Jay Lorch
586d631f09
Got cargo build working
2026-03-03 16:46:09 -08:00
Jay Lorch
5819992d17
More progress toward cargo build
2026-03-03 16:44:31 -08:00
Jay Lorch
90894aa8e1
Progress to cargo build success
2026-03-03 16:35:05 -08:00
Jay Lorch
1f2a2ecb41
More specs for Number
2026-03-03 16:20:59 -08:00
Jay Lorch
ba987998c4
More Number proofs
2026-03-03 15:58:36 -08:00
Jay Lorch
c3813c8876
Avoid some build errors
2026-03-03 15:16:35 -08:00
Jay Lorch
6ab452989f
Proofs about some float operations
2026-03-03 14:43:45 -08:00
Jay Lorch
4865364b48
Verus specs for BigNum, Number
2026-02-27 15:52:00 -08:00
Jay Lorch
156772c523
Add Verus dependencies
2026-02-17 13:25:11 -08:00
dependabot[bot]
8814eda0ae
Bump the per-dependency group with 1 update ( #587 )
...
Bumps Microsoft.Build.NoTargets from 3.7.56 to 3.7.134
---
updated-dependencies:
- dependency-name: Microsoft.Build.NoTargets
dependency-version: 3.7.134
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: per-dependency
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-02-12 16:47:12 -06:00
dependabot[bot]
b4a69a13ba
build(deps): bump the per-dependency group ( #585 )
...
---
updated-dependencies:
- dependency-name: magnus
dependency-version: 0.8.2
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: per-dependency
- dependency-name: regorus
dependency-version: 0.9.1
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: per-dependency
- dependency-name: serde_magnus
dependency-version: 0.11.0
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: per-dependency
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-02-12 09:53:36 -06:00
dependabot[bot]
e83a47497a
build(deps): bump the per-dependency group ( #586 )
...
Bumps the per-dependency group in /bindings/ruby with 7 updates:
| Package | From | To |
| --- | --- | --- |
| [minitest](https://github.com/minitest/minitest ) | `5.25.4` | `6.0.1` |
| [rake](https://github.com/ruby/rake ) | `13.2.1` | `13.3.1` |
| [rake-compiler](https://github.com/rake-compiler/rake-compiler ) | `1.2.9` | `1.3.1` |
| [rake-compiler-dock](https://github.com/rake-compiler/rake-compiler-dock ) | `1.9.1` | `1.11.0` |
| [rubocop](https://github.com/rubocop/rubocop ) | `1.73.2` | `1.84.1` |
| [rubocop-minitest](https://github.com/rubocop/rubocop-minitest ) | `0.37.1` | `0.38.2` |
| [rb_sys](https://github.com/oxidize-rb/rb-sys ) | `0.9.111` | `0.9.124` |
Updates `minitest` from 5.25.4 to 6.0.1
- [Changelog](https://github.com/minitest/minitest/blob/master/History.rdoc )
- [Commits](https://github.com/minitest/minitest/compare/v5.25.4...v6.0.1 )
Updates `rake` from 13.2.1 to 13.3.1
- [Release notes](https://github.com/ruby/rake/releases )
- [Changelog](https://github.com/ruby/rake/blob/master/History.rdoc )
- [Commits](https://github.com/ruby/rake/compare/v13.2.1...v13.3.1 )
Updates `rake-compiler` from 1.2.9 to 1.3.1
- [Release notes](https://github.com/rake-compiler/rake-compiler/releases )
- [Changelog](https://github.com/rake-compiler/rake-compiler/blob/master/History.md )
- [Commits](https://github.com/rake-compiler/rake-compiler/compare/v1.2.9...v1.3.1 )
Updates `rake-compiler-dock` from 1.9.1 to 1.11.0
- [Release notes](https://github.com/rake-compiler/rake-compiler-dock/releases )
- [Changelog](https://github.com/rake-compiler/rake-compiler-dock/blob/main/CHANGELOG.md )
- [Commits](https://github.com/rake-compiler/rake-compiler-dock/compare/v1.9.1...v1.11.0 )
Updates `rubocop` from 1.73.2 to 1.84.1
- [Release notes](https://github.com/rubocop/rubocop/releases )
- [Changelog](https://github.com/rubocop/rubocop/blob/master/CHANGELOG.md )
- [Commits](https://github.com/rubocop/rubocop/compare/v1.73.2...v1.84.1 )
Updates `rubocop-minitest` from 0.37.1 to 0.38.2
- [Release notes](https://github.com/rubocop/rubocop-minitest/releases )
- [Changelog](https://github.com/rubocop/rubocop-minitest/blob/master/CHANGELOG.md )
- [Commits](https://github.com/rubocop/rubocop-minitest/compare/v0.37.1...v0.38.2 )
Updates `rb_sys` from 0.9.111 to 0.9.124
- [Release notes](https://github.com/oxidize-rb/rb-sys/releases )
