v1.8.1: bump version (unified release)

docs: 1.8.1 release notes
Move tests to side files
2026-10-07 18:13:11 +00:00 · 2026-10-07 03:56:41 +00:00 · 2026-10-06 20:19:21 -07:00 · 2026-10-05 20:22:40 -07:00 · 2026-10-05 02:17:02 +00:00 · 2026-10-04 18:28:24 -07:00
18 changed files with 5897 additions and 4326 deletions
@@ -1,63 +1,33 @@
+# Version updates are monthly and grouped into one PR per ecosystem.
+# Security updates are separate and run whenever an advisory is published.
 version: 2
-
-# Dependency updates land on `dev`, never on `main`.
-#
-# `main` here is a RELEASE POINTER that release.sh moves to each tag. A bot
-# commit on it would put work there that no tag contains, which is exactly the
-# state that aborted the 1.6.2 cascade at the last step -- so pointing
-# Dependabot at main would recreate that failure on a schedule.
 updates:
-  - package-ecosystem: cargo
-    directory: /
-    target-branch: dev
-    schedule:
-      interval: weekly
-    open-pull-requests-limit: 5
-    # One PR per week for the routine bumps instead of one per crate. Eight
-    # repos times a handful of crates is a volume nobody reads, and an
-    # unread PR queue is indistinguishable from no updates at all.
-    groups:
-      minor-and-patch:
-        update-types:
-          - minor
-          - patch
-    ignore:
-      # The freemkv crates depend on each other by GIT TAG, re-pinned by
-      # release.sh as part of the release commit. Dependabot cannot see that
-      # cascade, so a PR bumping one of these would fight the release process
-      # and could pin a version whose tag does not exist yet.
-      - dependency-name: freemkv-unlock
-      - dependency-name: libfreemkv
-      - dependency-name: freemkv-keysources
-      - dependency-name: freemkv-i18n
-      - dependency-name: freemkv-engine
-
-  # The workflows are now real infrastructure -- the release cascade, the
-  # cross-platform hash matrix, the disc gate -- so their actions need the same
-  # attention as the crates.
-  - package-ecosystem: github-actions
-    directory: /
-    target-branch: dev
-    schedule:
-      interval: weekly
-    open-pull-requests-limit: 5
-    groups:
-      actions:
-        update-types:
-          - minor
-          - patch
-    ignore:
-      # NOT a dependency: `dtolnay/rust-toolchain` is versioned by the RUST
-      # release it installs, and the tag we pin is the toolchain CI is pinned
-      # to on purpose -- precommit.sh runs the same one locally so a lint that
-      # passes on a developer's newer default cannot pass CI by accident.
-      #
-      # Dependabot reads those tags as semver and proposed 1.97.0 -> 1.100.0,
-      # a Rust version that does not exist. Every such PR 404s on toolchain
-      # download across all eight repos, and they regenerate weekly -- eight
-      # permanently-red PRs that promote.yml then has to special-case when it
-      # decides whether dev is green.
-      #
-      # Bumping the toolchain is a deliberate, all-eight-repos change, made by
-      # hand together with precommit.sh. There is nothing here for a bot.
-      - dependency-name: dtolnay/rust-toolchain
+- package-ecosystem: cargo
+  directory: /
+  target-branch: dev
+  schedule:
+    interval: monthly
+  open-pull-requests-limit: 5
+  groups:
+    all:
+      patterns:
+      - '*'
+  ignore:
+  - dependency-name: freemkv-unlock
+  - dependency-name: libfreemkv
+  - dependency-name: freemkv-keysources
+  - dependency-name: freemkv-i18n
+  - dependency-name: freemkv-engine
+- package-ecosystem: github-actions
+  directory: /
+  target-branch: dev
+  schedule:
+    interval: monthly
+  open-pull-requests-limit: 5
+  groups:
+    all:
+      patterns:
+      - '*'
+  ignore:
+  - dependency-name: dtolnay/rust-toolchain
+  - dependency-name: freemkv/.github*
@@ -53,7 +53,7 @@ jobs:
    outputs:
      v: ${{ steps.msrv.outputs.v }}
    steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v7
      - id: msrv
        shell: bash
        run: echo "v=$(grep -m1 '^rust-version' Cargo.toml | sed -E 's/.*\"([^\"]+)\".*/\1/')" >> "$GITHUB_OUTPUT"
@@ -67,7 +67,7 @@ jobs:
  changelog:
    runs-on: ubuntu-latest
    steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v7
      - name: Require a CHANGELOG entry for the crate version on main
        shell: bash
        run: |
@@ -88,13 +88,13 @@ jobs:
    needs: resolve-msrv
    runs-on: ubuntu-latest
    steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v7
        with:
          path: freemkv-keysources
      - uses: freemkv/.github/.github/actions/checkout-siblings@v1
        with:
          checkout: libfreemkv freemkv-unlock
-          patch: libfreemkv
+          patch: libfreemkv freemkv-unlock
          self: freemkv-keysources
      # fmt runs on the MSRV pin; clippy runs on stable so new-lint debt is a
      # blocking gate the pinned toolchain would hide. Stable is installed first
@@ -119,13 +119,13 @@ jobs:
    needs: resolve-msrv
    runs-on: ubuntu-latest
    steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v7
        with:
          path: freemkv-keysources
      - uses: freemkv/.github/.github/actions/checkout-siblings@v1
        with:
          checkout: libfreemkv freemkv-unlock
-          patch: libfreemkv
+          patch: libfreemkv freemkv-unlock
          self: freemkv-keysources
      - uses: dtolnay/rust-toolchain@master
        with:
@@ -143,19 +143,19 @@ jobs:
  deny:
    runs-on: ubuntu-latest
    steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v7
        with:
          path: freemkv-keysources
      - uses: freemkv/.github/.github/actions/checkout-siblings@v1
        with:
          checkout: libfreemkv freemkv-unlock
-          patch: libfreemkv
+          patch: libfreemkv freemkv-unlock
          self: freemkv-keysources
      - uses: dtolnay/rust-toolchain@stable
-      - uses: EmbarkStudios/cargo-deny-action@v2
-        with:
-          command: check advisories bans licenses sources
-          manifest-path: freemkv-keysources/Cargo.toml
+      - uses: taiki-e/install-action@cargo-deny
+      # Run from the repo dir so the generated .cargo/config.toml path patches apply.
+      - run: cargo deny --all-features check advisories bans licenses sources
+        working-directory: freemkv-keysources

