Update random and cryptography crates by joshuamegnauth54 · Pull Request #8010 · RustPython/RustPython

joshuamegnauth54 · 2026-06-02T01:50:04Z

Redo of #7800.

Bumping the random and crypto crates is not trivial. Both sets of crates have had API changes which require manual updates.

AI use:
I wrote all of the code myself but used AI to figure out the new APIs. AI explained SHAKE's block size and why the block_size() function doesn't exist in the new crate. I confirmed the block size, which is actually represented in the new types for SHAKE. Shake128 is actually Shake<168> - 168 is the block size. I cited Wikipedia as it lists the SHAKE block size in bits.

I also used AI to figure out HMAC for SHA3.

Assisted-by: Codex:gpt-5.4

Closes #xxxx
This PR follows our AI policy

Summary

Bump all of the crypto and rand crates
Add the shake crate. shake used to be part of the sha3 crate but the RustCrypto maintainers moved it to its own crate.

Fun fact: Both the LLM and I were horribly confused at the HMAC issue.

Summary by CodeRabbit

Chores
- Updated multiple cryptography and randomness dependencies to newer releases; Dependabot grouping expanded for additional crypto libraries.
Refactor
- Reworked HMAC and PBKDF2 handling for SHA‑3 to improve consistency.
- Switched default RNG seeding to use the updated random API.
Bug Fixes
- Fixed SHAKE/XOF block-size reporting to use correct constants.

coderabbitai · 2026-06-02T01:50:20Z

Note

Reviews paused

It looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the reviews.auto_review.auto_pause_after_reviewed_commits setting.

Use the following commands to manage reviews:

@coderabbitai resume to resume automatic reviews.
@coderabbitai review to trigger a single review.

Use the checkboxes below for quick actions:

▶️ Resume reviews
🔍 Trigger review

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yml

Review profile: CHILL

Plan: Pro

Run ID: e98f8d9c-c52c-4aaa-99c4-954d816783fc

📥 Commits

Reviewing files that changed from the base of the PR and between 25df0c3 and f904031.

⛔ Files ignored due to path filters (1)

Cargo.lock is excluded by !**/*.lock

📒 Files selected for processing (6)

.github/dependabot.yml
Cargo.toml
crates/literal/src/float.rs
crates/stdlib/Cargo.toml
crates/stdlib/src/hashlib.rs
crates/stdlib/src/random.rs

🚧 Files skipped from review as they are similar to previous changes (5)

crates/stdlib/src/random.rs
.github/dependabot.yml
crates/stdlib/Cargo.toml
Cargo.toml
crates/stdlib/src/hashlib.rs

📝 Walkthrough

Walkthrough

RustPython upgrades workspace and stdlib crypto/RNG dependencies, adapts hashlib to use SimpleHmac for SHA‑3 and a fixed SHAKE block size, changes random seeding to use rand::rng(), and updates a test import for rand 0.10.

Changes

Cryptographic and RNG Dependency Modernization

Layer / File(s)	Summary
Workspace and stdlib dependency version updates `Cargo.toml`, `crates/stdlib/Cargo.toml`, `.github/dependabot.yml`	Workspace and stdlib manifests updated: blake2, digest, getrandom (0.3→0.4, std), hmac, md-5, pbkdf2, rand (0.9→0.10), mt19937, sha-1→sha1, sha2, sha3 versions bumped; `rand_core` entry removed; dependabot group adds `shake` and `chacha20`.
Hashlib SHA-3 HMAC and PBKDF2 refactoring `crates/stdlib/src/hashlib.rs`	Digest imports adjusted to block API paths and `SimpleHmac` added; HMAC macros refactored to accept explicit wrapper types. SHA‑3 HMACs and PBKDF2 now use `SimpleHmac<...>`; SHAKE XOF block_size() returns fixed constants (168/136).
Random module seeding mechanism update `crates/stdlib/src/random.rs`	Imports switched from `rand_core` to `rand`. `PyRandom.seed()` default case now uses `MT19937::from_rng(&mut rand::rng())` instead of `try_from_os_rng()` with IO error mapping.
Test import compatibility update `crates/literal/src/float.rs`	Test updated to import `rand::RngExt` instead of `rand::Rng` to match rand 0.10 API.

Estimated code review effort

🎯 4 (Complex) | ⏱️ ~45 minutes

Suggested reviewers

fanninpm
ShaharNaveh
youknowone

Poem

🐰 I hopped through Cargo.toml tonight,
nudged hashes, bumped versions light.
SimpleHmac hums in SHA‑3 land,
seeds now sprout from rand's own hand,
the burrow gleams with tests in sight.

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 71.43% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title 'Update random and cryptography crates' clearly and concisely describes the main change: bumping versions of random and crypto dependencies across the workspace, which is the primary focus of the changeset.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

Create PR with unit tests

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

coderabbitai

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@Cargo.toml`:
- Line 254: The comment on the mt19937 dependency entry ("mt19937 = \"3.3\"  #
upgrade it once rand is upgraded") is now stale because rand has already been
bumped to 0.10; update or remove that trailing comment on the mt19937 line so it
no longer instructs future readers to upgrade mt19937 once rand is
upgraded—locate the mt19937 = "3.3" entry in Cargo.toml and either delete the
outdated comment or replace it with a short factual note reflecting the current
state.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

Push a commit to this branch (recommended)
Create a new PR with the fixes

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yml

Review profile: CHILL

Plan: Pro

Run ID: 732efa0d-2cbf-4d7c-977a-c7420cac61d0

📥 Commits

Reviewing files that changed from the base of the PR and between 885cf5c and 74122c6.

