Release Pithos 0.8 with format 1.1

.github/workflows/checks.yaml

@@ -0,0 +1,86 @@
+name: Checks
+
+on:
+  push:
+    branches:
+      - main
+  pull_request:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  fmt:
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    steps:
+      - name: Check out repository
+        uses: actions/checkout@v4
+
+      - name: Install stable rustfmt
+        uses: dtolnay/rust-toolchain@stable
+        with:
+          components: rustfmt
+
+      - name: Check formatting
+        run: cargo +stable fmt --all -- --check
+
+  clippy:
+    runs-on: ubuntu-latest
+    timeout-minutes: 20
+    steps:
+      - name: Check out repository
+        uses: actions/checkout@v4
+
+      - name: Install stable clippy
+        uses: dtolnay/rust-toolchain@stable
+        with:
+          components: clippy
+
+      - name: Cache Rust build artifacts
+        uses: Swatinem/rust-cache@v2
+
+      - name: Run Clippy
+        run: cargo +stable clippy --locked --workspace --all-targets --all-features -- -D warnings
+
+  deny:
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    steps:
+      - name: Check out repository
+        uses: actions/checkout@v4
+
+      - name: Install stable Rust
+        uses: dtolnay/rust-toolchain@stable
+
+      - name: Cache Rust build artifacts
+        uses: Swatinem/rust-cache@v2
+
+      - name: Install cargo-deny
+        uses: taiki-e/install-action@v2
+        with:
+          tool: cargo-deny
+
+      - name: Check workspace dependency policy
+        run: cargo deny --locked check
+
+      - name: Check fuzz dependency policy
+        run: cargo deny --manifest-path fuzz/Cargo.toml --config deny.toml --locked check
+
+  actionlint:
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    steps:
+      - name: Check out repository
+        uses: actions/checkout@v4
+
+      - name: Install actionlint
+        run: go install github.com/rhysd/actionlint/cmd/actionlint@v1.7.12
+
+      - name: Check workflows
+        run: |
+          "$(go env GOPATH)/bin/actionlint"

.github/workflows/ci.yaml

@@ -1,7 +1,9 @@
 name: CI
 on:
-  - push
-  - pull_request
+  push:
+    branches:
+      - main
+  pull_request:
 
 permissions:
   contents: read
@@ -11,20 +13,6 @@ concurrency:
   cancel-in-progress: true
 
 jobs:
-  actionlint:
-    runs-on: ubuntu-latest
-    timeout-minutes: 10
-    steps:
-      - name: Check out repository
-        uses: actions/checkout@v4
-
-      - name: Install actionlint
-        run: go install github.com/rhysd/actionlint/cmd/actionlint@v1.7.12
-
-      - name: Check workflows
-        run: |
-          "$(go env GOPATH)/bin/actionlint"
-
   tests:
     runs-on: ubuntu-latest
     timeout-minutes: 20
@@ -38,56 +26,39 @@ jobs:
       - name: Cache Rust build artifacts
         uses: Swatinem/rust-cache@v2
 
-      - name: Run workspace tests
-        run: cargo test --locked --workspace --all-targets
-
-  fmt:
-    runs-on: ubuntu-latest
-    timeout-minutes: 10
-    steps:
-      - name: Check out repository
-        uses: actions/checkout@v4
-
-      - name: Install stable rustfmt
-        uses: dtolnay/rust-toolchain@stable
-        with:
-          components: rustfmt
+      - name: Run stable workspace tests
+        run: cargo +stable test --locked --workspace --all-features --lib --bins --tests
 
-      - name: Check formatting
-        run: cargo fmt --all -- --check
-
-  clippy:
+  msrv:
     runs-on: ubuntu-latest
     timeout-minutes: 20
     steps:
       - name: Check out repository
         uses: actions/checkout@v4
 
-      - name: Install stable clippy
-        uses: dtolnay/rust-toolchain@stable
-        with:
-          components: clippy
+      - name: Install Rust 1.89.0
+        uses: dtolnay/rust-toolchain@1.89.0
 
