[wip] substitute cargo & rustc externally

.github/workflows/release.yaml

@@ -12,6 +12,7 @@ jobs:
       - nix
       - ${{ matrix.nix-system }}
     strategy:
+      fail-fast: false
       matrix:
         nix-system:
           - x86_64-linux
@@ -27,23 +28,3 @@ jobs:
           prerelease: ${{ contains(github.ref_name, 'alpha') || contains(github.ref_name, 'beta') }}
           files: |
             result/*
-
-          
-  release-darwin:
-    name: Release for x86_64-darwin
-    runs-on:
-      - macos-latest
-    steps:
-      - uses: actions/checkout@v3
-      - uses: cachix/install-nix-action@v20
-        with:
-          github_access_token: ${{ secrets.GITHUB_TOKEN }}
-      - name: Build release-package for ${{ matrix.nix-system }}
-        run: nix build .#release-package --print-build-logs
-      - name: Release
-        uses: softprops/action-gh-release@v1
-        with:
-          draft: ${{ contains(github.ref_name, 'rc') }}
-          prerelease: ${{ contains(github.ref_name, 'alpha') || contains(github.ref_name, 'beta') }}
-          files: |
-            result/*

Cargo.lock

@@ -865,7 +865,7 @@ checksum = "3582f63211428f83597b51b2ddb88e2a91a9d52d12831f9d08f5e624e8977422"
 
 [[package]]
 name = "rosenpass"
-version = "0.1.2-rc.3"
+version = "0.1.1"
 dependencies = [
  "anyhow",
  "base64",

Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "rosenpass"
-version = "0.1.2-rc.3"
+version = "0.1.1"
 authors = ["Karolin Varner <karo@cupdev.net>", "wucke13 <wucke13@gmail.com>"]
 edition = "2021"
 license = "MIT OR Apache-2.0"

flake.nix

@@ -66,9 +66,27 @@
             # given set of nixpkgs
             rpDerivation = p:
               let
-                isStatic = p.stdenv.hostPlatform.isStatic;
+                # whether we want to build a statically linked binary
+                isStatic = p.targetPlatform.isStatic;
+
+                # the rust target of `p`
+                target = p.rust.toRustTargetSpec p.targetPlatform;
+
+                # convert a string to shout case
+                shout = string: builtins.replaceStrings ["-"] ["_"] (pkgs.lib.toUpper string);
+
+                # suitable Rust toolchain
+                toolchain = with inputs.fenix.packages.${system}; combine [
+                  stable.cargo
+                  stable.rustc
+                  targets.${target}.stable.rust-std
+                ];
+                myRustPlatform = p.makeRustPlatform {
+                  cargo = toolchain;
+                  rustc = toolchain;
+                };
               in
-              p.rustPlatform.buildRustPackage {
+              myRustPlatform.buildRustPackage {
                 # metadata and source
                 pname = cargoToml.package.name;
                 version = cargoToml.package.version;
@@ -83,12 +101,17 @@
                   pkg-config # let libsodium-sys-stable find libsodium
                   removeReferencesTo
                   rustPlatform.bindgenHook # for C-bindings in the crypto libs
+                  pkgs.stdenv.cc # for Rust proc macro linking we need a non-cross compiler
                 ];
                 buildInputs = with p; [ bash libsodium ];
 
                 # otherwise pkg-config tries to link non-existent dynamic libs
                 PKG_CONFIG_ALL_STATIC = true;
 
+                CARGO_BUILD_TARGET = target;
+                # for final linking, a cross compiler needs to be used
+                "CARGO_TARGET_${shout target}_LINKER" = "${pkgs.stdenv.cc.targetPrefix}ld";
+
                 # nix defaults to building for aarch64 _without_ the armv8-a
                 # crypto extensions, but liboqs depens on these
                 preBuild =
@@ -132,15 +155,19 @@
               default = rosenpass;
               rosenpass = rpDerivation pkgs;
               rosenpass-oci-image = rosenpassOCI "rosenpass";
-              rosenpass-static = rpDerivation pkgs.pkgsStatic;
-              rosenpass-static-oci-image = rosenpassOCI "rosenpass-static";
 
               # derivation for the release
               release-package =
                 let
                   version = cargoToml.package.version;
-                  package = packages.rosenpass-static;
+                  package =
-                  oci-image = packages.rosenpass-static-oci-image;
+                    if pkgs.hostPlatform.isLinux then
+                      packages.rosenpass-static
+                    else packages.rosenpass;
+                  oci-image =
+                    if pkgs.hostPlatform.isLinux then
+                      packages.rosenpass-static-oci-image
+                    else packages.rosenpass-oci-image;
                 in
                 pkgs.runCommandNoCC "lace-result" { }
                   ''
@@ -151,7 +178,10 @@
                     cp ${oci-image} \
                       $out/rosenpass-oci-image-${system}-${version}.tar.gz
                   '';
-            };
+            } // (if pkgs.stdenv.isLinux then rec {
+              rosenpass-static = rpDerivation pkgs.pkgsStatic;
+              rosenpass-static-oci-image = rosenpassOCI "rosenpass-static";
+            } else { });
           }
         ))
 

papers/whitepaper.md

@@ -33,7 +33,7 @@ abstract: |
 Rosenpass inherits most security properties from Post-Quantum WireGuard (PQWG). The security properties mentioned here are covered by the symbolic analysis in the Rosenpass repository. 
 
 ## Secrecy
-Three key encapsulations using the keypairs `sski`/`spki`, `sskr`/`spkr`, and `eski`/`epki` provide secrecy (see Section \ref{variables} for an introduction of the variables). Their respective ciphertexts are called `scti`, `sctr`, and `ectr` and the resulting keys are called `spti`, `sptr`, `epti`. A single secure encapsulation is sufficient to provide secrecy. We use two different KEMs (Key Encapsulation Mechanisms; see section \ref{skem}): Kyber and Classic McEliece.
+Three key encapsulations using the keypairs `sski`/`spki`, `sskr`/`spkr`, and `eski`/`epki` provide secrecy (see Section \ref{variables} for an introduction of the variables). Their respective ciphertexts are called `scti`, `sctr`, and `ectr` and the resulting keys are called `spti`, `sptr`, `epti`. A single secure encapsulation is sufficient to provide secrecy. We use two different KEMs (Key Encapsulation Methods; see section \ref{skem}): Kyber and Classic McEliece.
 
 ## Authenticity