webauthn-kit 0.3.7

Standalone WebAuthn/FIDO2 passkey verification kit: CTAP2 authenticator data parsing, COSE ES256/ES384/EdDSA/RS256 signature verification via ring, enforceable credential policies (UV, backup eligibility, algorithm allowlists), challenge freshness/replay protection and sign-count clone detection.
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32

name: CI
on:
  push:
    branches: [main, master]
  pull_request:

jobs:
  quality:
    uses: WyattAu/engineering-standards/.github/workflows/rust-kit.yml@main
    with:
      tier: a
      all-features: true
      loom: false
      wasm: false
      miri: false

  # Fuzz smoke: 60s per untrusted-input target. Full runs are local/nightly;
  # this gate catches regressions on the WebAuthn ceremony parsing early.
  fuzz-smoke:
    name: fuzz smoke
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: dtolnay/rust-toolchain@nightly
      - uses: Swatinem/rust-cache@v2
      - run: cargo install cargo-fuzz --locked
      - name: registration smoke (60s)
        run: cargo fuzz run fuzz_verify_registration -- -max_total_time=60 -max_len=16384 -detect_leaks=0
      - name: authentication smoke (60s)
        run: cargo fuzz run fuzz_verify_authentication -- -max_total_time=60 -max_len=16384 -detect_leaks=0
      - name: COSE key smoke (60s)
        run: cargo fuzz run fuzz_cose_key -- -max_total_time=60 -max_len=8192 -detect_leaks=0