- [Commits](https://github.com/oxidize-rb/rb-sys/compare/v0.9.111...v0.9.124 )
---
updated-dependencies:
- dependency-name: minitest
dependency-version: 6.0.1
dependency-type: direct:production
update-type: version-update:semver-major
dependency-group: per-dependency
- dependency-name: rake
dependency-version: 13.3.1
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: per-dependency
- dependency-name: rake-compiler
dependency-version: 1.3.1
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: per-dependency
- dependency-name: rake-compiler-dock
dependency-version: 1.11.0
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: per-dependency
- dependency-name: rubocop
dependency-version: 1.84.1
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: per-dependency
- dependency-name: rubocop-minitest
dependency-version: 0.38.2
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: per-dependency
- dependency-name: rb_sys
dependency-version: 0.9.124
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: per-dependency
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-02-12 09:53:00 -06:00
dependabot[bot]
241c1d445b
build(deps-dev): bump the per-dependency group ( #583 )
...
Bumps the per-dependency group in /bindings/java with 6 updates:
| Package | From | To |
| --- | --- | --- |
| [junit:junit](https://github.com/junit-team/junit4 ) | `3.8.1` | `4.13.2` |
| [com.google.code.gson:gson](https://github.com/google/gson ) | `2.10.1` | `2.13.2` |
| [org.codehaus.mojo:exec-maven-plugin](https://github.com/mojohaus/exec-maven-plugin ) | `3.1.0` | `3.6.3` |
| [org.apache.maven.plugins:maven-surefire-plugin](https://github.com/apache/maven-surefire ) | `3.2.5` | `3.5.4` |
| [org.apache.maven.plugins:maven-javadoc-plugin](https://github.com/apache/maven-javadoc-plugin ) | `3.6.3` | `3.12.0` |
| [org.apache.maven.plugins:maven-source-plugin](https://github.com/apache/maven-source-plugin ) | `3.3.0` | `3.4.0` |
Updates `junit:junit` from 3.8.1 to 4.13.2
- [Release notes](https://github.com/junit-team/junit4/releases )
- [Changelog](https://github.com/junit-team/junit4/blob/main/doc/ReleaseNotes4.13.2.md )
- [Commits](https://github.com/junit-team/junit4/commits/r4.13.2 )
Updates `com.google.code.gson:gson` from 2.10.1 to 2.13.2
- [Release notes](https://github.com/google/gson/releases )
- [Changelog](https://github.com/google/gson/blob/main/CHANGELOG.md )
- [Commits](https://github.com/google/gson/compare/gson-parent-2.10.1...gson-parent-2.13.2 )
Updates `org.codehaus.mojo:exec-maven-plugin` from 3.1.0 to 3.6.3
- [Release notes](https://github.com/mojohaus/exec-maven-plugin/releases )
- [Commits](https://github.com/mojohaus/exec-maven-plugin/compare/exec-maven-plugin-3.1.0...3.6.3 )
Updates `org.apache.maven.plugins:maven-surefire-plugin` from 3.2.5 to 3.5.4
- [Release notes](https://github.com/apache/maven-surefire/releases )
- [Commits](https://github.com/apache/maven-surefire/compare/surefire-3.2.5...surefire-3.5.4 )
Updates `org.apache.maven.plugins:maven-javadoc-plugin` from 3.6.3 to 3.12.0
- [Release notes](https://github.com/apache/maven-javadoc-plugin/releases )
- [Commits](https://github.com/apache/maven-javadoc-plugin/compare/maven-javadoc-plugin-3.6.3...maven-javadoc-plugin-3.12.0 )
Updates `org.apache.maven.plugins:maven-source-plugin` from 3.3.0 to 3.4.0
- [Release notes](https://github.com/apache/maven-source-plugin/releases )
- [Commits](https://github.com/apache/maven-source-plugin/compare/maven-source-plugin-3.3.0...maven-source-plugin-3.4.0 )
---
updated-dependencies:
- dependency-name: junit:junit
dependency-version: 4.13.2
dependency-type: direct:development
update-type: version-update:semver-major
dependency-group: per-dependency
- dependency-name: com.google.code.gson:gson
dependency-version: 2.13.2
dependency-type: direct:development
update-type: version-update:semver-minor
dependency-group: per-dependency
- dependency-name: org.codehaus.mojo:exec-maven-plugin
dependency-version: 3.6.3
dependency-type: direct:development
