Prepare v0.11.0 release

.github/workflows/rust-tests.yml

@@ -26,10 +26,10 @@ jobs:
       - run: cargo fmt -- --check
   test-code:
     runs-on: ubuntu-latest
+    container: "nisectuni/qubip-ossl-rust-runner:latest-nix"
     permissions:
       contents: read
       statuses: read
-    container: "nisectuni/qubip-ossl-rust-runner:latest-nix"
     steps:
       - name: ⤵️ Check out code from GitHub
         uses: actions/checkout@v1
@@ -41,6 +41,53 @@ jobs:
         run: openssl version -a
       - name: "Execute cargo test"
         run: cargo test
+  test-code-pqclean:
+    runs-on: ubuntu-latest
+    container: "nisectuni/qubip-ossl-rust-runner:latest-nix"
+    defaults:
+      run:
+        shell: bash
+    permissions:
+      contents: read
+      statuses: read
+    steps:
+      - name: ⤵️ Check out code from GitHub
+        uses: actions/checkout@v1
+      - name: "Check rustc version"
+        run: rustc --version
+      - name: "Check cargo version"
+        run: cargo --version
+      - name: "Check openssl version"
+        run: openssl version -a
+      - name: "Install jaq to query Cargo.toml"
+        run: CARGO_INSTALL_ROOT=/ cargo install jaq
+      - name: "Execute cargo test selecting pqclean"
+        run: |
+          QUERY='.features.default - ["default_adapters"] + .features.default_adapters - ["mldsa_native_adapter"] + ["pqclean_adapter"] | join(",")'
+          TEST_FEATURES="$(jaq -r "$QUERY" Cargo.toml)"
+          # We must set TEST_NO_DEFAULT_FEATURES and TEST_FEATURES as inherited
+          # environment variables when running `cargo test`.
+          # Without this, the cdylib may be built with a different feature set than
+          # the one used for the tests themselves.
+          #
+          # Integration tests (the ones in `/tests/`) use a custom setup that invokes
+          # `cargo build` at the beginning of their execution to ensure the aurora
+          # cdylib is up-to-date.
+          #
+          # However, Cargo does not propagate the CLI flags of `cargo test` (such as
+          # `--no-default-features` and `--features=...`) to subprocesses.
+          # As a result, when the test binaries run and their `setup()` executes,
+          # this feature configuration is no longer visible.
+          # Consequently, the `cargo build` invoked from within the integration tests
+          # would run with default features enabled unless we explicitly forward the
+          # desired configuration via environment variables.
+          #
+          # These environment variables MUST be kept in sync with the `cargo test`
+          # CLI arguments.
+          # Since Cargo does not propagate feature flags to subprocesses, this manual
+          # forwarding is required to ensure the inner `cargo build` uses the same
+          # feature configuration.
+          TEST_NO_DEFAULT_FEATURES=1 TEST_FEATURES="$TEST_FEATURES" cargo test --no-fail-fast --no-default-features --features="${TEST_FEATURES}"
   just-list:
     runs-on: ubuntu-latest
     permissions:

.gitlab-ci.yml

@@ -29,6 +29,38 @@ test-code:
     #- cargo install cargo-tarpaulin
     #- cargo tarpaulin --ignore-tests
 
