Conversation
Wire `[lints] workspace = true` into api-types, audit, core, core-types,
keystone, local-emergency-store, storage-api, webauthn, and
k8s-auth-driver-sql, and drop storage-crypto-{pkcs11,tpm}'s own
unsafe_code = "forbid" override in favor of the workspace one — no crate
outside storage-crypto may contain unsafe code.
Fix resulting violations without weakening the policy:
- core: replace two unsafe std::env::set_var/remove_var calls in
auth_plugin.rs tests with temp_env::with_var instead of loosening
unsafe_code to "deny" (overridable) as a workaround.
- core-types: keep SecurityContextTestingBuilder::build() panicking via
plain .expect() + #[allow(clippy::expect_used)], not a hand-rolled
match/panic! that dodges the lint.
- audit/webauthn integration tests: annotate helper functions
(hex_decode, vectors_path, get_provider_mocks, get_isolated_database,
get_state) with targeted #[allow(clippy::expect_used/unwrap_used)] —
clippy.toml's allow-*-in-tests only exempts #[test] fns/#[cfg(test)]
modules, not free helpers called from them.
- identity-driver-sql: factor the repeated 4-tuple/3-tuple in
fetch_joined_user_details into JoinedUserDetails/JoinedUserDetailsRow
type aliases (clippy::type_complexity).
- core/rate_limit.rs: gate IpRateLimitKey, rate_limit_key_for_ip, and
the IpAddr import behind cfg(any(feature = "api", test)) to match
their only caller (check_ip); mark trusted_proxies dead_code outside
that cfg since it's written unconditionally but only read there.
Signed-off-by: Artem Goncharov <artem.goncharov@gmail.com>
|
🦢 Load Test Results Goose Attack ReportPlan Overview
Request Metrics
Response Time Metrics
Status Code Metrics
Transaction Metrics
Scenario Metrics
Error Metrics
|
|
🧪 Tempest Identity Compatibility Results (advisory, non-blocking) rust Failed test IDs |
|
Bencher Report| Project | keystone |
| Branch | clippy |
| Testbed | ubuntu-latest |
Click to view all benchmark results
| Benchmark | Latency | Benchmark Result nanoseconds (ns) (Result Δ%) | Upper Boundary nanoseconds (ns) (Limit %) |
|---|---|---|---|
| Command_Serde/apply/remove | 📈 view plot 🚷 view threshold | 130,050.00 ns(-60.67%)Baseline: 330,662.22 ns | 1,646,361.36 ns (7.90%) |
| Command_Serde/apply/set | 📈 view plot 🚷 view threshold | 143,790.00 ns(-61.04%)Baseline: 369,076.91 ns | 1,711,427.52 ns (8.40%) |
| Command_Serde/pack/delete | 📈 view plot 🚷 view threshold | 121.10 ns(+2.67%)Baseline: 117.96 ns | 157.94 ns (76.68%) |
| Command_Serde/pack/delete_index | 📈 view plot 🚷 view threshold | 108.76 ns(+4.11%)Baseline: 104.47 ns | 139.02 ns (78.23%) |
| Command_Serde/pack/set | 📈 view plot 🚷 view threshold | 198.64 ns(+5.33%)Baseline: 188.59 ns | 250.48 ns (79.31%) |
| Command_Serde/pack/set_index | 📈 view plot 🚷 view threshold | 108.49 ns(+3.86%)Baseline: 104.45 ns | 139.25 ns (77.91%) |
| Command_Serde/unpack/delete | 📈 view plot 🚷 view threshold | 191.11 ns(+4.23%)Baseline: 183.36 ns | 265.09 ns (72.09%) |
| Command_Serde/unpack/delete_index | 📈 view plot 🚷 view threshold | 157.33 ns(+2.39%)Baseline: 153.65 ns | 216.19 ns (72.77%) |
| Command_Serde/unpack/set | 📈 view plot 🚷 view threshold | 275.34 ns(+7.69%)Baseline: 255.67 ns | 349.43 ns (78.80%) |
| Command_Serde/unpack/set_index | 📈 view plot 🚷 view threshold | 156.16 ns(+3.63%)Baseline: 150.70 ns | 210.88 ns (74.05%) |
| Payload_encryption/pack/remove_cmd | 📈 view plot 🚷 view threshold | 128.49 ns(+15.09%)Baseline: 111.64 ns | 148.80 ns (86.35%) |
| Payload_encryption/pack/set_cmd | 📈 view plot 🚷 view threshold | 245.50 ns(+26.05%)Baseline: 194.77 ns | 266.25 ns (92.20%) |
| Payload_encryption/unpack/remove_cmd | 📈 view plot 🚷 view threshold | 219.84 ns(+14.63%)Baseline: 191.79 ns | 278.83 ns (78.84%) |
| Payload_encryption/unpack/set_cmd | 📈 view plot 🚷 view threshold | 317.95 ns(+18.73%)Baseline: 267.79 ns | 372.86 ns (85.27%) |
