mirror of
https://github.com/luxfi/precompile.git
synced 2026-09-24 00:26:21 +00:00
zeekay
12a326ed3d
BLAKE3 is gated under strict-PQ NOT because the primitive is classical (it's a hash function, PQ-safe at 128-bit Grover security on 256-bit output — same as SHA-256) but because the strict-PQ profile mandates a ≥192-bit PQ security floor consistent with SHAKE256-384 + ML-DSA-65 elsewhere in the stack. Documenting the policy intent inline so the next-rev reviewer doesn't have to triangulate from strict_pq.go comments. The gate stays. Cryptographer audit 2026-06-05 verdict: YELLOW (ship #48/#144, address 3 cleanups next rev). Y2 closed by this comment. Y1 (migration/LLM.md double-SHAKE doc lies) closed in a sibling commit. Y3 (routerConfig placeholders) waits on #48 contract deploys to land real addresses.
32 lines
803 B
Bash
Executable File
32 lines
803 B
Bash
Executable File
#!/usr/bin/env bash
|
|
# scripts/checks/jasmin.sh — Jasmin type-check + jasmin-ct gate.
|
|
#
|
|
# Runs jasminc against precompile/p3q/jasmin/verify.jazz to verify
|
|
# (a) the file type-checks (b) the file passes the constant-time
|
|
# leakage analysis on its declared CT signature.
|
|
#
|
|
# Skipped gracefully if jasminc is not on PATH.
|
|
|
|
set -euo pipefail
|
|
|
|
REPO_ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
|
|
cd "$REPO_ROOT"
|
|
|
|
JZ_FILE="$REPO_ROOT/jasmin/verify.jazz"
|
|
|
|
if ! command -v jasminc >/dev/null 2>&1; then
|
|
echo "==> [skip] jasminc not on PATH; skipping Jasmin CT check"
|
|
exit 0
|
|
fi
|
|
|
|
if [[ ! -f "$JZ_FILE" ]]; then
|
|
echo "==> [FAIL] missing Jasmin file: $JZ_FILE"
|
|
exit 2
|
|
fi
|
|
|
|
echo "==> jasminc -checkCT $JZ_FILE"
|
|
jasminc -checkCT "$JZ_FILE"
|
|
|
|
echo "==> done — Jasmin CT gate green"
|
|
exit 0
|