ilpanich / axiam / 29313902595

91%

push

github

build(deps): upgrade aes-gcm 0.11, sha2 0.11, hkdf 0.13, rcgen 0.14 (#181)

Adapt source to breaking API changes in four security-critical crypto
crates. Behavior-preserving only: no changes to algorithms, key sizes,
nonce handling, KDF parameters, or certificate properties. Every existing
test stays green.

digest-0.11 cluster (interdependent, upgraded together so the
digest/crypto-common trait bounds resolve):
- aes-gcm 0.10.3 -> 0.11.0
- sha2   0.10.9 -> 0.11.0
- hkdf   0.12.4 -> 0.13.0
- hmac   0.12.1 -> 0.13.0 (aligned to the digest-0.11 generation)

independent:
- rcgen  0.13.2 -> 0.14.8

API adaptations (call sites only):
- aes-gcm 0.11: the OsRng re-export / AeadCore::generate_nonce are gone from
  the default surface. Generate the fresh 12-byte nonce via the aead
  `Generate` trait (same OS CSPRNG source as before) and build Key/Nonce with
  From/TryFrom instead of the now-deprecated from_slice. Wire formats and
  nonce semantics are unchanged.
- hmac 0.13: `new_from_slice` now lives on the `KeyInit` trait rather than
  `Mac`; qualified the constructor accordingly.
- rcgen 0.14: `CertificateParams::from_ca_cert_pem` moved onto the new
  `Issuer` type, which now owns the signing key; `signed_by` takes
  `(&public_key, &issuer)` (2 args). Issuer DN, validity, SAN, key usage and
  algorithm of issued certs are preserved.

Supersedes #177, #178, #179, #180 (the Dependabot PRs that could not apply
because they require these code changes).

Co-authored-by: Claude <noreply@anthropic.com>

1603 of 1765 branches covered (90.82%)

Branch coverage included in aggregate %.

41 of 45 new or added lines in 6 files covered. (91.11%)

26535 of 33028 relevant lines covered (80.34%)

68.09 hits per line