+test-code-pqclean:
+  stage: test
+  script:
+    #- CARGO_INSTALL_ROOT=/ cargo install cargo-nextest --version 0.9.100 --locked
+    - CARGO_INSTALL_ROOT=/ cargo install jaq
+    - QUERY='.features.default - ["default_adapters"] + .features.default_adapters - ["mldsa_native_adapter"] + ["pqclean_adapter"] | join(",")'
+    - TEST_FEATURES="$(jaq -r "$QUERY" Cargo.toml)"
+    - echo "TEST_FEATURES=\"${TEST_FEATURES}\"" >&2
+    # We must set TEST_NO_DEFAULT_FEATURES and TEST_FEATURES as inherited
+    # environment variables when running `cargo test`.
+    # Without this, the cdylib may be built with a different feature set than
+    # the one used for the tests themselves.
+    #
+    # Integration tests (the ones in `/tests/`) use a custom setup that invokes
+    # `cargo build` at the beginning of their execution to ensure the aurora
+    # cdylib is up-to-date.
+    #
+    # However, Cargo does not propagate the CLI flags of `cargo test` (such as
+    # `--no-default-features` and `--features=...`) to subprocesses.
+    # As a result, when the test binaries run and their `setup()` executes,
+    # this feature configuration is no longer visible.
+    # Consequently, the `cargo build` invoked from within the integration tests
+    # would run with default features enabled unless we explicitly forward the
+    # desired configuration via environment variables.
+    #
+    # These environment variables MUST be kept in sync with the `cargo test`
+    # CLI arguments.
+    # Since Cargo does not propagate feature flags to subprocesses, this manual
+    # forwarding is required to ensure the inner `cargo build` uses the same
+    # feature configuration.
+    - TEST_NO_DEFAULT_FEATURES=1 TEST_FEATURES="$TEST_FEATURES" cargo test --no-fail-fast --no-default-features --features="${TEST_FEATURES}"
+
 test-doc:
   stage: test
   script:

CHANGELOG.md

@@ -2,6 +2,70 @@
 
 All notable changes to this project will be documented in this file.
 
+## [0.11.0] - 2026-04-28
+
+### ⚠ BREAKING CHANGES
+
+- *(propquery)* `provider=aurora` is now set on all algorithms
+- *(propquery)* `x.author=QUBIP` instead of `x.author='QUBIP'`
+- *(propquery)* `aurora.adapter=<adapter>` instead of `x.qubip.adapter='<adapter>'`
+
+### 🚀 Features
+
+- *(helpers)* Add concat_cstr macro for const CStr composition
+- Allow a selection flag of 0 in decoders
+- Don't panic on wrong size in load()
+- *(pqclean)* Support decoding of `seed` and `both` private key formats for pure ML-DSA
+- *(pqclean)* Don't panic on unsupported composite private key encodings
+- *(pqclean)* Re-derive expanded key from seed and ensure it matches the decoded one
+- *(provider)* Add new mldsa-native-rs adapter
+- *(provider)* Use mldsa_native instead of pqclean among default adapters
+- *(adapters/common)* Implement TryFrom<&[u8; N]> for Signature
+- *(mldsa_native)* Implement decoding of both-seed-and-expanded DER private key format for pure MLDSA
+- *(mldsa_native)* Re-derive expanded key from seed and ensure it matches the decoded one
+- *(mldsa_native, pqclean)* Add ASN.1 definitions for composite ML-DSA keys
+- *(mldsa_native)* Implement v0.9-compatible composite ASN.1 encodings
+- *(pqclean)* Make seed optional in MLDSA and composites
+- *(pqclean)* Enable OSSL_FUNC_SIGNATURE_SIGN/VERIFY in dispatch table
+- *(rustcrypto)* Enable OSSL_FUNC_SIGNATURE_SIGN/VERIFY in dispatch table
+- *(slhdsa_c)* Enable OSSL_FUNC_SIGNATURE_SIGN/VERIFY in dispatch table
+- *(mldsa_native)* Enable OSSL_FUNC_SIGNATURE_SIGN/VERIFY in dispatch table
+
+### 🐛 Bug Fixes
+
+- We must check for NULL before `Box::from_raw`
+- *(docs)* Reference FIPS 204 tables for ML-DSA const tests
+- *(adapters/pqclean)* Report correct ed25519 backend in description string
+- *(mldsa_native)* Encode pure MLDSA private keys with correct ASNPrivateKey variant
+- *(build)* Ensure build.rs reruns on ASN.1 file changes
+
+### 🚜 Refactor
+
+- Replace LazyLock with OnceLock for CStr statics
+- *(provider)* Remove unused data field
+- Move helpers and macros to separate module
+- *(provider)* Add `provider=aurora` to property definitions
+- *(adapters)* Inherit property strings from parent modules
+- *(properties)* Remove quotes from property values
+- *(properties)* Remove x. prefix from qubip.adapter property
+- *(adapters)* Compose PROPERTY_DEFINITION with concat_cstr!
+- *(properties)* Rename qubip.adapter to aurora.adapter
+- *(all adapters)* Align common decoder and encoder logic across adapters
+
+### 🧪 Testing
+
+- *(openssl_certs)* Ensure we actually verify the self-signature
+- Optionally skip difficult-to-satisfy ML-DSA privkey decoding wycheproof tests
+- Add CLI tests for sign/verify through pkeyutl
+- Make decode tests more generic
+- Add backward-compatibility tests for aurora v0.10.0 artifacts
+- Make the old list_all_algorithms test specific for transcoders
+- Add new basic test to list provided key managers
+- Add backward-compatibility tests for aurora v0.9.0 artifacts
+- Env-based cargo flags for integration test build
+- Test also with (non-default) pqclean adapter
+
+
 ## [0.10.0] - 2025-12-17
 
