chore: release (#382)

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>

.github/workflows/pr-extensions.yml

@@ -1,4 +1,4 @@
-name: tests/release
+name: tests/release-extensions
 
 on:
   push:

.github/workflows/test-go.yml

@@ -18,7 +18,6 @@ jobs:
           
       - uses: actions/setup-go@v5
         with:
-          python-version: ${{ env.PYTHON_VERSION }}
           architecture: x64
 
       - name: Build ffi
@@ -29,5 +28,5 @@ jobs:
         run: |
           go mod tidy
           go build
-          LD_LIBRARY_PATH=../../target/release ./regorus_test
+          LD_LIBRARY_PATH=../ffi/target/release ./regorus_test
         working-directory: ./bindings/go

.github/workflows/test-java.yml

@@ -33,5 +33,5 @@ jobs:
       - name: Test jar
         run: |
           javac -cp target/regorus-java-0.2.2.jar Test.java
-          java -Djava.library.path=../../target/release -cp target/regorus-java-0.2.2.jar:. Test
+          java -Djava.library.path=target/release -cp target/regorus-java-0.2.2.jar:. Test
         working-directory: ./bindings/java

.gitignore

@@ -25,4 +25,6 @@ worktrees/
 
 # Generated C, C++ headers
 bindings/ffi/regorus.h
-bindings/ffi/regorus.ffi.hpp
+bindings/ffi/regorus.ffi.hpp
+
+bindings/*/target

CHANGELOG.md

@@ -6,6 +6,16 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.4.0](https://github.com/microsoft/regorus/compare/regorus-v0.3.0...regorus-v0.4.0) - 2025-03-14
+
+### Fixed
+- [**breaking**] Update ruby json dependency ([#381](https://github.com/microsoft/regorus/pull/381))
+- [**breaking**] Remove ring dependency ([#380](https://github.com/microsoft/regorus/pull/380))
+- [**breaking**] Remove sha1 dependency ([#379](https://github.com/microsoft/regorus/pull/379))
+
+### Other
+- Specify optimization flags ([#378](https://github.com/microsoft/regorus/pull/378))
+
 ## [0.3.0](https://github.com/microsoft/regorus/compare/regorus-v0.2.8...regorus-v0.3.0) - 2025-03-10
 
 ### Added

Cargo.toml

@@ -1,18 +1,13 @@
 [workspace]
 
 members = [
-    "bindings/ffi",
-    "bindings/python",
-    "bindings/wasm",
-    "bindings/java",
-    "bindings/ruby/ext/regorusrb",
     "tests/ensure_no_std",
 ]
 
 [package]
 name = "regorus"
 description = "A fast, lightweight Rego (OPA policy language) interpreter"
-version = "0.3.0"
+version = "0.4.0"
 edition = "2021"
 license-file = "LICENSE"
 repository = "https://github.com/microsoft/regorus"
@@ -31,14 +26,13 @@ ast = []
 base64 = ["dep:data-encoding"]
 base64url = ["dep:data-encoding"]
 coverage = []
-crypto = ["dep:constant_time_eq", "dep:hmac", "dep:hex", "dep:md-5", "dep:sha1", "dep:sha2"]
+crypto = ["dep:constant_time_eq", "dep:hmac", "dep:hex", "dep:md-5", "dep:sha2"]
 deprecated = []
 hex = ["dep:data-encoding"]
 http = []
 glob = ["dep:wax"]
 graph = []
 jsonschema = ["dep:jsonschema"]
-jwt = ["dep:jsonwebtoken", "dep:data-encoding", "dep:itertools"]
 no_std = ["lazy_static/spin_no_std"]
 opa-runtime = []
 regex = ["dep:regex"]
@@ -58,7 +52,6 @@ full-opa = [
     "graph",
     "hex",
     "http",
-    "jwt",
     "jsonschema",
     "opa-runtime",
     "regex",
@@ -109,7 +102,6 @@ constant_time_eq = {version = "0.4.0", optional = true, default-features = false
 hmac = {version = "0.12.1", optional = true, default-features = false}
 sha2 = {version= "0.10.8", optional = true, default-features = false }
 hex = {version = "0.4.3", optional = true, default-features = false, features = ["alloc"] }
-sha1 = {version = "0.10.6", optional = true, default-features = false }
 md-5 = {version = "0.10.6", optional = true, default-features = false }
 
