auth: accept caller entropy for RSA signing

.changes/add-caller-random-rsa-signing-a1e7.md

@@ -0,0 +1,5 @@
+---
+"rscrypto" = "minor"
+---
+
+Add caller-supplied entropy APIs for RSA profile and TLS signing, a fixed-schedule batched blinding inverse, and half-width CRT assembly dispatch while preserving bounded blinding, fault checks, output cleanup, and allocation-free scratch reuse.

.config/benchmark-matrix.json

@@ -95,7 +95,7 @@
       "binary": "rsa",
       "kind": "criterion",
       "required": true,
-      "features": ["parallel", "rsa", "diag"]
+      "features": ["parallel", "rsa", "diag", "getrandom"]
     },
     "aead_diag": {
       "binary": "aead",

.config/rail.toml

@@ -1,7 +1,5 @@
-# cargo-rail config for rscrypto
-# Documentation: https://github.com/loadingalias/cargo-rail
-
-# Targets
+# Additional target-resolution and compiler-evidence views owned by
+# .config/target-matrix.json and docs/platforms.md.
 targets = [
   "aarch64-apple-darwin",
   "aarch64-pc-windows-msvc",
@@ -23,67 +21,45 @@ targets = [
 ]
 
 [unify]
-include_paths = true
 include_renamed = true
-
 strict_version_compat = true
 exact_pin_handling = "warn"
 major_version_conflict = "warn"
-preserve_features = []
-skip_undeclared_patterns = []
-
-exclude = []
-include = []
-max_backups = 2
-consumer_scope = "open" # Published library: preserve dormant public feature and dependency APIs.
-msrv_policy = { mode = "disabled" } # Root package MSRV remains authoritative in this single-crate workspace.
-
+skip_undeclared_patterns = [] # Every feature spelling is actionable in this crate.
+consumer_scope = "open" # Published library: external consumers may activate dormant public features.
+msrv_policy = { mode = "disabled" } # Cargo.toml owns the tested package MSRV.
 
 [release]
-tag_prefix = "v"
-tag_format = "{prefix}{version}" # Single crate: vX.Y.Z
-
+source = "changes"
+tag_format = "{prefix}{version}"
 sign_tags = true
-
-require_changelog_entries = false
 require_release_notes = true
-release_notes_dir = "release-notes"
 pre_1_breaking_bump = "minor"
-unconventional_commits = "allow" # Required .changes files own bumps and user-facing release notes.
-semver_check = "warn"
+# Before 1.0, reviewed minor releases may deliberately replace unstable API
+# shapes. Re-enable compiler-backed SemVer enforcement when rscrypto adopts a
+# stable compatibility contract.
+semver_check = "off"
 change_dir = ".changes"
-require_change_files = ["rscrypto"]
-remote_effects = "push" # Release automation pushes commits/tags; the repository workflow owns forge releases.
+remote_effects = "push" # The repository workflow, not Cargo Rail, owns forge release publication.
 
 [release.changelog]
 path = "CHANGELOG.md"
 relative_to = "workspace"
-entry_format = "- {scope}{breaking}{description}{prs} ({sha_link})" # Entry placeholders: scope, breaking, description, prs, sha, sha_link, type
-emoji = true # Render emoji in changelog section headers
-group_order = [] # Render reviewed .changes entries only; commit subjects are not release notes.
-fallback = "skip" # Drop commit-derived entries.
-
-[release.changelog.filters]
-skip_types = ["chore", "ci"]
-skip_scopes = []
-include_paths = [] # Optional changelog attribution include globs
-exclude_paths = [] # Optional changelog attribution exclude globs
-
 
 [change-detection]
 infrastructure = [
   ".changes/**",
   ".github/**",
   ".config/**",
+  ".cargo/**",
   "justfile",
   "Cargo.lock",
   "rust-toolchain.toml",
   "deny.toml",
   "rustfmt.toml",
-  ".cargo/config.toml",
 ]
-unknown_file_policy = "strict" # Unknown crate files build/test; unknown workspace files run infrastructure checks.
-confidence_profile = "balanced" # Planner confidence profile: strict, balanced, fast
+unknown_file_policy = "strict"
+confidence_profile = "balanced"
 
 [change-detection.custom]
 cargo_graph = [
@@ -92,12 +68,11 @@ cargo_graph = [
   "rust-toolchain.toml",
   ".cargo/**",
   ".config/rail.toml",
+  ".config/target-matrix.json",
+  ".config/toolchains.toml",
   "build.rs",
   "src/**",
   "tests/**",
   "benches/**",
   "examples/**",
 ]
-
-[run]
-default_profile = "local" # Default run profile (built-ins: local, ci, nightly)