update-type: version-update:semver-minor
dependency-group: per-dependency
- dependency-name: org.apache.maven.plugins:maven-surefire-plugin
dependency-version: 3.5.4
dependency-type: direct:development
update-type: version-update:semver-minor
dependency-group: per-dependency
- dependency-name: org.apache.maven.plugins:maven-javadoc-plugin
dependency-version: 3.12.0
dependency-type: direct:development
update-type: version-update:semver-minor
dependency-group: per-dependency
- dependency-name: org.apache.maven.plugins:maven-source-plugin
dependency-version: 3.4.0
dependency-type: direct:development
update-type: version-update:semver-minor
dependency-group: per-dependency
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-02-12 09:46:33 -06:00
dependabot[bot]
4054d1b6b6
build(deps): bump the per-dependency group with 12 updates ( #593 )
...
Bumps the per-dependency group with 12 updates:
| Package | From | To |
| --- | --- | --- |
| [actions/checkout](https://github.com/actions/checkout ) | `4.3.1` | `6.0.2` |
| [actions/setup-python](https://github.com/actions/setup-python ) | `5.6.0` | `6.2.0` |
| [actions/setup-java](https://github.com/actions/setup-java ) | `4.8.0` | `5.2.0` |
| [actions/setup-go](https://github.com/actions/setup-go ) | `5.1.0` | `6.2.0` |
| [actions/setup-dotnet](https://github.com/actions/setup-dotnet ) | `4.1.0` | `5.1.0` |
| [actions/setup-node](https://github.com/actions/setup-node ) | `4.4.0` | `6.2.0` |
| [github/codeql-action](https://github.com/github/codeql-action ) | `3.32.2` | `4.32.2` |
| [actions/upload-artifact](https://github.com/actions/upload-artifact ) | `4.6.2` | `6.0.0` |
| [actions/download-artifact](https://github.com/actions/download-artifact ) | `5.0.0` | `7.0.0` |
| [PyO3/maturin-action](https://github.com/pyo3/maturin-action ) | `63b75c597b83e247fbf4fb7719801cc4220ae9f3` | `b1bd829e37fef14c63f19162034228a2f3dc1021` |
| [MarcoIeni/release-plz-action](https://github.com/marcoieni/release-plz-action ) | `0.5.108` | `0.5.126` |
| [oxidize-rb/actions](https://github.com/oxidize-rb/actions ) | `1.2.6` | `1.4.4` |
Updates `actions/checkout` from 4.3.1 to 6.0.2
- [Release notes](https://github.com/actions/checkout/releases )
- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md )
- [Commits](34e114876b...de0fac2e45https://github.com/actions/setup-python/releases )
- [Commits](a26af69be9...a309ff8b42https://github.com/actions/setup-java/releases )
- [Commits](https://github.com/actions/setup-java/compare/v4.8.0...be666c2fcd27ec809703dec50e508c2fdc7f6654 )
Updates `actions/setup-go` from 5.1.0 to 6.2.0
- [Release notes](https://github.com/actions/setup-go/releases )
- [Commits](https://github.com/actions/setup-go/compare/v5.1.0...7a3fe6cf4cb3a834922a1244abfce67bcef6a0c5 )
Updates `actions/setup-dotnet` from 4.1.0 to 5.1.0
- [Release notes](https://github.com/actions/setup-dotnet/releases )
- [Commits](https://github.com/actions/setup-dotnet/compare/v4.1.0...baa11fbfe1d6520db94683bd5c7a3818018e4309 )
Updates `actions/setup-node` from 4.4.0 to 6.2.0
- [Release notes](https://github.com/actions/setup-node/releases )
- [Commits](49933ea528...6044e13b5dhttps://github.com/github/codeql-action/releases )
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md )
- [Commits](https://github.com/github/codeql-action/compare/v3.32.2...45cbd0c69e560cd9e7cd7f8c32362050c9b7ded2 )
Updates `actions/upload-artifact` from 4.6.2 to 6.0.0
- [Release notes](https://github.com/actions/upload-artifact/releases )
- [Commits](ea165f8d65...b7c566a772https://github.com/actions/download-artifact/releases )
- [Commits](634f93cb29...37930b1c2ahttps://github.com/pyo3/maturin-action/releases )
- [Commits](63b75c597b...b1bd829e37https://github.com/marcoieni/release-plz-action/releases )
- [Commits](8724d33cd9...52440b50d3https://github.com/oxidize-rb/actions/releases )
- [Commits](7ca44a16e2...e5f9a49a78support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-02-12 06:30:19 -06:00
Anand Krishnamoorthi
8f7ca44bdf
chore(dependabot): expand coverage and pin workflows ( #579 )
...