 data-encoding = { version = "2.8.0", optional = true, default-features=false, features = ["alloc"] }
@@ -123,8 +115,6 @@ uuid = { version = "1.15.1", default-features = false, features = ["v4", "fast-r
 jsonschema = { version = "0.29.0", default-features = false, optional = true }
 chrono = { version = "0.4.40", optional = true }
 chrono-tz = { version = "0.10.1", optional = true }
-jsonwebtoken = { version = "9.3.1", optional = true }
-itertools = { version = "0.14.0", default-features = false, optional = true }
 
 serde_yaml = {version = "0.9.16", default-features = false, optional = true }
 # Specify thread_rng for in order to use random_range
@@ -144,6 +134,8 @@ anyhow = "1.0"
 
 [profile.release]
 debug = true
+lto = true
+codegen-units = 1
 
 [[test]]
 name="opa"

README.md

@@ -298,8 +298,11 @@ The following test suites don't pass fully due to missing builtins:
 - `graphql`
 - `invalidkeyerror`
 - `jsonpatch`
+- `jwtbuiltins`
 - `jwtdecodeverify`
 - `jwtencodesign`
+- `jwtencodesignheadererrors`
+- `jwtencodesignpayloaderrors`
 - `jwtencodesignraw`
 - `jwtverifyhs256`
 - `jwtverifyhs384`
@@ -321,6 +324,7 @@ The following test suites don't pass fully due to missing builtins:
 
 They are captured in the following [github issues](https://github.com/microsoft/regorus/issues?q=is%3Aopen+is%3Aissue+label%3Alib).
 
+Cryptographically insecure `sha1` related builtins are intentionally not supported to discourage their use.
 
 ### Grammar
 

bindings/c-nostd/CMakeLists.txt

@@ -7,7 +7,8 @@ include(FetchContent)
 FetchContent_Declare(
     Corrosion
     GIT_REPOSITORY https://github.com/corrosion-rs/corrosion.git
-    GIT_TAG v0.4 # Optionally specify a commit hash, version tag or branch here
+    # Use a tag that has a fix for https://github.com/corrosion-rs/corrosion/issues/590
+    GIT_TAG 6be991bb34c348dfb8344be22f3606288ea5c7fd
 )
 FetchContent_MakeAvailable(Corrosion)
 

bindings/c/CMakeLists.txt

@@ -7,7 +7,8 @@ include(FetchContent)
 FetchContent_Declare(
     Corrosion
     GIT_REPOSITORY https://github.com/corrosion-rs/corrosion.git
-    GIT_TAG v0.4 # Optionally specify a commit hash, version tag or branch here
+    # Use a tag that has a fix for https://github.com/corrosion-rs/corrosion/issues/590
+    GIT_TAG 6be991bb34c348dfb8344be22f3606288ea5c7fd
 )
 FetchContent_MakeAvailable(Corrosion)
 

bindings/cpp/CMakeLists.txt

@@ -7,7 +7,8 @@ include(FetchContent)
 FetchContent_Declare(
     Corrosion
     GIT_REPOSITORY https://github.com/corrosion-rs/corrosion.git
-    GIT_TAG v0.4 # Optionally specify a commit hash, version tag or branch here
+    # Use a tag that has a fix for https://github.com/corrosion-rs/corrosion/issues/590
+    GIT_TAG 6be991bb34c348dfb8344be22f3606288ea5c7fd
 )
 FetchContent_MakeAvailable(Corrosion)
 

bindings/csharp/net40/regorus-test.csproj

@@ -4,7 +4,7 @@
     <Exec Command="cargo build -r --manifest-path ../../ffi/Cargo.toml" />
     <Copy SourceFiles="../../ffi/RegorusFFI.g.cs" DestinationFolder="." />
     <ItemGroup>
-        <RegorusDylib Include="..\..\..\target\release\*regorus_ffi*" />
+        <RegorusDylib Include="..\..\ffi\target\release\*regorus_ffi*" />
     </ItemGroup>    
     <Copy SourceFiles="@(RegorusDylib)" DestinationFolder="." />
   </Target>

