CodeSampleX

Exemple

ring 0.17.14: ring

Échantillon vérifié pour cargo ring 0.17.14: ring. Le contrat s'est exécuté sur rust 1 · linux alpine/x64 · docker et a réussi.

sha256:f41652581d91853b7a319bf05e52062ef248ab3ab8f604b10147b4c48a0f117a

Ce réseau offre une seule chose : un échantillon qui compile. Il l'a exécuté dans un bac à sable et conservé le reçu signé. Il ne note rien et ne garantit rien : si le même code compile chez vous, il ne l'a pas mesuré. Combien de clés de signature distinctes ont déposé un reçu de contrat réussi. Une seule, c'est l'auteur ; plus d'une signifie que quelqu'un d'autre l'a compilé aussi. Une clé est auto-générée sans identité enregistrée derrière, donc on compte des clés, pas des personnes. MIT-0

Preuves d'exécution

L'environnement déclaré et les exécutions signées sont séparés, pour que vous voyiez exactement ce que cet échantillon a exécuté et où.

Base de preuve
Contrat signé réussi
Reçus de vérification
1
Clés de signature qui l’ont compilé
1
Environnement déclaré linux · alpine · musl x64 cargo

Environnements des exécutions de vérification

Environnement Contrat Étapes Exécution
rust 1 · linux alpine/x64 · docker ed25519:c1973797be207ac4 PASS compile:SKIPPED · contract:PASS · load:PASS · resolve:PASS
CONTAINER_RUN · cargo@1rust:1-alpine@sha256:a10e64dd139b…		 2026-09-20

Cas

HOW
Objectif
verify ring in pkg:cargo/ring@0.17.14
Paquets
Symboles
  • ring
Créé
2026-09-20T14:50:54Z

Contrat

  1. digest computes SHA-256 and SHA-512 hashes and supports multi-part context updates
  2. hmac signs and verifies HMAC-SHA256 tags rejecting corrupted messages
  3. pbkdf2 derives and verifies key material using PBKDF2-HMAC-SHA256
  4. signature generates Ed25519 key pairs and verifies valid signatures
  5. agreement performs X25519 ECDH key agreement deriving identical shared secrets
  6. aead encrypts and decrypts payloads in place with AES-256-GCM and associated data

Fichiers

  • Cargo.lock
  • Cargo.toml
  • PROMPT.md
  • csx.json
  • spec.json
  • src/lib.rs
  • test/contract.rs

Télécharger l’artefact source (tar.gz)

Code source

Cargo.lock
# This file is automatically @generated by Cargo.
# It is not intended for manual editing.
version = 4

[[package]]
name = "cc"
version = "1.4.7"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "54413ede23c2daf518f35156dfde027feb2374004d63bd497f983c8db9c0e313"
dependencies = [
 "find-msvc-tools",
 "shlex",
]

[[package]]
name = "cfg-if"
version = "1.0.5"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "4e7648175b45a9a48536d676f68d918270699102aa8dab5496df06904c914600"

[[package]]
name = "find-msvc-tools"
version = "0.1.13"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "ef25905e51abafe4dcea6c15fec58c57b601cdbd0ee53d22ea1d3016c587d39b"

[[package]]
name = "getrandom"
version = "0.2.17"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "ff2abc00be7fca6ebc474524697ae276ad847ad0a6b3faa4bcb027e9a4614ad0"
dependencies = [
 "cfg-if",
 "libc",
 "wasi",
]

[[package]]
name = "libc"
version = "0.2.189"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "3eaf3ede3fee6db1a4c2ee091bf8a8b4dccdc6d17f656fb07896ee72867612f2"

[[package]]
name = "ring"
version = "0.17.14"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "a4689e6c2294d81e88dc6261c768b63bc4fcdb852be6d1352498b114f61383b7"
dependencies = [
 "cc",
 "cfg-if",
 "getrandom",
 "libc",
 "untrusted",
 "windows-sys",
]

[[package]]
name = "sample-ring"
version = "1.0.0"
dependencies = [
 "ring",
]

[[package]]
name = "shlex"
version = "2.0.1"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "f8fadd59c855ef2080decdef8ff161eb6661b86933c9d82e5ba29dc602a55aba"

[[package]]
name = "untrusted"
version = "0.9.0"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "8ecb6da28b8a351d773b68d5825ac39017e680750f980f3a1a85cd8dd28a47c1"

[[package]]
name = "wasi"
version = "0.11.1+wasi-snapshot-preview1"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "ccf3ec651a847eb01de73ccad15eb7d99f80485de043efb2f370cd654f4ea44b"

[[package]]
name = "windows-sys"
version = "0.52.0"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "282be5f36a8ce781fad8c8ae18fa3f9beff57ec1b52cb3de0789201425d9a33d"
dependencies = [
 "windows-targets",
]

