Informational 11 Bitcoin Committed Jul 21, 2026 · 15:07 UTC

build(zcash): use released protocol crates

ef5ad05f View source ↗

Public commit record

What the developer wrote

Authored by Adam Tucker

80/100 · Strong

build(zcash): use released protocol crates

Use crates.io releases for PCZT, Orchard, and the librustzcash crate family. Keep ur-registry patched to the merged SDK revision until its updated batch envelope is published.

✓ Descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope✓ Provides detailed explanatory context

The short version

What changed, and why it matters

This commit is a routine build update for the Zcash parts of the Keystone 3 firmware. It switches several Rust libraries from using specific GitHub revisions to using published versions from crates.io, and bumps a few version numbers. There is no direct evidence in the commit that this fixes a security vulnerability. It is primarily a dependency-maintenance change.

Recommended action

Treat as a normal dependency hygiene update. Review the release notes of the updated Zcash crates (pczt 0.8.0-rc.1, orchard 0.15.1, zcash_primitives 0.29.0, etc.) and the ur-registry SDK revision 4131bae5 for any security fixes. Run the existing Zcash test suite and verify reproducible builds after the lockfile change.

Security signals we found

Dependency source changed from Git revisions to crates.io releases

Pre-release Zcash crate versions bumped to stable releases

ur-registry pinned to a newer SDK revision

No application code or cryptographic implementation changes visible

Technical analysis

Evidence from the diff

The commit replaces Git-based patches for zcash/librustzcash and zcash/orchard crates with crates.io releases, and updates Cargo.toml version pins from pre-release (e.g., 0.29.0-pre.0) to stable (e.g., 0.29.0). It also pins ur-registry to a newer Git revision and uses an exact version pin (=1.0.5). The diff shows only dependency source and version changes; no application code or cryptographic logic is modified.

Changed components

rust/Cargo.lockrust/Cargo.tomlrust/apps/zcash/Cargo.tomlrust/zcash_vendor/Cargo.tomlZcash-related Rust dependencies (pczt, orchard, zcash_*, ur-registry)

Inspect captured patch +37 / −45

diff --git a/rust/Cargo.lock b/rust/Cargo.lock
index b453ee5..109ba77 100644
--- a/rust/Cargo.lock
+++ b/rust/Cargo.lock
@@ -1678,7 +1678,8 @@ checksum = "edd0f118536f44f5ccd48bcb8b111bdc3de888b58c74639dfb034a357d0f206d"
 [[package]]
 name = "equihash"
 version = "0.3.0"
-source = "git+https://github.com/zcash/librustzcash?rev=878db2074ae8ac2682d3e6c61c00f7018b6adc0c#878db2074ae8ac2682d3e6c61c00f7018b6adc0c"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "306286e8dcc39ab3dfceb74c792ce8baffdab90591321d3ffaae64829734c37f"
 dependencies = [
  "blake2b_simd",
  "corez",
@@ -1802,14 +1803,6 @@ dependencies = [
  "blake2b_simd",
 ]
 
-[[package]]
-name = "f4jumble"
-version = "0.1.1"
-source = "git+https://github.com/zcash/librustzcash?rev=878db2074ae8ac2682d3e6c61c00f7018b6adc0c#878db2074ae8ac2682d3e6c61c00f7018b6adc0c"
-dependencies = [
- "blake2b_simd",
-]
-
 [[package]]
 name = "fastrand"
 version = "2.3.0"
@@ -3041,8 +3034,9 @@ checksum = "c08d65885ee38876c4f86fa503fb49d7b507c2b62552df7c70b2fce627e06381"
 
 [[package]]
 name = "orchard"
-version = "0.15.0"
-source = "git+https://github.com/zcash/orchard?rev=8995ee7e26f8b654a5457d05c95ee5b3132b3edd#8995ee7e26f8b654a5457d05c95ee5b3132b3edd"
+version = "0.15.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "04153a90834b939edd03c3e1b3ff15c9d305b9224c5e196faf3a490d21dfa299"
 dependencies = [
  "aes",
  "bitvec",
@@ -3142,8 +3136,9 @@ checksum = "57c0d7b74b563b49d38dae00a0c37d4d6de9b432382b2892f0574ddcae73fd0a"
 