bindings/csharp/net8.0/regorus-test.csproj

@@ -4,7 +4,7 @@
     <Exec Command="cargo build -r --manifest-path ../../ffi/Cargo.toml" />
     <Copy SourceFiles="../../ffi/RegorusFFI.g.cs" DestinationFolder="." />
     <ItemGroup>
-        <RegorusDylib Include="..\..\..\target\release\*regorus_ffi*" />
+        <RegorusDylib Include="..\..\ffi\target\release\*regorus_ffi*" />
     </ItemGroup>    
     <Copy SourceFiles="@(RegorusDylib)" DestinationFolder="." />
   </Target>

bindings/ffi/Cargo.toml

@@ -1,3 +1,5 @@
+[workspace]
+
 [package]
 name = "regorus-ffi"
 version = "0.2.2"

bindings/go/pkg/regorus/mod.go

@@ -1,6 +1,6 @@
 package regorus
 
-// #cgo LDFLAGS: -L ../../../../target/release -lregorus_ffi
+// #cgo LDFLAGS: -L ../../../ffi/target/release -lregorus_ffi
 // #include "../../../ffi/regorus.h"
 import "C"
 import (
@@ -28,7 +28,7 @@ func (e *Engine) Clone() *Engine {
 	return c
 }
 
-func (e *Engine) SetRegoV0(enable bool) (error) {
+func (e *Engine) SetRegoV0(enable bool) error {
 	result := C.regorus_engine_set_rego_v0(e.e, C.bool(enable))
 	defer C.regorus_result_drop(result)
 
@@ -84,7 +84,6 @@ func (e *Engine) GetPolicies() (string, error) {
 	return C.GoString(result.output), nil
 }
 
-
 func (e *Engine) AddDataJson(data string) error {
 	data_c := C.CString(data)
 	defer C.free(unsafe.Pointer(data_c))

bindings/java/Cargo.toml

@@ -1,3 +1,5 @@
+[workspace]
+
 [package]
 name = "regorus-java"
 version = "0.3.0"

bindings/java/README.md

@@ -23,7 +23,7 @@ Afterwards, you can build native library for that target using:
 $ cargo build --release --target aarch64-apple-darwin
 ```
 
-You will then have a native library at `../../target/aarch64-apple-darwin/release/libregorus_java.dylib` depending on your target.
+You will then have a native library at `target/aarch64-apple-darwin/release/libregorus_java.dylib` depending on your target.
 
 You then need to build Java bindings using:
 ```bash

bindings/python/Cargo.toml

@@ -1,3 +1,5 @@
+[workspace]
+
 [package]
 name = "regoruspy"
 version = "0.3.0"

bindings/ruby/Gemfile.lock

@@ -8,7 +8,7 @@ GEM
   remote: https://rubygems.org/
   specs:
     ast (2.4.2)
-    json (2.10.1)
+    json (2.10.2)
     language_server-protocol (3.17.0.4)
     lint_roller (1.1.0)
     minitest (5.25.4)

bindings/wasm/Cargo.toml

@@ -1,3 +1,5 @@
+[workspace]
+
 [package]
 name = "regorusjs"
 version = "0.3.0"
@@ -23,7 +25,8 @@ wasm-bindgen = "0.2.100"
 # when targeting wasm32-unknown-unknown.
 uuid = { version = "1.15.1", default-features = false, features = ["v4", "fast-rng", "js"]}
 # Enable wasm_js. See https://docs.rs/getrandom/latest/getrandom/#webassembly-support
-getrandom = { version = "0.3", features = ["std", "wasm_js"] }
+getrandom_for_jsonschema = { package = "getrandom", version = "0.2.15", features = ["std", "js"] }
+getrandom = { version = "0.3.1", features = ["std", "wasm_js"] }
 
