mirror of
https://github.com/freemkv/libfreemkv.git
synced 2026-10-07 18:13:10 +00:00
Matthew Jackson
5d8f77e049
Two problems, both invisible until the whole graph is looked at together. DEAD: num-bigint, sha2, num-traits, num-integer, cmac and cbc are declared here and referenced nowhere -- not in src, tests or benches. They were being compiled, audited and offered version bumps forever for no reason. Removing beats bumping. cbc nearly survived the sweep: a substring search for "cbc" matches 44 occurrences of ycbcr_to_rgb in the DVD subtitle decoder, so it looked used. Only a word-boundary search exposed it. SKEW: this crate was the outlier on every shared dependency -- aes 0.8, rand 0.8, base64 0.22.1 and zip 2 against 0.9 / 0.10 / 0.23 / 8 elsewhere. Cargo cannot unify across a major version, so it compiled BOTH: 32 duplicated crates in the freemkv binary's graph, including two complete AES implementations (aes 0.8 + 0.9, cipher 0.4 + 0.5), two digest stacks and two getrandom. Two crypto stacks in one product is worth removing on its own. The aes bump is an API rename -- BlockCipher-prefixed traits, Array for GenericArray -- and the obvious translation uses Array::from_slice, which the new version deprecates and clippy's -D warnings would reject. These use the From<[T; N]> conversion the crate points at instead. 3441 tests pass in debug and release. The AACS crypto here is covered by known-answer tests, so a byte-order or sizing mistake in that rename could not have passed.