  # This crate ships wherever freemkv and autorip ship, and it drags in all of
  # libfreemkv's platform code (SCSI transports included). Build the tests, not
@@ -176,13 +176,13 @@ jobs:
    if: github.ref_name == 'qa' || github.ref_name == 'main'
    runs-on: macos-latest
    steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v7
        with:
          path: freemkv-keysources
      - uses: freemkv/.github/.github/actions/checkout-siblings@v1
        with:
          checkout: libfreemkv freemkv-unlock
-          patch: libfreemkv
+          patch: libfreemkv freemkv-unlock
          self: freemkv-keysources
      - uses: dtolnay/rust-toolchain@master
        with:
@@ -203,13 +203,13 @@ jobs:
    needs: resolve-msrv
    runs-on: ubuntu-latest
    steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v7
        with:
          path: freemkv-keysources
      - uses: freemkv/.github/.github/actions/checkout-siblings@v1
        with:
          checkout: libfreemkv freemkv-unlock
-          patch: libfreemkv
+          patch: libfreemkv freemkv-unlock
          self: freemkv-keysources
      - uses: dtolnay/rust-toolchain@master
        with:
@@ -244,13 +244,13 @@ jobs:
    if: github.ref_name == 'qa' || github.ref_name == 'main'
    runs-on: windows-latest
    steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v7
        with:
          path: freemkv-keysources
      - uses: freemkv/.github/.github/actions/checkout-siblings@v1
        with:
          checkout: libfreemkv freemkv-unlock
-          patch: libfreemkv
+          patch: libfreemkv freemkv-unlock
          self: freemkv-keysources
      - uses: dtolnay/rust-toolchain@master
        with:
@@ -37,7 +37,7 @@ jobs:
    outputs:
      v: ${{ steps.msrv.outputs.v }}
    steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v7
      - id: msrv
        shell: bash
        run: echo "v=$(grep -m1 '^rust-version' Cargo.toml | sed -E 's/.*\"([^\"]+)\".*/\1/')" >> "$GITHUB_OUTPUT"
@@ -61,7 +61,7 @@ jobs:
    permissions:
      contents: write
    steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v7
        with:
          fetch-depth: 0
      - name: Stamp the next rc
@@ -90,13 +90,13 @@ jobs:
        os: ['ubuntu-latest', 'macos-latest']
    runs-on: ${{ matrix.os }}
    steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v7
        with:
          path: freemkv-keysources
      - uses: freemkv/.github/.github/actions/checkout-siblings@v1
        with:
          checkout: libfreemkv freemkv-unlock
-          patch: libfreemkv
+          patch: libfreemkv freemkv-unlock
          self: freemkv-keysources
      - uses: dtolnay/rust-toolchain@master
        with:
@@ -113,13 +113,13 @@ jobs:
  cross-lint:
    runs-on: ubuntu-latest
    steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v7
        with:
          path: freemkv-keysources
      - uses: freemkv/.github/.github/actions/checkout-siblings@v1
        with:
          checkout: libfreemkv freemkv-unlock
-          patch: libfreemkv
+          patch: libfreemkv freemkv-unlock
          self: freemkv-keysources
      - uses: dtolnay/rust-toolchain@stable
        with:
@@ -139,13 +139,13 @@ jobs:
    needs: resolve-msrv
    runs-on: windows-latest
    steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v7
        with:
          path: freemkv-keysources
      - uses: freemkv/.github/.github/actions/checkout-siblings@v1
        with:
          checkout: libfreemkv freemkv-unlock
-          patch: libfreemkv
+          patch: libfreemkv freemkv-unlock
          self: freemkv-keysources
      - uses: dtolnay/rust-toolchain@master
        with:
@@ -17,7 +17,7 @@ jobs:
  verify:
    runs-on: ubuntu-latest
    steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v7
      - name: Verify Cargo.toml version matches tag
        run: |
          CARGO_VER="v$(grep '^version' Cargo.toml | head -1 | sed 's/.*"\(.*\)"/\1/')"
@@ -41,7 +41,7 @@ jobs:
    needs: verify
    runs-on: ubuntu-latest
    steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v7
      - id: msrv
        shell: bash
        run: echo "v=$(grep -m1 '^rust-version' Cargo.toml | sed -E 's/.*\"([^\"]+)\".*/\1/')" >> "$GITHUB_OUTPUT"
@@ -62,7 +62,7 @@ jobs:
    needs: verify
    runs-on: ubuntu-latest
    steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v7
      - name: Create GitHub Release
        uses: softprops/action-gh-release@v3
        with:
@@ -1,5 +1,31 @@
 # Changelog