 [dev-dependencies]
 wasm-bindgen-test = "0.3.40"

src/builtins/crypto.rs

@@ -11,18 +11,15 @@ use anyhow::{bail, Result};
 use constant_time_eq::constant_time_eq;
 use hmac::{Hmac, Mac};
 use md5::{Digest, Md5};
-use sha1::Sha1;
 use sha2::{Sha256, Sha512};
 
 pub fn register(m: &mut builtins::BuiltinsMap<&'static str, builtins::BuiltinFcn>) {
     m.insert("crypto.hmac.equal", (hmac_equal_fixed_time, 2));
     m.insert("crypto.hmac.md5", (hmac_md5, 2));
-    m.insert("crypto.hmac.sha1", (hmac_sha1, 2));
     m.insert("crypto.hmac.sha256", (hmac_sha256, 2));
     m.insert("crypto.hmac.sha512", (hmac_sha512, 2));
 
     m.insert("crypto.md5", (crypto_md5, 1));
-    m.insert("crypto.sha1", (crypto_sha1, 1));
     m.insert("crypto.sha256", (crypto_sha256, 1));
 }
 
@@ -60,22 +57,6 @@ fn hmac_md5(span: &Span, params: &[Ref<Expr>], args: &[Value], _strict: bool) ->
     Ok(Value::String(hex::encode(result.into_bytes()).into()))
 }
 
-fn hmac_sha1(span: &Span, params: &[Ref<Expr>], args: &[Value], _strict: bool) -> Result<Value> {
-    let name = "crypto.hmac.sha1";
-    ensure_args_count(span, name, params, args, 2)?;
-
-    let x = ensure_string(name, &params[0], &args[0])?;
-    let key = ensure_string(name, &params[1], &args[1])?;
-
-    let mut hmac = Hmac::<Sha1>::new_from_slice(key.as_bytes())
-        .or_else(|_| bail!(span.error("failed to create hmac instance")))?;
-
-    hmac.update(x.as_bytes());
-    let result = hmac.finalize();
-
-    Ok(Value::String(hex::encode(result.into_bytes()).into()))
-}
-
 fn hmac_sha256(span: &Span, params: &[Ref<Expr>], args: &[Value], _strict: bool) -> Result<Value> {
     let name = "crypto.hmac.sha256";
     ensure_args_count(span, name, params, args, 2)?;
@@ -122,20 +103,6 @@ fn crypto_md5(span: &Span, params: &[Ref<Expr>], args: &[Value], _strict: bool)
     Ok(Value::String(hex::encode(result).into()))
 }
 
-fn crypto_sha1(span: &Span, params: &[Ref<Expr>], args: &[Value], _strict: bool) -> Result<Value> {
-    let name = "crypto.sha1";
-    ensure_args_count(span, name, params, args, 1)?;
-
-    let x = ensure_string(name, &params[0], &args[0])?;
-
-    let mut h = Sha1::new();
-
-    h.update(x.as_bytes());
-    let result = h.finalize();
-
-    Ok(Value::String(hex::encode(result).into()))
-}
-
 fn crypto_sha256(
     span: &Span,
     params: &[Ref<Expr>],

src/builtins/jwt.rs

@@ -1,73 +0,0 @@
-// Copyright (c) Microsoft Corporation.
-// Licensed under the MIT License.
-
-use crate::ast::{Expr, Ref};
-use crate::builtins;
-use crate::builtins::utils::{ensure_args_count, ensure_string};
-use crate::*;
-
-use crate::lexer::Span;
-use crate::value::Value;
-
-use itertools::Itertools;
-
-use anyhow::{bail, Result};
-
-pub fn register(m: &mut builtins::BuiltinsMap<&'static str, builtins::BuiltinFcn>) {
-    m.insert("io.jwt.decode", (jwt_decode, 1));
-    m.insert("io.jwt.decode_verify", (jwt_decode_verify, 2));
-}
-
-fn decode(span: &Span, jwt: String, strict: bool) -> Result<Value> {
-    let Some((Ok(header), Ok(payload), Ok(signature))) = jwt
-        .split('.')
-        .map(|p| data_encoding::BASE64URL_NOPAD.decode(p.as_bytes()))
-        .collect_tuple()
-    else {
-        if strict {
-            bail!(span.error("invalid jwt token"));
-        }
-        return Ok(Value::Undefined);
-    };
-
-    let header = String::from_utf8_lossy(&header).to_string();
-    let payload = String::from_utf8_lossy(&payload).to_string();
-    let signature = data_encoding::HEXLOWER_PERMISSIVE.encode(&signature);
-
-    let signature = Value::String(signature.into());
-    let header = Value::from_json_str(&header)?;
-
-    if header["enc"] != Value::Undefined {
-        bail!(span.error("JWT is a JWE object, which is not supported"));
-    }
-
-    if header["cty"] == "JWT".into() {
-        if payload.len() <= 2 || !payload.starts_with('"') || !payload.ends_with('"') {
-            bail!(span.error("invalid nested JWT"));
-        }
-        // Ignore ""
-        decode(span, payload[1..payload.len() - 1].to_string(), strict)
-    } else {
-        let payload = Value::from_json_str(&payload)?;
-        Ok(Value::from_array([header, payload, signature].into()))
-    }
-}
-
-fn jwt_decode(span: &Span, params: &[Ref<Expr>], args: &[Value], strict: bool) -> Result<Value> {
-    let name = "io.jwt.decode";
-    ensure_args_count(span, name, params, args, 1)?;
-    let jwt = ensure_string(name, &params[0], &args[0])?;
-
-    decode(span, jwt.to_string(), strict) //header, payload, signature, strict)
-}
-
-fn jwt_decode_verify(
-    span: &Span,
-    params: &[Ref<Expr>],
-    args: &[Value],
-    _strict: bool,
-) -> Result<Value> {
-    let name = "io.jwt.decode_verify";
-    ensure_args_count(span, name, params, args, 2)?;
-    Ok(Value::Undefined)
-}

