[polaz]

Summary

• wasm-smoke now runs the cms feature in the compiled WebAssembly module, so the provider is executed there and not only compiled.
• It checks a real RFC 3161 token through CmsProvider; the same token with an altered signature value is an invalid signature, not an error.

Changes

• tests/wasm-smoke selects cms and exports xml_sec_wasm_cms over the Ed25519 token fixture.
• The wasm-smoke command calls the new export; a missing export, or one that does not return 1, fails the check.
• docs/features.md describes the extended alloc-only gate, and docs/ci-hardening.md no longer says core XMLDSig requires std.

Testing

wasm-smoke, its tool tests, lints and formatting pass on macOS; CI runs the alloc-only job and the full gates.

Closes #344

Summary by CodeRabbit

• Documentation

  • Clarified which allocation-only checks cover shared dependencies and which apply to the root package.
  • Updated feature guidance to reflect expanded allocation-only and WebAssembly checks.

• Tests

  • Expanded WebAssembly smoke testing to cover CMS RFC 3161 timestamp validation, including valid and altered tokens.
  • Added checks that each expected smoke-test feature is present and reports success.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-30T22:33:54.373554Z	0b51a7e	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[coderabbitai]

No actionable comments were generated in the recent review.

Recent review info

Run configuration

• Source mode: Auto
• Repository: structured-world/xml-sec
• Branch: test/&#35;344-cms-wasm
• File: .coderabbit.yaml
• Commit: 0b51a7e
• Layers: Repository YAML
• Review profile: CHILL
• Plan: Advanced
• Run ID: cb6c9233-f2ba-456d-9b56-98beb655caaf

Commits

Reviewing files that changed from the base of the PR and between 88d3bd3 and 0b51a7e.

Files selected for processing: 6

• docs/ci-hardening.md
• docs/features.md
• tests/wasm-smoke/Cargo.toml
• tests/wasm-smoke/src/lib.rs
• tools/xml-sec-tools/src/wasm_smoke.rs
• tools/xml-sec-tools/src/wasm_smoke/tests.rs

Included review availability: This review used your included allowance. Your plan provides up to 1 included review per hour; 0 remain after this review.

Walkthrough

The WASM smoke consumer now runs an RFC 3161 timestamp check through the CMS path. The smoke tool requires and tests the new export alongside C14N and XMLDSig verification. The documentation updates describe the alloc-only qualification coverage.

Changes: CMS WebAssembly smoke coverage

Layer / File(s)	Summary
Alloc-only CMS qualification tests/wasm-smoke/Cargo.toml, docs/features.md, docs/ci-hardening.md	The WASM smoke manifest enables CMS-related alloc dependencies. The documentation describes CMS lint coverage, the RFC 3161 WASM check, and the distinction between shared-package and root-package alloc-only checks.
RFC 3161 token check tests/wasm-smoke/src/lib.rs	The consumer embeds token, certificate, and payload fixtures. It checks the original token and a copy with its final byte altered, returning success only when their signature answers are Valid and Invalid, respectively.
Export validation tools/xml-sec-tools/src/wasm_smoke.rs, tools/xml-sec-tools/src/wasm_smoke/tests.rs	The smoke tool adds the CMS export to its required checks. Tests cover successful exports, individual failures, and each missing export.

Estimated code review effort: 3 (Moderate) | ~20 minutes

Change: Other

Sequence Diagram(s)

sequenceDiagram
  participant WasmSmokeTool
  participant xml_sec_wasm_cms
  participant check_token
  participant CmsProvider
  WasmSmokeTool->>xml_sec_wasm_cms: invoke CMS smoke export
  xml_sec_wasm_cms->>check_token: check original and altered tokens
  check_token->>CmsProvider: parse and check timestamp token
  CmsProvider-->>check_token: signature answer and verification evidence
  check_token-->>xml_sec_wasm_cms: return signature answer or None
  xml_sec_wasm_cms-->>WasmSmokeTool: return 1 only for Valid original and Invalid altered token

Loading

Possibly related PRs

• structured-world/xml-sec#295: Changes the alloc-only CI job and its documented lint contract, which this PR extends with CMS coverage.
• structured-world/xml-sec#269: Adds the feature qualification runner and documentation that this PR extends to the CMS WASM execution path.
• structured-world/xml-sec#320: Separates XMLDSig verification from signing and private-key import; this PR selects the CMS feature in the WASM consumer.

Merge Risk: Minimal · up to 0b51a

No actionable merge-blocking risk was identified; normal CI checks should pass before merging.

Pre-merge checks: 4 · 1

Failed checks: 1 warning

Check name	Status	Explanation	Resolution
Docstring Coverage		Docstring coverage is 50.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff with cyclomatic complexity of at least 2. Documenta…	Write docstrings for the functions missing them to satisfy the coverage threshold.

Passed checks: 4 passed

Check name	Status	Explanation
Description Check		Check skipped - CodeRabbit’s high-level summary is enabled.
Title check		The title clearly and concisely describes the main change: executing the CMS provider in the WebAssembly smoke test.
Linked Issues check		Issue #344 requires execution of the CMS check in the compiled WebAssembly module. xml_sec_wasm_cms uses CmsProvider with the RFC 3161 fixture, checks a matching imprint and retained evidence, and…
Out of Scope Changes check		The manifest changes add the CMS dependencies and features required by the WASM consumer. The documentation updates describe the changed alloc-only gate. The smoke-tool tests verify the new export and…

Full details: Linked Issues check

Explanation

Issue #344 requires execution of the CMS check in the compiled WebAssembly module. xml_sec_wasm_cms uses CmsProvider with the RFC 3161 fixture, checks a matching imprint and retained evidence, and verifies the valid and tampered answers. wasm_smoke::EXPORTS calls the export and requires return value 1. The tool tests cover a missing export and non-1 results.

Full details: Out of Scope Changes check

Explanation

The manifest changes add the CMS dependencies and features required by the WASM consumer. The documentation updates describe the changed alloc-only gate. The smoke-tool tests verify the new export and remain connected to Issue #344. No unrelated change is demonstrated.

Full details: Docstring Coverage

Explanation

Docstring coverage is 50.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff with cyclomatic complexity of at least 2. Documentation-only edits and deletions within surviving functions are included; unchanged diff context and fully deleted functions are excluded. Analyzed 4 functions across 3 files. (3 skipped: 3 unsupported.)

Resolution

Write docstrings for the functions missing them to satisfy the coverage threshold.

Finishing Touches: 💡 1

📝 Generate docstrings: 💡

• Commit to this branch
• Create a new PR

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}