- Expand dependabot coverage across Rust subcrates and other ecosystems.
- Group updates per dependency and ignore vendored mimalloc crates.
- Pin GitHub Actions to exact SHAs in existing workflows.
2026-02-11 17:43:48 -06:00
Anand Krishnamoorthi
96360fa9d8
fix(bindings): add SafeHandleWrapper + memory growth checks; bump 0.9.1 ( #571 )
...
- Introduce SafeHandleWrapper with gating, short drain wait, and deferred release on last in-flight exit.
- Wire Engine/Program/Rvm/CompiledPolicy to wrapper (centralized handle use, interop helper).
- Add C# memory growth tests (using/finalizer paths) and extend xtask C# runner options.
- Add pooled marshalling utilities, ResultHelpers, and API cleanups; update versions/changelog.
Fixes #570 . Closes #554
Signed-off-by: Anand Krishnamoorthi <anakrish@microsoft.com >
2026-02-09 12:22:05 -06:00
Anand Krishnamoorthi
455d2aa588
chore(nuget): Add support for macosx ( #553 )
...
Additionally
- Include more metadata in nuget package
- Also generate snupkg for native symbols.
We intentionally don't add the symbols for native rust shared library
to the nuget package since that could increase the size of the nuget.
We will revisit that later.
- update licenses of all the bindings.
closes #551
Signed-off-by: Anand Krishnamoorthi <anakrish@microsoft.com >
2026-02-03 00:09:52 +05:30
Elijah Koulaxis
0e5fe9b9ac
feat: add tests for number semantics ( #555 )
2026-01-31 07:27:51 +05:30
Anand Krishnamoorthi
0e9e34a519
chore: Gate exports using allocator-limits feature ( #564 )
...
This is needed to publish regorus-mimalloc
Signed-off-by: Anand Krishnamoorthi <anakrish@microsoft.com >
2026-01-30 23:56:29 +05:30
Anand Krishnamoorthi
3f7a5496dc
feat(bindings)!: add RVM/Program support across FFI and language bindings ( #565 )
...
- FFI: add RVM/Program APIs, execution state accessors, HostAwait handling, and buffer/result helpers in rvm.rs, common.rs, engine.rs.
- Compiler: emit HostAwait for __builtin_host_await in function_calls.rs.
- RVM tests: add HostAwait regression cases and extend harness for suspend/resume responses in host_await.yaml and mod.rs.
- C/C++: add RVM tests/examples and wrapper updates in rvm_tests.c, rvm_tests.cpp, regorus.hpp, plus CMake wiring.
- C#: add Program/Rvm bindings, SafeHandle/PInvoke, tests, and example usage in Regorus, RvmProgramTests.cs, Program.cs, and README updates.
- Go: add Program/Rvm bindings, tests, and examples in rvm.go, rvm_test.go, main.go.
- Java: add Program/Rvm bindings, JNI glue, and examples in lib.rs, regorus, Test.java.
- Python: add Program/Rvm bindings and examples in lib.rs, test.py.
- WASM: add Program/Rvm bindings and examples in lib.rs, test.js.
- Tooling: wire binding tests in xtask and ignore generated Java artifacts in .gitignore.