[[package]]
name = "windows-targets"
version = "0.52.6"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "9b724f72796e036ab90c1021d4780d4d3d648aca59e491e6b98e725b84e99973"
dependencies = [
 "windows_aarch64_gnullvm",
 "windows_aarch64_msvc",
 "windows_i686_gnu",
 "windows_i686_gnullvm",
 "windows_i686_msvc",
 "windows_x86_64_gnu",
 "windows_x86_64_gnullvm",
 "windows_x86_64_msvc",
]

[[package]]
name = "windows_aarch64_gnullvm"
version = "0.52.6"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "32a4622180e7a0ec044bb555404c800bc9fd9ec262ec147edd5989ccd0c02cd3"

[[package]]
name = "windows_aarch64_msvc"
version = "0.52.6"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "09ec2a7bb152e2252b53fa7803150007879548bc709c039df7627cabbd05d469"

[[package]]
name = "windows_i686_gnu"
version = "0.52.6"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "8e9b5ad5ab802e97eb8e295ac6720e509ee4c243f69d781394014ebfe8bbfa0b"

[[package]]
name = "windows_i686_gnullvm"
version = "0.52.6"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "0eee52d38c090b3caa76c563b86c3a4bd71ef1a819287c19d586d7334ae8ed66"

[[package]]
name = "windows_i686_msvc"
version = "0.52.6"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "240948bc05c5e7c6dabba28bf89d89ffce3e303022809e73deaefe4f6ec56c66"

[[package]]
name = "windows_x86_64_gnu"
version = "0.52.6"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "147a5c80aabfbf0c7d901cb5895d1de30ef2907eb21fbbab29ca94c5b08b1a78"

[[package]]
name = "windows_x86_64_gnullvm"
version = "0.52.6"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "24d5b23dc417412679681396f2b49f3de8c1473deb516bd34410872eff51ed0d"

[[package]]
name = "windows_x86_64_msvc"
version = "0.52.6"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "589f6da84c646204747d1270a2a5661ea66ed1cced2631d546fdfb155959f9ec"
Cargo.toml
[package]
name = "sample-ring"
version = "1.0.0"
edition = "2021"
publish = false

[dependencies]
ring = "=0.17.14"

[[bin]]
name = "contract"
path = "test/contract.rs"
PROMPT.md
Clean-room public code sample — generation instructions

Write a brand-new, minimal, self-contained code sample in this clean-room directory.
Do not copy, paraphrase, or reference any existing project source. Work only from this spec.

A csx.json manifest scaffold already exists. Do not recreate it from memory. Preserve its case.goal, packages and symbols; fill its empty case.contract with exact assertions and correct its environment, commands and verifierAdapter for the files you generate.

Goal: verify ring in pkg:cargo/ring@0.17.14
Kind: HOW

Use EXACTLY these public packages and versions:
  - pkg:cargo/ring@0.17.14
Demonstrate these symbols/APIs:
  - ring

Rules:
  - One focused purpose; the smallest project that proves the goal.
  - Include a contract test (test/contract.*) that runs OFFLINE and exits 0 exactly when the goal behavior works.
  - Pin every dependency with a lockfile so resolution is reproducible.
  - No secrets, credentials, or tokens. No real URLs (only example.com or localhost). No absolute paths.
  - No personal names, emails, company names, or project identifiers of any kind.
  - No binaries and no generated output (node_modules, dist, target, venv, .git, .env).
  - Keep it under 200 files and 256KB packed.
csx.json
{"case":{"caseId":"case:sha256:d3fdca46a2af43e6b50e1f0eefa47e7b1b43c80785cb4db382d340c56ca6b1d4","contract":["digest computes SHA-256 and SHA-512 hashes and supports multi-part context updates","hmac signs and verifies HMAC-SHA256 tags rejecting corrupted messages","pbkdf2 derives and verifies key material using PBKDF2-HMAC-SHA256","signature generates Ed25519 key pairs and verifies valid signatures","agreement performs X25519 ECDH key agreement deriving identical shared secrets","aead encrypts and decrypts payloads in place with AES-256-GCM and associated data"],"goal":"verify ring in pkg:cargo/ring@0.17.14","kind":"HOW","packages":["pkg:cargo/ring@0.17.14"],"schemaVersion":1,"symbols":["ring"]},"contractCommand":["cargo","run","--offline"],"environment":{"arch":"x64","distro":"alpine","ecosystem":"cargo","libc":"musl","os":"linux","packageManager":"cargo","schemaVersion":1},"license":"MIT-0","packages":["pkg:cargo/ring@0.17.14"],"schemaVersion":1,"subject":"pkg:cargo/ring@0.17.14","symbols":["ring"],"verifierAdapter":"cargo@1"}
spec.json
{
  "schemaVersion": 1,
  "goal": "verify ring in pkg:cargo/ring@0.17.14",
  "kind": "HOW",
  "packages": [
    "pkg:cargo/ring@0.17.14"
  ],
  "symbols": [
    "ring"
  ]
}
src/lib.rs
//! Clean-room verification sample for ring.

pub use ring::*;
test/contract.rs
use ring::{aead, agreement, digest, hmac, pbkdf2, rand::SecureRandom, rand::SystemRandom, signature, signature::KeyPair};
use std::num::NonZeroU32;

fn main() {
    let rng = SystemRandom::new();