src/builtins/mod.rs

@@ -18,8 +18,6 @@ mod glob;
 mod graph;
 #[cfg(feature = "http")]
 mod http;
-#[cfg(feature = "jwt")]
-mod jwt;
 pub mod numbers;
 mod objects;
 #[cfg(feature = "opa-runtime")]
@@ -83,8 +81,6 @@ lazy_static! {
 	//units::register(&mut m);
 	types::register(&mut m);
 	encoding::register(&mut m);
-	#[cfg(feature = "jwt")]
-	jwt::register(&mut m);
 	#[cfg(feature = "time")]
 	time::register(&mut m);
 

src/builtins/opa.rs

@@ -67,8 +67,6 @@ fn opa_runtime(span: &Span, params: &[Ref<Expr>], args: &[Value], _strict: bool)
         "hex",
         #[cfg(feature = "http")]
         "http",
-        #[cfg(feature = "jwt")]
-        "jwt",
         #[cfg(feature = "jsonschema")]
         "jsonschema",
         #[cfg(feature = "opa-runtime")]

tests/opa.passing

@@ -22,11 +22,9 @@ v0/comprehensions
 v0/containskeyword
 v0/cryptohmacequal
 v0/cryptohmacmd5
-v0/cryptohmacsha1
 v0/cryptohmacsha256
 v0/cryptohmacsha512
 v0/cryptomd5
-v0/cryptosha1
 v0/cryptosha256
 v0/dataderef
 v0/defaultkeyword
@@ -54,7 +52,6 @@ v0/jsonfilteridempotent
 v0/jsonremove
 v0/jsonremoveidempotent
 v0/jsonschema
-v0/jwtbuiltins
 v0/negation
 v0/nestedreferences
 v0/numbersrange
@@ -137,11 +134,9 @@ v1/comprehensions
 v1/containskeyword
 v1/cryptohmacequal
 v1/cryptohmacmd5
-v1/cryptohmacsha1
 v1/cryptohmacsha256
 v1/cryptohmacsha512
 v1/cryptomd5
-v1/cryptosha1
 v1/cryptosha256
 v1/dataderef
 v1/defaultkeyword
@@ -169,7 +164,6 @@ v1/jsonfilteridempotent
 v1/jsonremove
 v1/jsonremoveidempotent
 v1/jsonschema
-v1/jwtbuiltins
 v1/negation
 v1/nestedreferences
 v1/numbersrange

tests/opa.rs

@@ -210,6 +210,10 @@ fn run_opa_tests(opa_tests_dir: String, folders: &[String]) -> Result<()> {
                 if let Some(ref mut want_result) = &mut case.want_result {
                     want_result.as_array_mut()?.sort();
                 }
+            } else if case.note == "withkeyword/builtin: nested, multiple mocks" {
+                // Mocks non-existent jwt builtin.
+                println!("skipping mock test for io.jwt.decode_verify: {}", case.note);
+                continue;
             }
 
             // Normalize for comparison.