GeezerVison

The World Wide Web, restored to 800 pixels of glory.

GeezerVison is showing github.com — Update random and cryptography crates by joshuamegnauth54 · Pull Request #8010 · RustPython/RustPython

Conversation

joshuamegnauth54 commented Jun 2, 2026 •

edited by coderabbitai Bot

Loading

Uh oh!

There was an error while loading. Please reload this page.

Copy link

Copy Markdown

Contributor

Redo of #7800.

Bumping the random and crypto crates is not trivial. Both sets of crates have had API changes which require manual updates.

AI use:
I wrote all of the code myself but used AI to figure out the new APIs. AI explained SHAKE's block size and why the block_size() function doesn't exist in the new crate. I confirmed the block size, which is actually represented in the new types for SHAKE. Shake128 is actually Shake<168> - 168 is the block size. I cited Wikipedia as it lists the SHAKE block size in bits.

I also used AI to figure out HMAC for SHA3.

Assisted-by: Codex:gpt-5.4

Closes #xxxx
This PR follows our AI policy

Summary

Bump all of the crypto and rand crates
Add the shake crate. shake used to be part of the sha3 crate but the RustCrypto maintainers moved it to its own crate.

Fun fact: Both the LLM and I were horribly confused at the HMAC issue.

Summary by CodeRabbit

Chores
- Updated multiple cryptography and randomness dependencies to newer releases; Dependabot grouping expanded for additional crypto libraries.
Refactor
- Reworked HMAC and PBKDF2 handling for SHA‑3 to improve consistency.
- Switched default RNG seeding to use the updated random API.
Bug Fixes
- Fixed SHAKE/XOF block-size reporting to use correct constants.

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

All reactions

coderabbitai Bot commented Jun 2, 2026 •

edited

Loading

Uh oh!

There was an error while loading. Please reload this page.

Copy link

Copy Markdown

Contributor

Note

Reviews paused

It looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the reviews.auto_review.auto_pause_after_reviewed_commits setting.

Use the following commands to manage reviews:

@coderabbitai resume to resume automatic reviews.
@coderabbitai review to trigger a single review.

Use the checkboxes below for quick actions:

▶️ Resume reviews
🔍 Trigger review

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yml

Review profile: CHILL

Plan: Pro

Run ID: e98f8d9c-c52c-4aaa-99c4-954d816783fc

📥 Commits

Reviewing files that changed from the base of the PR and between 25df0c3 and f904031.

⛔ Files ignored due to path filters (1)

Cargo.lock is excluded by !**/*.lock

📒 Files selected for processing (6)

.github/dependabot.yml
Cargo.toml
crates/literal/src/float.rs
crates/stdlib/Cargo.toml
crates/stdlib/src/hashlib.rs
crates/stdlib/src/random.rs

🚧 Files skipped from review as they are similar to previous changes (5)

crates/stdlib/src/random.rs
.github/dependabot.yml
crates/stdlib/Cargo.toml
Cargo.toml
crates/stdlib/src/hashlib.rs

📝 Walkthrough

Walkthrough

RustPython upgrades workspace and stdlib crypto/RNG dependencies, adapts hashlib to use SimpleHmac for SHA‑3 and a fixed SHAKE block size, changes random seeding to use rand::rng(), and updates a test import for rand 0.10.

Changes

Cryptographic and RNG Dependency Modernization

Layer / File(s)	Summary
Workspace and stdlib dependency version updates `Cargo.toml`, `crates/stdlib/Cargo.toml`, `.github/dependabot.yml`	Workspace and stdlib manifests updated: blake2, digest, getrandom (0.3→0.4, std), hmac, md-5, pbkdf2, rand (0.9→0.10), mt19937, sha-1→sha1, sha2, sha3 versions bumped; `rand_core` entry removed; dependabot group adds `shake` and `chacha20`.
Hashlib SHA-3 HMAC and PBKDF2 refactoring `crates/stdlib/src/hashlib.rs`	Digest imports adjusted to block API paths and `SimpleHmac` added; HMAC macros refactored to accept explicit wrapper types. SHA‑3 HMACs and PBKDF2 now use `SimpleHmac<...>`; SHAKE XOF block_size() returns fixed constants (168/136).
Random module seeding mechanism update `crates/stdlib/src/random.rs`	Imports switched from `rand_core` to `rand`. `PyRandom.seed()` default case now uses `MT19937::from_rng(&mut rand::rng())` instead of `try_from_os_rng()` with IO error mapping.
Test import compatibility update `crates/literal/src/float.rs`	Test updated to import `rand::RngExt` instead of `rand::Rng` to match rand 0.10 API.