+## [1.8.1] — 2026-10-07
+
+### Changed
+
+- Unit tests live in `*_tests.rs` side files. No behaviour change.
+
+## [1.8.0] — 2026-10-05
+
+### Fixed
+
+- The online key service ignores `HTTP_PROXY`/`HTTPS_PROXY`/`ALL_PROXY`: with one set, every key lookup failed (the pinned resolver also answered the proxy's address, so the proxy request went to the key service).
+
+### Changed
+
+- `KeydbSource` hands out host certs best first, with no disc input: certs with no `Revoked in MKBv<N>` note in keydb order, then revoked ones by latest revocation. The inherent `host_certs()` and the `KeySource::host_certs` trait method both return this order; the trait ignores its `mkb` argument.
+
+### Deprecated
+
+- `KeyDb::host_certs(mkb)`: use `KeyDb::host_certs_ranked`.
+
+### Added
+
+- `KeyDb::host_certs_ranked`.
+- `check_keyserver_url` with `KeyserverUrlRejection`/`KeyserverUrlFault`: a typed Permanent vs Temporary verdict, so callers need not match `validate_keyserver_url`'s text.
+- `test-hooks` feature exposing `set_last_decode_reachability`, to test decode-verdict handling without a network.
+
 ## [1.7.7] — 2026-09-26

 ### Maintenance
@@ -31,6 +31,12 @@ version = "0.23.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "ac07cdecf99051d9a5238b80f35af32cdeba5b336e55d957b318b50137e18da5"

+[[package]]
+name = "bitflags"
+version = "2.13.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3ded4057c258ba199e2d26386d3af3780957ecaee6c4ef4041c6b4b8b97c0b06"
+
 [[package]]
 name = "block-buffer"
 version = "0.12.1"
@@ -240,6 +246,16 @@ version = "1.0.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "877a4ace8713b0bcf2a4e7eec82529c029f1d0619886d18145fea96c3ffe5c0f"

+[[package]]
+name = "errno"
+version = "0.3.14"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "39cab71617ae0d63f51a36d69f866391735b51691dbda63cf6f96d042b63efeb"
+dependencies = [
+ "libc",
+ "windows-sys 0.52.0",
+]
+
 [[package]]
 name = "find-msvc-tools"
 version = "0.1.11"
@@ -497,13 +513,22 @@ dependencies = [
 "memchr",
 "rayon",
 "roxmltree",
+ "rustix",
 "serde",
 "serde_json",
 "sha1",
+ "sha2",
+ "socket2",
 "tracing",
 "zip",
 ]

+[[package]]
+name = "linux-raw-sys"
+version = "0.12.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "32a66949e030da00e8c7d4434b251670a91556f4144941d37452769c25d58a53"
+
 [[package]]
 name = "litemap"
 version = "0.8.3"
@@ -677,7 +702,7 @@ dependencies = [
 "getrandom 0.2.17",
 "libc",
 "untrusted",
- "windows-sys",
+ "windows-sys 0.52.0",
 ]

 [[package]]
@@ -686,6 +711,19 @@ version = "0.20.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "6c20b6793b5c2fa6553b250154b78d6d0db37e72700ae35fad9387a46f487c97"

+[[package]]
+name = "rustix"
+version = "1.1.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "891efababe418670775f199f0d233d84843c227a0949a883ce15b37c78d6629d"
+dependencies = [
+ "bitflags",
+ "errno",
+ "libc",
+ "linux-raw-sys",
+ "windows-sys 0.52.0",
+]
+
 [[package]]
 name = "rustls"
 version = "0.23.45"
@@ -804,6 +842,16 @@ version = "1.16.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "b9be42f50aa861c555654aa3a37f52f4b1074bacf4e48fe0ef7fa584e80f1f0f"