 [[package]]
 name = "pczt"
-version = "0.7.0"
-source = "git+https://github.com/zcash/librustzcash?rev=878db2074ae8ac2682d3e6c61c00f7018b6adc0c#878db2074ae8ac2682d3e6c61c00f7018b6adc0c"
+version = "0.8.0-rc.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e8fb3f5ea64b891d40cff8182aca0bd7d063c9460920546fe7066860b781de91"
 dependencies = [
  "blake2b_simd",
  "bls12_381",
@@ -4814,7 +4809,7 @@ dependencies = [
 [[package]]
 name = "ur-registry"
 version = "1.0.5"
-source = "git+https://github.com/KeystoneHQ/keystone-sdk-rust.git?rev=c2119436f5246be05b1ba877a7e6b63f51c01339#c2119436f5246be05b1ba877a7e6b63f51c01339"
+source = "git+https://github.com/KeystoneHQ/keystone-sdk-rust.git?rev=4131bae5407e31633c01edf9c324094aca69341a#4131bae5407e31633c01edf9c324094aca69341a"
 dependencies = [
  "bs58",
  "hex",
@@ -5412,12 +5407,13 @@ dependencies = [
 [[package]]
 name = "zcash_address"
 version = "0.13.0"
-source = "git+https://github.com/zcash/librustzcash?rev=878db2074ae8ac2682d3e6c61c00f7018b6adc0c#878db2074ae8ac2682d3e6c61c00f7018b6adc0c"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5a854b28c07dba372f4410ea8ad62b4bf7d5c2bf8be32fc4b31bc0db6521a975"
 dependencies = [
  "bech32 0.11.0",
  "bs58",
  "corez",
- "f4jumble 0.1.1 (git+https://github.com/zcash/librustzcash?rev=878db2074ae8ac2682d3e6c61c00f7018b6adc0c)",
+ "f4jumble",
  "zcash_encoding",
  "zcash_protocol",
 ]
@@ -5425,7 +5421,8 @@ dependencies = [
 [[package]]
 name = "zcash_encoding"
 version = "0.4.0"
-source = "git+https://github.com/zcash/librustzcash?rev=878db2074ae8ac2682d3e6c61c00f7018b6adc0c#878db2074ae8ac2682d3e6c61c00f7018b6adc0c"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1440921903cdb86133fb9e2fe800be488015db2939a30bedb413078a1acb0306"
 dependencies = [
  "corez",
  "hex",
@@ -5435,7 +5432,8 @@ dependencies = [
 [[package]]
 name = "zcash_keys"
 version = "0.15.0"
-source = "git+https://github.com/zcash/librustzcash?rev=878db2074ae8ac2682d3e6c61c00f7018b6adc0c#878db2074ae8ac2682d3e6c61c00f7018b6adc0c"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "36391ebfce7df2510c6564f79e608ed93f1c0692c6464e2397b248e06dae3912"
 dependencies = [
  "bech32 0.11.0",
  "bip32",
@@ -5474,7 +5472,8 @@ dependencies = [
 [[package]]
 name = "zcash_primitives"
 version = "0.29.0"
-source = "git+https://github.com/zcash/librustzcash?rev=878db2074ae8ac2682d3e6c61c00f7018b6adc0c#878db2074ae8ac2682d3e6c61c00f7018b6adc0c"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bdbeccc05bfe63b6dee9e989c6ff5027421741562a4853c36504dd621f6a81b1"
 dependencies = [
  "blake2b_simd",
  "block-buffer 0.11.0-rc.3",
@@ -5504,7 +5503,8 @@ dependencies = [
 [[package]]
 name = "zcash_protocol"
 version = "0.10.0"
-source = "git+https://github.com/zcash/librustzcash?rev=878db2074ae8ac2682d3e6c61c00f7018b6adc0c#878db2074ae8ac2682d3e6c61c00f7018b6adc0c"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2973d210e74ebd81adc50828fbbb284ab6aaa099308097c42c47dc63cf3420fc"
 dependencies = [
  "corez",
  "hex",
@@ -5543,7 +5543,8 @@ dependencies = [
 [[package]]
 name = "zcash_transparent"
 version = "0.9.0"
-source = "git+https://github.com/zcash/librustzcash?rev=878db2074ae8ac2682d3e6c61c00f7018b6adc0c#878db2074ae8ac2682d3e6c61c00f7018b6adc0c"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "72e0f8c142bed366ed5886dcfa8772ec90b5420cc127e6cdb76b6744c53a287b"
 dependencies = [
  "bip32",
  "bs58",
@@ -5575,7 +5576,7 @@ dependencies = [
  "bs58",
  "byteorder",
  "chacha20poly1305",
- "f4jumble 0.1.1 (registry+https://github.com/rust-lang/crates.io-index)",
+ "f4jumble",
  "ff",
  "fpe",
  "getset",
diff --git a/rust/Cargo.toml b/rust/Cargo.toml
index 7cf07e1..8d370a6 100644
--- a/rust/Cargo.toml
+++ b/rust/Cargo.toml
@@ -76,7 +76,7 @@ core2 = { version = "0.9.4", package = "no_std_io2", default-features = false }
 thiserror = { version = "1.0", package = "thiserror-core", default-features = false }
 rsa = { version = "0.8.2", default-features = false }
 sha1 = { version = "0.10.5", default-features = false }
-ur-registry = "1.0.5"
+ur-registry = "=1.0.5"
 ur-parse-lib = "1.0.4"
 sui-transaction-types-core = { git = "https://github.com/KeystoneHQ/sui.git", tag = "mainnet-nostd-v1.69.2.1", default-features = false, features = ["alloc"] }
 ed25519-bip32-core = { version = "0.1.1", default-features = false }
@@ -122,15 +122,6 @@ zeroize = { version = "1.8.2", default-features = false }
 # third party dependencies end
 