Estimated code review effort

🎯 4 (Complex) | ⏱️ ~45 minutes

Suggested reviewers

fanninpm
ShaharNaveh
youknowone

Poem

🐰 I hopped through Cargo.toml tonight,
nudged hashes, bumped versions light.
SimpleHmac hums in SHA‑3 land,
seeds now sprout from rand's own hand,
the burrow gleams with tests in sight.

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 71.43% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title 'Update random and cryptography crates' clearly and concisely describes the main change: bumping versions of random and crypto dependencies across the workspace, which is the primary focus of the changeset.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

Create PR with unit tests

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

coderabbitai Bot reviewed

Jun 2, 2026

View reviewed changes

coderabbitai Bot left a comment

Copy link

Copy Markdown

Contributor

There was a problem hiding this comment.

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@Cargo.toml`:
- Line 254: The comment on the mt19937 dependency entry ("mt19937 = \"3.3\"  #
upgrade it once rand is upgraded") is now stale because rand has already been
bumped to 0.10; update or remove that trailing comment on the mt19937 line so it
no longer instructs future readers to upgrade mt19937 once rand is
upgraded—locate the mt19937 = "3.3" entry in Cargo.toml and either delete the
outdated comment or replace it with a short factual note reflecting the current
state.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

Push a commit to this branch (recommended)
Create a new PR with the fixes

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yml

Review profile: CHILL

Plan: Pro

Run ID: 732efa0d-2cbf-4d7c-977a-c7420cac61d0

📥 Commits

Reviewing files that changed from the base of the PR and between 885cf5c and 74122c6.

⛔ Files ignored due to path filters (1)

Cargo.lock is excluded by !**/*.lock

📒 Files selected for processing (5)

Cargo.toml
crates/literal/src/float.rs
crates/stdlib/Cargo.toml
crates/stdlib/src/hashlib.rs
crates/stdlib/src/random.rs

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

All reactions

Comment thread

Cargo.toml Resolved

Uh oh!

There was an error while loading. Please reload this page.

joshuamegnauth54 force-pushed the bump-random-crypto branch from 74122c6 to 2e14a1e Compare

June 2, 2026 01:59

ShaharNaveh approved these changes

Jun 2, 2026

View reviewed changes

ShaharNaveh left a comment

Copy link

Copy Markdown

Contributor

There was a problem hiding this comment.

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

ty:)

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

All reactions

youknowone reviewed

Jun 2, 2026

View reviewed changes

Comment thread

crates/stdlib/src/hashlib.rs

		Self::Shake128(_) => Shake128::block_size(),
		Self::Shake256(_) => Shake256::block_size(),
		Self::Shake128(_) => 168,
		Self::Shake256(_) => 136,

youknowone Jun 2, 2026

Copy link

Copy Markdown

Member

There was a problem hiding this comment.

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

aren't those values match ot Shake{128,256}::block_size()? then why does it happen? do those block_size refer different thiing?

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

All reactions

joshuamegnauth54 Jun 2, 2026

Copy link

Copy Markdown

Contributor Author

There was a problem hiding this comment.

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

block_size() doesn't exist anymore, so I had to hard code the values. For XOF (SHAKE and other algorithms), the block size is just the rate in bytes.

I'll check if there's a nicer way to get the block size without hard coding it. 😁

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

youknowone reacted with thumbs up emoji

All reactions

👍 1 reaction

joshuamegnauth54 Jun 2, 2026

Copy link

Copy Markdown

Contributor Author

There was a problem hiding this comment.

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The shake crate doesn't provide a different way to get the rate. 😓 However, the rate wouldn't change so it's probably okay to just hard code it.

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

All reactions

fanninpm commented Jun 2, 2026

Copy link

Copy Markdown

Contributor

Could you please try rebasing this branch onto a fresh copy of main? #8004 got merged, which changes a Windows CI job.

All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

fanninpm reviewed

Jun 2, 2026

View reviewed changes

Comment thread

crates/stdlib/Cargo.toml Resolved

Uh oh!

There was an error while loading. Please reload this page.

fanninpm reviewed

Jun 2, 2026

View reviewed changes

Comment thread

Cargo.lock

		checksum = "613afe47fcd5fac7ccf1db93babcb082c5994d996f20b8b159f2ad1658eb5724"

		[[package]]
		name = "chacha20"

fanninpm Jun 2, 2026

Copy link

Copy Markdown

Contributor

There was a problem hiding this comment.

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Does this need to be added to the random category in .github/dependabot.yml?

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

All reactions

joshuamegnauth54 Jun 2, 2026

Copy link

Copy Markdown

Contributor Author

There was a problem hiding this comment.