+[[package]]
+name = "socket2"
+version = "0.6.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c3d1e2c7f27f8d4cb10542a02c49005dbd6e93095799d6f3be745fae9f8fedd4"
+dependencies = [
+ "libc",
+ "windows-sys 0.61.2",
+]
+
 [[package]]
 name = "stable_deref_trait"
 version = "1.2.1"
@@ -1021,6 +1069,12 @@ dependencies = [
 "rustls-pki-types",
 ]

+[[package]]
+name = "windows-link"
+version = "0.2.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f0805222e57f7521d6a62e36fa9163bc891acd422f971defe97d64e70d0a4fe5"
+
 [[package]]
 name = "windows-sys"
 version = "0.52.0"
@@ -1030,6 +1084,15 @@ dependencies = [
 "windows-targets",
 ]

+[[package]]
+name = "windows-sys"
+version = "0.61.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ae137229bcbd6cdf0f7b80a31df61766145077ddf49416a728b02cb3921ff3fc"
+dependencies = [
+ "windows-link",
+]
+
 [[package]]
 name = "windows-targets"
 version = "0.52.6"
@@ -1242,3 +1305,7 @@ version = "1.7.7"
 [[patch.unused]]
 name = "freemkv-i18n"
 version = "1.7.7"
+
+[[patch.unused]]
+name = "freemkv-keysources"
+version = "1.7.7"
@@ -1,6 +1,6 @@
 [package]
 name = "freemkv-keysources"
-version = "1.7.7"
+version = "1.8.1"
 edition = "2024"
 rust-version = "1.88"
 license = "MIT"
@@ -17,7 +17,7 @@ publish = false
 # The crate provides the `KeySource` trait + `Key`/`DiscInputs` types these impls fill.
 # libfreemkv is git-only now; the committed [patch.crates-io] below redirects this
 # bare version req to the libfreemkv git tag (local dev overrides it to a path).
-libfreemkv = "1.7"
+libfreemkv = "1.8"
 # OnlineSource: POST disc inputs + samples to a key service over HTTP.
 ureq = { version = "3", features = ["json"] }
 serde_json = "1"
@@ -30,6 +30,15 @@ zip = { version = "8", default-features = false, features = ["deflate"] }
 # key material).
 tracing = "0.1"

+[features]
+# `set_last_decode_reachability`, for consumers' tests only (enable in dev-dependencies).
+test-hooks = []
+
+[dev-dependencies]
+# `test_util` fixtures (`decrypt_unit`, …) for this crate's tests (keys-upfront
+# KU-P1). CI resolves it through the sibling path patch.
+libfreemkv = { version = "1.8", features = ["test-util"] }
+
 [profile.release]
 lto = "thin"
 codegen-units = 1
@@ -40,7 +49,8 @@ codegen-units = 1
 # overrides it with a path patch via the gitignored .cargo/config.toml (a
 # config-level [patch.crates-io] wins over this manifest one for the same crate).
 [patch.crates-io]
-libfreemkv = { git = "https://github.com/freemkv/libfreemkv", tag = "v1.7.7" }
+libfreemkv = { git = "https://github.com/freemkv/libfreemkv", tag = "v1.8.1" }
+freemkv-unlock = { git = "https://github.com/freemkv/freemkv-unlock", tag = "v1.8.1" }

 [lints.clippy]
 uninlined_format_args = "allow"
@@ -16,8 +16,11 @@ mod paths;

 pub use keydb::{KeydbSource, UpdateResult};
 pub use keydb_format::{DiscEntry, KeyDb};
+#[cfg(feature = "test-hooks")]
+pub use online::set_last_decode_reachability;
 pub use online::{
-    DecodeReachability, MIN_SAMPLE_UNITS, OnlineSource, take_last_decode_reachability,
+    DecodeReachability, KeyserverUrlFault, KeyserverUrlRejection, MIN_SAMPLE_UNITS, OnlineSource,
+    check_keyserver_url, check_keyserver_url_static, take_last_decode_reachability,
    validate_keyserver_url,
 };
 pub use paths::{default_keydb_path, existing_keydb_path, keydb_search_paths};
@@ -134,9 +137,9 @@ impl KeySource for MultiSource {
        first_non_empty(&self.sources, |s, c| s.get_fmts_indexes(c), ctx)
    }

