chio-kernel-core 0.1.2

Portable (no_std + alloc) Chio kernel core: pure verdict evaluation, capability verification, and receipt signing
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100

[package]
name = "chio-kernel-core"
description = "Portable (no_std + alloc) Chio kernel core: pure verdict evaluation, capability verification, and receipt signing"
version.workspace = true
edition.workspace = true
rust-version.workspace = true
license.workspace = true
repository.workspace = true
readme = "README.md"
publish = ["crates-io"]

[lib]
name = "chio_kernel_core"

# This crate contains the pure-compute subset of Chio kernel evaluation:
# capability verification, scope matching, guard pipeline evaluation, and
# receipt signing. It is a `no_std + alloc` crate by source, which means
# the crate itself never imports from `std`. The in-repo portability proof is
# `scripts/check-portable-kernel.sh`, which builds `chio-kernel-core` both for
# the host and for `wasm32-unknown-unknown` with `--no-default-features`.
# See docs/protocols/PORTABLE-KERNEL-ARCHITECTURE.md.
[dependencies]
# Depend on `chio-core-types` with `default-features = false` and forward the
# `std` feature through our own feature flag so downstream consumers can
# select between the hosted `std` build and the portable `no_std + alloc`
# build used by the scripted host + wasm proof.
chio-core-types = { version = "=0.1.2", path = "../../core/chio-core-types", default-features = false }
serde = { version = "1", default-features = false, features = ["derive", "alloc"] }
serde_json = { version = "1", default-features = false, features = ["alloc"] }
# `arbitrary` is gated behind the `fuzz` feature so production builds stay
# free of fuzz instrumentation. Pulled in by
# `fuzz/fuzz_targets/receipt_log_replay.rs` via
# `chio-kernel-core = { features = ["fuzz"] }`.
arbitrary = { version = "1", features = ["derive"], optional = true }
# `arc-swap` powers the `RevocationView` read-only cache: the gossip
# task swaps a fresh snapshot in atomically while dispatch readers hold
# a no-lock reference. Requires `std` at link time so it is only pulled
# in via the `revocation-view` feature, which itself implies `std`. The
# portable `no_std + alloc` proof never observes this surface.
arc-swap = { workspace = true, optional = true }
# `dudect-bencher` is gated behind the `dudect` feature so default builds
# never pull it in. Used by the timing-leak harnesses at
# `tests/dudect/{mac_eq,scope_subset}.rs`, wired as `harness = false` test
# binaries below. The harnesses statistically detect data-dependent timing
# in (a) `Signature` byte equality (the kernel-core's MAC-eq surface during
# signature verification) and (b) `NormalizedScope::is_subset_of` (the
# capability-algebra subset check).
dudect-bencher = { version = "0.7", optional = true }

[features]
default = ["std", "revocation-view"]
std = ["chio-core-types/std", "serde/std", "serde_json/std"]
# Enables the `revocation_view` module: an arc-swap-backed read-only
# snapshot of the revocation oracle's most recent signed epoch root that
# dispatch consults on every call. Implies `std` because `arc-swap`
# itself requires std; the portable no_std + alloc proof leaves the
# module out and falls back to a denylist-only path. The `revocation-view`
# feature is on by default for hosted builds and explicitly disabled by
# the wasm portable proof via `--no-default-features`.
revocation-view = ["dep:arc-swap", "std"]
# Enables `chio_kernel_core::fuzz`, the libFuzzer entry-point module for the
# receipt-log replay verifier. Implies `std` because libFuzzer itself only
# runs in a hosted environment, so the `no_std + alloc` portable proof never
# observes this surface. Off by default; turned on only by the `chio-fuzz`
# standalone workspace at `../../fuzz`.
fuzz = ["dep:arbitrary", "std"]
# Enables the dudect timing-leak harnesses at `tests/dudect/{mac_eq,
# scope_subset}.rs`. Implies `std` because dudect-bencher is a hosted-only
# tool (clap, ctrlc, OS time syscalls) that never runs in the portable
# `no_std + alloc` proof. Off by default; opt in via
# `cargo test -p chio-kernel-core --features dudect --release {mac_eq|scope_subset}`.
# CI lane: `.github/workflows/dudect.yml`.
dudect = ["dep:dudect-bencher", "std"]

[dev-dependencies]
chio-adversarial-suite = { path = "../../core/chio-adversarial-suite" }
proptest = { workspace = true }

# Timing-leak dudect harnesses. `harness = false` so each test binary's
# `main` is provided by `dudect_bencher::ctbench_main!`. Gated behind the
# `dudect` feature so default `cargo test` does not try to compile them
# (the sources are `#![cfg(feature = "dudect")]`).
[[test]]
name = "dudect_mac_eq"
path = "tests/dudect/mac_eq.rs"
harness = false
required-features = ["dudect"]

[[test]]
name = "dudect_scope_subset"
path = "tests/dudect/scope_subset.rs"
harness = false
required-features = ["dudect"]

[lints.clippy]
unwrap_used = "deny"
expect_used = "deny"

[lints.rust]
unexpected_cfgs = { level = "warn", check-cfg = ["cfg(kani)"] }