       - name: Cache Rust build artifacts
         uses: Swatinem/rust-cache@v2
 
-      - name: Run clippy
-        run: cargo clippy --locked --workspace --all-targets -- -D warnings
+      - name: Run MSRV workspace tests
+        run: cargo +1.89.0 test --locked --workspace --all-features
 
-  deny:
+  block-count:
     runs-on: ubuntu-latest
-    timeout-minutes: 10
+    timeout-minutes: 40
     steps:
       - name: Check out repository
         uses: actions/checkout@v4
 
       - name: Install stable Rust
         uses: dtolnay/rust-toolchain@stable
 
-      - name: Install cargo-deny
-        uses: taiki-e/install-action@v2
-        with:
-          tool: cargo-deny
+      - name: Cache Rust build artifacts
+        uses: Swatinem/rust-cache@v2
 
-      - name: Check dependency policy
-        run: cargo deny check
+      - name: Run the ignored 5 TiB block-count test in release mode
+        run: >-
+          cargo +stable test --locked --release -p pithos_lib --test pieces
+          a_composition_with_the_block_count_of_5_tib_opens_with_default_limits -- --ignored --exact

.github/workflows/codecov.yaml

@@ -2,11 +2,20 @@ on:
   push:
     branches: [main]
   pull_request:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+
 name: coverage
 jobs:
   report:
     name: Report
     runs-on: ubuntu-latest
+    timeout-minutes: 20
 
     steps:
       - name: Checkout repository
@@ -31,7 +40,7 @@ jobs:
         name: Generate Coverage Report
         run: |
           mkdir -p .coverage
-          cargo llvm-cov --locked --workspace --all-targets --lcov --output-path=./.coverage/lcov.info
+          cargo llvm-cov --locked --workspace --lib --bins --tests --lcov --output-path=./.coverage/lcov.info
 
       - id: upload
         name: Upload Coverage Report

.github/workflows/fuzz.yaml

@@ -0,0 +1,76 @@
+name: Fuzzing
+
+on:
+  pull_request:
+    branches:
+      - main
+  schedule:
+    - cron: "30 2 * * 0" # Sundays at 02:30 UTC.
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event_name }}-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
+jobs:
+  dependency-policy:
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    steps:
+      - name: Check out repository
+        uses: actions/checkout@v4
+
+      - name: Install cargo-deny
+        uses: taiki-e/install-action@v2
+        with:
+          tool: cargo-deny
+
+      - name: Check fuzz dependency policy
+        run: cargo deny --manifest-path fuzz/Cargo.toml --config deny.toml --locked check
+
+  fuzz:
+    name: Fuzz ${{ matrix.target }}
+    needs: dependency-policy
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+    strategy:
+      fail-fast: false
+      matrix:
+        target:
+          - header_decode
+          - directory_decode
+          - crypt4gh_decode
+          - chain_validation
+    env:
+      FUZZ_MAX_TOTAL_TIME: ${{ github.event_name == 'pull_request' && '60' || '900' }}
+      FUZZ_TIMEOUT: ${{ github.event_name == 'pull_request' && '5' || '10' }}
+      FUZZ_RSS_LIMIT_MB: ${{ github.event_name == 'pull_request' && '1024' || '1536' }}
+    steps:
+      - name: Check out repository
+        uses: actions/checkout@v4
+
+      - name: Install nightly Rust
+        uses: dtolnay/rust-toolchain@nightly
+
+      - name: Install cargo-fuzz 0.13.2
+        run: cargo +nightly install cargo-fuzz --version 0.13.2 --locked
+
+      - name: Run ${{ matrix.target }}
+        id: fuzz
+        run: |
+          cargo +nightly fuzz run "${{ matrix.target }}" -- \
+            -max_total_time="$FUZZ_MAX_TOTAL_TIME" \
+            -timeout="$FUZZ_TIMEOUT" \
+            -rss_limit_mb="$FUZZ_RSS_LIMIT_MB"
+
+      - name: Upload fuzz artifacts
+        if: failure() && steps.fuzz.outcome == 'failure'
+        uses: actions/upload-artifact@v4
+        with:
+          name: fuzz-artifacts-${{ matrix.target }}-${{ github.run_id }}
+          path: fuzz/artifacts/
+          if-no-files-found: ignore
+          retention-days: 14

