feat(core): fuzzing hooks — config re-export, decrypt/parse split, key-injected VRC verify (#124)#125
Merged
Conversation
…y-injected VRC verify (#124) Lands the self-contained openvtc-core seams the cargo-fuzz harnesses need (issue #124), without the fuzz workspace itself. - config: re-export `PublicConfig` at `openvtc_core::config::PublicConfig` (was only reachable via `config::public_config`). The validators the issue asks for are already `pub` (`MessageType: TryFrom<&str>`, `CredentialKind::from_credential`, `messaging::validate_did`) — no change needed there. - config: split decrypt from parse. `ProtectedConfig::parse(&[u8])` is the post-decrypt serde half of `load`; `SecuredConfig::parse(&[u8])` parse-checks the stored wire blob (tagged or legacy) — both reachable with no OS keyring so the deserializers can be fuzzed directly. `load` now routes through them. - messaging: add `verify_vrc_proof_with_key(vrc, &public_key_bytes)` — verifies a VRC's data-integrity proof against an injected issuer key (no live TDK / DID resolution), sharing the issuer⇄verification-method binding guard with the TDK-based `verify_vrc_proof` via a new `check_vrc_issuer_binding` helper. Uses dtg-credentials' `verify_proof_with_public_key` (its `affinidi-signing` feature is default-on; no dep change). Tests: parse accept/reject for both configs; `verify_vrc_proof_with_key` accepts the matching issuer key and rejects a different key + unsigned credentials. Not included (the fuzz team's contribution, per #124 item 5): the `fuzz/` workspace + `#[derive(Arbitrary)]`. Item 1's `--no-default-features` reachability already holds (it's in the CI gate); a dedicated `parsing` feature gating the network deps is out of scope (those deps are non-optional). Gate: cargo fmt; clippy --workspace --all-targets -D warnings (+ openvtc-core --no-default-features); cargo test --workspace — all green. No dep change. Signed-off-by: Glenn Gore <glenn.g@affinidi.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Lands the self-contained
openvtc-coreseams the cargo-fuzz harnesses in #124need, without the fuzz workspace itself. Per the review on #124.
What's here (issue #124 items 2–4)
Item 2 —
pubvalidators. Mostly already true:MessageType: TryFrom<&str>,CredentialKind::from_credential, andmessaging::validate_didare alreadypub(the issue's worry thatvalidate_did"may be private" was unfounded).Net change: re-export
PublicConfigso the requested pathopenvtc_core::config::PublicConfigworks (it was only atconfig::public_config).Item 3 — split decrypt from parse.
ProtectedConfig::parse(&[u8])— the post-decrypt serde half ofload.SecuredConfig::parse(&[u8])— parse-checks the stored wire blob (tagged orlegacy) without unlocking.
Both reachable with no OS keyring;
loadroutes through them so behaviour isunchanged.
Item 4 —
verify_vrc_proofwithout a live TDK. Newverify_vrc_proof_with_key(vrc, &public_key_bytes)verifies the proof against aninjected issuer key (no TDK / DID resolution), sharing the
issuer⇄verification-method binding guard with the TDK path via a new
check_vrc_issuer_bindinghelper. Uses dtg-credentials'verify_proof_with_public_key(itsaffinidi-signingfeature is default-on — nodep change).
Tests
ProtectedConfig::parse/SecuredConfig::parse: accept valid, reject garbage/empty.verify_vrc_proof_with_key: accepts the matching issuer key, rejects adifferent key, rejects unsigned (binding guard).
Not included (deliberately)
fuzz/workspace +#[derive(Arbitrary)]) — the fuzz team'scontribution per the issue; left to them. Happy to feature-gate
Arbitraryifwanted.
parsingfeature —--no-default-featuresreachability alreadyholds (it's in the CI gate); gating out the network deps would be a large
refactor (they're non-optional). The issue's "drops network deps" framing is
noted on the issue.
Gate
cargo fmt;clippy --workspace --all-targets -D warnings(+openvtc-core --no-default-features);cargo test --workspace— all green. No dependencychange (
Cargo.lockuntouched).