release: repair public readiness signals

.changes/align-canonical-install-examples-30b9.md

@@ -0,0 +1,5 @@
+---
+"rscrypto" = "patch"
+---
+
+Align canonical install examples and the security support matrix with rscrypto 0.8.0.

.config/nextest.toml

@@ -7,6 +7,14 @@ test-threads = "num-cpus"
 slow-timeout = { period = "30s", terminate-after = 4 }
 retries = 0
 
+[[profile.default.overrides]]
+filter = 'binary(=rsa_public_key) & test(=generated_modern_private_key_outputs_verify_and_decrypt_with_external_oracles)'
+slow-timeout = { period = "60s", terminate-after = 8 }
+
+[[profile.default.overrides]]
+filter = 'binary(=rsa_wycheproof) & test(=wycheproof_rsaes_pkcs1v15_3072_decrypt_vectors_match_expected_results)'
+slow-timeout = { period = "60s", terminate-after = 8 }
+
 [profile.commit]
 status-level = "fail"
 success-output = "never"

.github/workflows/scorecard.yaml

@@ -28,7 +28,7 @@ jobs:
           persist-credentials: false
 
       - name: Run Scorecard
-        uses: ./.github/actions/scorecard
+        uses: ossf/scorecard-action@4eaacf0543bb3f2c246792bd56e8cdeffafb205a  # v2.4.3
         with:
           results_file: scorecard.sarif
           results_format: sarif

README.md

@@ -39,14 +39,14 @@ Minimal `no_std` SHA-2 build:
 
 ```toml
 [dependencies]
-rscrypto = { version = "0.7.8", default-features = false, features = ["sha2"] }
+rscrypto = { version = "0.8.0", default-features = false, features = ["sha2"] }
 ```
 
 Full primitive stack with OS randomness enabled:
 
 ```toml
 [dependencies]
-rscrypto = { version = "0.7.8", features = ["full", "getrandom"] }
+rscrypto = { version = "0.8.0", features = ["full", "getrandom"] }
 ```
 
 Use `default-features = false` for `no_std` builds. Enable `getrandom` only for

SECURITY.md

@@ -51,10 +51,10 @@ Out of scope:
 
 | Version | Supported |
 | ------- | --------- |
-| `0.7.x` | Yes |
+| `0.8.x` | Yes |
 
 Only the latest patch release in the current minor line receives security
-fixes. Upgrade to the latest published `0.7.x` release before reporting an issue
+fixes. Upgrade to the latest published `0.8.x` release before reporting an issue
 that may already be fixed.
 
 ## Security posture

scripts/ci/check-ci-ownership-test.sh

@@ -185,12 +185,11 @@ yq eval '(.jobs."rail-plan".steps[] | select(.id == "rail") | .with.since) = "or
   "$mutable_rail_base/.github/workflows/ci.yaml"
 expect_failure "$mutable_rail_base" "cargo-rail-action plans from a mutable base"
 
-unpinned_scorecard="$TMP_ROOT/unpinned-scorecard"
-make_fixture "$unpinned_scorecard"
-sed -i.bak 's#@sha256:[0-9a-f]*#:v2.4.3#' \
-  "$unpinned_scorecard/.github/actions/scorecard/action.yaml"
-rm -f "$unpinned_scorecard/.github/actions/scorecard/action.yaml.bak"
-expect_failure "$unpinned_scorecard" "Scorecard container uses a mutable tag"
+indirect_scorecard="$TMP_ROOT/indirect-scorecard"
+make_fixture "$indirect_scorecard"
+yq eval '(.jobs.scorecard.steps[] | select(.name == "Run Scorecard") | .uses) = "./.github/actions/scorecard"' -i \
+  "$indirect_scorecard/.github/workflows/scorecard.yaml"
+expect_failure "$indirect_scorecard" "Scorecard publication does not call the official action directly"
 
 floating_codecov="$TMP_ROOT/floating-codecov"
 make_fixture "$floating_codecov"

scripts/ci/check-ci-ownership.sh

@@ -29,7 +29,6 @@ RELEASE="$WORKFLOWS/release.yaml"
 RSA="$WORKFLOWS/rsa.yaml"
 SETUP_ACTION="$ACTIONS/setup/action.yaml"
 TOOLCHAIN_ACTION="$ACTIONS/setup-toolchain/action.yaml"
-SCORECARD_ACTION="$ACTIONS/scorecard/action.yaml"
 MANIFEST="$ROOT/.config/target-matrix.json"
 TOOL_ARCHIVES="$ROOT/.config/ci-tool-archives.tsv"
 CARGO_CONFIG="$ROOT/.cargo/config.toml"
@@ -129,7 +128,6 @@ require_file "$RELEASE"
 require_file "$RSA"
 require_file "$SETUP_ACTION"
 require_file "$TOOLCHAIN_ACTION"
-require_file "$SCORECARD_ACTION"
 require_file "$MANIFEST"
 require_file "$TOOL_ARCHIVES"
 require_file "$CARGO_CONFIG"
@@ -267,7 +265,7 @@ fi
 bash -eu -o pipefail -c 'source "$1"; ci_tool_validate_manifest' _ "$TOOL_INTEGRITY" \
   || fail "direct CI tool archive manifest is invalid"
 
-if grep -ERn 'uses:[[:space:]]+(dtolnay/rust-toolchain|ossf/scorecard-action)@' \
+if grep -ERn 'uses:[[:space:]]+dtolnay/rust-toolchain@' \
   "$WORKFLOWS" "$ACTIONS" >/dev/null; then
   fail "CI must not delegate installation to an action with an unauthenticated executable fallback"
 fi
@@ -394,12 +392,12 @@ grep -Fq 'ci_tool_download codecov' "$INSTALL_CODECOV" \
 # shellcheck disable=SC2016 # GitHub expression is an intentional literal contract.
 grep -Fq 'binary: ${{ steps.codecov.outputs.binary }}' "$WEEKLY" \
   || fail "Codecov action must use the repository-verified CLI"
-[[ $(yq eval '.jobs.scorecard.steps[] | select(.name == "Run Scorecard") | .uses' "$SCORECARD") \
-  == "./.github/actions/scorecard" ]] \
-  || fail "Scorecard must use the repository-owned digest-pinned action"
-scorecard_image=$(yq eval -r '.runs.image' "$SCORECARD_ACTION")
-[[ "$scorecard_image" =~ ^docker://ghcr\.io/ossf/scorecard-action@sha256:[0-9a-f]{64}$ ]] \
-  || fail "Scorecard container must use an OCI digest"
+scorecard_action=$(yq eval '.jobs.scorecard.steps[] | select(.name == "Run Scorecard") | .uses' "$SCORECARD")
+[[ "$scorecard_action" =~ ^ossf/scorecard-action@[0-9a-f]{40}$ ]] \
+  || fail "Scorecard publication must call the official action at an immutable commit"
+[[ $(yq eval '.jobs.scorecard.steps[] | select(.name == "Run Scorecard") | .with.publish_results' "$SCORECARD") \
+  == "true" ]] \
+  || fail "Scorecard must publish results"
 
 [[ $(count_feature_sets "$FEATURE_PROFILES" COMPILE_FEATURE_SETS) -eq 58 ]] \
   || fail "compile feature matrix must retain all 58 profiles"

src/lib.rs

@@ -14,7 +14,7 @@
 //!
 //! ```toml
 //! [dependencies]
-//! rscrypto = { version = "0.6.4", default-features = false, features = ["sha2"] }
+//! rscrypto = { version = "0.8.0", default-features = false, features = ["sha2"] }
 //! ```
 //!
 //! # Guides