8744103c
• AgentSCM attestation: 46a3982131f5b7df4d80a279363a401a8ea359b6352cdbc9d795c7bb11805f39
• iOS result SHA-256: 817decb3ebc498e88a7fed29e4c588089d9e0b2ec842e54f177d274e04fee05f
• iOS screenshot SHA-256: 08e32216d3794fe71f621eeb32bc128357e61e1e912214c12e71e28dfe61a112
• Android result SHA-256: 00fba2763f722753df35fb25b9979c9798a32866dcca7d49c8fe9c465733195a
• Android screenshot SHA-256: b19b6703967e2a2f35b6a92999e3fc3377c2da9e5206587f6670455f5fa76621

Platform	Final screenshot
iOS
Android

The hashes above are present in command stdout committed by the signed attestation. Images expire after 30 days; the hashes remain the durable binding.