⛔ Files ignored due to path filters (1)

Cargo.lock is excluded by !**/*.lock

📒 Files selected for processing (5)

Cargo.toml
crates/literal/src/float.rs
crates/stdlib/Cargo.toml
crates/stdlib/src/hashlib.rs
crates/stdlib/src/random.rs

ShaharNaveh

ty:)

youknowone · 2026-06-02T06:36:57Z

-                Self::Shake128(_) => Shake128::block_size(),
-                Self::Shake256(_) => Shake256::block_size(),
+                Self::Shake128(_) => 168,
+                Self::Shake256(_) => 136,


aren't those values match ot Shake{128,256}::block_size()? then why does it happen? do those block_size refer different thiing?

block_size() doesn't exist anymore, so I had to hard code the values. For XOF (SHAKE and other algorithms), the block size is just the rate in bytes.

I'll check if there's a nicer way to get the block size without hard coding it. 😁

The shake crate doesn't provide a different way to get the rate. 😓 However, the rate wouldn't change so it's probably okay to just hard code it.

fanninpm · 2026-06-02T16:14:52Z

Could you please try rebasing this branch onto a fresh copy of main? #8004 got merged, which changes a Windows CI job.

fanninpm · 2026-06-02T16:25:44Z

 checksum = "613afe47fcd5fac7ccf1db93babcb082c5994d996f20b8b159f2ad1658eb5724"

+[[package]]
+name = "chacha20"


Does this need to be added to the random category in .github/dependabot.yml?

I'm not sure about this one since it's not a direct dependency. Should I add it anyway?

I seem to recall that we've had problems in the past where Dependabot would update a dependency only found in Cargo.lock and the build would break. It probably wouldn't hurt to add it.

Redo of RustPython#7800. Bumping the random and crypto crates is not trivial. Both sets of crates have had API changes which require manual updates. AI use: I wrote all of the code myself but used AI to figure out the new APIs. AI explained SHAKE's block size and why the block_size() function doesn't exist in the new crate. I confirmed the block size, which is actually represented in the new types for SHAKE. `Shake128` is actually `Shake<168>` - 168 is the block size. I cited Wikipedia as it lists the SHAKE block size in bits. I also used AI to figure out HMAC for SHA3. Assisted-by: Codex:gpt-5.4

youknowone

Thank you!

coderabbitai Bot reviewed Jun 2, 2026

View reviewed changes

Comment thread Cargo.toml Outdated

joshuamegnauth54 force-pushed the bump-random-crypto branch from 74122c6 to 2e14a1e Compare June 2, 2026 01:59

ShaharNaveh approved these changes Jun 2, 2026

View reviewed changes

youknowone reviewed Jun 2, 2026

View reviewed changes

fanninpm reviewed Jun 2, 2026

View reviewed changes

Comment thread crates/stdlib/Cargo.toml

fanninpm reviewed Jun 2, 2026

View reviewed changes

joshuamegnauth54 force-pushed the bump-random-crypto branch 2 times, most recently from e4abecf to 25df0c3 Compare June 2, 2026 17:23

joshuamegnauth54 force-pushed the bump-random-crypto branch from 25df0c3 to f904031 Compare June 2, 2026 17:45

youknowone approved these changes Jun 3, 2026

View reviewed changes

youknowone merged commit 0862451 into RustPython:main Jun 3, 2026
26 checks passed

fanninpm mentioned this pull request Jun 4, 2026

rustpython-stdlib compilation failure with old mt19937 dependency #8025

Closed

Conversation

joshuamegnauth54 commented Jun 2, 2026 • edited by coderabbitai Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Summary by CodeRabbit

Uh oh!

coderabbitai Bot commented Jun 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Reviews paused

Walkthrough

Changes

Estimated code review effort

Suggested reviewers

Poem

❌ Failed checks (1 warning)

Uh oh!

coderabbitai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

ShaharNaveh left a comment

Choose a reason for hiding this comment

Uh oh!

youknowone Jun 2, 2026

Choose a reason for hiding this comment

Uh oh!

joshuamegnauth54 Jun 2, 2026

Choose a reason for hiding this comment

Uh oh!

joshuamegnauth54 Jun 2, 2026

Choose a reason for hiding this comment

Uh oh!

fanninpm commented Jun 2, 2026

Uh oh!

Uh oh!

fanninpm Jun 2, 2026

Choose a reason for hiding this comment

Uh oh!

joshuamegnauth54 Jun 2, 2026

Choose a reason for hiding this comment

Uh oh!

fanninpm Jun 2, 2026

Choose a reason for hiding this comment

Uh oh!

youknowone left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

joshuamegnauth54 commented Jun 2, 2026 •

edited by coderabbitai Bot

Loading

coderabbitai Bot commented Jun 2, 2026 •

edited

Loading