.github/actions/setup/action.yaml

@@ -1,17 +1,13 @@
 name: Setup rscrypto Environment
 description: |
-  Install Rust toolchain, cargo tools, and configure caching.
+  Install the Rust toolchain, configure Cargo Rail compiler reuse, and install cargo tools.
   Unified host setup for GHA + runs-on.com + IBM/RISC-V runners.
 
 inputs:
   toolchain-contract:
     description: Toolchain contract to install (development, msrv, or nightly).
     required: false
     default: "development"
-  cache-key:
-    description: Suffix for the rust-cache key (workflow + target).
-    required: false
-    default: ""
   tools-mode:
     description: Tool install mode (standard, quality, release, rail, ci, supply-chain, bench, ibm, fuzz, coverage, ct-linux, minimal, none).
     required: false
@@ -20,44 +16,41 @@ inputs:
     description: Comma-separated rust toolchain components.
     required: false
     default: "clippy, rustfmt, rust-src"
-  enable-magic-cache:
-    description: Enable runs-on.com MagicCache (S3-backed). Only effective on runs-on pools declaring s3-cache extras.
+  cache-url:
+    description: Machine-owned Cargo Rail L2 URL. Empty leaves existing machine cache policy unchanged.
     required: false
-    default: "false"
-  enable-rust-cache:
-    description: Enable Swatinem/rust-cache for cargo artifacts.
+    default: ""
+  cache-mode:
+    description: Cargo Rail remote authority (read or read-write).
     required: false
-    default: "true"
+    default: "read"
+  cache-max-size:
+    description: Positive bound for the job-local verified compiler cache.
+    required: false
+    default: "10GiB"
 
 runs:
   using: composite
   steps:
-    # runs-on.com S3-backed cache intercept. No-op on non-runs-on pools.
-    - name: Setup MagicCache
-      if: inputs.enable-magic-cache == 'true'
-      uses: runs-on/action@46910bf61b41721b0579f237e186afb35477007a # v2.3.0
-
     - name: Setup Toolchain
       uses: ./.github/actions/setup-toolchain
       with:
         contract: ${{ inputs.toolchain-contract }}
         components: ${{ inputs.toolchain-components }}
 
+    - name: Setup Cargo Rail Cache
+      if: inputs.cache-url != ''
+      uses: loadingalias/cargo-rail-action/cache@47e86bde928ce420b85efa5f8d3b5feb96fd0ffc # v7.0.0
+      with:
+        version: "0.22.2"
+        checksum: required
+        url: ${{ inputs.cache-url }}
+        mode: ${{ inputs.cache-mode }}
+        max-size: ${{ inputs.cache-max-size }}
+
     - name: Install Cargo Tools
       if: inputs.tools-mode != 'none'
       shell: bash
       env:
         TOOLS_MODE: ${{ inputs.tools-mode }}
       run: scripts/ci/install-tools.sh "$TOOLS_MODE"
-
-    - name: Setup Rust Cache
-      if: inputs.enable-rust-cache == 'true'
-      uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
-      with:
-        shared-key: "rscrypto-v1-${{ inputs.cache-key }}"
-        cache-directories: ${{ inputs.tools-mode == 'rail' && 'target/cargo-rail/cache' || '' }}
-        cache-bin: false
-        cache-on-failure: true
-        # Populate cache on main, manual dispatch, and PRs (so slow platforms
-        # like IBM/RISC-V warm their cache before merge).
-        save-if: ${{ github.ref == 'refs/heads/main' || github.event_name == 'workflow_dispatch' || github.event_name == 'pull_request' }}

.github/runs-on.yml

@@ -100,7 +100,6 @@ runners:
     spot: false
     volume: 100gb:gp3
     ssh: true
-    extras: ["s3-cache"]
     tags:
       - rscrypto:ci
       - arch:x86-64
@@ -113,7 +112,6 @@ runners:
     spot: false
     volume: 100gb:gp3
     ssh: true
-    extras: ["s3-cache"]
     tags:
       - rscrypto:ci
       - arch:aarch64

.github/workflows/_ci-suite.yaml

@@ -7,10 +7,6 @@ name: _ci-suite
 on:
   workflow_call:
     inputs:
-      cache_key_prefix:
-        description: "Cache-key prefix, segregates commit/weekly caches."
-        required: true
-        type: string
       supply_chain_mode:
         description: "'light' (cargo deny check advisories) or 'full' (deny all + audit)."
         required: true
@@ -60,11 +56,8 @@ jobs:
     with:
       runner: runs-on=${{ github.run_id }}/runner=linux-x64-ci
       timeout_minutes: 30
-      cache_key: ${{ inputs.cache_key_prefix }}-quality
       tools_mode: quality
       toolchain_components: "clippy, rustfmt, rust-src"
-      enable_magic_cache: true
-      enable_rust_cache: true
       operation: quality
 