| Raft_1Node_Latency/prefix/1node | 📈 view plot 🚷 view threshold | 2,476,400.00 ns(-7.64%)Baseline: 2,681,155.62 ns | 6,698,273.97 ns (36.97%) |
| Raft_1Node_Latency/read/1node | 📈 view plot 🚷 view threshold | 42,077.00 ns(+11.84%)Baseline: 37,622.83 ns | 53,595.65 ns (78.51%) |
| Raft_1Node_Latency/remove/1node | 📈 view plot 🚷 view threshold | 368,800.00 ns(-57.18%)Baseline: 861,366.72 ns | 4,178,387.79 ns (8.83%) |
| Raft_1Node_Latency/write/1node | 📈 view plot 🚷 view threshold | 384,740.00 ns(-61.04%)Baseline: 987,527.81 ns | 5,501,799.50 ns (6.99%) |
| build_snapshot/default | 📈 view plot 🚷 view threshold | 112,920.00 ns(-10.45%)Baseline: 126,101.94 ns | 221,633.95 ns (50.95%) |
| fernet token/project | 📈 view plot 🚷 view threshold | 1,493.90 ns(+6.33%)Baseline: 1,404.94 ns | 1,794.34 ns (83.26%) |
| get_data_keyspace | 📈 view plot 🚷 view threshold | 0.31 ns(-0.49%)Baseline: 0.31 ns | 0.39 ns (80.48%) |
| get_db | 📈 view plot 🚷 view threshold | 0.31 ns(-0.66%)Baseline: 0.31 ns | 0.39 ns (80.46%) |
| get_fernet_token_timestamp/project | 📈 view plot 🚷 view threshold | 134.49 ns(-2.90%)Baseline: 138.51 ns | 179.09 ns (75.10%) |
| get_keyspace | 📈 view plot 🚷 view threshold | 4.26 ns(-28.79%)Baseline: 5.98 ns | 13.92 ns (30.59%) |
Open
ShJ-code
added a commit
to ShJ-code/keystone
that referenced
this pull request
Jul 31, 2026
`batched_fetch` cast its `&Cell<usize>` argument to a `*const` and dereferenced it inside the returned closure, to escape a borrow lifetime that the `impl FnMut` return type cannot name. Its comment called this "SAFETY-free", which it was not: nothing tied the pointer's validity to the closure. It held only by the convention that every caller happened to keep the counter alive on its own stack frame for at least as long. Share the counter through `Rc<Cell<usize>>` instead. The returned closure owns its handle, the lifetime problem disappears with it, and both `unsafe` blocks go away without changing what any test asserts. The block compiled for as long as it did because the keystone crate had no `[lints] workspace = true`, so the workspace's `unsafe_code = "forbid"` never reached it. Rebasing this branch onto main picked up openstack-experimental#1120, which added that stanza, turning the pre-existing block into a hard error on the lib test target -- hence a CI failure on a line this branch had not otherwise touched since it was written. No production code is affected; `batched_fetch` is a test-only helper for the `collect_authorized_page` refill tests. Signed-off-by: ShJ-code <sihao_jiang@outlook.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Wire
[lints] workspace = trueinto api-types, audit, core, core-types,keystone, local-emergency-store, storage-api, webauthn, and
k8s-auth-driver-sql, and drop storage-crypto-{pkcs11,tpm}'s own
unsafe_code = "forbid" override in favor of the workspace one — no crate
outside storage-crypto may contain unsafe code.
Fix resulting violations without weakening the policy:
auth_plugin.rs tests with temp_env::with_var instead of loosening
unsafe_code to "deny" (overridable) as a workaround.
plain .expect() + #[allow(clippy::expect_used)], not a hand-rolled
match/panic! that dodges the lint.
(hex_decode, vectors_path, get_provider_mocks, get_isolated_database,
get_state) with targeted #[allow(clippy::expect_used/unwrap_used)] —
clippy.toml's allow-*-in-tests only exempts #[test] fns/#[cfg(test)]
modules, not free helpers called from them.
fetch_joined_user_details into JoinedUserDetails/JoinedUserDetailsRow
type aliases (clippy::type_complexity).
the IpAddr import behind cfg(any(feature = "api", test)) to match
their only caller (check_ip); mark trusted_proxies dead_code outside
that cfg since it's written unconditionally but only read there.
Signed-off-by: Artem Goncharov artem.goncharov@gmail.com