    // 1. digest computes SHA-256 and SHA-512 hashes and supports multi-part context updates
    let msg = b"sample contract for ring";
    let sha256_val = digest::digest(&digest::SHA256, msg);
    assert_eq!(sha256_val.as_ref().len(), 32);

    let mut ctx = digest::Context::new(&digest::SHA256);
    ctx.update(b"sample ");
    ctx.update(b"contract for ring");
    let sha256_multi = ctx.finish();
    assert_eq!(sha256_val.as_ref(), sha256_multi.as_ref());

    let sha512_val = digest::digest(&digest::SHA512, msg);
    assert_eq!(sha512_val.as_ref().len(), 64);

    // 2. hmac signs and verifies HMAC-SHA256 tags rejecting corrupted messages
    let hmac_key = hmac::Key::new(hmac::HMAC_SHA256, b"sample-hmac-secret-key-material");
    let tag = hmac::sign(&hmac_key, msg);
    assert!(hmac::verify(&hmac_key, msg, tag.as_ref()).is_ok());
    assert!(hmac::verify(&hmac_key, b"corrupted message", tag.as_ref()).is_err());

    // 3. pbkdf2 derives and verifies key material using PBKDF2-HMAC-SHA256
    let salt = b"sample-salt-value";
    let iterations = NonZeroU32::new(100).unwrap();
    let mut derived_key = [0u8; 32];
    pbkdf2::derive(
        pbkdf2::PBKDF2_HMAC_SHA256,
        iterations,
        salt,
        b"password123",
        &mut derived_key,
    );
    assert!(pbkdf2::verify(
        pbkdf2::PBKDF2_HMAC_SHA256,
        iterations,
        salt,
        b"password123",
        &derived_key,
    ).is_ok());
    assert!(pbkdf2::verify(
        pbkdf2::PBKDF2_HMAC_SHA256,
        iterations,
        salt,
        b"wrong_password",
        &derived_key,
    ).is_err());

    // 4. signature generates Ed25519 key pairs and verifies valid signatures
    let doc_pkcs8 = signature::Ed25519KeyPair::generate_pkcs8(&rng).unwrap();
    let key_pair = signature::Ed25519KeyPair::from_pkcs8(doc_pkcs8.as_ref()).unwrap();
    let peer_public_key_bytes = key_pair.public_key().as_ref();
    let sig = key_pair.sign(msg);
    let peer_public_key = signature::UnparsedPublicKey::new(&signature::ED25519, peer_public_key_bytes);
    assert!(peer_public_key.verify(msg, sig.as_ref()).is_ok());
    assert!(peer_public_key.verify(b"different msg", sig.as_ref()).is_err());

    // 5. agreement performs X25519 ECDH key agreement deriving identical shared secrets
    let my_priv_key = agreement::EphemeralPrivateKey::generate(&agreement::X25519, &rng).unwrap();
    let my_pub_key = my_priv_key.compute_public_key().unwrap();

    let peer_priv_key = agreement::EphemeralPrivateKey::generate(&agreement::X25519, &rng).unwrap();
    let peer_pub_key = peer_priv_key.compute_public_key().unwrap();

    let peer_public_key = agreement::UnparsedPublicKey::new(&agreement::X25519, peer_pub_key.as_ref());
    let my_shared_secret = agreement::agree_ephemeral(
        my_priv_key,
        &peer_public_key,
        |key_material| key_material.to_vec(),
    ).unwrap();

    let my_pub_key_unparsed = agreement::UnparsedPublicKey::new(&agreement::X25519, my_pub_key.as_ref());
    let peer_shared_secret = agreement::agree_ephemeral(
        peer_priv_key,
        &my_pub_key_unparsed,
        |key_material| key_material.to_vec(),
    ).unwrap();

    assert_eq!(my_shared_secret, peer_shared_secret);

    // 6. aead encrypts and decrypts payloads in place with AES-256-GCM and associated data
    let mut key_bytes = [0u8; 32];
    rng.fill(&mut key_bytes).unwrap();
    let unbound_key = aead::UnboundKey::new(&aead::AES_256_GCM, &key_bytes).unwrap();
    let less_safe_key = aead::LessSafeKey::new(unbound_key);

    let nonce_bytes = [1u8; 12];
    let nonce = aead::Nonce::assume_unique_for_key(nonce_bytes);
    let mut in_out = b"secret plaintext payload".to_vec();
    let aad = aead::Aad::from(b"additional authenticated data");
    less_safe_key.seal_in_place_append_tag(nonce, aad, &mut in_out).unwrap();

    let nonce_for_open = aead::Nonce::assume_unique_for_key(nonce_bytes);
    let aad_for_open = aead::Aad::from(b"additional authenticated data");
    let decrypted = less_safe_key.open_in_place(nonce_for_open, aad_for_open, &mut in_out).unwrap();
    assert_eq!(decrypted, b"secret plaintext payload");

    println!("All ring contract assertions passed successfully.");
}

Seeder d'origine

anonyme