-    /// UNION every inner source's host certs (filtered at the given MKB
-    /// generation). Without this a composed source would hide an inner source's
-    /// cert from the OEM cert-auth route — the gap this fixes.
+    /// UNION every inner source's host certs, in source order (`mkb` is passed
+    /// through unchanged). Without this a composed source would hide an inner
+    /// source's cert from the OEM cert-auth route — the gap this fixes.
    fn host_certs(&self, mkb: Option<u32>) -> Vec<libfreemkv::aacs::types::HostCert> {
        self.sources
            .iter()
@@ -147,97 +150,25 @@ impl KeySource for MultiSource {
    fn label(&self) -> &'static str {
        "multi"
    }
+
+    // KU3-6: depends on samples if ANY inner source does, so a nested
+    // sample-dependent source keeps getting the per-piece ask.
+    fn answer_depends_on_samples(&self) -> bool {
+        self.sources.iter().any(|s| s.answer_depends_on_samples())
+    }
+
+    // Same `any(inner)` rule (KU-K1 review): `resolve` retries the composition
+    // whenever any inner source's last failure was transport-class.
+    fn last_failure_was_transport(&self) -> bool {
+        self.sources.iter().any(|s| s.last_failure_was_transport())
+    }
+
+    // KU J23: any inner source that consumes the VID makes the composition one.
+    fn uses_vid(&self) -> bool {
+        self.sources.iter().any(|s| s.uses_vid())
+    }
 }