.github/workflows/tag_publish.yaml

@@ -55,8 +55,9 @@ jobs:
           }
 
           for package in pithos_lib pithos; do
-            package_id="$(cargo pkgid -p "$package")"
-            package_version="${package_id##*@}"
+            package_id="$(cargo +stable pkgid -p "$package")"
+            package_version="${package_id##*#}"
+            package_version="${package_version##*@}"
             if [[ "$package_version" != "$RELEASE_VERSION" ]]; then
               printf '%s version %s does not match release tag %s.\n' "$package" "$package_version" "$RELEASE_VERSION" >&2
               exit 1
@@ -65,40 +66,43 @@ jobs:
 
           printf 'RELEASE_VERSION=%s\n' "$RELEASE_VERSION" >> "$GITHUB_ENV"
 
-      - name: Run workspace tests
-        run: cargo test --locked --workspace --all-targets
+      - name: Run stable workspace tests
+        run: cargo +stable test --locked --workspace --all-features --lib --bins --tests
 
       - name: Check formatting
-        run: cargo fmt --all -- --check
+        run: cargo +stable fmt --all -- --check
 
       - name: Run Clippy
-        run: cargo clippy --locked --workspace --all-targets -- -D warnings
+        run: cargo +stable clippy --locked --workspace --all-targets --all-features -- -D warnings
 
-      - name: Check dependency policy
-        run: cargo deny check
+      - name: Check root dependency policy
+        run: cargo deny --locked check
+
+      - name: Check fuzz dependency policy
+        run: cargo deny --manifest-path fuzz/Cargo.toml --config deny.toml --locked check
 
       - name: Package library
-        run: cargo package -p pithos_lib --locked
+        run: cargo +stable package -p pithos_lib --locked
 
       - name: Dry-run library publish
-        run: cargo publish -p pithos_lib --dry-run --locked
+        run: cargo +stable publish -p pithos_lib --dry-run --locked
 
       - name: Publish or verify library
         shell: bash
         env:
           CARGO_REGISTRY_TOKEN: ${{ secrets.CRATES_TOKEN }}
         run: |
-          if cargo publish -p pithos_lib --locked; then
+          if cargo +stable publish -p pithos_lib --locked; then
             exit 0
           fi
 
-          cargo info "pithos_lib@$RELEASE_VERSION" --registry crates-io >/dev/null
+          cargo +stable info "pithos_lib@$RELEASE_VERSION" --registry crates-io >/dev/null
 
       - name: Wait for library to reach crates.io
         shell: bash
         run: |
           for _ in {1..30}; do
-            if cargo info "pithos_lib@$RELEASE_VERSION" --registry crates-io >/dev/null 2>&1; then
+            if cargo +stable info "pithos_lib@$RELEASE_VERSION" --registry crates-io >/dev/null 2>&1; then
               exit 0
             fi
 
@@ -109,18 +113,18 @@ jobs:
           exit 1
 
       - name: Package CLI
-        run: cargo package -p pithos --locked
+        run: cargo +stable package -p pithos --locked
 
       - name: Dry-run CLI publish
-        run: cargo publish -p pithos --dry-run --locked
+        run: cargo +stable publish -p pithos --dry-run --locked
 
       - name: Publish or verify CLI
         shell: bash
         env:
           CARGO_REGISTRY_TOKEN: ${{ secrets.CRATES_TOKEN }}
         run: |
-          if cargo publish -p pithos --locked; then
+          if cargo +stable publish -p pithos --locked; then
             exit 0
           fi
 
-          cargo info "pithos@$RELEASE_VERSION" --registry crates-io >/dev/null
+          cargo +stable info "pithos@$RELEASE_VERSION" --registry crates-io >/dev/null