Signed-off-by: Anand Krishnamoorthi <anakrish@microsoft.com >
2026-01-30 23:55:31 +05:30
Anand Krishnamoorthi
0316ccd90c
chore(release): publish vendored mimalloc crates ( #563 )
...
- Prefix regorus- to mimalloc crates and add MIT licenses
- alias dependencies to avoid code changes
- add versions and release-plz publish entries
- update Cargo.lock files for new crate names
Signed-off-by: Anand Krishnamoorthi <anakrish@microsoft.com >
2026-01-30 09:03:02 +05:30
Anand Krishnamoorthi
10eebfe54c
test(rvm): Move vm execution limit tests to a separate test to avoid flakiness ( #558 )
...
Having a separate integration test allows the execution tests to freely
change the global fallback limits without affecting other tests.
also ask release-plz to ignore xtask package
Signed-off-by: Anand Krishnamoorthi <anakrish@microsoft.com >
2026-01-29 04:15:33 +05:30
Anand Krishnamoorthi
e688806ca0
chore: Keep regorus and binding versions in sync ( #552 )
...
Bump up the versions to 0.9.0 to match the C# binding version.
Also use central version management for C# projects
Also fix clippy lint errors
Signed-off-by: Anand Krishnamoorthi <anakrish@microsoft.com >
2026-01-28 05:58:34 +05:30
Anand Krishnamoorthi
394625d4bc
feat!: add cooperative execution-time limits across engine, VM, and binding ( #539 )
...
- Introduce ExecutionTimer/ExecutionTimerConfig to allow limiting evaluating time.
- To amortize time checking costs, checking interval can be configured via the notion of work units
- A global fallback time limit can be set to universally limit all evaluation in addition to engine level limit setting.
- Implement limnits in interpreter and RVM. In RVM, also handle suspend/resume so that time during pause is not counted.
- Add engine-level APIs to set/clear per-engine timer configuration and apply global fallback defaults.
- Surface execution-time limits through FFI and C# bindings
- Add C# tests and example usage to validate engine overrides, global fallback behavior, and compiled policy enforcement.
- Expand docs for execution-time limit
- Add interpreter YAML cases and VM unit tests for time-limit behavior and deterministic time sources.
Signed-off-by: Anand Krishnamoorthi <anakrish@microsoft.com >
2026-01-28 05:58:03 +05:30
Anand Krishnamoorthi
e68e852ee3
feat(xtask): consolidate CI workflows onto xtask helpers ( #542 )
...
- split the xtask crate into structured modules for
- bindings
- ci
- dev
- util
- no-std
- Adding commands for
- ci-release/ci-debug
- MUSL/no-std
- per- binding language smoke tests
- developer tasks (fmt, clippy, pre-commit, pre-push)
- refresh Cargo manifests/locks, binding readmes, and shared FFI helpers so every binding reuses the same preparation steps
- refactor GitHub Actions (release/debug, extensions, CodeQL, clippy, bindings) to call the new xtask commands
- Use rust-cache in ci workflows (microsoft qdk also does this)
- extend README with a contributor workflow section describing how xtask mirrors CI expectations
- update pre-commit and pre-push hooks to use the xtask dev commands
WORKAROUND:
When dotnet is run from an xtask, codeql tracer intercepts it an routes to a nonexistent binary.
Therefore in codeql workflow, xtask is not used for c# and instead dotnet is directly invoked.
Tracked by #545
closes #475
Signed-off-by: Anand Krishnamoorthi <anakrish@microsoft.com >
2026-01-27 07:42:21 +05:30
Anand Krishnamoorthi
2b1434b3ac
fix(release): Fix release-plz dirty-tree errors from Ruby binstubs ( #547 )
...
Ruby binstubs were checked in, but ignore via .gitignore **bin pattern.
This causes release-plz to think that the source tree is dirty.
The binstubs are deleted from source repo since they are always regenerated by bundler.
Also simplizy release-plz to focus only on the core crate.
Signed-off-by: Anand Krishnamoorthi <anakrish@microsoft.com >
2026-01-24 07:09:25 +05:30
Anand Krishnamoorthi
fd59bb5a91
feat(memory): Allocator-backed global memory limits ( #544 )
...
Policy evaluation at scale needs to be able to set memory limits
so that a bad policy does not hog memory or to ensure that
policy evaluation itself does not use too much memory which could
cause other components to suffer.