 #[cfg(test)]
-mod tests {
-    use super::*;
-    use libfreemkv::aacs::types::HostCert;
-
-    // A minimal KeySource that only supplies host certs — the sole MultiSource
-    // behaviour under test. It never resolves a unit key.
-    struct CertOnly {
-        certs: Vec<HostCert>,
-    }
-    impl KeySource for CertOnly {
-        fn get_unit_keys(&self, _ctx: &dyn ResolveCtx) -> Result<Vec<UnitKey>, libfreemkv::Error> {
-            Ok(Vec::new())
-        }
-        fn host_certs(&self, _mkb: Option<u32>) -> Vec<HostCert> {
-            self.certs.clone()
-        }
-    }
-
-    // A host cert tagged with a distinct marker byte so a returned set can be
-    // identified exactly. Synthetic bytes only; no real key material.
-    fn cert(marker: u8) -> HostCert {
-        HostCert {
-            private_key: [marker; 20],
-            certificate: vec![marker; 92],
-            private_key_v2: None,
-            certificate_v2: None,
-        }
-    }
-
-    fn boxed(certs: Vec<HostCert>) -> Box<dyn KeySource> {
-        Box::new(CertOnly { certs }) as Box<dyn KeySource>
-    }
-
-    /// `MultiSource::host_certs` must UNION every inner source's certs. Without
-    /// this a composed source hides an inner source's cert from the OEM
-    /// cert-auth route — the gap the union closes.
-    #[test]
-    fn multi_source_host_certs_unions_every_inner_source() {
-        let multi = MultiSource::new(vec![
-            boxed(vec![cert(0x01)]),
-            boxed(vec![cert(0x02), cert(0x03)]),
-        ]);
-        let mut markers: Vec<u8> = multi
-            .host_certs(Some(50))
-            .iter()
-            .map(|c| c.certificate[0])
-            .collect();
-        markers.sort_unstable();
-        assert_eq!(
-            markers,
-            vec![0x01, 0x02, 0x03],
-            "certs from every inner source must be unioned"
-        );
-    }
-
-    /// With no inner source holding a cert, the union is empty (not an error).
-    #[test]
-    fn multi_source_host_certs_empty_when_no_source_has_one() {
-        let multi = MultiSource::new(vec![boxed(vec![]), boxed(vec![])]);
-        assert!(multi.host_certs(None).is_empty());
-    }
-
-    /// The `mkb` generation must reach each inner source so its OWN revocation
-    /// filter can act; a source that drops everything at a given generation is
-    /// honoured by the union.
-    #[test]
-    fn multi_source_host_certs_passes_mkb_through_to_inner_sources() {
-        struct GenAware;
-        impl KeySource for GenAware {
-            fn get_unit_keys(
-                &self,
-                _c: &dyn ResolveCtx,
-            ) -> Result<Vec<UnitKey>, libfreemkv::Error> {
-                Ok(Vec::new())
-            }
-            fn host_certs(&self, mkb: Option<u32>) -> Vec<HostCert> {
-                match mkb {
-                    // Modelled on a cert revoked in MKBv72.
-                    Some(g) if g >= 72 => Vec::new(),
-                    _ => vec![cert(0xaa)],
-                }
-            }
-        }
-        let multi = MultiSource::new(vec![Box::new(GenAware) as Box<dyn KeySource>]);
-        assert_eq!(multi.host_certs(Some(50)).len(), 1, "usable below gen 72");
-        assert!(
-            multi.host_certs(Some(72)).is_empty(),
-            "the gen must reach the inner source's filter"
-        );
-    }
-}
+#[path = "lib_tests.rs"]
+mod tests;
@@ -0,0 +1,172 @@
+use super::*;
+use libfreemkv::aacs::types::HostCert;
+
+// A minimal KeySource that only supplies host certs — the sole MultiSource
+// behaviour under test. It never resolves a unit key.
+struct CertOnly {
+    certs: Vec<HostCert>,
+}
+impl KeySource for CertOnly {
+    fn get_unit_keys(&self, _ctx: &dyn ResolveCtx) -> Result<Vec<UnitKey>, libfreemkv::Error> {
+        Ok(Vec::new())
+    }
+    fn host_certs(&self, _mkb: Option<u32>) -> Vec<HostCert> {
+        self.certs.clone()
+    }
+}
+
+// A host cert tagged with a distinct marker byte so a returned set can be
+// identified exactly. Synthetic bytes only; no real key material.
+fn cert(marker: u8) -> HostCert {
+    HostCert {
+        private_key: [marker; 20],
+        certificate: vec![marker; 92],
+        private_key_v2: None,
+        certificate_v2: None,
+    }
+}
+
+fn boxed(certs: Vec<HostCert>) -> Box<dyn KeySource> {
+    Box::new(CertOnly { certs }) as Box<dyn KeySource>
+}
+
+/// `MultiSource::host_certs` must UNION every inner source's certs. Without
+/// this a composed source hides an inner source's cert from the OEM
+/// cert-auth route — the gap the union closes.
+#[test]
+fn multi_source_host_certs_unions_every_inner_source() {
+    let multi = MultiSource::new(vec![
+        boxed(vec![cert(0x01)]),
+        boxed(vec![cert(0x02), cert(0x03)]),
+    ]);
+    let mut markers: Vec<u8> = multi
+        .host_certs(Some(50))
+        .iter()
+        .map(|c| c.certificate[0])
+        .collect();
+    markers.sort_unstable();
+    assert_eq!(
+        markers,
+        vec![0x01, 0x02, 0x03],
+        "certs from every inner source must be unioned"
+    );
+}
+
+/// With no inner source holding a cert, the union is empty (not an error).
+#[test]
+fn multi_source_host_certs_empty_when_no_source_has_one() {
+    let multi = MultiSource::new(vec![boxed(vec![]), boxed(vec![])]);
+    assert!(multi.host_certs(None).is_empty());
+}
+
+// A source whose `answer_depends_on_samples` is fixed to the given value —
+// the only behaviour KSK2 exercises.
+struct FixedDependency(bool);
+impl KeySource for FixedDependency {
+    fn get_unit_keys(&self, _ctx: &dyn ResolveCtx) -> Result<Vec<UnitKey>, libfreemkv::Error> {
+        Ok(Vec::new())
+    }
+    fn answer_depends_on_samples(&self) -> bool {
+        self.0
+    }
+}
+
+// KSK2: `MultiSource::answer_depends_on_samples` is `any(inner)`, so nesting
+// a sample-dependent online source under a sample-independent keydb still
+// gets the per-piece ask (`resolve` must not treat the pair as keydb-only).
+#[test]
+fn multi_source_answer_depends_on_samples_is_any_inner() {
+    let all_independent = MultiSource::new(vec![
+        Box::new(FixedDependency(false)) as Box<dyn KeySource>,
+        Box::new(FixedDependency(false)) as Box<dyn KeySource>,
+    ]);
+    assert!(!all_independent.answer_depends_on_samples());
+
+    let keydb_then_online = MultiSource::new(vec![
+        Box::new(FixedDependency(false)) as Box<dyn KeySource>,
+        Box::new(FixedDependency(true)) as Box<dyn KeySource>,
+    ]);
+    assert!(keydb_then_online.answer_depends_on_samples());
+}
+
+// A source whose `uses_vid` is fixed to the given value.
+struct FixedVid(bool);
+impl KeySource for FixedVid {
+    fn get_unit_keys(&self, _ctx: &dyn ResolveCtx) -> Result<Vec<UnitKey>, libfreemkv::Error> {
+        Ok(Vec::new())
+    }
+    fn uses_vid(&self) -> bool {
+        self.0
+    }
+}
+
+// KU J23: like `answer_depends_on_samples`, a composed source uses the VID if any
+// inner one does, so a nested online source still makes a Missing piece VID-derivable.
+#[test]
+fn multi_source_uses_vid_is_any_inner() {
+    let neither = MultiSource::new(vec![
+        Box::new(FixedVid(false)) as Box<dyn KeySource>,
+        Box::new(FixedVid(false)) as Box<dyn KeySource>,
+    ]);
+    assert!(!neither.uses_vid());
+    let keydb_then_online = MultiSource::new(vec![
+        Box::new(FixedVid(false)) as Box<dyn KeySource>,
+        Box::new(FixedVid(true)) as Box<dyn KeySource>,
+    ]);
+    assert!(keydb_then_online.uses_vid());
+}
+
+// A source whose `last_failure_was_transport` is fixed to the given value.
+struct FixedTransport(bool);
+impl KeySource for FixedTransport {
+    fn get_unit_keys(&self, _ctx: &dyn ResolveCtx) -> Result<Vec<UnitKey>, libfreemkv::Error> {
+        Ok(Vec::new())
+    }
+    fn last_failure_was_transport(&self) -> bool {
+        self.0
+    }
+}
+
+// For consistency with `answer_depends_on_samples` (KU3-6): a composed
+// source's last-failure verdict is `any(inner)` too, so `resolve` retries
+// the composition whenever ANY inner source's last failure was transport.
+#[test]
+fn multi_source_last_failure_was_transport_is_any_inner() {
+    let none_transport = MultiSource::new(vec![
+        Box::new(FixedTransport(false)) as Box<dyn KeySource>,
+        Box::new(FixedTransport(false)) as Box<dyn KeySource>,
+    ]);
+    assert!(!none_transport.last_failure_was_transport());
+
+    let one_transport = MultiSource::new(vec![
+        Box::new(FixedTransport(false)) as Box<dyn KeySource>,
+        Box::new(FixedTransport(true)) as Box<dyn KeySource>,
+    ]);
+    assert!(one_transport.last_failure_was_transport());
+}
+
+/// The `mkb` generation must reach each inner source so its OWN revocation
+/// filter can act; a source that drops everything at a given generation is
+/// honoured by the union.
+#[test]
+fn multi_source_host_certs_passes_mkb_through_to_inner_sources() {
+    struct GenAware;
+    impl KeySource for GenAware {
+        fn get_unit_keys(&self, _c: &dyn ResolveCtx) -> Result<Vec<UnitKey>, libfreemkv::Error> {
+            Ok(Vec::new())
+        }
+        fn host_certs(&self, mkb: Option<u32>) -> Vec<HostCert> {
+            match mkb {
+                // Modelled on a cert revoked in MKBv72.
+                Some(g) if g >= 72 => Vec::new(),
+                _ => vec![cert(0xaa)],
+            }
+        }
+    }
+    let multi = MultiSource::new(vec![Box::new(GenAware) as Box<dyn KeySource>]);
+    assert_eq!(multi.host_certs(Some(50)).len(), 1, "usable below gen 72");
+    assert!(
+        multi.host_certs(Some(72)).is_empty(),
+        "the gen must reach the inner source's filter"
+    );
+}
@@ -46,45 +46,5 @@ pub fn default_keydb_path() -> Option<PathBuf> {
 }

