Repository navigation
fix: reject low-order X25519 public keys - #418
Merged
Mathieu Morrissette (mmorrissette-devolutions) merged 2 commits intoOct 19, 2026
Merged
Mathieu Morrissette (mmorrissette-devolutions) merged 2 commits into
Mathieu Morrissette (mmorrissette-devolutions) merged 2 commits into
Conversation
Mathieu Morrissette (mmorrissette-devolutions)
marked this pull request as ready for review
October 16, 2026 15:43
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
Mathieu Morrissette (mmorrissette-devolutions)
requested a review
from a team
as a code owner
October 16, 2026 15:54
Sébastien Duquette (sduquette-devolutions)
approved these changes
Oct 19, 2026
Dion Gionet Mallet (dion-gionet)
approved these changes
Oct 19, 2026
Mathieu Morrissette (mmorrissette-devolutions)
merged commit Oct 19, 2026
d678c09
into
master
34 checks passed
Mathieu Morrissette (mmorrissette-devolutions)
deleted the
fix/x25519-reject-low-order-points
branch
October 19, 2026 13:43
Mathieu Morrissette (mmorrissette-devolutions)
added a commit
that referenced
this pull request
Oct 19, 2026
Stacked on #418. Fixes the warnings reported by [CI run 38927727942](https://github.com/Devolutions/devolutions-crypto/actions/runs/38927727942). ## Fixed - **Node 20 deprecation (actions)**: `download-artifact` v4 → v8, `upload-artifact` v4/v4.3.6 → v7, `setup-python` v5 → v7, `setup-node` v4 → v7, `setup-java` v3 → v6 (also clears the "setup-java v3 is deprecated" warning). Uploads that were pinned to v4.3.6 get `include-hidden-files: true` to keep the dotfile behaviour (v4.4+ excludes them by default). Artifacts are still zipped, so `dv github download-artifact` in the release workflows is unaffected. - **Cargo manifest**: drop `package.homepage` (redundant with `package.repository`; printed on every cargo invocation). Add `description`/`license`/`repository` to the `python` and `devolutions-crypto-uniffi` crates (maturin's `cargo package --list` warning). - **cargo-deny yanked crate**: `chacha20` 0.10.1 → 0.10.2 (0.10.1 is yanked). The lockfile diff touches only `chacha20`. - **C# nullable warnings**: - CS8632 in `dotnet-core`: enable `<Nullable>` (the shared test files are annotated). - CS8602/CS8604 in `android`: bump MSTest 3.0.0 → 3.7.1, matching the local test project. MSTest 3.0.0 lacks `[NotNull]` on `Assert.IsNotNull`; reproduced locally (42 warnings with 3.0.0, 0 with 3.7.1). - CS8765 in iOS: `AppDelegate.FinishedLaunching` takes `NSDictionary?`. - **NETSDK1202**: android nuget tests `net9.0-android` → `net10.0-android` (CI already uses SDK 10). This is a separate commit, so it's easy to drop if needed. - **Kotlin Gradle deprecations**: `kotlinOptions` → `compilerOptions`; library `targetSdk` moved to `testOptions`/`lint`. ## Not fixed (out of this repo's control) - `uniffi.toml` "old-style --config": maturin passes the crate's `uniffi.toml` to uniffi-bindgen 0.32 via `--config`. Python doesn't use the `[bindings.kotlin]` section, and rewriting the file risks the Kotlin package name. - `zip v2.4.2` yanked, `buf_redux`/`multipart` future-incompat: these come from the wasm-pack / wasm-bindgen-cli lockfiles installed with `--locked`. - emcc `WASM_BIGINT is deprecated`: injected by rustc's `wasm32-unknown-emscripten` target, not by our flags. - cargo-deny duplicate crates (`rand`, `getrandom`, `syn`, …): this needs dependency-tree work and is out of scope. - Homebrew "Skipping X / Treating azure-cli as a formula": these come from re-running the Homebrew installer on the macOS runner. - Runner notices (macOS arm64 capacity, `ubuntu-latest` → Ubuntu 26 migration) and the wasm-pack PATH hint. ## Verification - `cargo test --lib`: 46 passed. `cargo package --list` no longer prints manifest warnings. - The local C# test project and the `dotnet-core` test project (built against the source project) both build with 0 warnings. - The `kotlin-android` lib builds with the new DSL (`:lib:compileReleaseKotlin`). - Android/iOS builds and the action bumps are verified by this PR's CI.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Return
Error::InvalidDatawhen an X25519 exchange is not contributory (low-order peer public key) inmix_key_exchangeand in asymmetric encryption/decryption, including online ciphertexts.