This PR introduces capability to set and enforce global memory limits.
It also lays the groundwork for enabling per evaluation limits in future.
Once a global memory limit is set, Regorus maintains per thread counters
to track memory activity (allocation, deallocation) of a thread.
These counters are periodically flushed to global memory counters.
Per thread counters avoid the contention that updating global counters
on each alloc/free would cause.
Policy evaluation periodically checks these counters and raises errors
if allocated memory has exceeded the configured limit.
Currently memory limit capability is exposed only to FFI and C#.
Also update mimalloc to v2.2.6
Signed-off-by: Anand Krishnamoorthi <anakrish@microsoft.com >
2026-01-24 07:08:54 +05:30
Anand Krishnamoorthi
80686d6ed1
feat(ffi): unwind safety: shield FFI entrypoints with panic guard ( #546 )
...
This PR implements widely accepted Rust programming practices for
dealing with panics across ABI (programming language) boundaries.
- Add panic_guard.rs to wrap FFI calls and prevent panic across FFI/ABI boundary (undefined behavior).
- Capture per-thread backtraces via a temporary panic hook
- After a panic, subsequent invocations are poisoned.
- Integrate with_unwind_guard across the engine, schema registry, and target registry exportis
Signed-off-by: Anand Krishnamoorthi <anakrish@microsoft.com >
2026-01-21 09:20:10 +05:30
Anand Krishnamoorthi
9426b2ec02
fix: Imports without a name binding ( #543 )
...
Handle imports that don't use the `as` clause to create a binding.
These imports are bound to the last identifier in the imported path.
Fix both interpreter and compiler.
Add tests.
fixes #541
Signed-off-by: Anand Krishnamoorthi <anakrish@microsoft.com >
2026-01-15 03:57:52 +05:30
Anand Krishnamoorthi
740db8a0f5
chore: Harden RVM implementation ( #537 )
...
Signed-off-by: Anand Krishnamoorthi <anakrish@microsoft.com >
2026-01-14 06:07:31 +05:30
Ben Beasley
d626f75421
Include all licenses in SPDX expression and LICENSE file ( #540 )
...
Change the SPDX license expression from `MIT` to
`MIT AND Apache-2.0 AND BSD-3-Clause` to reflect all of the licenses
that apply to the crate’s sources.
Add license text for `Apache-2.0` and the `BSD-3-Clause` license from
Go’s `time` module to `LICENSE`. Like `MIT`, both of these licenses
require the license text to be distributed with source and/or binaries.
2026-01-10 18:31:49 +05:30
Anand Krishnamoorthi
5afbd96159
chore: Interpreter hardening ( #536 )
...
Fix majority of the interpreter lint errors/warnings
Signed-off-by: Anand Krishnamoorthi <anakrish@microsoft.com >
2025-12-30 18:21:09 -06:00
Anand Krishnamoorthi
28891ef883
chore: Harden instructions and program ( #535 )
...
Also enforce sane limits in program
Signed-off-by: Anand Krishnamoorthi <anakrish@microsoft.com >
2025-12-30 18:20:07 -06:00
Anand Krishnamoorthi
49958c2ece
chore: Make clippy clean and harden helpers ( #532 )
...
- Promote common accessors (Expr/Rule span/eidx, ScopeContext constructors, Engine::set_rego_v0) to const
- Prefer Option combinators (map_or, then_some) and map_or_else
- Tighten engine logic: add missing semicolons, use checked u32::try_from, make boolean query evaluation avoid unchecked indexing,
Signed-off-by: Anand Krishnamoorthi <anakrish@microsoft.com >
2025-12-29 14:47:09 -06:00
Anand Krishnamoorthi
08a5e00960
chore: Harden lexer bounds and span handling ( #531 )
...
- Document arithmetic safety assumptions and add explicit lexer limits for columns, file size (1 MiB), and line count.
Realistic policies will be well within these bounds.
- Use checked arithmetic to prevent overflow underflow.
- Avoid var name shadowing.
- Misc clippy lints
Signed-off-by: Anand Krishnamoorthi <anakrish@microsoft.com >
2025-12-29 14:46:05 -06:00
Anand Krishnamoorthi
1d71df30b6
chore: Fix lint errors in lookup.rs ( #530 )
...