 #[cfg(test)]
-mod tests {
-    use super::*;
-
-    /// The expected exe-local keydb path, computed the same way the code does.
-    /// Under `cargo test`, `current_exe()` is the test binary under `target/…`.
-    fn expected_local() -> Option<PathBuf> {
-        std::env::current_exe()
-            .ok()
-            .and_then(|exe| exe.parent().map(|dir| dir.join("keydb.cfg")))
-    }
-
-    #[test]
-    fn search_paths_is_exactly_exe_local_keydb() {
-        let paths = keydb_search_paths();
-        match expected_local() {
-            Some(expected) => {
-                assert_eq!(
-                    paths,
-                    vec![expected],
-                    "search list must be exactly [<exe dir>/keydb.cfg]"
-                );
-            }
-            None => {
-                // No exe dir available → empty, no OS fallback (local only).
-                assert!(
-                    paths.is_empty(),
-                    "no exe dir means an empty search list, never an OS fallback"
-                );
-            }
-        }
-    }
-
-    #[test]
-    fn default_path_matches_search_head() {
-        // The write default is the single search entry, or None if unavailable.
-        assert_eq!(default_keydb_path(), expected_local());
-        assert_eq!(
-            default_keydb_path(),
-            keydb_search_paths().into_iter().next()
-        );
-    }
-}
+#[path = "paths_tests.rs"]
+mod tests;
@@ -0,0 +1,40 @@
+use super::*;
+
+/// The expected exe-local keydb path, computed the same way the code does.
+/// Under `cargo test`, `current_exe()` is the test binary under `target/…`.
+fn expected_local() -> Option<PathBuf> {
+    std::env::current_exe()
+        .ok()
+        .and_then(|exe| exe.parent().map(|dir| dir.join("keydb.cfg")))
+}
+
+#[test]
+fn search_paths_is_exactly_exe_local_keydb() {
+    let paths = keydb_search_paths();
+    match expected_local() {
+        Some(expected) => {
+            assert_eq!(
+                paths,
+                vec![expected],
+                "search list must be exactly [<exe dir>/keydb.cfg]"
+            );
+        }
+        None => {
+            // No exe dir available → empty, no OS fallback (local only).
+            assert!(
+                paths.is_empty(),
+                "no exe dir means an empty search list, never an OS fallback"
+            );
+        }
+    }
+}
+
+#[test]
+fn default_path_matches_search_head() {
+    // The write default is the single search entry, or None if unavailable.
+    assert_eq!(default_keydb_path(), expected_local());
+    assert_eq!(
+        default_keydb_path(),
+        keydb_search_paths().into_iter().next()
+    );
+}
@@ -138,7 +138,7 @@ fn keydb_source_label_is_keydb() {
    assert_eq!(KeydbSource::new("/nonexistent/keydb.cfg").label(), "keydb");
 }