 ### ⚠ BREAKING CHANGES
@@ -490,6 +554,7 @@ All notable changes to this project will be documented in this file.
 
 <!-- generated by git-cliff -->
 
+[0.11.0]: https://github.com/QUBIP/aurora/compare/v0.10.0...v0.11.0
 [0.10.0]: https://github.com/QUBIP/aurora/compare/v0.9.0...v0.10.0
 [0.9.0]: https://github.com/QUBIP/aurora/compare/v0.8.5...v0.9.0
 [0.8.5]: https://github.com/QUBIP/aurora/compare/v0.8.4...v0.8.5

Cargo.toml

@@ -1,7 +1,8 @@
 [package]
 name = "qubip_aurora"
-version = "0.10.1+dev"
+version = "0.11.1+dev"
 edition = "2021"
+rust-version = "1.85"
 description = "A framework to build OpenSSL Providers tailored for the transition to post-quantum cryptography"
 license = "Apache-2.0"
 repository = "https://github.com/QUBIP/aurora"
@@ -21,11 +22,12 @@ default = [
 ]
 default_adapters = [
   "libcrux_adapter",
-  "pqclean_adapter",
   "rustcrypto_adapter",
   "slhdsa_c_adapter",
+  "mldsa_native_adapter",
 ]
 env_logger = ["dep:env_logger"]
+skip_troublesome_wycheproof = []
 export = []
 
 # One (and not more than one!) of the _draft_N features must be enabled to support `_composite_mldsa_eddsa`!
@@ -59,6 +61,15 @@ slhdsa_c_adapter = [
   "_transcoders_deps",
   "_slhdsa",
 ]
+mldsa_native_adapter = [
+  "dep:ed25519-dalek",
+  "dep:mldsa-native-rs",
+  "dep:ml-dsa",
+  "dep:sha2",
+  "_transcoders_deps",
+  "_mldsa",
+  "_composite_mldsa_eddsa",
+]
 
 # This feature is _private_: it collects all the dependecies for transcoders
 _transcoders_deps = ["dep:pem", "dep:pkcs8", "dep:rasn"]
@@ -87,8 +98,10 @@ libcrux-kem = { version = "0.0.2-alpha.3", optional = true }
 slhdsa-c-rs = { version = "0.0.3", optional = true }
 pqcrypto-mldsa = { version = "0.1.0", optional = true }
 pqcrypto-traits = { version = "0.3.5", optional = true }
+mldsa-native-rs = { version = "0.0.1-alpha.4", optional = true }
 sha2 = { version = "0.10.9", optional = true }
 itertools = "0.14.0"
+constcat = "0.6.1"
 
 [build-dependencies]
 rasn-compiler = "0.11.0"