build(deps): bump hmac from 0.12.1 to 0.13.0

[dependabot]

Bumps hmac from 0.12.1 to 0.13.0.

Commits

• 0236c8e hmac v0.13.0 (#263)
• b895e50 Migrate tests to the new blobby format (#264)
• 3d1440b Workspace-level lint configuration (#261)
• 11d4f36 hmac: use release versions of dev-dependencies (#260)
• c40b82b hmac: bump sha2 dev-dependency to v0.11 (#259)
• 1fa0781 Cut rc.5 prereleases (#258)
• a008265 hmac v0.13.0-rc.6 (#256)
• da485cd Use (Reset)MacTraits (#254)
• 2c51e3b hmac: derive Clone instead of relying on (Reset)MacTraits (#253)
• 669d805 Relax Clone bounds (#250)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

Contribution tier

Tier C (authentication/HMAC code and receipt-hash encoding in coop-server and coop-attestation).

Declared scope

Align the workspace digest family with hmac 0.13 (sha2 0.10 -> 0.11) and replace generic-array LowerHex digest formatting, removed in generic-array 1.x, with a shared bytes_to_hex helper plus a KeyInit import for the relocated Hmac constructor. No algorithm or format changes.

Changes

• Workspace sha2 0.10 -> 0.11 so hmac 0.13 shares one digest 0.11 graph.
• New shared bytes_to_hex helper (per-byte {02x}, identical output to LowerHex).
• Converted all digest sites in coop-server and coop-attestation/tests to it.
• Added bytes_to_hex_matches_nist_vector test (FIPS 180-4 vector).

Validation

• Head: fb34107
• Checks: cargo test --locked --workspace 296 passed, 0 failed; cargo fmt --check and clippy clean; CI re-running on this head.

Root invariant

Receipt and attestation SHA-256 hex digests must be byte-identical across the digest-crate upgrade, and the HMAC credential path must keep authenticating.

Reproduction and RED evidence

CI on the bump-only head failed to compile: E0277 trait skew at auth.rs:1338 (two digest versions in the graph) and E0277 LowerHex across server and attestation sources (run 33642043375). Both failures are resolved by this change.

Adversarial coverage

• NIST FIPS 180-4 vector (SHA-256 of "abc") locks the encoding independently of any crate impl, so receipt digests cannot silently change representation.
• Existing receipt/attestation suites asserting exact digests all pass.
• HMAC credential suites (legacy exact-match, indexed, expiry/revocation) pass.
• Unknown-digest-shape risk does not apply: SHA-256 output width is unchanged.

Non-goals and remaining work

No algorithm changes (still SHA-256/HMAC-SHA256) and no receipt-format changes. jsonwebtoken 11 adaptation ships separately in #55.

Safety and compatibility

Output is byte-identical by construction ({02x} per byte equals LowerHex); rollback is reverting this change with the hmac 0.12 / sha2 0.10 pins.

Completion state

• Implementation: done
• Validation: done locally, CI pending on this head
• Review: pending maintainer
• Integration: pending merge

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository: sambai-dev/rookhold/.coderabbit.yaml

Review profile: ASSERTIVE

Plan: Advanced

Run ID: 4fe10289-be80-4695-9414-f88db9d0bd12

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[sambai-dev]

Closing as part of the Dependabot cleanup (#67).

[dependabot]

OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting @dependabot ignore this major version or @dependabot ignore this minor version.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.