-// ── KeydbSource: MKB-aware host-cert serving from a file ────────────────────
+// ── KeydbSource: host-cert serving from a file ──────────────────────────────

 #[test]
 fn keydb_source_serves_host_cert_from_hc_row() {
@@ -152,14 +152,13 @@ fn keydb_source_serves_host_cert_from_hc_row() {
    let path = s.write("keydb.cfg", &line);

    let src = KeydbSource::new(&path);
-    // Inherent (no-MKB, scan-options) form.
+    // Inherent (scan-options) form.
    assert_eq!(
        src.host_certs().len(),
        1,
        "inherent host_certs sees the HC row"
    );
-    // Trait form now wires the MKB generation through (no revocation annotation
-    // → always returned).
+    // Trait form: `mkb` is ignored; the ranked list is returned.
    let via_trait = KeySource::host_certs(&src, Some(70));
    assert_eq!(via_trait.len(), 1, "trait host_certs sees the HC row");
    assert_eq!(via_trait[0].certificate.len(), 92);
@@ -229,13 +228,14 @@ fn online_source_metadata() {
 }

 #[test]
-fn validate_keyserver_url_gates_scheme_and_ssrf() {
+fn validate_keyserver_url_gates_scheme_and_allows_lan() {
    assert!(validate_keyserver_url("https://8.8.8.8/keys").is_ok());
+    // Home app: LAN/loopback/link-local hosts pass; cleartext http and invalid addresses do not.
+    assert!(validate_keyserver_url("https://127.0.0.1/keys").is_ok());
+    assert!(validate_keyserver_url("https://169.254.1.5/keys").is_ok());
+    assert!(validate_keyserver_url("https://[::1]:9000/keys").is_ok());
    assert!(validate_keyserver_url("http://127.0.0.1/keys").is_err());
-    // SSRF blocking is IP-based, not scheme-gated: https://<private-IP> is rejected too.
-    assert!(validate_keyserver_url("https://127.0.0.1/keys").is_err());
-    assert!(validate_keyserver_url("http://169.254.169.254/latest/meta-data/").is_err());
-    assert!(validate_keyserver_url("http://[::1]:9000/keys").is_err());
+    assert!(validate_keyserver_url("https://0.0.0.0/keys").is_err());
    assert!(validate_keyserver_url("ftp://example.com/keys").is_err());
    assert!(validate_keyserver_url("").is_err());
 }
Author	SHA1	Message	Date
Matthew Jackson	bd07927292	v1.8.1: bump version (unified release)	2026-10-07 03:56:41 +00:00
Matthew Jackson	49348eab2d	docs: 1.8.1 release notes	2026-10-06 20:19:21 -07:00
Matthew Jackson	36e9d93525	Move tests to side files	2026-10-05 20:22:40 -07:00
Matthew Jackson	d2f6bbd272	v1.8.0: bump version (unified release)	2026-10-05 02:17:02 +00:00
Matthew Jackson	8c2d9be19a	changelog: 1.8.0 release notes	2026-10-04 18:28:24 -07:00
Matthew Jackson	473f629d13	ci: monthly grouped dependabot; actions/checkout 7 Dependabot runs monthly with grouped version updates. actions/checkout 5 -> 7 in ci, qa and release (#13).	2026-10-03 11:16:01 -07:00
Matthew Jackson	1662345b7e	online: halt and liveness wiring, forensic fallback, LAN key-service hosts The query worker honours ctx.halt() and reports liveness (following libfreemkv's Progress -> Liveness rename). A definitive key-service miss allows the forensic phase fallback. LAN, loopback and link-local hosts are allowed, vetted with libfreemkv's is_blocked_ip. CI path-patches freemkv-unlock and runs cargo-deny from the repo dir; Stop tests use idle bounds instead of tight wall-clock limits.	2026-10-01 18:06:06 -07:00
Matthew Jackson	0ec14fc338	keysources: sources report VID use, sample dependence and transport failures keydb and MultiSource say whether an answer depends on samples; online failures are classed as transport or not without erasing the reachability slot; OnlineSource and MultiSource report uses_vid, and partial stored keys plus a Km still report NoVid. Factory builds get a DNS-free key-service URL check. Tests decrypt through libfreemkv's test_util.	2026-09-28 07:18:27 -07:00
Matthew Jackson	520df9ebe3	online: stall-only key-service timeouts; a stopped query sends nothing Key-service timeouts measure stalls rather than totals, and a Stop ends a query mid-flight. A query stopped before it starts sends nothing, builds no body and reads no disc material.	2026-09-27 23:50:33 -07:00
Matthew Jackson	5bf4afce0b	online, keydb: no env proxy; typed keyserver URL verdict; host certs best first The key service never uses an environment proxy: it was resolved to the service's pinned address, so every lookup failed. Keyserver URLs get a typed verdict, and a test-hooks feature lets consumers' tests set the last reachability. keydb hands out host certs best first, with no disc input.	2026-09-27 17:24:04 -07:00