What the developer wrote
Authored by ww3512687
update cargo.toml
What changed, and why it matters
This commit only changes how two internal Rust libraries are sourced in the project's build configuration. It switches from using local file paths on a developer's Windows machine (C:/3.git/...) to pulling the same libraries from a specific Git branch in the vendor's public repository. There is no code behavior change visible in this commit, and nothing in the commit message or diff indicates a security fix or vulnerability.
No security action required for this commit. If reviewing the broader feature branch, verify that the support_crypto_extend branch of keystone-sdk-rust has itself been reviewed for security before it is merged into the firmware's main dependency set.
Security signals we found
No strong security signals were identified.
Evidence from the diff
The diff updates rust/Cargo.toml and rust/Cargo.lock to replace path-based dependencies for ur-registry and ur-parse-lib with git-based dependencies pinned to the support_crypto_extend branch of KeystoneHQ/keystone-sdk-rust (commit 414ecb6c). This is a build/dependency sourcing change only. No functional code, cryptographic logic, input parsing, or firmware behavior is modified in this commit.
Changed components
rust/Cargo.tomlrust/Cargo.lockInspect captured patch +4 / −4
diff --git a/rust/Cargo.lock b/rust/Cargo.lock
index 2be6b7a..9d931d9 100644
--- a/rust/Cargo.lock
+++ b/rust/Cargo.lock
@@ -4789,6 +4789,7 @@ dependencies = [
[[package]]
name = "ur-parse-lib"
version = "0.2.0"
+source = "git+https://github.com/KeystoneHQ/keystone-sdk-rust.git?branch=support_crypto_extend#414ecb6cc3730d780067dc52754b5c2f61a6cc7b"
dependencies = [
"hex",
"ur",
@@ -4798,6 +4799,7 @@ dependencies = [
[[package]]
name = "ur-registry"
version = "0.1.1"
+source = "git+https://github.com/KeystoneHQ/keystone-sdk-rust.git?branch=support_crypto_extend#414ecb6cc3730d780067dc52754b5c2f61a6cc7b"
dependencies = [
"bs58 0.5.1",
"core2",
diff --git a/rust/Cargo.toml b/rust/Cargo.toml
index e1fd73f..da569b5 100644
--- a/rust/Cargo.toml
+++ b/rust/Cargo.toml
@@ -74,10 +74,8 @@ core2 = { version = "0.3.3", default-features = false, features = ["alloc"] }
thiserror = { version = "1.0", package = "thiserror-core", default-features = false }
rsa = { version = "0.8.2", default-features = false }
sha1 = { version = "0.10.5", default-features = false }
-# ur-registry = { git = "https://git@github.com/KeystoneHQ/keystone-sdk-rust.git", tag = "0.0.49" }
-# ur-parse-lib = { git = "https://git@github.com/KeystoneHQ/keystone-sdk-rust.git", tag = "0.0.49" }
-ur-registry = { path = "C:/3.git/keystone-sdk-rust/libs/ur-registry"}
-ur-parse-lib = { path = "C:/3.git/keystone-sdk-rust/libs/ur-parse-lib"}
+ur-registry = { git = "https://git@github.com/KeystoneHQ/keystone-sdk-rust.git", branch = "support_crypto_extend" }
+ur-parse-lib = { git = "https://git@github.com/KeystoneHQ/keystone-sdk-rust.git", branch = "support_crypto_extend" }
ed25519-bip32-core = { version = "0.1.1", default-features = false }
cryptoxide = "0.4"
arrayref = "0.3.6"
Why this scored 15/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.