public/steve
6
0
Fork 0
Code Issues Pull requests Releases Wiki Activity

feat/rust-client-sdk #3

Closed
Ghost wants to merge 3 commits from refs/pull/3/head into main
pull from: refs/pull/3/head
merge into: public:main
Conversation 3 Commits 3 Files changed 8 +3293 -370
Ghost commented 2026-06-15 09:52:43 +00:00 (Migrated from codeberg.org)
Copy link

initial rust client sdk for steve

initial rust client sdk for steve
Ghost commented 2026-07-28 00:05:18 +00:00 (Migrated from codeberg.org)
Copy link

Careful pre-merge review found two blocking compatibility issues against the current server protocol:

  1. crates/steve-sdk/src/lib.rs still targets the old v1 E2P shape (/attestation + /e2p/v1/create_shared_key) and expects attested user_data to contain a long-lived verifying_key. Current STEVE uses the v2 session/confirm/request flow and binds the attestation to the session transcript instead. As written, this SDK won't interoperate with current main and would reintroduce the older key-exchange trust model.

  2. RequestBuilder::send encrypts the body but posts it directly to the application URL with v1 headers (x-e2p-key, x-e2p-original-method). Current v2 expects encrypted application requests to go through /e2p/v2/request, with the application method/path/headers inside the protected envelope. Posting to the original URL either bypasses the v2 handler or exposes the application path/query on the outer request.

I think this should be rebased/rewritten for E2P v2 before merge rather than landing the v1 SDK as-is.

Careful pre-merge review found two blocking compatibility issues against the current server protocol: 1. `crates/steve-sdk/src/lib.rs` still targets the old v1 E2P shape (`/attestation` + `/e2p/v1/create_shared_key`) and expects attested `user_data` to contain a long-lived `verifying_key`. Current STEVE uses the v2 session/confirm/request flow and binds the attestation to the session transcript instead. As written, this SDK won't interoperate with current `main` and would reintroduce the older key-exchange trust model. 2. `RequestBuilder::send` encrypts the body but posts it directly to the application URL with v1 headers (`x-e2p-key`, `x-e2p-original-method`). Current v2 expects encrypted application requests to go through `/e2p/v2/request`, with the application method/path/headers inside the protected envelope. Posting to the original URL either bypasses the v2 handler or exposes the application path/query on the outer request. I think this should be rebased/rewritten for E2P v2 before merge rather than landing the v1 SDK as-is.
Ghost commented 2026-07-29 10:04:48 +00:00 (Migrated from codeberg.org)
Copy link

rebased and comments adressed

rebased and comments adressed
Ghost commented 2026-07-30 11:39:31 +00:00 (Migrated from codeberg.org)
Copy link

Closing this PR as the Rust SDK can be reviewed easily (crates/steve-sdk) as part of https://git.distrust.co/public/steve/pulls/7

Closing this PR as the Rust SDK can be reviewed easily (`crates/steve-sdk`) as part of https://git.distrust.co/public/steve/pulls/7

Pull request closed

This pull request cannot be reopened because the branch was deleted.
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels
No items
No labels
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference
public/steve!3
No description provided.