 [patch.crates-io]
-pczt = { git = "https://github.com/zcash/librustzcash", rev = "878db2074ae8ac2682d3e6c61c00f7018b6adc0c" }
-zcash_address = { git = "https://github.com/zcash/librustzcash", rev = "878db2074ae8ac2682d3e6c61c00f7018b6adc0c" }
-zcash_encoding = { git = "https://github.com/zcash/librustzcash", rev = "878db2074ae8ac2682d3e6c61c00f7018b6adc0c" }
-zcash_keys = { git = "https://github.com/zcash/librustzcash", rev = "878db2074ae8ac2682d3e6c61c00f7018b6adc0c" }
-zcash_primitives = { git = "https://github.com/zcash/librustzcash", rev = "878db2074ae8ac2682d3e6c61c00f7018b6adc0c" }
-zcash_protocol = { git = "https://github.com/zcash/librustzcash", rev = "878db2074ae8ac2682d3e6c61c00f7018b6adc0c" }
-zcash_transparent = { git = "https://github.com/zcash/librustzcash", rev = "878db2074ae8ac2682d3e6c61c00f7018b6adc0c" }
-# Keep `orchard` aligned with the pinned PCZT/librustzcash revision.
-orchard = { git = "https://github.com/zcash/orchard", rev = "8995ee7e26f8b654a5457d05c95ee5b3132b3edd" }
-# Use the SDK rev that wraps PCZT-owned Postcard messages as opaque UR data,
-# correlates requests and results, and reports one firmware version per batch result.
-ur-registry = { git = "https://github.com/KeystoneHQ/keystone-sdk-rust.git", rev = "c2119436f5246be05b1ba877a7e6b63f51c01339" }
+# The published crate does not yet include the PCZT-owned batch messages or
+# firmware version in batch results.
+ur-registry = { git = "https://github.com/KeystoneHQ/keystone-sdk-rust.git", rev = "4131bae5407e31633c01edf9c324094aca69341a" }
diff --git a/rust/apps/zcash/Cargo.toml b/rust/apps/zcash/Cargo.toml
index 8942b91..ec589bd 100644
--- a/rust/apps/zcash/Cargo.toml
+++ b/rust/apps/zcash/Cargo.toml
@@ -27,14 +27,14 @@ zeroize = { workspace = true }
 
