fix(test): realign round-trip Rust helper to affinidi-messaging-didcomm 0.15 (unblocks CI) - #7
Merged
Merged
Conversation
…mm 0.15 The roundtrip-rust interop vectors (JS pack -> Rust unpack) had been red in CI since the 0.5.0 ECDH-1PU cc_tag length-prefix fix (#322): JS pack became spec-correct while tools/roundtrip-helper still pinned the pre-fix affinidi-messaging-didcomm 0.13, whose legacy (unprefixed) Concat-KDF KEK could no longer unwrap JS's authcrypt (key unwrap integrity check failed). The helper-vs-JS mismatch, not any library code, was the failure. - bump the helper to 0.15 (matching the VTA + mediator pin, which carries the #322 fix); - move the key-agreement imports to their new home in 0.15 (affinidi_crypto::jose::key_agreement) and add the affinidi-crypto dep; - handle the new UnpackResult::Encrypted fields (surface legacy_kek_used, which is false for a spec-correct JS >=0.5.0 pack) and the now #[non_exhaustive] enum. All previously-failing vectors pass: forward + mediator-auth + roundtrip-rust are 19/19; full suite 206 pass / 0 fail (4 unrelated did:webvh fixture-cache skips). Test-only tooling (publish = false), so no npm package version bump. Signed-off-by: Glenn Gore <glenn.g@affinidi.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why CI is red (and has been since #3)
mainhas failed CI since PR #3 (ecdh-1pu-kdf-length-prefix) — the last greenpush was #2. Every failing test is a
roundtrip-rustinterop vector(JS-pack → Rust-unpack) dying with
key unwrap failed: key unwrap integrity check failed. These run only in CI, where the Rustdidcomm-unpackhelper isbuilt; locally they skip. This is not caused by any library change — PRs #5
and #6 inherit the same pre-existing red.
Root cause (the repo's own 0.5.0 CHANGELOG flags it): #3 made JS authcrypt
spec-correct by length-prefixing the ECDH-1PU Concat-KDF
cc_tag(upstream#322). JS
unpackalso got a dual-KEK fallback. Buttools/roundtrip-helperstill pinned the pre-fix
affinidi-messaging-didcomm 0.13, whose legacy(unprefixed) KDF computes a different KEK and can't unwrap JS's now-correct
key-wrap — and the helper has no fallback. So JS→Rust authcrypt broke. The 0.5.0
notes even say the vectors "should be regenerated against a Rust [impl with the
fix]."
The VTA + mediator have since moved to
affinidi-messaging-didcomm 0.15; onlythis test helper lagged at 0.13.
Fix
tools/roundtrip-helpertoaffinidi-messaging-didcomm 0.15(matchingthe workspace, which carries #322).
affinidi_messaging_didcomm::cryptointo
affinidi_crypto::jose::key_agreement— updated the imports and added theaffinidi-cryptodep.UnpackResult::Encryptedadditions: surfacelegacy_kek_used(it is
falsefor a spec-correct JS ≥0.5.0 pack — exactly the interop thisharness verifies) and add the wildcard arm the now-
#[non_exhaustive]enumrequires.
Result
With the rebuilt helper the vectors run and pass:
forward+mediator-auth+roundtrip-rust: 19/19, 0 skipped.did:webvhfixture-cache tests). Helper builds clean.
Test-only tooling (
publish = false), so no npm package version bump.Merge order
Merge this first — it turns
maingreen again. PRs #5 (D8-F2 auth) and#6 (D8-F3 transport) then just need a rebase to pick up the working helper;
their own new tests already pass. Part of D8 / R4.1 (hand-maintained clients
drifting from the Rust side).