modelcontextprotocol/rust-sdk
Watch
1
0
Fork
You've already forked rust-sdk
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions 1

fix: harden signing key handling (#1166)

Browse source 
* fix: harden signing key handling

* fix: validate static keys at compile time
This commit is contained in:
Dale Seo 2026-08-18 21:56:58 +09:00 • committed by GitHub
commit d5c46b3fe0
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
1 changed files with 214 additions and 43 deletions
Download patch file Download diff file Expand all files Collapse all files

8
crates/rmcp/tests/test_mrtr_behavior.rs
View file

@ -594,11 +594,15 @@ async fn request_state_codec_seals_and_verifies_through_the_loop() -> anyhow::Re
use rmcp::model::RequestStateCodec;
// A shared per-process signing key, mirroring how a real server would derive one.
static KEY: &[u8] = b"integration-signing-key-32-bytes!";
const KEY: &[u8] = b"integration-signing-key-32-bytes!";
const _: () = assert!(
KEY.len() >= RequestStateCodec::MIN_KEY_LENGTH,
"KEY is shorter than RequestStateCodec::MIN_KEY_LENGTH",
);
fn codec() -> &'static RequestStateCodec {
static CODEC: OnceLock<RequestStateCodec> = OnceLock::new();
CODEC.get_or_init(|| RequestStateCodec::new(KEY))
CODEC.get_or_init(|| RequestStateCodec::new_unchecked(KEY))
}
#[derive(Clone, Default)]