 [dev-dependencies]
 keystore = { path = "../../keystore" }
-pczt = { version = "0.7", default-features = false, features = ["io-finalizer", "orchard", "sapling", "transparent", "zcp-builder"] }
-zcash_primitives = { version = "0.29.0-pre.0", default-features = false, features = ["circuits", "test-dependencies", "transparent-inputs"] }
+pczt = { version = "0.8.0-rc.1", default-features = false, features = ["io-finalizer", "orchard", "sapling", "transparent", "zcp-builder"] }
+zcash_primitives = { version = "0.29.0", default-features = false, features = ["circuits", "test-dependencies", "transparent-inputs"] }
 incrementalmerkletree = { version = "0.8.2", default-features = false }
 shardtree = "0.6.2"
 # Nameable only so the transparent-only `legacy_test_support` can spell the
 # `BuildConfig::orchard_pool_bundle_type` value; orchard is already built transitively
 # via the `zcash_primitives` dev-dependency.
-orchard = { version = "0.15.0", default-features = false }
+orchard = { version = "0.15.1", default-features = false }
 
 [lints.rust]
 unexpected_cfgs = { level = "warn", check-cfg = [
diff --git a/rust/zcash_vendor/Cargo.toml b/rust/zcash_vendor/Cargo.toml
index e501be9..f4673b0 100644
--- a/rust/zcash_vendor/Cargo.toml
+++ b/rust/zcash_vendor/Cargo.toml
@@ -41,20 +41,20 @@ chacha20poly1305 = { version = "0.10.1", default-features = false, features = [
 ] }
 postcard = { version = "1.0.3", features = ["alloc"] }
 getset = { version = "0.1.3" }
-orchard = { version = "0.15.0", default-features = false, optional = true }
-pczt = { version = "0.7", default-features = false }
+orchard = { version = "0.15.1", default-features = false, optional = true }
+pczt = { version = "0.8.0-rc.1", default-features = false }
 serde = { workspace = true }
 serde_with = { version = "3.11.0", features = [
     "alloc",
     "macros",
 ], default-features = false }
-transparent = { package = "zcash_transparent", version = "0.9.0-pre.0", default-features = false, features = [
+transparent = { package = "zcash_transparent", version = "0.9.0", default-features = false, features = [
     "transparent-inputs",
 ] }
-zcash_address = { version = "0.13.0-pre.0", default-features = false }
+zcash_address = { version = "0.13.0", default-features = false }
 zcash_encoding = { version = "0.4", default-features = false }
-zcash_keys = { version = "0.15.0-pre.0", default-features = false }
-zcash_protocol = { version = "0.10.0-pre.0", default-features = false }
+zcash_keys = { version = "0.15.0", default-features = false }
+zcash_protocol = { version = "0.10.0", default-features = false }
 zip32 = { version = "0.2", default-features = false }
 rust_tools = { workspace = true }
 #zcash end
@@ -65,7 +65,7 @@ unexpected_cfgs = { level = "warn", check-cfg = [
 ] }
 
 [dev-dependencies]
-transparent = { package = "zcash_transparent", version = "0.9.0-pre.0", default-features = false, features = [
+transparent = { package = "zcash_transparent", version = "0.9.0", default-features = false, features = [
     "transparent-inputs",
     "test-dependencies",
 ] }

Risk score

Why this scored 11/100

Our methodology →

Potential impact 2/30

Exploitability 1/25

Stealth signal 1/15

Affected reach 2/15

Confidence 3/10

Evidence quality 2/5

Human-validated context

Community notes

Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.

No validated notes yet.

The AI analysis stands alone for now. Submit a note if you can add evidence or important context.

What the developer wrote

What changed, and why it matters

Security signals we found

Evidence from the diff

Changed components

Why this scored 11/100

Community notes

Related watches

Build fix (#2273)

limit file count (#2272)

Merge pull request #2268 from KeystoneHQ/regular-review-fix