xml-sec 0.1.14

Pure Rust XML Security: XMLDSig, XMLEnc, C14N. Drop-in replacement for libxmlsec1.
Documentation
name: CI
on:
  push:
    branches: [main]
  pull_request:
    branches: [main]

permissions:
  contents: read

env:
  CARGO_TERM_COLOR: always
  RUSTFLAGS: -Dwarnings
  XMLSEC1_PREFIX: ${{ github.workspace }}/.tools/xmlsec1-1.3.13
  XMLSEC1_BIN: ${{ github.workspace }}/.tools/xmlsec1-1.3.13/bin/xmlsec1
  LD_LIBRARY_PATH: ${{ github.workspace }}/.tools/xmlsec1-1.3.13/lib

jobs:
  capability-ledger:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v7
        with:
          persist-credentials: false
      - name: Read pinned donor revision
        id: donor-revision
        run: |
          commit="$(cat compatibility/libxmlsec1-1.3.13-donor-commit.txt)"
          [[ "$commit" =~ ^[0-9a-f]{40}$ ]]
          echo "commit=$commit" >> "$GITHUB_OUTPUT"
      - uses: actions/checkout@v7
        with:
          repository: lsh123/xmlsec
          ref: ${{ steps.donor-revision.outputs.commit }}
          path: donors/xmlsec
          persist-credentials: false
      - uses: dtolnay/rust-toolchain@stable
        with:
          toolchain: "1.92.0"
      - uses: Swatinem/rust-cache@v2
      - name: Check native CLI upstream fixture snapshot
        run: scripts/import-xmlsec1-cli-fixtures.sh --check
      - run: >-
          cargo run -p xml-sec-capability-ledger -- check
          donors/xmlsec
          compatibility/libxmlsec1-1.3.13-rules.json
          compatibility/libxmlsec1-1.3.13.json
      - run: >-
          cargo run -p xml-sec-capability-ledger -- behavior-check
          donors/xmlsec
          compatibility/libxmlsec1-1.3.13-behavior-rules.json
          compatibility/libxmlsec1-1.3.13-behavior.json

  build-matrix:
    name: build-matrix (${{ matrix.rust }}, ${{ matrix.xml-backend }})
    runs-on: ubuntu-latest
    strategy:
      fail-fast: false
      matrix:
        include:
          - rust: stable
            xml-backend: xmloxide
            cargo-args: --all-features
          - rust: stable
            xml-backend: roxmltree
            cargo-args: --no-default-features --features xmldsig,xmlenc,c14n,xml-backend-roxmltree
          - rust: "1.92.0"
            xml-backend: xmloxide
            cargo-args: --all-features
          - rust: "1.92.0"
            xml-backend: roxmltree
            cargo-args: --no-default-features --features xmldsig,xmlenc,c14n,xml-backend-roxmltree
    steps:
      - uses: actions/checkout@v7
        with:
          persist-credentials: false
      - uses: dtolnay/rust-toolchain@stable
        with:
          toolchain: ${{ matrix.rust }}
      - uses: Swatinem/rust-cache@v2
      - run: cargo build --workspace ${{ matrix.cargo-args }}

  build:
    runs-on: ubuntu-latest
    needs: build-matrix
    if: ${{ always() }}
    steps:
      - run: test "${{ needs.build-matrix.result }}" = "success"

  test-matrix:
    name: test-matrix (${{ matrix.rust }}, ${{ matrix.xml-backend }})
    runs-on: ubuntu-latest
    strategy:
      fail-fast: false
      matrix:
        include:
          - rust: stable
            xml-backend: xmloxide
            cargo-args: --all-features
          - rust: stable
            xml-backend: roxmltree
            cargo-args: --no-default-features --features xmldsig,xmlenc,c14n,xml-backend-roxmltree
          - rust: "1.92.0"
            xml-backend: xmloxide
            cargo-args: --all-features
          - rust: "1.92.0"
            xml-backend: roxmltree
            cargo-args: --no-default-features --features xmldsig,xmlenc,c14n,xml-backend-roxmltree
    steps:
      - uses: actions/checkout@v7
        with:
          persist-credentials: false
      - name: Read pinned donor revision
        id: test-donor-revision
        run: |
          commit="$(cat compatibility/libxmlsec1-1.3.13-donor-commit.txt)"
          [[ "$commit" =~ ^[0-9a-f]{40}$ ]]
          echo "commit=$commit" >> "$GITHUB_OUTPUT"
      - uses: actions/checkout@v7
        with:
          repository: lsh123/xmlsec
          ref: ${{ steps.test-donor-revision.outputs.commit }}
          path: donors/xmlsec
          persist-credentials: false
      - uses: dtolnay/rust-toolchain@stable
        with:
          toolchain: ${{ matrix.rust }}
      - uses: taiki-e/install-action@nextest
      - name: Refresh apt package index
        run: sudo apt-get update
      - name: Build pinned xmlsec1 for external-oracle tests
        env:
          XMLSEC1_SOURCE_DIR: ${{ github.workspace }}/donors/xmlsec
        run: |
          sudo apt-get install --yes autoconf automake build-essential libltdl-dev libssl-dev libtool libxml2-dev pkg-config
          scripts/install-xmlsec1.sh
          "$XMLSEC1_BIN" --version
      - uses: Swatinem/rust-cache@v2
      - run: cargo nextest run --workspace ${{ matrix.cargo-args }}
      - run: cargo test --doc --workspace ${{ matrix.cargo-args }}

  test:
    runs-on: ubuntu-latest
    needs: test-matrix
    if: ${{ always() }}
    steps:
      - run: test "${{ needs.test-matrix.result }}" = "success"

  clippy-matrix:
    name: clippy (${{ matrix.xml-backend }})
    runs-on: ubuntu-latest
    strategy:
      fail-fast: false
      matrix:
        include:
          - xml-backend: xmloxide
            cargo-args: --all-features
          - xml-backend: roxmltree
            cargo-args: --no-default-features --features xmldsig,xmlenc,c14n,xml-backend-roxmltree
    steps:
      - uses: actions/checkout@v7
        with:
          persist-credentials: false
      - uses: dtolnay/rust-toolchain@stable
        with:
          components: clippy
      - uses: Swatinem/rust-cache@v2
      - run: cargo clippy --workspace --all-targets ${{ matrix.cargo-args }} -- -D warnings

  clippy:
    runs-on: ubuntu-latest
    needs: clippy-matrix
    if: ${{ always() }}
    steps:
      - run: test "${{ needs.clippy-matrix.result }}" = "success"

  fmt:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v7
        with:
          persist-credentials: false
      - uses: dtolnay/rust-toolchain@stable
        with:
          components: rustfmt
      - run: cargo fmt --all -- --check
      - run: cargo fmt --manifest-path fuzz/Cargo.toml -- --check

  fuzz-smoke:
    timeout-minutes: 20
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v7
        with:
          persist-credentials: false
      - uses: dtolnay/rust-toolchain@nightly
      # cargo-fuzz 0.13.1's published lockfile pins rustix 0.36.5, which no
      # longer compiles on current nightly. Keep the tool version pinned while
      # allowing compatible patch-level transitive dependencies.
      - run: cargo +nightly install cargo-fuzz --version 0.13.1
      - run: cargo +nightly fuzz run xmldsig_verify -- -runs=256 -max_len=65536