- Made the lookup module crate-visible to address clippy’s redundant visibility lint.
- Replaced unchecked as casts with a fallible usize_from_u32 helper and propagate conversion errors in lookup accessors.
- Switched LookupIndexError to implement core::error::Error for no_std correctness.
- Fixed the pattern type mismatch by matching on the value in the Display impl.
- Promoted trivial helpers to const fn (new, module_len) per clippy suggestions.
- Centralized bounds-checked slot access via slot_ref/slot_mut to keep getters/clearers lint-clean and avoid unchecked indexing.
Signed-off-by: Anand Krishnamoorthi <anakrish@microsoft.com >
2025-12-29 13:53:46 -06:00
Anand Krishnamoorthi
249dcd0b43
chore: Add clippy lints ( #529 )
...
Lints are added (deny) at crate level.
In each offending file, the failing lints are explicitly allowed.
Each file will be fixed in subsequent PRs.
Signed-off-by: Anand Krishnamoorthi <anakrish@microsoft.com >
2025-12-23 15:59:34 -06:00
Anand Krishnamoorthi
604591a0f7
Merge pull request #527 from anakrish/checked-indexing
...
Checked indexing
2025-12-19 13:24:55 -06:00
Anand Krishnamoorthi
dbfb8e38a8
fix: Skip reordering in truncated queries.
...
In case all the statements of a query don't execute,
skip reordering the result expressions to match the
source order. Doing so requires maintaining additional
data structures not worth the complexity for now.
Additionally we want to discourage queries and encourage
evaluating rules. Queries are inherently less performant
than rules which can be precompiled.
Signed-off-by: Anand Krishnamoorthi <anakrish@microsoft.com >
2025-12-19 12:08:09 -06:00
Anand Krishnamoorthi
273a80571e
fix: apply expression ordering to schedule in a safe way
...
Signed-off-by: Anand Krishnamoorthi <anakrish@microsoft.com >
2025-12-19 11:33:25 -06:00
Anand Krishnamoorthi
3f29eb2fa6
fix: Create ordered statements in a safe way
...
Signed-off-by: Anand Krishnamoorthi <anakrish@microsoft.com >
2025-12-19 11:33:25 -06:00
Anand Krishnamoorthi
889a02ddd6
fix: Avoid unwrap when accesssing current module
...
Signed-off-by: Anand Krishnamoorthi <anakrish@microsoft.com >
2025-12-19 11:33:24 -06:00
Anand Krishnamoorthi
70f63a0982
fix: Avoid unrap/expect in context management
...
Signed-off-by: Anand Krishnamoorthi <anakrish@microsoft.com >
2025-12-19 11:33:24 -06:00
Anand Krishnamoorthi
6bc1249dc8
feat: Safeguard lookup use
...
Detect invalid indexes and raise internal errors.
Signed-off-by: Anand Krishnamoorthi <anakrish@microsoft.com >
2025-12-19 11:33:24 -06:00
Anand Krishnamoorthi
5d0cf95332
feat: add recursion limit to parser
...
Signed-off-by: Anand Krishnamoorthi <anakrish@microsoft.com >
2025-12-19 11:33:24 -06:00
Anand Krishnamoorthi
fd4bb3081f
feat: Safeguard against panics in parser
...
Signed-off-by: Anand Krishnamoorthi <anakrish@microsoft.com >
2025-12-19 11:33:24 -06:00
Anand Krishnamoorthi
93a633750c
feat: Guard against runtime panics in lexer
...
Add guardrails for operations to ensure that they
won't panic at runtime.
Signed-off-by: Anand Krishnamoorthi <anakrish@microsoft.com >
2025-12-19 11:33:24 -06:00
Anand Krishnamoorthi
52b56f4214
Merge pull request #526 from anakrish/quick-fixes
...
Quick fixes
2025-12-17 16:56:06 -06:00
Anand Krishnamoorthi
8b84d4ce12
Merge pull request #525 from tjons/tjons/feat-implement-net-cidr-expand
...
feat: implement `net.cidr_expand` builtin
2025-12-17 13:16:52 -06:00
Anand Krishnamoorthi
ecf95833f9
Merge pull request #519 from anakrish/opa-rvm-3
...
Opa rvm 3
2025-12-16 14:11:08 -06:00