   msrv:
@@ -73,28 +66,24 @@ jobs:
     with:
       runner: runs-on=${{ github.run_id }}/runner=linux-x64-ci
       timeout_minutes: 30
-      cache_key: ${{ inputs.cache_key_prefix }}-msrv
       tools_mode: none
       toolchain_contract: msrv
       toolchain_components: ""
-      enable_magic_cache: true
-      enable_rust_cache: true
       operation: msrv
 
   cargo-graph:
     if: ${{ inputs.include_cargo_graph }}
     name: Cargo Graph Assurance
     uses: ./.github/workflows/_rust-job.yaml
     with:
-      runner: runs-on=${{ github.run_id }}/runner=linux-x64-ci
+      # PR runners are provisioned from protected main, whose pre-transition
+      # definition still enables RunsOn MagicCache until this change lands.
+      runner: ubuntu-latest
       timeout_minutes: 90
-      cache_key: ${{ inputs.cache_key_prefix }}-cargo-graph
       tools_mode: rail
       toolchain_components: "rust-src"
-      enable_magic_cache: true
-      enable_rust_cache: true
       operation: cargo-graph
-      artifact_name: cargo-graph-${{ inputs.cache_key_prefix }}
+      artifact_name: cargo-graph-${{ inputs.test_mode }}
       artifact_path: target/cargo-rail/unify-result.json
       artifact_always: true
       artifact_retention_days: ${{ inputs.artifact_retention_days }}
@@ -105,11 +94,8 @@ jobs:
     with:
       runner: runs-on=${{ github.run_id }}/runner=linux-x64-ci
       timeout_minutes: 120
-      cache_key: ${{ inputs.cache_key_prefix }}-feature-contracts
       tools_mode: minimal
       toolchain_components: "rust-src"
-      enable_magic_cache: true
-      enable_rust_cache: true
       operation: feature-contracts
 
   ci:
@@ -123,11 +109,8 @@ jobs:
     with:
       runner: ${{ matrix.target.runner }}
       timeout_minutes: 180
-      cache_key: ${{ inputs.cache_key_prefix }}-${{ matrix.target.name }}
       tools_mode: ${{ contains(matrix.target.name, 'windows-msvc') && 'none' || 'ci' }}
       toolchain_components: ${{ contains(matrix.target.name, 'windows-msvc') && 'clippy' || 'clippy, rustfmt, rust-src' }}
-      enable_magic_cache: ${{ matrix.target.type == 'runson' }}
-      enable_rust_cache: true
       operation: native
       target: ${{ matrix.target.name }}
       test_mode: ${{ inputs.test_mode }}
@@ -138,12 +121,9 @@ jobs:
     with:
       runner: ubuntu-24.04-s390x
       timeout_minutes: 120
-      cache_key: ${{ inputs.cache_key_prefix }}-ibm-s390x
       tools_mode: none
       toolchain_contract: nightly
       toolchain_components: "clippy, rustfmt"
-      enable_magic_cache: false
-      enable_rust_cache: true
       operation: native-ibm
       test_mode: ${{ inputs.test_mode }}
 
@@ -153,12 +133,9 @@ jobs:
     with:
       runner: ubuntu-24.04-ppc64le-p10
       timeout_minutes: 120
-      cache_key: ${{ inputs.cache_key_prefix }}-ibm-power10
       tools_mode: none
       toolchain_contract: nightly
       toolchain_components: "clippy, rustfmt"
-      enable_magic_cache: false
-      enable_rust_cache: true
       operation: native-ibm
       test_mode: ${{ inputs.test_mode }}
 
@@ -168,12 +145,9 @@ jobs:
     with:
       runner: runs-on=${{ github.run_id }}/runner=intel-spr
       timeout_minutes: 30
-      cache_key: ${{ inputs.cache_key_prefix }}-platform-amx-test-nodebug
       tools_mode: none
       toolchain_contract: nightly
       toolchain_components: "rustfmt"
-      enable_magic_cache: true
-      enable_rust_cache: true
       operation: platform-amx
 
   cross-targets:
@@ -182,12 +156,9 @@ jobs:
     with:
       runner: runs-on=${{ github.run_id }}/runner=linux-x64-ci
       timeout_minutes: 90
-      cache_key: ${{ inputs.cache_key_prefix }}-cross-targets
       tools_mode: none
       toolchain_contract: nightly
       toolchain_components: "clippy, rust-src"
-      enable_magic_cache: true
-      enable_rust_cache: true
       operation: cross-targets
 
   supply-chain:
@@ -196,9 +167,6 @@ jobs:
     with:
       runner: runs-on=${{ github.run_id }}/runner=linux-x64-ci
       timeout_minutes: 45
-      cache_key: ${{ inputs.cache_key_prefix }}-supply-chain
       tools_mode: supply-chain
-      enable_magic_cache: true
-      enable_rust_cache: true
       operation: supply-chain
       supply_chain_mode: ${{ inputs.supply_chain_mode }}