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I'm not sure about this one since it's not a direct dependency. Should I add it anyway?

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

All reactions

fanninpm Jun 2, 2026

Copy link

Copy Markdown

Contributor

There was a problem hiding this comment.

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I seem to recall that we've had problems in the past where Dependabot would update a dependency only found in Cargo.lock and the build would break. It probably wouldn't hurt to add it.

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

All reactions

joshuamegnauth54 force-pushed the bump-random-crypto branch 2 times, most recently from e4abecf to 25df0c3 Compare

June 2, 2026 17:23


          Update random and cryptography crates

f904031

Redo of RustPython#7800.

Bumping the random and crypto crates is not trivial. Both sets of crates
have had API changes which require manual updates.

AI use:
I wrote all of the code myself but used AI to figure out the new APIs.
AI explained SHAKE's block size and why the block_size() function
doesn't exist in the new crate. I confirmed the block size, which is
actually represented in the new types for SHAKE. `Shake128` is actually
`Shake<168>` - 168 is the block size. I cited Wikipedia as it lists the
SHAKE block size in bits.

I also used AI to figure out HMAC for SHA3.

Assisted-by: Codex:gpt-5.4

joshuamegnauth54 force-pushed the bump-random-crypto branch from 25df0c3 to f904031 Compare

June 2, 2026 17:45

youknowone approved these changes

Jun 3, 2026

View reviewed changes

youknowone left a comment

Copy link

Copy Markdown

Member

There was a problem hiding this comment.

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thank you!

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

All reactions

youknowone merged commit 0862451 into RustPython:main

Jun 3, 2026

26 checks passed

Uh oh!

There was an error while loading. Please reload this page.

fanninpm mentioned this pull request

Jun 4, 2026

rustpython-stdlib compilation failure with old mt19937 dependency #8025

Closed

joshuamegnauth54 deleted the bump-random-crypto branch

June 15, 2026 02:31

youknowone pushed a commit that referenced this pull request

Sep 16, 2026


          Update random and cryptography crates (#8010)

3d53342

Redo of #7800.

Bumping the random and crypto crates is not trivial. Both sets of crates
have had API changes which require manual updates.

AI use:
I wrote all of the code myself but used AI to figure out the new APIs.
AI explained SHAKE's block size and why the block_size() function
doesn't exist in the new crate. I confirmed the block size, which is
actually represented in the new types for SHAKE. `Shake128` is actually
`Shake<168>` - 168 is the block size. I cited Wikipedia as it lists the
SHAKE block size in bits.

I also used AI to figure out HMAC for SHA3.

Assisted-by: Codex:gpt-5.4

Reviewers

fanninpm

fanninpm left review comments

coderabbitai[bot]

coderabbitai[bot] left review comments

youknowone

youknowone approved these changes

ShaharNaveh

ShaharNaveh approved these changes

Uh oh!

There was an error while loading. Please reload this page.

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

Uh oh!

There was an error while loading. Please reload this page.

4 participants

Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.

You are visitor 01402503 — GeezerVison does not store the pages you look up.
Best viewed with Netscape Navigator 4.7 or Internet Explorer 6 at 800×600. No cookies required.

GeezerVison

Conversation

joshuamegnauth54 commented Jun 2, 2026 • edited by coderabbitai Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Summary by CodeRabbit

Uh oh!

coderabbitai Bot commented Jun 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Reviews paused

Walkthrough

Changes

Estimated code review effort

Suggested reviewers

Poem

❌ Failed checks (1 warning)

Uh oh!

coderabbitai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

ShaharNaveh left a comment

Choose a reason for hiding this comment

Uh oh!

youknowone Jun 2, 2026

Choose a reason for hiding this comment

Uh oh!

joshuamegnauth54 Jun 2, 2026

Choose a reason for hiding this comment

Uh oh!

joshuamegnauth54 Jun 2, 2026

Choose a reason for hiding this comment

Uh oh!

fanninpm commented Jun 2, 2026

Uh oh!

Uh oh!

fanninpm Jun 2, 2026

Choose a reason for hiding this comment

Uh oh!

joshuamegnauth54 Jun 2, 2026

Choose a reason for hiding this comment

Uh oh!

fanninpm Jun 2, 2026

Choose a reason for hiding this comment

Uh oh!

youknowone left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

joshuamegnauth54 commented Jun 2, 2026 •

edited by coderabbitai Bot

Loading

Uh oh!

There was an error while loading. Please reload this page.

coderabbitai Bot commented Jun 2, 2026 •

edited

Loading

Uh oh!

There was an error while loading. Please reload this page.