Use typed batch firmware version encoding
What the developer wrote
Authored by Adam Tucker
Use typed batch firmware version encoding
What changed, and why it matters
This commit updates the firmware's Zcash batch signing result to use a new typed encoding for the firmware version field. It is a routine dependency bump and code adjustment to match a changed SDK API. There is no direct evidence in the commit that this fixes a security vulnerability; it appears to be a correctness or compatibility change.
Treat as a normal maintenance commit. Review the upstream keystone-sdk-rust changes between the two revisions if you need to confirm whether the SDK update includes any security fixes not mentioned here. No immediate security action is indicated by this diff alone.
Security signals we found
Dependency update to newer SDK revision
Change in firmware version encoding type for Zcash batch signature results
No explicit security fix described in commit message or diff
Evidence from the diff
The commit bumps the ur-registry dependency in rust/Cargo.toml and rust/Cargo.lock to a newer revision of keystone-sdk-rust, and adjusts rust/rust_c/src/zcash/mod.rs so that ZcashBatchSigResult::new receives KEYSTONE_FW_VERSION.encode() directly instead of converting it to a Vec
Changed components
rust/rust_c/src/zcash/mod.rsrust/Cargo.tomlrust/Cargo.lockur-registry dependency (keystone-sdk-rust)Inspect captured patch +8 / −5
diff --git a/rust/Cargo.lock b/rust/Cargo.lock
index 59b6bf0..b453ee5 100644
--- a/rust/Cargo.lock
+++ b/rust/Cargo.lock
@@ -2565,7 +2565,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "07033963ba89ebaf1584d767badaa2e8fcec21aedea6b8c0346d487d49c28667"
dependencies = [
"cfg-if",
- "windows-targets 0.53.2",
+ "windows-targets 0.48.5",
]
[[package]]
@@ -4814,7 +4814,7 @@ dependencies = [
[[package]]
name = "ur-registry"
version = "1.0.5"
-source = "git+https://github.com/KeystoneHQ/keystone-sdk-rust.git?rev=f6b688eb9b6eb928f400b4cd7d2d623fdbc3b34d#f6b688eb9b6eb928f400b4cd7d2d623fdbc3b34d"
+source = "git+https://github.com/KeystoneHQ/keystone-sdk-rust.git?rev=c2119436f5246be05b1ba877a7e6b63f51c01339#c2119436f5246be05b1ba877a7e6b63f51c01339"
dependencies = [
"bs58",
"hex",
diff --git a/rust/Cargo.toml b/rust/Cargo.toml
index 86bb8b6..7cf07e1 100644
--- a/rust/Cargo.toml
+++ b/rust/Cargo.toml
@@ -133,4 +133,4 @@ zcash_transparent = { git = "https://github.com/zcash/librustzcash", rev = "878d
orchard = { git = "https://github.com/zcash/orchard", rev = "8995ee7e26f8b654a5457d05c95ee5b3132b3edd" }
# Use the SDK rev that wraps PCZT-owned Postcard messages as opaque UR data,
# correlates requests and results, and reports one firmware version per batch result.
-ur-registry = { git = "https://github.com/KeystoneHQ/keystone-sdk-rust.git", rev = "f6b688eb9b6eb928f400b4cd7d2d623fdbc3b34d" }
+ur-registry = { git = "https://github.com/KeystoneHQ/keystone-sdk-rust.git", rev = "c2119436f5246be05b1ba877a7e6b63f51c01339" }
diff --git a/rust/rust_c/src/zcash/mod.rs b/rust/rust_c/src/zcash/mod.rs
index 5573d9d..96ddd8e 100644
--- a/rust/rust_c/src/zcash/mod.rs
+++ b/rust/rust_c/src/zcash/mod.rs
@@ -359,7 +359,7 @@ fn encode_zcash_batch_sig_result(
request_id: Vec<u8>,
data: Vec<u8>,
) -> Result<Vec<u8>, RustCError> {
- ZcashBatchSigResult::new(request_id, data, KEYSTONE_FW_VERSION.encode().to_vec())
+ ZcashBatchSigResult::new(request_id, data, KEYSTONE_FW_VERSION.encode())
.try_into()
.map_err(|e| RustCError::InvalidData(format!("encode Zcash batch result envelope: {e:?}")))
}
@@ -1074,7 +1074,10 @@ mod tests {
assert_eq!(decoded.get_request_id(), request_id);
assert_eq!(decoded.get_data(), response_bytes);
- assert_eq!(decoded.get_firmware_version(), KEYSTONE_FW_VERSION.encode());
+ assert_eq!(
+ decoded.get_firmware_version(),
+ &KEYSTONE_FW_VERSION.encode()
+ );
assert_eq!(
BatchSignResponse::parse(decoded.get_data()).unwrap(),
response
Why this scored 15/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.